@vellumai/assistant 0.9.0-dev.202606180940.f141ea3 → 0.9.0-dev.202606181324.0804a69

package/node_modules/@vellumai/gateway-client/src/admission-policy-contract.ts

@@ -49,8 +49,7 @@ export const ADMISSION_FLOOR: Record<AdmissionPolicy, number> = {
 
 /**
  * Hard-exempt internal channels — never subject to PUT policy, omitted from
- * GET list, runtime admission stage short-circuits without floor check,
- * gateway kill switch skips the `no_one` check.
+ * GET list, runtime admission stage short-circuits without floor check.
  *
  * `platform` / `a2a` are peer/internal channels with no human-trust model.
  *
@@ -61,8 +60,8 @@ export const ADMISSION_FLOOR: Record<AdmissionPolicy, number> = {
  * until voice ingress is wired in a follow-up PR. Remove `"phone"` from this
  * set once the voice path enforces admission.
  *
- * `vellum` is intentionally NOT exempt — it is client-configurable, with the
- * single restriction in {@link KILL_SWITCH_FORBIDDEN_CHANNELS}.
+ * `vellum` is NOT exempt — its floor is still enforced at runtime — but it is
+ * hidden from the configurable UI; see {@link ADMISSION_POLICY_HIDDEN_CHANNELS}.
  */
 export const ADMISSION_POLICY_EXEMPT_CHANNELS: ReadonlySet<string> = new Set([
   "platform",
@@ -75,18 +74,24 @@ export function isAdmissionPolicyExemptChannel(channelType: string): boolean {
 }
 
 /**
- * Channels that are configurable but may never be set to `no_one` (the kill
- * switch). `vellum` is the local desktop/web client channel; allowing `no_one`
- * there would let the guardian lock themselves out of their own client. The
- * guardian is always classified `guardian` (max rank) on vellum, so every
- * floor except `no_one` still admits them — only the kill switch is forbidden.
+ * Channels omitted from the Channel Trust Floors list (GET) and rejected on
+ * PUT/DELETE — managed automatically at their seed default, not user
+ * configurable. Unlike {@link ADMISSION_POLICY_EXEMPT_CHANNELS} they are still
+ * enforced at runtime, so hiding a real inbound channel like `whatsapp` never
+ * silently disables its admission floor check. The startup seed re-pins any
+ * drifted row so a stale floor (e.g. a legacy `no_one`) can't strand a channel
+ * the user can no longer see.
+ *
+ * `vellum` is the local desktop/web client surface; the guardian is always
+ * max-rank there, so the seed default admits them regardless of the floor.
  */
-export const KILL_SWITCH_FORBIDDEN_CHANNELS: ReadonlySet<string> = new Set([
+export const ADMISSION_POLICY_HIDDEN_CHANNELS: ReadonlySet<string> = new Set([
   "vellum",
+  "whatsapp",
 ]);
 
-export function isKillSwitchForbiddenChannel(channelType: string): boolean {
-  return KILL_SWITCH_FORBIDDEN_CHANNELS.has(channelType);
+export function isAdmissionPolicyHiddenChannel(channelType: string): boolean {
+  return ADMISSION_POLICY_HIDDEN_CHANNELS.has(channelType);
 }
 
 export function isAdmissionPolicy(value: unknown): value is AdmissionPolicy {

package/node_modules/@vellumai/gateway-client/src/index.ts

@@ -56,17 +56,17 @@ export type { IpcRequest, IpcResponse, Logger } from "./types.js";
 
 export { noopLogger } from "./types.js";
 
-// Admission policy contract (gateway → daemon) — Zod schemas + derived types + exempt channels
+// Admission policy contract (gateway → daemon) — Zod schemas + derived types + channel sets
 export {
   ADMISSION_FLOOR,
   ADMISSION_POLICY_DEFAULT,
   ADMISSION_POLICY_EXEMPT_CHANNELS,
+  ADMISSION_POLICY_HIDDEN_CHANNELS,
   ADMISSION_POLICY_VALUES,
   AdmissionPolicySchema,
   isAdmissionPolicy,
   isAdmissionPolicyExemptChannel,
-  isKillSwitchForbiddenChannel,
-  KILL_SWITCH_FORBIDDEN_CHANNELS,
+  isAdmissionPolicyHiddenChannel,
 } from "./admission-policy-contract.js";
 
 export type { AdmissionPolicy } from "./admission-policy-contract.js";

package/openapi.yaml

@@ -12116,6 +12116,19 @@ paths:
                           propertyNames:
                             type: string
                           additionalProperties: {}
+                        sourceType:
+                          type: string
+                          enum:
+                            - heartbeat
+                            - memory_consolidation
+                            - schedule
+                            - auto_analysis
+                            - user
+                            - other
+                        sourceKey:
+                          type: string
+                        sourceLabel:
+                          type: string
                         createdAt:
                           type: string
                       required:
@@ -12296,6 +12309,19 @@ paths:
                     propertyNames:
                       type: string
                     additionalProperties: {}
+                  sourceType:
+                    type: string
+                    enum:
+                      - heartbeat
+                      - memory_consolidation
+                      - schedule
+                      - auto_analysis
+                      - user
+                      - other
+                  sourceKey:
+                    type: string
+                  sourceLabel:
+                    type: string
                   createdAt:
                     type: string
                 required:
@@ -12508,6 +12534,19 @@ paths:
                           propertyNames:
                             type: string
                           additionalProperties: {}
+                        sourceType:
+                          type: string
+                          enum:
+                            - heartbeat
+                            - memory_consolidation
+                            - schedule
+                            - auto_analysis
+                            - user
+                            - other
+                        sourceKey:
+                          type: string
+                        sourceLabel:
+                          type: string
                         createdAt:
                           type: string
                       required:
@@ -17936,6 +17975,19 @@ paths:
                         propertyNames:
                           type: string
                         additionalProperties: {}
+                      sourceType:
+                        type: string
+                        enum:
+                          - heartbeat
+                          - memory_consolidation
+                          - schedule
+                          - auto_analysis
+                          - user
+                          - other
+                      sourceKey:
+                        type: string
+                      sourceLabel:
+                        type: string
                       createdAt:
                         type: string
                     required:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.9.0-dev.202606180940.f141ea3",
+  "version": "0.9.0-dev.202606181324.0804a69",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/disk-usage.test.ts

