@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/agent/loop.ts

@@ -60,6 +60,28 @@ const MID_LOOP_YIELD_THRESHOLD_RATIO = 0.85;
 const LONG_HISTORY_MESSAGE_THRESHOLD = 50;
 const LONG_HISTORY_SAFETY_MARGIN_FLOOR = 0.15;
 
+/**
+ * Minimum token regrowth, measured from the post-compaction watermark, before
+ * the budget gate will compact again. A compaction pass that just ran already
+ * proved how far the history can shrink; if the estimate has not climbed at
+ * least this far past that watermark, another pass cannot free more than it
+ * already did and would only thrash (the production failure mode: each pass
+ * lands a hair under the trigger, one tick pushes it back over, repeat).
+ *
+ * Sized as `max(2048, 2% of maxInputTokens)` so it scales with the window but
+ * never collapses to a trivial value on small budgets. Overflow-driven
+ * compaction bypasses this guard entirely — a provider-confirmed overflow must
+ * always be allowed to compact.
+ */
+const MIN_REGROWTH_FLOOR_TOKENS = 2048;
+const MIN_REGROWTH_WINDOW_RATIO = 0.02;
+function minRegrowthTokens(maxInputTokens: number): number {
+  return Math.max(
+    MIN_REGROWTH_FLOOR_TOKENS,
+    Math.floor(maxInputTokens * MIN_REGROWTH_WINDOW_RATIO),
+  );
+}
+
 export interface AgentLoopConfig {
   maxTokens: number;
   maxInputTokens?: number; // context window size for tool result truncation
@@ -493,6 +515,16 @@ export interface AgentLoopRunOptions {
    * call-site named profile. Missing profile names silently fall through.
    */
   overrideProfile?: string;
+  /**
+   * Float the override profile above the call-site layers (named site
+   * profile + call-site override) for non-main-agent call sites — the
+   * resolver's `forceOverrideProfile` escape hatch. Threaded onto each
+   * send's `SendMessageOptions.config` alongside `overrideProfile`. Used by
+   * wakes that must run a background call site under a specific
+   * conversation's inference profile (e.g. fork-based memory
+   * retrospectives).
+   */
+  forceOverrideProfile?: boolean;
   resolveOverrideProfile?: () => string | undefined;
   /**
    * Resolves the orchestrator's effective context window for this turn: the
@@ -856,6 +888,7 @@ export class AgentLoop {
       callSite,
       trust,
       overrideProfile,
+      forceOverrideProfile = false,
       resolveOverrideProfile,
       resolveContextWindow,
       compactInPlace = false,
@@ -899,6 +932,28 @@ export class AgentLoop {
     // `context_too_large`) instead of looping.
     let overflowLadderExhausted = false;
     let overflowAutoCompressApplied = false;
+    // Per-turn suppression for floor-dominated proactive-compaction thrash.
+    // Set when a proactive (non-overflow) pass completes WITHOUT clearing the
+    // mid-loop gate (the manager returned `exhausted` — it could not get below
+    // its success threshold). During a tool-heavy turn each tool round grows the
+    // PROTECTED in-flight region past the regrowth guard's re-arm delta, but
+    // that region is exactly what compaction cannot touch, so every subsequent
+    // gate check would fire another futile full-context pass. Once set, the
+    // budget gate skips proactive compaction for the rest of THIS turn; it
+    // clears when a later proactive pass succeeds (non-exhausted). Overflow-
+    // driven compaction always bypasses it — a provider-confirmed overflow must
+    // always compact.
+    //
+    // Lifetime is exactly one turn: this is a `run()`-local (like
+    // `budgetGateArmed` / `pendingOverflowSignal` / `overflowLadderExhausted`),
+    // not an instance field. The AgentLoop instance is constructed once per
+    // Conversation and `run()` is invoked once per turn (a checkpoint handoff
+    // breaks out of the loop and the queued message resumes in a fresh `run()`),
+    // so a `run()`-local resets implicitly at every turn start — no manual reset
+    // point is needed, and suppression can never leak across turns the way an
+    // instance field would. (The regrowth watermark, by contrast, lives on the
+    // cross-turn `compactionCircuit` precisely because it must persist.)
+    let proactiveCompactionFutileThisTurn = false;
     const rlog = log.child({ requestId });
 
