@vellumai/assistant 0.6.6 → 0.7.0

package/src/permissions/approval-policy.test.ts

@@ -26,7 +26,6 @@ function makeContext(overrides: Partial<ApprovalContext>): ApprovalContext {
   return {
     riskLevel: RiskLevel.Low,
     toolName: "bash",
-    permissionsMode: "workspace",
     isContainerized: false,
     isWorkspaceScoped: false,
     ...overrides,
@@ -75,7 +74,7 @@ describe("ask rule", () => {
   const askRule = makeRule({ decision: "ask" });
 
   test("ask at Low risk", () => {
-    const result = evaluate({ riskLevel: RiskLevel.Low, matchedRule: askRule });
+    const result = evaluate({ riskLevel: RiskLevel.Low, matchedRule: askRule, autoApproveUpTo: "none" });
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("ask rule");
     expect(result.matchedRule).toBe(askRule);
@@ -241,13 +240,38 @@ describe("sandbox auto-approve", () => {
     expect(result.reason).toContain("high risk");
   });
 
-  test("sandbox auto-approve fires even for High risk commands", () => {
-    // e.g. rm -rf in a container — should be auto-approved
+  test("sandbox auto-approve fires for High risk commands when threshold allows", () => {
+    // e.g. rm -rf in a container where the user has set autoApproveUpTo: "high"
     const result = evaluate({
       riskLevel: RiskLevel.High,
       toolName: "bash",
       hasSandboxAutoApprove: true,
       isContainerized: true,
+      autoApproveUpTo: "high",
+    });
+    expect(result.decision).toBe("allow");
+    expect(result.reason).toContain("sandbox auto-approve");
+  });
+
+  test("sandbox auto-approve blocked when autoApproveUpTo is 'none' (Strict mode override)", () => {
+    // Per-conversation Strict override: threshold = none → no commands auto-approved.
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+      autoApproveUpTo: "none",
+    });
+    expect(result.decision).toBe("prompt");
+  });
+
+  test("sandbox auto-approve still works when autoApproveUpTo is 'low'", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "bash",
+      hasSandboxAutoApprove: true,
+      isContainerized: true,
+      autoApproveUpTo: "low",
     });
     expect(result.decision).toBe("allow");
     expect(result.reason).toContain("sandbox auto-approve");
@@ -267,36 +291,35 @@ describe("sandbox auto-approve", () => {
     expect(result.reason).toContain("deny rule");
   });
 
-  test("strict mode blocks sandbox auto-approve", () => {
+  test("autoApproveUpTo 'none' blocks sandbox auto-approve", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "bash",
       hasSandboxAutoApprove: true,
       isContainerized: true,
-      permissionsMode: "strict",
+      autoApproveUpTo: "none",
     });
-    // Strict mode requires explicit rules — sandbox auto-approve only
-    // fires in workspace mode.
     expect(result.decision).toBe("prompt");
-    expect(result.reason).toContain("Strict mode");
+    expect(result.reason).toContain("above auto-approve threshold");
   });
 });
 
 // ── No rule: third-party skill tool ──────────────────────────────────────────
 
 describe("no rule — third-party skill tool", () => {
-  test("skill origin, not bundled → prompt", () => {
+  test("skill origin, not bundled, strict threshold → prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "custom_tool",
       toolOrigin: "skill",
       isSkillBundled: false,
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("Skill tool");
   });
 
-  test("skill origin, not bundled, Medium risk → prompt", () => {
+  test("skill origin, not bundled, Medium risk → prompt (above default threshold)", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Medium,
       toolName: "custom_tool",
@@ -307,11 +330,12 @@ describe("no rule — third-party skill tool", () => {
     expect(result.reason).toContain("Skill tool");
   });
 
-  test("no tool origin but hasManifestOverride → prompt (unregistered skill tool)", () => {
+  test("no tool origin but hasManifestOverride, strict threshold → prompt (unregistered skill tool)", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "unknown_tool",
       hasManifestOverride: true,
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("Skill tool");
@@ -328,134 +352,124 @@ describe("no rule — third-party skill tool", () => {
     expect(result.decision).toBe("allow");
   });
 