@@ -6,6 +6,8 @@ const GIB = 1024 * MIB;
 let existingPaths = new Set<string>();
 const workspaceDir = "/workspace";
 let minikubeStorageSize: string | undefined;
+let isContainerized = false;
+let isPlatform = false;
 let statfsResult = {
   bsize: 4096,
   blocks: 0,
@@ -34,6 +36,8 @@ mock.module("node:child_process", () => ({
 
 mock.module("../config/env-registry.js", () => ({
   getMinikubeStorageSize: () => minikubeStorageSize,
+  getIsContainerized: () => isContainerized,
+  getIsPlatform: () => isPlatform,
 }));
 
 mock.module("../util/platform.js", () => ({
@@ -55,6 +59,8 @@ describe("disk usage sampler", () => {
   beforeEach(() => {
     existingPaths = new Set([workspaceDir]);
     minikubeStorageSize = undefined;
+    isContainerized = false;
+    isPlatform = false;
     statfsResult = statfsFor(100 * MIB, 25 * MIB);
     spawnResult = { status: 0, stdout: "" };
     spawnCalls = [];
@@ -119,6 +125,65 @@ describe("disk usage sampler", () => {
     ]);
   });
 
+  test("measures workspace du usage on a local Docker hatch", () => {
+    isContainerized = true;
+    isPlatform = false;
+    statfsResult = statfsFor(100 * GIB, 40 * GIB);
+    spawnResult = {
+      status: 0,
+      stdout: `${2 * GIB}\t/workspace\n`,
+    };
+
+    const usage = getDiskUsageInfo();
+
+    // Used reflects only the workspace (du), free reflects the host headroom
+    // the volume can grow into, and total is their sum.
+    expect(usage).toEqual({
+      path: "/workspace",
+      totalMb: 2048 + 40960,
+      usedMb: 2048,
+      freeMb: 40960,
+    });
+    expect(spawnCalls).toEqual([
+      { command: "du", args: ["-sb", "/workspace"] },
+    ]);
+  });
+
+  test("does not use du for platform-managed containerized instances", () => {
+    isContainerized = true;
+    isPlatform = true;
+    statfsResult = statfsFor(10 * GIB, 6 * GIB);
+
+    const usage = getDiskUsageInfo();
+
+    expect(usage).toEqual({
+      path: "/workspace",
+      totalMb: 10240,
+      usedMb: 4096,
+      freeMb: 6144,
+    });
+    expect(spawnCalls).toHaveLength(0);
+  });
+
+  test("falls back to statfs when du fails on a local Docker hatch", () => {
+    isContainerized = true;
+    isPlatform = false;
+    statfsResult = statfsFor(100 * GIB, 40 * GIB);
+    spawnResult = { status: 1, stdout: "" };
+
+    const usage = getDiskUsageInfo();
+
+    expect(usage).toEqual({
+      path: "/workspace",
+      totalMb: 102400,
+      usedMb: 61440,
+      freeMb: 40960,
+    });
+    expect(spawnCalls).toEqual([
+      { command: "du", args: ["-sb", "/workspace"] },
+    ]);
+  });
+
   test("returns null for malformed Kubernetes memory strings", () => {
     expect(parseK8sMemoryBytes("")).toBeNull();
     expect(parseK8sMemoryBytes("abc")).toBeNull();

package/src/api/index.ts

@@ -385,6 +385,8 @@ export {
   FeedItemDetailPanelKindSchema,
   FeedItemDetailPanelSchema,
   FeedItemSchema,
+  type FeedItemSourceType,
+  FeedItemSourceTypeSchema,
   type FeedItemStatus,
   FeedItemStatusSchema,
   type FeedItemType,

package/src/api/responses/home.ts

@@ -55,6 +55,25 @@ export const FeedItemCategorySchema = z.enum([
 ]);
 export type FeedItemCategory = z.infer<typeof FeedItemCategorySchema>;
 
+/**
+ * Producer of a feed item's source conversation — lets clients filter the
+ * activity feed by what generated each notification: the periodic
+ * heartbeat, a memory-consolidation pass, a recurring schedule, an
+ * auto-analysis run, etc. Derived at read time from the source
+ * conversation's `source` column (see `home/feed-source-enrichment.ts`).
+ * Individual schedules are distinguished by `sourceKey`/`sourceLabel`, not
+ * this coarse type.
+ */
+export const FeedItemSourceTypeSchema = z.enum([
+  "heartbeat",
+  "memory_consolidation",
+  "schedule",
+  "auto_analysis",
+  "user",
+  "other",
+]);
+export type FeedItemSourceType = z.infer<typeof FeedItemSourceTypeSchema>;
+
 /**
  * A single action button attached to a feed item.
  *
@@ -120,6 +139,13 @@ export const FeedItemSchema = z.object({
   noteworthy: z.boolean().optional(),
   fromAssistant: z.boolean().optional(),
   metadata: z.record(z.string(), z.unknown()).optional(),
+  // Source-conversation classification, enriched at read time. `sourceKey`
+  // is the stable filter id — `schedule:<id>` for schedules so each filters
+  // separately, otherwise the `sourceType`. `sourceLabel` is the display
+  // string (a schedule's name, or a static label like "Heartbeat").
+  sourceType: FeedItemSourceTypeSchema.optional(),
+  sourceKey: z.string().optional(),
+  sourceLabel: z.string().optional(),
   createdAt: z.string(),
 });
 export type FeedItem = z.infer<typeof FeedItemSchema>;