     // Conversation directory for the result-time tool-result spool/stub pass.
@@ -1052,7 +1107,47 @@ export class AgentLoop {
               overflowDriven ||
               !isFirstCallGate ||
               !(await this.compactionCircuit.isOpen());
-            if (shouldCompact && compactionAllowed) {
+            // Regrowth hysteresis: a proactive pass that just ran proved how
+            // far this history can shrink. If the estimate has not climbed at
+            // least `minRegrowth` past that watermark, another pass cannot free
+            // more and would only thrash — skip it and let the provider call
+            // proceed (overflow recovery remains the safety net). Overflow-
+            // driven compaction always bypasses the guard.
+            const watermark = this.compactionCircuit.lastPostCompactionEstimate;
+            const minRegrowth = minRegrowthTokens(maxInputTokens);
+            const regrowthGuardSkip =
+              !overflowDriven &&
+              watermark !== null &&
+              estimated - watermark < minRegrowth;
+            // Floor-dominated thrash guard: a proactive pass earlier this turn
+            // already exhausted the compactor (couldn't clear the gate because
+            // the over-budget region is the protected in-flight turn). The
+            // regrowth guard cannot catch this — each tool round's growth lands
+            // in that protected region and re-arms the regrowth delta — so this
+            // per-turn latch is what stops the repeated futile passes. Overflow-
+            // driven compaction bypasses it.
+            const proactiveFutileSkip =
+              !overflowDriven && proactiveCompactionFutileThisTurn;
+            if (
+              shouldCompact &&
+              compactionAllowed &&
+              (regrowthGuardSkip || proactiveFutileSkip)
+            ) {
+              rlog.info(
+                {
+                  turn: toolUseTurns,
+                  estimated,
+                  postCompactionWatermark: watermark,
+                  minRegrowth,
+                  reason: proactiveFutileSkip
+                    ? "proactive_compaction_exhausted_this_turn"
+                    : "history_not_regrown",
+                },
+                proactiveFutileSkip
+                  ? "Skipping compaction: a proactive pass already exhausted the compactor this turn — the over-budget region is the protected in-flight turn, so re-compacting would free nothing"
+                  : "Skipping compaction: history has not regrown past the post-compaction watermark — re-compacting would not free more",
+              );
+            } else if (shouldCompact && compactionAllowed) {
               rlog.info(
                 {
                   turn: toolUseTurns,
@@ -1078,6 +1173,11 @@ export class AgentLoop {
                 // The compacted, re-injected array is the new base; output
                 // produced after this point is what the wrapper persists.
                 newMessagesStart = history.length;
+                // Record the post-compaction estimate so the regrowth guard can
+                // tell, on a later gate crossing, whether the history has grown
+                // enough to be worth compacting again.
+                this.compactionCircuit.lastPostCompactionEstimate =
+                  this.estimateTokens(history);
               }
               if (overflowDriven) {
                 // Carry the ladder's terminal state to the catch: if the
@@ -1085,6 +1185,12 @@ export class AgentLoop {
                 // ends instead of looping.
                 overflowLadderExhausted = attempt.exhausted;
                 overflowAutoCompressApplied = attempt.autoCompressApplied;
+              } else {
+                // Proactive (non-overflow) pass. If it exhausted the compactor
+                // without clearing the gate, latch suppression so later gate
+                // checks this turn skip the futile re-pass; a pass that DID
+                // clear the gate (non-exhausted) releases the latch.
+                proactiveCompactionFutileThisTurn = attempt.exhausted;
               }
             }
           }
@@ -1195,6 +1301,9 @@ export class AgentLoop {
         const effectiveOverrideProfile = resolveEffectiveOverrideProfile();
         if (effectiveOverrideProfile) {
           providerConfig.overrideProfile = effectiveOverrideProfile;
+          if (forceOverrideProfile) {
+            providerConfig.forceOverrideProfile = true;
+          }
         }
 