-  test("skill origin, not bundled, gateway threshold covers risk → allow", () => {
+  test("skill origin, not bundled, threshold covers risk → allow", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "custom_tool",
       toolOrigin: "skill",
       isSkillBundled: false,
       autoApproveUpTo: "medium",
-      isGatewayThreshold: true,
     });
     expect(result.decision).toBe("allow");
     expect(result.reason).toContain("within auto-approve threshold");
   });
 
-  test("skill origin, not bundled, gateway threshold does not cover risk → prompt", () => {
+  test("skill origin, not bundled, threshold does not cover risk → prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.High,
       toolName: "custom_tool",
       toolOrigin: "skill",
       isSkillBundled: false,
       autoApproveUpTo: "medium",
-      isGatewayThreshold: true,
     });
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("Skill tool");
   });
 
-  test("hasManifestOverride, gateway threshold covers risk → allow", () => {
+  test("hasManifestOverride, threshold covers risk → allow", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "unknown_tool",
       hasManifestOverride: true,
       autoApproveUpTo: "low",
-      isGatewayThreshold: true,
     });
     expect(result.decision).toBe("allow");
     expect(result.reason).toContain("within auto-approve threshold");
   });
 });
 
-// ── No rule: strict mode ─────────────────────────────────────────────────────
+// ── No rule: autoApproveUpTo "none" (strict-equivalent) ────────────────────
 
-describe("no rule — strict mode", () => {
-  test("strict mode, Low risk → prompt", () => {
+describe("no rule — autoApproveUpTo 'none'", () => {
+  test("none threshold, Low risk, not workspace-scoped → prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "file_read",
-      permissionsMode: "strict",
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
-    expect(result.reason).toContain("Strict mode");
+    expect(result.reason).toContain("above auto-approve threshold");
   });
 
-  test("strict mode, Medium risk → prompt", () => {
+  test("none threshold, Medium risk → prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Medium,
       toolName: "file_read",
-      permissionsMode: "strict",
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
-    expect(result.reason).toContain("Strict mode");
+    expect(result.reason).toContain("above auto-approve threshold");
   });
 
-  test("strict mode, High risk → prompt", () => {
+  test("none threshold, High risk → prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.High,
       toolName: "file_read",
-      permissionsMode: "strict",
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
-    expect(result.reason).toContain("Strict mode");
+    expect(result.reason).toContain("above auto-approve threshold");
   });
 
-  test("strict mode blocks bundled skill tools without explicit rule", () => {
+  test("none threshold, Low risk, workspace-scoped → prompt (threshold respected)", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
-      toolName: "bundled_tool",
-      permissionsMode: "strict",
-      toolOrigin: "skill",
-      isSkillBundled: true,
+      toolName: "file_read",
+      autoApproveUpTo: "none",
+      isWorkspaceScoped: true,
     });
     expect(result.decision).toBe("prompt");
-    expect(result.reason).toContain("Strict mode");
+    expect(result.reason).toContain("above auto-approve threshold");
   });
 
-  test("strict mode, gateway threshold covers risk → allow", () => {
+  test("none threshold with low autoApproveUpTo → allow", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "file_read",
-      permissionsMode: "strict",
       autoApproveUpTo: "low",
-      isGatewayThreshold: true,
     });
     expect(result.decision).toBe("allow");
     expect(result.reason).toContain("within auto-approve threshold");
   });
 
-  test("strict mode, gateway threshold does not cover risk → prompt", () => {
+  test("medium risk with low threshold → prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Medium,
       toolName: "file_read",
-      permissionsMode: "strict",
       autoApproveUpTo: "low",
-      isGatewayThreshold: true,
     });
     expect(result.decision).toBe("prompt");
-    expect(result.reason).toContain("Strict mode");
+    expect(result.reason).toContain("above auto-approve threshold");
   });
 });
 
-// ── No rule: workspace mode ──────────────────────────────────────────────────
+// ── No rule: workspace-scoped operations ──────────────────────────────────────
 
-describe("no rule — workspace mode", () => {
-  test("workspace mode, Low risk, workspace-scoped → allow", () => {
+describe("no rule — workspace-scoped operations", () => {
+  test("Low risk, workspace-scoped, within threshold → allow", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "file_read",
-      permissionsMode: "workspace",
       isWorkspaceScoped: true,
     });
     expect(result.decision).toBe("allow");
-    expect(result.reason).toContain("Workspace mode");
+    expect(result.reason).toContain("Workspace-scoped");
   });
 