package/src/config/bundled-skills/messaging/tools/messaging-archive-by-sender.ts

@@ -1,4 +1,4 @@
-import { resolveCapabilities } from "../../../../runtime/capabilities.js";
+import { isArchiveBySenderAuthorized } from "../../../../runtime/effective-capabilities.js";
 import type {
   ToolContext,
   ToolExecutionResult,
@@ -9,15 +9,14 @@ export async function run(
   input: Record<string, unknown>,
   context: ToolContext,
 ): Promise<ToolExecutionResult> {
-  const userApproved =
-    input.user_approved === true &&
-    resolveCapabilities(context.trustClass).canSelfAuthorizeArchiveBySender;
-  if (
-    !context.triggeredBySurfaceAction &&
-    !context.batchAuthorizedByTask &&
-    !context.approvedViaPrompt &&
-    !userApproved
-  ) {
+  const authorized = isArchiveBySenderAuthorized({
+    trustClass: context.trustClass,
+    triggeredBySurfaceAction: context.triggeredBySurfaceAction,
+    batchAuthorizedByTask: context.batchAuthorizedByTask,
+    approvedViaPrompt: context.approvedViaPrompt,
+    userApproved: input.user_approved === true,
+  });
+  if (!authorized) {
     return err(
       "This tool requires either a surface action or a scheduled task run with this tool in required_tools. Present results in a selection table with action buttons and wait for the user to click before proceeding.",
     );

package/src/home/feed-source-enrichment.test.ts

@@ -0,0 +1,151 @@
+import { describe, expect, it } from "bun:test";
+
+import { type FeedItem } from "../api/responses/home.js";
+import {
+  classifyConversationSource,
+  enrichFeedItemsWithSource,
+  type FeedSourceEnrichmentDeps,
+} from "./feed-source-enrichment.js";
+
+function makeItem(partial: Partial<FeedItem> & Pick<FeedItem, "id">): FeedItem {
+  return {
+    type: "notification",
+    priority: 50,
+    summary: "summary",
+    timestamp: "2026-06-18T00:00:00.000Z",
+    createdAt: "2026-06-18T00:00:00.000Z",
+    status: "new",
+    ...partial,
+  };
+}
+
+describe("classifyConversationSource", () => {
+  it("maps each known producer source to its coarse type", () => {
+    expect(classifyConversationSource("heartbeat")).toBe("heartbeat");
+    expect(classifyConversationSource("memory-retrospective")).toBe(
+      "memory_consolidation",
+    );
+    expect(classifyConversationSource("memory-retrospective-fork")).toBe(
+      "memory_consolidation",
+    );
+    expect(classifyConversationSource("schedule")).toBe("schedule");
+    expect(classifyConversationSource("auto-analysis")).toBe("auto_analysis");
+    expect(classifyConversationSource("user")).toBe("user");
+    expect(classifyConversationSource("home-feed")).toBe("user");
+  });
+
+  it("falls through to 'other' for unknown / paired-delivery / empty sources", () => {
+    expect(classifyConversationSource("notification")).toBe("other");
+    expect(classifyConversationSource("something-else")).toBe("other");
+    expect(classifyConversationSource(null)).toBe("other");
+    expect(classifyConversationSource(undefined)).toBe("other");
+  });
+});
+
+describe("enrichFeedItemsWithSource", () => {
+  const deps = (
+    conv: Record<string, { source: string; scheduleJobId: string | null }>,
+    schedules: Record<string, string> = {},
+  ): FeedSourceEnrichmentDeps => ({
+    getConversationRow: (id) => conv[id] ?? null,
+    getScheduleName: (id) => schedules[id] ?? null,
+  });
+
+  it("classifies a heartbeat item with a static label", () => {
+    const [item] = enrichFeedItemsWithSource(
+      [makeItem({ id: "n1", conversationId: "c1" })],
+      deps({ c1: { source: "heartbeat", scheduleJobId: null } }),
+    );
+    expect(item.sourceType).toBe("heartbeat");
+    expect(item.sourceKey).toBe("heartbeat");
+    expect(item.sourceLabel).toBe("Heartbeat");
+  });
+
+  it("classifies a memory-consolidation item", () => {
+    const [item] = enrichFeedItemsWithSource(
+      [makeItem({ id: "n2", conversationId: "c2" })],
+      deps({ c2: { source: "memory-retrospective", scheduleJobId: null } }),
+    );
+    expect(item.sourceType).toBe("memory_consolidation");
+    expect(item.sourceKey).toBe("memory_consolidation");
+    expect(item.sourceLabel).toBe("Memory consolidation");
+  });
+
+  it("gives distinct keys and names to two different schedules", () => {
+    const [a, b] = enrichFeedItemsWithSource(
+      [
+        makeItem({ id: "n3", conversationId: "cA" }),
+        makeItem({ id: "n4", conversationId: "cB" }),
+      ],
+      deps(
+        {
+          cA: { source: "schedule", scheduleJobId: "sched-A" },
+          cB: { source: "schedule", scheduleJobId: "sched-B" },
+        },
+        { "sched-A": "Morning digest", "sched-B": "Evening recap" },
+      ),
+    );
+    expect(a.sourceType).toBe("schedule");
+    expect(a.sourceKey).toBe("schedule:sched-A");
+    expect(a.sourceLabel).toBe("Morning digest");
+    // scheduleId recovered from the conversation row is surfaced in metadata.
+    expect(a.metadata?.scheduleId).toBe("sched-A");
+
+    expect(b.sourceKey).toBe("schedule:sched-B");
+    expect(b.sourceLabel).toBe("Evening recap");
+  });
+
+  it("prefers an explicit metadata.scheduleId over the conversation row", () => {
+    const [item] = enrichFeedItemsWithSource(
+      [
+        makeItem({
+          id: "n5",
+          conversationId: "cX",
+          metadata: { scheduleId: "from-payload" },
+        }),
+      ],
+      deps(
+        { cX: { source: "schedule", scheduleJobId: "from-row" } },
+        { "from-payload": "Payload schedule" },
+      ),
+    );
+    expect(item.sourceKey).toBe("schedule:from-payload");
+    expect(item.sourceLabel).toBe("Payload schedule");
+  });
+
+  it("labels a schedule with no resolvable name as 'Scheduled'", () => {
+    const [item] = enrichFeedItemsWithSource(
+      [makeItem({ id: "n6", conversationId: "cY" })],
+      deps({ cY: { source: "schedule", scheduleJobId: "gone" } }),
+    );
+    expect(item.sourceKey).toBe("schedule:gone");
+    expect(item.sourceLabel).toBe("Scheduled");
+  });
+
+  it("classifies items with no source conversation as 'other'", () => {
+    const [item] = enrichFeedItemsWithSource(
+      [makeItem({ id: "n7" })],
+      deps({}),
+    );
+    expect(item.sourceType).toBe("other");
+    expect(item.sourceKey).toBe("other");
+    expect(item.sourceLabel).toBe("Other");
+  });
+
+  it("resolves each distinct conversation at most once", () => {
+    const calls: string[] = [];
+    enrichFeedItemsWithSource(
+      [
+        makeItem({ id: "n8", conversationId: "dup" }),
+        makeItem({ id: "n9", conversationId: "dup" }),
+      ],
+      {
+        getConversationRow: (id) => {
+          calls.push(id);
+          return { source: "heartbeat", scheduleJobId: null };
+        },
+      },
+    );
+    expect(calls).toEqual(["dup"]);
+  });
+});