         // Rate-limit consecutive LLM calls to prevent spin when tools return instantly
@@ -1504,8 +1613,10 @@ export class AgentLoop {
           content: response.content,
         };
 
-        // Check for tool use
-        toolUseBlocks = response.content.filter(
+        // The model's own tool calls. The executable set is finalized after
+        // the `post-model-call` hook below, which may add or drop tool calls;
+        // this raw set drives only the completion log and the max-tokens branch.
+        const modelToolUseBlocks = response.content.filter(
           (block): block is Extract<ContentBlock, { type: "tool_use" }> =>
             block.type === "tool_use",
         );
@@ -1515,7 +1626,7 @@ export class AgentLoop {
             turn: toolUseTurns,
             stopReason: response.stopReason,
             contentBlocks: response.content.length,
-            toolUseCount: toolUseBlocks.length,
+            toolUseCount: modelToolUseBlocks.length,
             durationMs: providerDurationMs,
           },
           "LLM call complete",
@@ -1534,20 +1645,59 @@ export class AgentLoop {
               stopReason: response.stopReason,
               contentBlocks: response.content.length,
               safeContentBlocks: safeContent.length,
-              toolUseCount: toolUseBlocks.length,
+              toolUseCount: modelToolUseBlocks.length,
             },
             "LLM response reached output token limit",
           );
           // Run the hook on the truncated reply so output-filter plugins still
           // see it, and so a turn that streamed nothing live gets its final
-          // emit (without this the client would see nothing). The retry decision
-          // is ignored here: a max-tokens stop is terminal.
-          const { finalized: safeAssistantMessage } =
-            await finalizeAssistantMessage({
-              role: "assistant",
-              content: safeContent,
-            });
+          // emit (without this the client would see nothing). A recovery hook
+          // (max-tokens-continue) may set `decision: "continue"` to resume the
+          // truncated turn: it leaves `messages` as the next history (the
+          // truncated turn followed by a continuation nudge), so unlike the
+          // no-tool retry below the partial output is kept, not discarded.
+          // Otherwise the stop is terminal and the continuation card surfaces.
+          const {
+            finalized: rawSafeAssistantMessage,
+            decision: maxTokensDecision,
+            messages: maxTokensMessages,
+          } = await finalizeAssistantMessage({
+            role: "assistant",
+            content: safeContent,
+          });
+          // A truncated turn never executes tools — the model's own tool calls
+          // were stripped into `safeContent` above. The hook can still append a
+          // `tool_use` block while transforming the reply, but this branch
+          // short-circuits without an executor pass, so honoring it would
+          // persist a tool call with no matching `tool_result`. Drop hook-added
+          // tool calls here too: tool injection is supported only on the
+          // non-truncated path below, which runs the executor.
+          const safeAssistantMessage: Message = {
+            ...rawSafeAssistantMessage,
+            content: rawSafeAssistantMessage.content.filter(
+              (block) =>
+                block.type !== "tool_use" &&
+                block.type !== "server_tool_use" &&
+                block.type !== "web_search_tool_result",
+            ),
+          };
           emitFinalAssistantText(safeAssistantMessage.content);
+          if (
+            maxTokensDecision === "continue" &&
+            postModelCallContinues < MAX_POST_MODEL_CALL_CONTINUES
+          ) {
+            postModelCallContinues++;
+            rlog.warn(
+              { turn: toolUseTurns, retry: postModelCallContinues },
+              "max-tokens stop — auto-continuing the truncated turn",
+            );
+            await onEvent({
+              type: "message_complete",
+              message: safeAssistantMessage,
+            });
+            history = maxTokensMessages;
+            continue;
+          }
           history.push(safeAssistantMessage);
           await onEvent({
             type: "max_tokens_reached",
@@ -1575,6 +1725,25 @@ export class AgentLoop {
         } = await finalizeAssistantMessage(assistantMessage);
         assistantMessage = finalizedAssistantMessage;
 