-  test("workspace mode, Low risk, NOT workspace-scoped → falls through", () => {
+  test("Low risk, NOT workspace-scoped → falls through to threshold allow", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "file_read",
-      permissionsMode: "workspace",
       isWorkspaceScoped: false,
     });
     // Falls through to risk-based: Low → allow (within default "low" threshold)
@@ -463,39 +477,47 @@ describe("no rule — workspace mode", () => {
     expect(result.reason).toContain("low risk");
   });
 
-  test("workspace mode, Medium risk → falls through to risk-based prompt", () => {
+  test("Medium risk, workspace-scoped → falls through to risk-based prompt", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Medium,
       toolName: "file_write",
-      permissionsMode: "workspace",
       isWorkspaceScoped: true,
     });
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("medium risk");
   });
 
-  test("workspace mode, bash, NOT containerized, Low risk, workspace-scoped → allow via workspace mode", () => {
+  test("bash, NOT containerized, Low risk, workspace-scoped → allow via workspace-scoped check", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "bash",
-      permissionsMode: "workspace",
       isContainerized: false,
       isWorkspaceScoped: true,
     });
     expect(result.decision).toBe("allow");
-    expect(result.reason).toContain("Workspace mode");
+    expect(result.reason).toContain("Workspace-scoped");
   });
 
-  test("workspace mode, bash, containerized, Low risk, workspace-scoped → allow via workspace mode", () => {
+  test("bash, containerized, Low risk, workspace-scoped → allow via workspace-scoped check", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "bash",
-      permissionsMode: "workspace",
       isContainerized: true,
       isWorkspaceScoped: true,
     });
     expect(result.decision).toBe("allow");
-    expect(result.reason).toContain("Workspace mode");
+    expect(result.reason).toContain("Workspace-scoped");
+  });
+
+  test("Low risk, workspace-scoped, autoApproveUpTo 'none' → prompt (threshold not met)", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "file_read",
+      isWorkspaceScoped: true,
+      autoApproveUpTo: "none",
+    });
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("above auto-approve threshold");
   });
 });
 
@@ -506,7 +528,6 @@ describe("no rule — bundled skill tool", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "bundled_tool",
-      permissionsMode: "workspace",
       toolOrigin: "skill",
       isSkillBundled: true,
     });
@@ -518,7 +539,6 @@ describe("no rule — bundled skill tool", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Medium,
       toolName: "bundled_tool",
-      permissionsMode: "workspace",
       toolOrigin: "skill",
       isSkillBundled: true,
     });
@@ -530,13 +550,24 @@ describe("no rule — bundled skill tool", () => {
     const result = evaluate({
       riskLevel: RiskLevel.High,
       toolName: "bundled_tool",
-      permissionsMode: "workspace",
       toolOrigin: "skill",
       isSkillBundled: true,
     });
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("high risk");
   });
+
+  test("bundled skill, Low risk, autoApproveUpTo 'none' → prompt (threshold respected)", () => {
+    const result = evaluate({
+      riskLevel: RiskLevel.Low,
+      toolName: "bundled_tool",
+      toolOrigin: "skill",
+      isSkillBundled: true,
+      autoApproveUpTo: "none",
+    });
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("above auto-approve threshold");
+  });
 });
 
 // ── Risk-based fallback ──────────────────────────────────────────────────────
@@ -581,7 +612,6 @@ describe("edge cases", () => {
       matchedRule: denyRule,
       isContainerized: true,
       isWorkspaceScoped: true,
-      permissionsMode: "workspace",
     });
     expect(result.decision).toBe("deny");
   });
@@ -593,21 +623,21 @@ describe("edge cases", () => {
       toolName: "bash",
       matchedRule: askRule,
       isContainerized: true,
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
   });
 
-  test("allow rule High risk falls through to prompt even with workspace mode", () => {
+  test("allow rule High risk falls through to prompt", () => {
     const allowRule = makeRule({ decision: "allow" });
     const result = evaluate({
       riskLevel: RiskLevel.High,
       toolName: "file_write",
       matchedRule: allowRule,
-      permissionsMode: "workspace",
       isContainerized: false,
       isWorkspaceScoped: true,
     });
-    // Allow rule + High risk + non-bash → falls through to risk-based: High → prompt
+    // Allow rule + High risk → falls through to risk-based: High → prompt
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("high risk");
   });
@@ -630,29 +660,26 @@ describe("edge cases", () => {
     expect(result.reason).toContain("rm -rf /");
   });
 