package/src/home/feed-source-enrichment.ts

@@ -0,0 +1,176 @@
+/**
+ * Read-time enrichment of home-feed items with their source-conversation
+ * classification.
+ *
+ * The activity feed surfaces notifications produced by many background
+ * flows — the periodic heartbeat, memory-consolidation passes, each
+ * recurring schedule, auto-analysis runs, etc. Clients let the user filter
+ * the feed by that producer, so every item is tagged with:
+ *
+ *   - `sourceType`  — coarse producer category.
+ *   - `sourceKey`   — stable filter id (`schedule:<id>` per schedule,
+ *                     otherwise the `sourceType`).
+ *   - `sourceLabel` — human-readable display (a schedule's name, or a
+ *                     static label such as "Heartbeat").
+ *
+ * The classification is derived from the source conversation's `source`
+ * column (and, for schedules, its name) rather than persisted onto the
+ * feed item. Resolving at read time keeps labels fresh across schedule
+ * renames and retroactively classifies items written before this feature
+ * existed, with no migration.
+ *
+ * The lookups are injectable so the enrichment can be unit-tested without
+ * a live database; production callers use the defaults.
+ */
+
+import {
+  type FeedItem,
+  type FeedItemSourceType,
+} from "../api/responses/home.js";
+import { AUTO_ANALYSIS_SOURCE } from "../memory/auto-analysis-constants.js";
+import { getConversation } from "../memory/conversation-crud.js";
+import {
+  MEMORY_RETROSPECTIVE_FORK_SOURCE,
+  MEMORY_RETROSPECTIVE_SOURCE,
+} from "../memory/memory-retrospective-constants.js";
+import { getSchedule } from "../schedule/schedule-store.js";
+
+/** Minimal source-conversation shape the enrichment needs. */
+interface ConversationSourceRow {
+  source: string;
+  scheduleJobId: string | null;
+}
+
+export interface FeedSourceEnrichmentDeps {
+  /** Resolve the source columns for a conversation, or null when missing. */
+  getConversationRow?: (id: string) => ConversationSourceRow | null;
+  /** Resolve a schedule's display name, or null when missing. */
+  getScheduleName?: (id: string) => string | null;
+}
+
+/**
+ * Map a conversation's `source` column to a coarse feed source type.
+ * Mechanical mapping over the known producer sources; anything else
+ * (including the broadcaster's paired `"notification"` delivery
+ * conversations) falls through to `"other"`.
+ */
+export function classifyConversationSource(
+  source: string | null | undefined,
+): FeedItemSourceType {
+  switch (source) {
+    case "heartbeat":
+      return "heartbeat";
+    case MEMORY_RETROSPECTIVE_SOURCE:
+    case MEMORY_RETROSPECTIVE_FORK_SOURCE:
+      return "memory_consolidation";
+    case "schedule":
+      return "schedule";
+    case AUTO_ANALYSIS_SOURCE:
+      return "auto_analysis";
+    case "user":
+    case "home-feed":
+      return "user";
+    default:
+      return "other";
+  }
+}
+
+/** Static display labels for non-schedule source types. */
+const STATIC_SOURCE_LABELS: Record<
+  Exclude<FeedItemSourceType, "schedule">,
+  string
+> = {
+  heartbeat: "Heartbeat",
+  memory_consolidation: "Memory consolidation",
+  auto_analysis: "Auto-analysis",
+  user: "Conversation",
+  other: "Other",
+};
+
+function defaultGetConversationRow(id: string): ConversationSourceRow | null {
+  try {
+    const row = getConversation(id);
+    return row
+      ? { source: row.source, scheduleJobId: row.scheduleJobId }
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function defaultGetScheduleName(id: string): string | null {
+  try {
+    return getSchedule(id)?.name ?? null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Return a copy of each feed item enriched with `sourceType`, `sourceKey`,
+ * and `sourceLabel`. Conversation and schedule lookups are memoized across
+ * the batch so each distinct source is resolved at most once.
+ */
+export function enrichFeedItemsWithSource(
+  items: FeedItem[],
+  deps: FeedSourceEnrichmentDeps = {},
+): FeedItem[] {
+  if (items.length === 0) return items;
+
+  const getConversationRow =
+    deps.getConversationRow ?? defaultGetConversationRow;
+  const getScheduleName = deps.getScheduleName ?? defaultGetScheduleName;
+
+  const convCache = new Map<string, ConversationSourceRow | null>();
+  const resolveConv = (id: string): ConversationSourceRow | null => {
+    if (!convCache.has(id)) convCache.set(id, getConversationRow(id));
+    return convCache.get(id) ?? null;
+  };
+
+  const scheduleNameCache = new Map<string, string | null>();
+  const resolveScheduleName = (id: string): string | null => {
+    if (!scheduleNameCache.has(id)) {
+      scheduleNameCache.set(id, getScheduleName(id));
+    }
+    return scheduleNameCache.get(id) ?? null;
+  };
+
+  return items.map((item) => {
+    const row = item.conversationId ? resolveConv(item.conversationId) : null;
+    const sourceType = classifyConversationSource(row?.source);
+
+    const metadataScheduleId =
+      typeof item.metadata?.scheduleId === "string"
+        ? item.metadata.scheduleId
+        : undefined;
+    const scheduleId = metadataScheduleId ?? row?.scheduleJobId ?? undefined;
+
+    let sourceKey: string;
+    let sourceLabel: string;
+    if (sourceType === "schedule" && scheduleId) {
+      sourceKey = `schedule:${scheduleId}`;
+      sourceLabel = resolveScheduleName(scheduleId) ?? "Scheduled";
+    } else if (sourceType === "schedule") {
+      sourceKey = "schedule";
+      sourceLabel = "Scheduled";
+    } else {
+      sourceKey = sourceType;
+      sourceLabel = STATIC_SOURCE_LABELS[sourceType];
+    }
+
+    // Surface the scheduleId in metadata when it was recovered from the
+    // source conversation so clients have a single place to read it.
+    const metadata =
+      scheduleId !== undefined && metadataScheduleId === undefined
+        ? { ...(item.metadata ?? {}), scheduleId }
+        : item.metadata;
+
+    return {
+      ...item,
+      sourceType,
+      sourceKey,
+      sourceLabel,
+      ...(metadata ? { metadata } : {}),
+    };
+  });
+}