+        // Execution follows the FINALIZED content, not the raw reply. A
+        // `post-model-call` hook may append a `tool_use` block to run a tool as
+        // if the model had called it (the supported way for a plugin to surface
+        // a card or take a follow-up action), or drop one the model emitted, so
+        // the loop runs whatever the assistant message ends up carrying.
+        // Normalize ids so the executor and tool_result correlation stay 1:1 —
+        // a hook-added block may carry an empty or duplicate id.
+        toolUseBlocks = assistantMessage.content.filter(
+          (block): block is Extract<ContentBlock, { type: "tool_use" }> =>
+            block.type === "tool_use",
+        );
+        const seenToolUseIds = new Set<string>();
+        for (const block of toolUseBlocks) {
+          if (block.id.length === 0 || seenToolUseIds.has(block.id)) {
+            block.id = crypto.randomUUID();
+          }
+          seenToolUseIds.add(block.id);
+        }
+
         // At the no-tool stop boundary the retry decision is actionable: a
         // recovery hook may repair history and ask to re-query (a tool-bearing
         // turn already continues, so its decision is ignored). A re-query

package/src/api/constants/call-sites.ts

@@ -25,3 +25,15 @@
  */
 export const CALL_SITE_SYNTHETIC_AGENT_ERROR_MESSAGE =
   "syntheticAgentErrorMessage";
+
+/**
+ * Marks the summarizer LLM call the agent loop makes to compact a
+ * conversation's history when it approaches the context limit. The row
+ * lands in the inspector rail like any other call, so the frontend
+ * branches on this value to tag it as a compaction rather than a
+ * main-agent call.
+ *
+ * Mirrors the `compactionAgent` member of the backend's `LLMCallSite`
+ * enum (the value stamped on the row at write time).
+ */
+export const CALL_SITE_COMPACTION_AGENT = "compactionAgent";

package/src/api/events/assistant-thinking-delta.ts

@@ -12,6 +12,13 @@
  * Absent on streams produced by older daemons that pre-date the anchor
  * protocol.
  *
+ * `timestampMs` is the daemon's wall-clock emission time for the delta. The
+ * transport envelope (`AssistantEvent.emittedAt`) carries the same instant,
+ * but it is dropped once the inner message is unwrapped for persistence,
+ * debug buffers, and backend storage — so the timestamp is carried on the
+ * payload itself to make per-delta timing observable wherever the message
+ * travels.
+ *
  * Only emitted when thinking streaming is enabled for the turn; turns that
  * suppress reasoning output produce none.
  *
@@ -26,6 +33,9 @@ export const AssistantThinkingDeltaEventSchema = z.object({
   thinking: z.string(),
   messageId: z.string().optional(),
   conversationId: z.string().optional(),
+  /** Epoch milliseconds (`Date.now()`) at which the daemon emitted this
+   *  delta. Absent on streams produced by daemons that pre-date this field. */
+  timestampMs: z.number().optional(),
 });
 
 export type AssistantThinkingDeltaEvent = z.infer<

package/src/api/events/usage-update.ts

@@ -23,6 +23,13 @@ export const UsageUpdateEventSchema = z.object({
   conversationId: z.string(),
   inputTokens: z.number(),
   outputTokens: z.number(),
+  /**
+   * Per-call prompt-cache token counts, as reported by the provider.
+   * Optional: older daemons omit them, and providers without prompt
+   * caching never supply them. `inputTokens` already includes these.
+   */
+  cacheCreationInputTokens: z.number().optional(),
+  cacheReadInputTokens: z.number().optional(),
   totalInputTokens: z.number(),
   totalOutputTokens: z.number(),
   estimatedCost: z.number(),

package/src/api/index.ts

@@ -53,7 +53,10 @@ import { UsageProgressEventSchema } from "./events/usage-progress.js";
 import { UsageUpdateEventSchema } from "./events/usage-update.js";
 import { UserMessageEchoEventSchema } from "./events/user-message-echo.js";
 