-  test("strict mode with matched allow rule at Low risk → allow (rule takes precedence)", () => {
+  test("matched allow rule at Low risk → allow (rule takes precedence over threshold)", () => {
     const allowRule = makeRule({ decision: "allow" });
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "file_read",
       matchedRule: allowRule,
-      permissionsMode: "strict",
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("allow");
   });
 
-  test("workspace mode non-containerized bash, Low risk, workspace-scoped → workspace allow", () => {
-    // Non-containerized bash auto-allows via workspace mode like any other
-    // workspace-scoped tool when risk is Low.
+  test("non-containerized bash, Low risk, workspace-scoped → workspace-scoped allow", () => {
     const result = evaluate({
       riskLevel: RiskLevel.Low,
       toolName: "bash",
-      permissionsMode: "workspace",
       isContainerized: false,
       isWorkspaceScoped: true,
     });
     expect(result.decision).toBe("allow");
-    expect(result.reason).toContain("Workspace mode");
+    expect(result.reason).toContain("Workspace-scoped");
   });
 
   test("hasManifestOverride with toolOrigin set to skill — third-party check triggers on origin", () => {
@@ -662,6 +689,7 @@ describe("edge cases", () => {
       toolOrigin: "skill",
       isSkillBundled: false,
       hasManifestOverride: true,
+      autoApproveUpTo: "none",
     });
     expect(result.decision).toBe("prompt");
     expect(result.reason).toContain("Skill tool");
@@ -826,7 +854,7 @@ describe("autoApproveUpTo threshold", () => {
       expect(result.matchedRule).toBe(denyRule);
     });
 
-    test("ask rule still prompts without gateway threshold flag", () => {
+    test("ask rule auto-approves when risk is within threshold", () => {
       const askRule = makeRule({ decision: "ask" });
       const result = evaluate({
         riskLevel: RiskLevel.Low,
@@ -834,37 +862,35 @@ describe("autoApproveUpTo threshold", () => {
         matchedRule: askRule,
         autoApproveUpTo: "medium",
       });
-      expect(result.decision).toBe("prompt");
-      expect(result.matchedRule).toBe(askRule);
+      expect(result.decision).toBe("allow");
+      expect(result.reason).toContain("within auto-approve threshold");
     });
 
-    test("ask rule auto-approves when gateway threshold covers the risk", () => {
+    test("ask rule still prompts when threshold does not cover the risk", () => {
       const askRule = makeRule({ decision: "ask" });
       const result = evaluate({
-        riskLevel: RiskLevel.Low,
+        riskLevel: RiskLevel.High,
         toolName: "bash",
         matchedRule: askRule,
         autoApproveUpTo: "medium",
-        isGatewayThreshold: true,
       });
-      expect(result.decision).toBe("allow");
-      expect(result.reason).toContain("within auto-approve threshold");
+      expect(result.decision).toBe("prompt");
+      expect(result.matchedRule).toBe(askRule);
     });
 
-    test("ask rule still prompts when gateway threshold does not cover the risk", () => {
+    test("ask rule prompts when threshold is strict (none)", () => {
       const askRule = makeRule({ decision: "ask" });
       const result = evaluate({
-        riskLevel: RiskLevel.High,
+        riskLevel: RiskLevel.Low,
         toolName: "bash",
         matchedRule: askRule,
-        autoApproveUpTo: "medium",
-        isGatewayThreshold: true,
+        autoApproveUpTo: "none",
       });
       expect(result.decision).toBe("prompt");
       expect(result.matchedRule).toBe(askRule);
     });
 
-    test("skill_load_dynamic ask rule always prompts even with gateway threshold", () => {
+    test("skill_load_dynamic ask rule always prompts even with high threshold", () => {
       const dynamicSkillAskRule = makeRule({
         decision: "ask",
         pattern: "skill_load_dynamic:my-skill",
@@ -874,7 +900,6 @@ describe("autoApproveUpTo threshold", () => {
         toolName: "skill_load",
         matchedRule: dynamicSkillAskRule,
         autoApproveUpTo: "high",
-        isGatewayThreshold: true,
       });
       expect(result.decision).toBe("prompt");
       expect(result.matchedRule).toBe(dynamicSkillAskRule);
@@ -893,43 +918,36 @@ describe("autoApproveUpTo threshold", () => {
     });
   });
 