package/src/runtime/capabilities.ts

@@ -17,8 +17,10 @@
  * is the "what they may do once inside" axis.
  *
  * Context-dependent decisions (interactivity routing, self-approval races,
- * channel-specific overrides) COMPOSE these primitives with runtime context at
- * the call site — they are not encoded in the table.
+ * channel-specific overrides) COMPOSE these primitives with runtime context.
+ * They are not encoded in the table; named composition helpers live in
+ * `effective-capabilities.ts` (and `resolveRoutingState` in
+ * `trust-context-resolver.ts`).
  */
 
 import type { TrustClass } from "./actor-trust-resolver.js";
@@ -76,8 +78,9 @@ export interface CapabilitySet {
    */
   canAccessMemory: boolean;
   /**
-   * May perform privileged (non-conversation-scoped) document operations.
-   * Composed at the call site with the `vellum`-channel override.
+   * May perform privileged (non-conversation-scoped) document operations from
+   * trust class alone. The effective decision also honors privileged channels —
+   * see `canActOnPrivilegedDocuments` in `effective-capabilities.ts`.
    */
   canAccessPrivilegedDocuments: boolean;
 

package/src/runtime/effective-capabilities.test.ts

@@ -0,0 +1,128 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  canActOnPrivilegedDocuments,
+  isArchiveBySenderAuthorized,
+  isUntrustedShellLockdownActive,
+} from "./effective-capabilities.js";
+
+describe("canActOnPrivilegedDocuments", () => {
+  test("guardian is privileged regardless of channel", () => {
+    expect(canActOnPrivilegedDocuments({ trustClass: "guardian" })).toBe(true);
+    expect(
+      canActOnPrivilegedDocuments({
+        trustClass: "guardian",
+        executionChannel: "telegram",
+      }),
+    ).toBe(true);
+  });
+
+  test("non-guardian is privileged only on a privileged channel", () => {
+    expect(
+      canActOnPrivilegedDocuments({
+        trustClass: "trusted_contact",
+        executionChannel: "telegram",
+      }),
+    ).toBe(false);
+    expect(
+      canActOnPrivilegedDocuments({
+        trustClass: "trusted_contact",
+        executionChannel: "vellum",
+      }),
+    ).toBe(true);
+  });
+
+  test("the vellum channel grants access even to unknown actors", () => {
+    expect(
+      canActOnPrivilegedDocuments({
+        trustClass: "unknown",
+        executionChannel: "vellum",
+      }),
+    ).toBe(true);
+    expect(canActOnPrivilegedDocuments({ trustClass: "unknown" })).toBe(false);
+  });
+});
+
+describe("isUntrustedShellLockdownActive", () => {
+  test("inactive when the lockdown flag is off", () => {
+    expect(
+      isUntrustedShellLockdownActive({
+        trustClass: "unknown",
+        lockdownEnabled: false,
+      }),
+    ).toBe(false);
+  });
+
+  test("inactive for guardians even when the flag is on", () => {
+    expect(
+      isUntrustedShellLockdownActive({
+        trustClass: "guardian",
+        lockdownEnabled: true,
+      }),
+    ).toBe(false);
+  });
+
+  test("active for non-unsandboxed actors when the flag is on", () => {
+    expect(
+      isUntrustedShellLockdownActive({
+        trustClass: "trusted_contact",
+        lockdownEnabled: true,
+      }),
+    ).toBe(true);
+    expect(
+      isUntrustedShellLockdownActive({
+        trustClass: "unknown",
+        lockdownEnabled: true,
+      }),
+    ).toBe(true);
+  });
+});
+
+describe("isArchiveBySenderAuthorized", () => {
+  test("any non-self authorization path suffices", () => {
+    expect(
+      isArchiveBySenderAuthorized({
+        trustClass: "unknown",
+        triggeredBySurfaceAction: true,
+      }),
+    ).toBe(true);
+    expect(
+      isArchiveBySenderAuthorized({
+        trustClass: "unknown",
+        batchAuthorizedByTask: true,
+      }),
+    ).toBe(true);
+    expect(
+      isArchiveBySenderAuthorized({
+        trustClass: "unknown",
+        approvedViaPrompt: true,
+      }),
+    ).toBe(true);
+  });
+
+  test("user_approved self-authorizes only for a permitted trust class", () => {
+    expect(
+      isArchiveBySenderAuthorized({
+        trustClass: "guardian",