-export { CALL_SITE_SYNTHETIC_AGENT_ERROR_MESSAGE } from "./constants/call-sites.js";
+export {
+  CALL_SITE_COMPACTION_AGENT,
+  CALL_SITE_SYNTHETIC_AGENT_ERROR_MESSAGE,
+} from "./constants/call-sites.js";
 export { DEFAULT_TOOL_EXECUTION_TIMEOUT_SEC } from "./constants/tool-execution.js";
 export {
   type AssistantActivityAnchor,

package/src/api/responses/memory-v3-selection-log.ts

@@ -15,14 +15,13 @@
  * `injectedText` reflects the live selection; when only `shadow` is true it is
  * the block that WOULD have been injected.
  *
- * `injectedText` is APPROXIMATE, not a verbatim record. It is re-rendered from
- * the persisted selection rows, which store slug/source/pinned but NOT the
- * matched-section identity. A page that live injection sent as a single matched
- * section is re-rendered here as its FULL page (the section ordinal isn't
- * persisted), so the text can differ from what was actually sent to the model.
- * The selected slug set is exact — only the rendered text is full-page
- * approximate. Persisting the per-turn injected section is a documented
- * follow-up.
+ * `injectedText` is inspector-only, not a verbatim record of the live cards +
+ * spotlight. It re-renders each selection's matched section — resolved from the
+ * persisted `(slug, sectionOrdinal)` against the CURRENT page — falling back to
+ * the full page when no section was recorded. Because the section text is
+ * re-derived from the current page, it reflects bounded page-drift if the page
+ * changed since the turn (the same approximation the v2 inspector accepts). The
+ * selected slug set and each row's matched-section heading are exact as logged.
  */
 
 import { z } from "zod";
@@ -33,20 +32,28 @@ import { z } from "zod";
  * rows may carry retired labels) — but the schema stays a permissive string
  * so a new lane label (or a historical pre-lane row) doesn't break parsing on
  * the FE. `pinned` marks a page the turn was centrally about.
+ * `sectionOrdinal`/`sectionHeading` identify the matched section a finder lane
+ * surfaced (null for core/hot/fresh/edge selections and pre-migration rows).
  */
 export const MemoryV3SelectionRowSchema = z.object({
   slug: z.string(),
   source: z.string(),
   pinned: z.boolean(),
+  // The matched section a finder lane surfaced for this selection. Null for
+  // core/hot/fresh/edge selections with no matched section, and for rows
+  // written before the section columns existed. Optional + nullable so older
+  // clients and pre-migration rows round-trip.
+  sectionOrdinal: z.number().nullable().optional(),
+  sectionHeading: z.string().nullable().optional(),
 });
 
 export type MemoryV3SelectionRow = z.infer<typeof MemoryV3SelectionRowSchema>;
 
 /**
  * Memory v3 selection log shape. `injectedText` is the rendered
- * `<memory>…</memory>` block for the selection — APPROXIMATE: re-rendered from
- * the persisted rows, with full pages where live injection used a matched
- * section (the section identity isn't persisted). See the file header.
+ * `<memory>…</memory>` block for the selection — re-rendered from the persisted
+ * rows, with each selection's matched section resolved from its
+ * `(slug, sectionOrdinal)` (full-page fallback when none). See the file header.
  */
 export const MemoryV3SelectionLogSchema = z.object({
   turn: z.number(),

package/src/approvals/approval-primitive.ts

@@ -289,8 +289,8 @@ const GRANT_RETRY_MAX_WAIT_MS = 10_000;
  * polling to handle the voice pipeline race condition where the grant
  * may still be in-flight: `answerCall()` triggers the voice turn as
  * fire-and-forget, and the voice LLM can attempt tool execution before
- * `tryMintGuardianActionGrant`'s classifier finishes minting the
- * grant.  Polling bridges this timing gap without changing the
+ * the guardian-decision
+ * classifier finishes minting the grant.  Polling bridges this timing gap without changing the
  * fire-and-forget architecture.
  */
 export async function consumeGrantForInvocation(