-  describe("threshold interacts correctly with strict mode", () => {
-    test("strict mode still prompts even with medium threshold", () => {
+  describe("threshold controls workspace-scoped operations", () => {
+    test("workspace-scoped Low with 'medium' threshold → allow via workspace-scoped path", () => {
       const result = evaluate({
         riskLevel: RiskLevel.Low,
         toolName: "file_read",
-        permissionsMode: "strict",
+        isWorkspaceScoped: true,
         autoApproveUpTo: "medium",
       });
-      expect(result.decision).toBe("prompt");
-      expect(result.reason).toContain("Strict mode");
+      expect(result.decision).toBe("allow");
+      expect(result.reason).toContain("Workspace-scoped");
     });
-  });
 
-  describe("threshold interacts correctly with workspace mode", () => {
-    test("workspace mode workspace-scoped Low still allows via workspace path (before threshold)", () => {
+    test("workspace-scoped Low with 'none' threshold → prompt (threshold gates workspace-scoped too)", () => {
       const result = evaluate({
         riskLevel: RiskLevel.Low,
         toolName: "file_read",
-        permissionsMode: "workspace",
         isWorkspaceScoped: true,
         autoApproveUpTo: "none",
       });
-      // Workspace mode auto-allow fires before the threshold fallback
-      expect(result.decision).toBe("allow");
-      expect(result.reason).toContain("Workspace mode");
+      expect(result.decision).toBe("prompt");
+      expect(result.reason).toContain("above auto-approve threshold");
     });
 
-    test("workspace mode non-workspace-scoped Low with none threshold → prompt", () => {
+    test("non-workspace-scoped Low with 'none' threshold → prompt", () => {
       const result = evaluate({
         riskLevel: RiskLevel.Low,
         toolName: "file_read",
-        permissionsMode: "workspace",
         isWorkspaceScoped: false,
         autoApproveUpTo: "none",
       });
-      // Falls through workspace check (not workspace-scoped), then threshold
-      // "none" means Low risk is above threshold → prompt
       expect(result.decision).toBe("prompt");
       expect(result.reason).toContain("above auto-approve threshold");
     });
@@ -978,20 +996,19 @@ describe("resolveThreshold", () => {
   describe("object form", () => {
     const perContext = {
       conversation: "low" as const,
-      background: "medium" as const,
-      headless: "none" as const,
+      autonomous: "medium" as const,
     };
 
     test("returns conversation threshold for conversation context", () => {
       expect(resolveThreshold(perContext, "conversation")).toBe("low");
     });
 
-    test("returns background threshold for background context", () => {
+    test("returns autonomous threshold for background context", () => {
       expect(resolveThreshold(perContext, "background")).toBe("medium");
     });
 
-    test("returns headless threshold for headless context", () => {
-      expect(resolveThreshold(perContext, "headless")).toBe("none");
+    test("returns autonomous threshold for headless context", () => {
+      expect(resolveThreshold(perContext, "headless")).toBe("medium");
     });
 
     test("defaults to conversation when executionContext is omitted", () => {
@@ -1069,10 +1086,10 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
     );
   }
 
-  describe('default config (background: "medium") — behavioral parity with old riskLevel !== High', () => {
+  describe('default config (autonomous: "medium") — behavioral parity with old riskLevel !== High', () => {
     test("Low risk → within threshold (auto-approve)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "medium", headless: "none" },
+        { conversation: "low", autonomous: "medium" },
         "background",
       );
       expect(bgThreshold).toBe("medium");
@@ -1081,7 +1098,7 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("Medium risk → within threshold (auto-approve)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "medium", headless: "none" },
+        { conversation: "low", autonomous: "medium" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.Medium, bgThreshold)).toBe(true);
@@ -1089,17 +1106,17 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("High risk → above threshold (prompt)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "medium", headless: "none" },
+        { conversation: "low", autonomous: "medium" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.High, bgThreshold)).toBe(false);
     });
   });
 