+        userApproved: true,
+      }),
+    ).toBe(true);
+    expect(
+      isArchiveBySenderAuthorized({
+        trustClass: "trusted_contact",
+        userApproved: true,
+      }),
+    ).toBe(false);
+  });
+
+  test("unauthorized when no path applies", () => {
+    expect(isArchiveBySenderAuthorized({ trustClass: "guardian" })).toBe(false);
+    expect(
+      isArchiveBySenderAuthorized({
+        trustClass: "trusted_contact",
+        triggeredBySurfaceAction: false,
+        userApproved: false,
+      }),
+    ).toBe(false);
+  });
+});

package/src/runtime/effective-capabilities.ts

@@ -0,0 +1,84 @@
+/**
+ * Effective capabilities — trust-class capabilities COMPOSED with runtime context.
+ *
+ * `resolveCapabilities` (`capabilities.ts`) answers "what may this trust class
+ * do" from the actor's class alone, and stays deliberately pure (no context
+ * dependencies) so it remains the single fail-closed trust boundary. Some real
+ * decisions additionally depend on runtime context — the channel a request
+ * arrived on, surface actions, task authorization, a feature flag. Those
+ * compositions belong here, in named/testable helpers, rather than re-derived
+ * inline at each call site (which scatters a single policy across the codebase).
+ *
+ * Scope: this module composes capabilities with *actor/request* context. It does
+ * not read global config or feature flags itself — callers resolve those and
+ * pass the result in (e.g. `lockdownEnabled`), keeping this layer focused on the
+ * capability composition. `resolveRoutingState` in `trust-context-resolver.ts`
+ * is the same shape (capability + guardian-route context → `promptWaitingAllowed`)
+ * and predates this module; it stays where it is.
+ */
+import type { TrustClass } from "./actor-trust-resolver.js";
+import { resolveCapabilities } from "./capabilities.js";
+
+type RawTrustClass = TrustClass | (string & {}) | undefined;
+
+/**
+ * Channels that are themselves privileged document surfaces. Actors on these get
+ * privileged document access regardless of trust class — the `vellum` first-party
+ * console is the operator's own surface, not an external contact channel.
+ */
+const PRIVILEGED_DOCUMENT_CHANNELS = new Set<string>(["vellum"]);
+
+/**
+ * Whether an actor may perform privileged (non-conversation-scoped) document
+ * operations. True when the trust class grants it OR the request arrived on a
+ * privileged channel.
+ */
+export function canActOnPrivilegedDocuments(actor: {
+  trustClass: RawTrustClass;
+  executionChannel?: string;
+}): boolean {
+  return (
+    resolveCapabilities(actor.trustClass).canAccessPrivilegedDocuments ||
+    (actor.executionChannel != null &&
+      PRIVILEGED_DOCUMENT_CHANNELS.has(actor.executionChannel))
+  );
+}
+
+/**
+ * Whether the CES shell lockdown applies to this actor. Active when the lockdown
+ * flag is enabled AND the actor's trust class cannot run an unsandboxed shell.
+ * Callers resolve the flag (`isCesShellLockdownEnabled(config)`) and pass it in.
+ */
+export function isUntrustedShellLockdownActive(actor: {
+  trustClass: RawTrustClass;
+  lockdownEnabled: boolean;
+}): boolean {
+  return (
+    actor.lockdownEnabled &&
+    !resolveCapabilities(actor.trustClass).canRunUnsandboxedShell
+  );
+}
+
+/**
+ * Whether an archive-by-sender invocation is authorized. Any one of a surface
+ * action, a task-batch authorization, or an explicit prompt approval suffices.
+ * Absent those, the actor's own `user_approved` flag only counts when its trust
+ * class may self-authorize archive-by-sender.
+ */
+export function isArchiveBySenderAuthorized(args: {
+  trustClass: RawTrustClass;
+  triggeredBySurfaceAction?: boolean;
+  batchAuthorizedByTask?: boolean;
+  approvedViaPrompt?: boolean;
+  userApproved?: boolean;
+}): boolean {
+  const selfAuthorized =
+    args.userApproved === true &&
+    resolveCapabilities(args.trustClass).canSelfAuthorizeArchiveBySender;
+  return (
+    args.triggeredBySurfaceAction === true ||
+    args.batchAuthorizedByTask === true ||
+    args.approvedViaPrompt === true ||
+    selfAuthorized
+  );
+}