package/src/background-wake/background-wake-routes.test.ts

@@ -648,7 +648,10 @@ describe("background wake runtime routes", () => {
       },
     });
     const handler = findHandler("drainDueBackgroundWake");
-    const deadlineAt = Date.now() + 10;
+    // Keep the deadline far enough ahead that the synchronous start-check always
+    // sees it as live; the wait below outlasts it, so completion is verified to
+    // hold until the work settles rather than fire when the deadline elapses.
+    const deadlineAt = Date.now() + 200;
 
     const firstResponse = await handler({
       body: drainBodyFixture({
@@ -658,7 +661,7 @@ describe("background wake runtime routes", () => {
     });
 
     try {
-      await new Promise((resolve) => setTimeout(resolve, 25));
+      await new Promise((resolve) => setTimeout(resolve, 280));
       expect(mockCompleteBackgroundWakeLease).not.toHaveBeenCalled();
 
       const duplicateResponse = await handler({

package/src/bundler/compiler-tools.ts

@@ -2,7 +2,7 @@
  * JIT download and cache of esbuild binary + preact for app compilation.
  *
  * Instead of shipping these in the .app bundle (~11 MB), we download them
- * on first compile to ~/.vellum/workspace/compiler-tools/. Follows the
+ * on first compile to $VELLUM_WORKSPACE_DIR/compiler-tools/. Follows the
  * same pattern as EmbeddingRuntimeManager.
  */
 

package/src/bundler/package-resolver.ts

@@ -22,7 +22,6 @@ export const ALLOWED_PACKAGES: readonly string[] = [
   "lodash-es",
   "zod",
   "clsx",
-  "lucide",
 ] as const;
 
 const INSTALL_TIMEOUT_MS = 10_000;

package/src/calls/call-domain.ts

@@ -212,7 +212,7 @@ export async function resolveCallerIdentity(
     return {
       ok: false,
       error:
-        "user_number mode requires a user phone number. Set calls.callerIdentity.userNumber in config or store credential/twilio/user_phone_number via the credential_store tool.",
+        "user_number mode requires a user phone number. Set calls.callerIdentity.userNumber in config or store credential/twilio/user_phone_number via `assistant credentials set`.",
     };
   }
 

package/src/calls/guardian-action-sweep.ts

@@ -1,42 +1,18 @@
 /**
- * Periodic sweep for expired guardian action requests.
+ * Guardian action expiry notices.
  *
- * Runs on a 60-second interval. When a request has passed its expiresAt
- * timestamp:
- * 1. Expires the request and all its deliveries in the store
- * 2. Expires the associated pending question so the call-side timeout fires
- * 3. Sends expiry notices to external delivery destinations (telegram)
- * 4. Adds an expiry message to mac guardian conversations
+ * Sends "this request has expired" notices to guardian delivery
+ * destinations — vellum conversations get an assistant message, external
+ * channels (telegram, slack) get a direct channel reply.
  */
 
 import { addMessage } from "../memory/conversation-crud.js";
-import {
-  expireGuardianActionRequest,
-  getDeliveriesByRequestId,
-  getExpiredGuardianActionRequests,
-} from "../memory/guardian-action-store.js";
-import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
 import { deliverChannelReply } from "../runtime/gateway-client.js";
 import { composeGuardianActionMessageGenerative } from "../runtime/guardian-action-message-composer.js";
-import type { GuardianActionCopyGenerator } from "../runtime/http-types.js";
 import { getLogger } from "../util/logger.js";
-import { expirePendingQuestions } from "./call-store.js";
 
 const log = getLogger("guardian-action-sweep");
 
-const SWEEP_INTERVAL_MS = 60_000;
-
-let sweepTimer: ReturnType<typeof setInterval> | null = null;
-let sweepInProgress = false;
-
-/**
- * Send expiry notices to all delivery destinations for a guardian action
- * request. Handles both vellum/mac conversation messages and external channel
- * replies (telegram, slack).
- *
- * Deliveries must be captured *before* their status is changed to 'expired'
- * so the sent/pending filter still matches.
- */
 /** Minimal delivery shape used by the expiry notice sender. */
 export interface ExpiryDeliveryInfo {
   id: string;
@@ -46,23 +22,26 @@ export interface ExpiryDeliveryInfo {
   destinationChatId: string | null;
 }
 