-  describe('tighter config (background: "low") — only Low auto-approves', () => {
+  describe('tighter config (autonomous: "low") — only Low auto-approves', () => {
     test("Low risk → within threshold", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "low", headless: "none" },
+        { conversation: "low", autonomous: "low" },
         "background",
       );
       expect(bgThreshold).toBe("low");
@@ -1108,7 +1125,7 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("Medium risk → above threshold (prompt)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "low", headless: "none" },
+        { conversation: "low", autonomous: "low" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.Medium, bgThreshold)).toBe(false);
@@ -1116,17 +1133,17 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("High risk → above threshold (prompt)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "low", headless: "none" },
+        { conversation: "low", autonomous: "low" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.High, bgThreshold)).toBe(false);
     });
   });
 
-  describe('strictest config (background: "none") — nothing auto-approves', () => {
+  describe('strictest config (autonomous: "none") — nothing auto-approves', () => {
     test("Low risk → above threshold (prompt)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "none", headless: "none" },
+        { conversation: "low", autonomous: "none" },
         "background",
       );
       expect(bgThreshold).toBe("none");
@@ -1135,7 +1152,7 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("Medium risk → above threshold (prompt)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "none", headless: "none" },
+        { conversation: "low", autonomous: "none" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.Medium, bgThreshold)).toBe(false);
@@ -1143,17 +1160,17 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("High risk → above threshold (prompt)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "none", headless: "none" },
+        { conversation: "low", autonomous: "none" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.High, bgThreshold)).toBe(false);
     });
   });
 
-  describe('loosest config (background: "high") — everything auto-approves', () => {
+  describe('loosest config (autonomous: "high") — everything auto-approves', () => {
     test("Low risk → within threshold (auto-approve)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "high", headless: "none" },
+        { conversation: "low", autonomous: "high" },
         "background",
       );
       expect(bgThreshold).toBe("high");
@@ -1162,7 +1179,7 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("Medium risk → within threshold (auto-approve)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "high", headless: "none" },
+        { conversation: "low", autonomous: "high" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.Medium, bgThreshold)).toBe(true);
@@ -1170,7 +1187,7 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
 
     test("High risk → within threshold (auto-approve)", () => {
       const bgThreshold = resolveThreshold(
-        { conversation: "low", background: "high", headless: "none" },
+        { conversation: "low", autonomous: "high" },
         "background",
       );
       expect(isWithinThreshold(RiskLevel.High, bgThreshold)).toBe(true);
@@ -1196,28 +1213,28 @@ describe("guardian threshold-based auto-approve (ordinal comparison)", () => {
   });
 
   describe("default (undefined) resolves per-context defaults", () => {
-    test("undefined config → medium threshold for background", () => {
+    test("undefined config → low threshold for background", () => {
       const bgThreshold = resolveThreshold(undefined, "background");
-      expect(bgThreshold).toBe("medium");
-      // Low and Medium risk are within threshold, High is not
+      expect(bgThreshold).toBe("low");
+      // Low-risk auto-approves at the "low" threshold
       expect(isWithinThreshold(RiskLevel.Low, bgThreshold)).toBe(true);
-      expect(isWithinThreshold(RiskLevel.Medium, bgThreshold)).toBe(true);
+      expect(isWithinThreshold(RiskLevel.Medium, bgThreshold)).toBe(false);
       expect(isWithinThreshold(RiskLevel.High, bgThreshold)).toBe(false);
     });
 
-    test("undefined config → low threshold for conversation", () => {
+    test("undefined config → medium threshold for conversation", () => {
       const convThreshold = resolveThreshold(undefined, "conversation");
-      expect(convThreshold).toBe("low");
+      expect(convThreshold).toBe("medium");
     });
 
-    test("undefined config → none threshold for headless", () => {
+    test("undefined config → low threshold for headless", () => {
       const hlThreshold = resolveThreshold(undefined, "headless");
-      expect(hlThreshold).toBe("none");
+      expect(hlThreshold).toBe("low");
     });
 
-    test("undefined config + no context → low (conversation default)", () => {
+    test("undefined config + no context → medium (conversation default)", () => {
       const threshold = resolveThreshold(undefined);
-      expect(threshold).toBe("low");
+      expect(threshold).toBe("medium");
     });
   });
 });