package/src/runtime/routes/home-feed-routes.ts

@@ -28,6 +28,7 @@ import {
   type FeedItemStatus,
   HomeFeedResponseSchema,
 } from "../../api/responses/home.js";
+import { enrichFeedItemsWithSource } from "../../home/feed-source-enrichment.js";
 import { patchFeedItemStatus, readHomeFeed } from "../../home/feed-writer.js";
 import { revalidateHomeContentInBackground } from "../../home/home-content-refresh.js";
 import { getPersonalizedGreeting } from "../../home/home-greeting.js";
@@ -135,8 +136,10 @@ export async function handleGetHomeFeed({
   // v2 schema dropped per-item `minTimeAway` gating; surface every item
   // and let the client decide what to render based on its own
   // session state. `timeAwaySeconds` survives only to feed the
-  // context-banner relative-time label.
-  const filtered = feed.items;
+  // context-banner relative-time label. Each item is enriched with its
+  // source-conversation classification (`sourceType`/`sourceKey`/
+  // `sourceLabel`) so clients can filter the feed by what produced it.
+  const filtered = enrichFeedItemsWithSource(feed.items);
 
   const now = new Date();
 
@@ -287,7 +290,9 @@ export function handleListHomeFeed({
   const total = filtered.length;
   const offset = params.offset ?? 0;
   const limit = params.limit ?? 20;
-  const items = filtered.slice(offset, offset + limit);
+  const items = enrichFeedItemsWithSource(
+    filtered.slice(offset, offset + limit),
+  );
 
   return {
     items,

package/src/tools/document/document-tool.ts

@@ -13,14 +13,11 @@ import {
   searchDocumentsByTitle,
   updateDocumentContent,
 } from "../../documents/document-store.js";
-import { resolveCapabilities } from "../../runtime/capabilities.js";
+import { canActOnPrivilegedDocuments } from "../../runtime/effective-capabilities.js";
 import type { ToolContext, ToolExecutionResult } from "../types.js";
 
 function isPrivilegedDocumentActor(context: ToolContext): boolean {
-  return (
-    resolveCapabilities(context.trustClass).canAccessPrivilegedDocuments ||
-    context.executionChannel === "vellum"
-  );
+  return canActOnPrivilegedDocuments(context);
 }
 
 export function documentNotFound(surfaceId: string): ToolExecutionResult {

package/src/tools/executor.ts

@@ -5,7 +5,7 @@ import { bridgeCesApproval } from "../credential-execution/approval-bridge.js";
 import { isCesShellLockdownEnabled } from "../credential-execution/feature-gates.js";
 import { PermissionPrompter } from "../permissions/prompter.js";
 import { RiskLevel } from "../permissions/types.js";
-import { resolveCapabilities } from "../runtime/capabilities.js";
+import { isUntrustedShellLockdownActive } from "../runtime/effective-capabilities.js";
 import { redactSensitiveFields } from "../security/redaction.js";
 import { getCesClient } from "../security/secure-keys.js";
 import { TokenExpiredError } from "../security/token-manager.js";
@@ -128,8 +128,10 @@ export class ToolExecutor {
       // skip this assignment entirely - defeating the lockdown.
       if (
         name === "host_bash" &&
-        isCesShellLockdownEnabled(getConfig()) &&
-        !resolveCapabilities(context.trustClass).canRunUnsandboxedShell
+        isUntrustedShellLockdownActive({
+          trustClass: context.trustClass,
+          lockdownEnabled: isCesShellLockdownEnabled(getConfig()),
+        })
       ) {
         context.forcePromptSideEffects = true;
       }

package/src/tools/host-terminal/host-shell.ts

@@ -25,7 +25,7 @@ import { HostBashProxy } from "../../daemon/host-bash-proxy.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
 import { assistantEventHub } from "../../runtime/assistant-event-hub.js";
-import { resolveCapabilities } from "../../runtime/capabilities.js";
+import { isUntrustedShellLockdownActive } from "../../runtime/effective-capabilities.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import { getLogger } from "../../util/logger.js";
 import {
@@ -204,9 +204,10 @@ export const hostShellTool = {
     // NOTE: forcePromptSideEffects is set in executor.ts BEFORE the
     // permission check runs, not here. Setting it here would be too late
     // because execute() is called after permissions have already been evaluated.
-    const hostLockdownActive =
-      isCesShellLockdownEnabled(config) &&
-      !resolveCapabilities(context.trustClass).canRunUnsandboxedShell;
+    const hostLockdownActive = isUntrustedShellLockdownActive({
+      trustClass: context.trustClass,
+      lockdownEnabled: isCesShellLockdownEnabled(config),
+    });
 
     // Guard: non-host-proxy interfaces need an explicit target when multiple
     // capable clients are connected to avoid ambiguous untargeted broadcasts.

package/src/tools/terminal/shell.ts

@@ -5,7 +5,7 @@ import { getConfig } from "../../config/loader.js";
 import { isCesShellLockdownEnabled } from "../../credential-execution/feature-gates.js";
 import { RiskLevel } from "../../permissions/types.js";
 import { wakeAgentForOpportunity } from "../../runtime/agent-wake.js";
-import { resolveCapabilities } from "../../runtime/capabilities.js";
+import { isUntrustedShellLockdownActive } from "../../runtime/effective-capabilities.js";
 import { redactSecrets } from "../../security/secret-scanner.js";
 import { getLogger } from "../../util/logger.js";
 import { getDataDir } from "../../util/platform.js";
@@ -117,9 +117,10 @@ export const shellTool = {
     }
 
     const config = getConfig();
-    const shellLockdownActive =
-      isCesShellLockdownEnabled(config) &&
-      !resolveCapabilities(context.trustClass).canRunUnsandboxedShell;
+    const shellLockdownActive = isUntrustedShellLockdownActive({
+      trustClass: context.trustClass,
+      lockdownEnabled: isCesShellLockdownEnabled(config),
+    });
 
     const networkMode: "off" | "proxied" =
       input.network_mode === "proxied" ? "proxied" : "off";

package/src/util/disk-usage.ts

@@ -1,7 +1,11 @@
 import { spawnSync } from "node:child_process";
 import { existsSync, statfsSync } from "node:fs";
 