+/**
+ * Send expiry notices to all delivery destinations for a guardian action
+ * request. Handles both vellum/mac conversation messages and external channel
+ * replies (telegram, slack).
+ *
+ * Deliveries must be captured *before* their status is changed to 'expired'
+ * so the sent/pending filter still matches.
+ */
 export async function sendGuardianExpiryNotices(
   deliveries: ExpiryDeliveryInfo[],
   assistantId: string,
-  guardianActionCopyGenerator?: GuardianActionCopyGenerator,
 ): Promise<void> {
   for (const delivery of deliveries) {
     if (delivery.status !== "sent" && delivery.status !== "pending") continue;
 
     try {
-      const expiryText = await composeGuardianActionMessageGenerative(
-        {
-          scenario: "guardian_stale_expired",
-          channel: delivery.destinationChannel,
-        },
-        {},
-        guardianActionCopyGenerator,
-      );
+      const expiryText = await composeGuardianActionMessageGenerative({
+        scenario: "guardian_stale_expired",
+        channel: delivery.destinationChannel,
+      });
 
       if (
         delivery.destinationChannel === "vellum" &&
@@ -99,59 +78,3 @@ export async function sendGuardianExpiryNotices(
     }
   }
 }
-
-/**
- * Sweep expired guardian action requests and clean up.
- */
-export async function sweepExpiredGuardianActions(
-  guardianActionCopyGenerator?: GuardianActionCopyGenerator,
-): Promise<void> {
-  const expired = getExpiredGuardianActionRequests();
-
-  for (const request of expired) {
-    // Capture deliveries before expiring (since expiry changes their status)
-    const deliveries = getDeliveriesByRequestId(request.id);
-
-    // Expire the request and all deliveries
-    expireGuardianActionRequest(request.id, "sweep_timeout");
-
-    // Expire associated pending questions
-    expirePendingQuestions(request.callSessionId);
-
-    log.info(
-      { requestId: request.id, callSessionId: request.callSessionId },
-      "Expired guardian action request",
-    );
-
-    await sendGuardianExpiryNotices(
-      deliveries,
-      DAEMON_INTERNAL_ASSISTANT_ID,
-      guardianActionCopyGenerator,
-    );
-  }
-}
-
-export function startGuardianActionSweep(
-  guardianActionCopyGenerator?: GuardianActionCopyGenerator,
-): void {
-  if (sweepTimer) return;
-  sweepTimer = setInterval(async () => {
-    if (sweepInProgress) return;
-    sweepInProgress = true;
-    try {
-      await sweepExpiredGuardianActions(guardianActionCopyGenerator);
-    } catch (err) {
-      log.error({ err }, "Guardian action sweep failed");
-    } finally {
-      sweepInProgress = false;
-    }
-  }, SWEEP_INTERVAL_MS);
-}
-
-export function stopGuardianActionSweep(): void {
-  if (sweepTimer) {
-    clearInterval(sweepTimer);
-    sweepTimer = null;
-  }
-  sweepInProgress = false;
-}

package/src/cli/AGENTS.md

@@ -14,6 +14,10 @@ For commands that manage the **lifecycle of assistant instances** (create, start
 
 Examples: `config`, `contacts`, `memory`, `autonomy`, `conversations` belong here. `hatch`, `wake`, `sleep`, `retire`, `ps`, `ssh` belong in `cli/`.
 
+## Full CRUD for Resource Namespaces
+
+Every namespace that manages a resource (schedules, contacts, tasks, …) must expose the full CRUD surface — create, get/list, update, delete — each wired to a daemon route. Intentional exceptions (e.g. create restricted to one mode) must be documented inline in the namespace help text so agents know the gap is deliberate. Partial surfaces are not a smaller scope, they are a hazard: when a CRUD verb is missing, the model bypasses the CLI and hand-writes SQLite rows instead.
+
 ## Conventions
 
 - Commands use [Commander.js](https://github.com/tj/commander.js) and follow the `registerXCommand(program: Command)` pattern.