-import { getMinikubeStorageSize } from "../config/env-registry.js";
+import {
+  getIsContainerized,
+  getIsPlatform,
+  getMinikubeStorageSize,
+} from "../config/env-registry.js";
 import { getWorkspaceDir } from "./platform.js";
 
 export interface DiskUsageInfo {
@@ -58,6 +62,57 @@ export function __resetDiskUsageCacheForTests(): void {
   duCachePaths = null;
 }
 
+/**
+ * How the workspace volume's capacity should be reported when statfsSync
+ * cannot see the volume directly.
+ *
+ * - `fixed-cap`: minikube hostPath PVC — the PVC request is the hard
+ *   capacity, so usage is measured with `du` and free space is whatever
+ *   remains within the quota.
+ * - `host-free`: local Docker named volume — the volume is backed by the
+ *   host (or Colima VM) filesystem and can grow into its free space, so
+ *   usage is measured with `du` and the effective capacity is current usage
+ *   plus the host's remaining headroom.
+ * - `none`: statfsSync already reports the volume accurately (bare metal, or
+ *   a platform-managed instance on a CSI-backed PVC), so use it directly.
+ */
+type WorkspaceVolumeReporting =
+  | { kind: "none" }
+  | { kind: "fixed-cap"; totalBytes: number }
+  | { kind: "host-free" };
+
+/**
+ * Decide how to report the workspace volume's capacity. Both minikube
+ * hostPath PVCs and local Docker named volumes are backed by the host
+ * filesystem, so statfsSync reports the host's entire disk rather than the
+ * workspace volume — in both cases we measure actual usage with `du` instead.
+ */
+function classifyWorkspaceVolume(
+  fsTotalBytes: number,
+): WorkspaceVolumeReporting {
+  // Minikube mode: the platform passes the PVC storage size so we can report
+  // accurate capacity. Detect the hostPath case by comparing filesystem size
+  // against the PVC size — if the filesystem is larger, statfsSync is seeing
+  // the host disk and we should measure the directory instead.
+  const storageSizeRaw = getMinikubeStorageSize();
+  if (storageSizeRaw) {
+    const pvcTotalBytes = parseK8sMemoryBytes(storageSizeRaw);
+    if (pvcTotalBytes !== null && fsTotalBytes > pvcTotalBytes * 1.1) {
+      return { kind: "fixed-cap", totalBytes: pvcTotalBytes };
+    }
+    return { kind: "none" };
+  }
+
+  // Local Docker hatch: the workspace is a Docker named volume backed by the
+  // host filesystem. Platform-managed remote instances run on CSI-backed PVCs
+  // where statfsSync already reports the volume, so they are excluded.
+  if (getIsContainerized() && !getIsPlatform()) {
+    return { kind: "host-free" };
+  }
+
+  return { kind: "none" };
+}
+
 export function getDiskUsageInfo(): DiskUsageInfo | null {
   try {
     const wsDir = getWorkspaceDir();
@@ -68,28 +123,28 @@ export function getDiskUsageInfo(): DiskUsageInfo | null {
     const bytesToMb = (b: number) =>
       Math.round((b / (1024 * 1024)) * 100) / 100;
 
-    // Minikube mode: the platform passes the PVC storage size so we can
-    // report accurate capacity. On hostPath-backed PVCs statfsSync reports
-    // the host's entire filesystem rather than the PVC. Detect this by
-    // comparing filesystem size against PVC size — if the filesystem is
-    // larger, measure actual directory usage with `du` instead.
-    const storageSizeRaw = getMinikubeStorageSize();
-    if (storageSizeRaw) {
-      const pvcTotalBytes = parseK8sMemoryBytes(storageSizeRaw);
-      if (pvcTotalBytes !== null && fsTotalBytes > pvcTotalBytes * 1.1) {
-        const volumePaths = [diskPath];
-        if (diskPath !== "/data" && existsSync("/data")) {
-          volumePaths.push("/data");
-        }
-        const usedBytes = getCachedDirectorySizeBytes(volumePaths);
-        if (usedBytes !== null) {
-          return {
-            path: diskPath,
-            totalMb: bytesToMb(pvcTotalBytes),
-            usedMb: bytesToMb(usedBytes),
-            freeMb: bytesToMb(Math.max(0, pvcTotalBytes - usedBytes)),
-          };
-        }
+    const reporting = classifyWorkspaceVolume(fsTotalBytes);
+    if (reporting.kind !== "none") {
+      const volumePaths = [diskPath];
+      if (diskPath !== "/data" && existsSync("/data")) {
+        volumePaths.push("/data");
+      }
+      const usedBytes = getCachedDirectorySizeBytes(volumePaths);
+      if (usedBytes !== null) {
+        const totalBytes =
+          reporting.kind === "fixed-cap"
+            ? reporting.totalBytes
+            : usedBytes + fsFreeBytes;
+        const freeBytes =
+          reporting.kind === "fixed-cap"
+            ? Math.max(0, reporting.totalBytes - usedBytes)
+            : fsFreeBytes;
+        return {
+          path: diskPath,
+          totalMb: bytesToMb(totalBytes),
+          usedMb: bytesToMb(usedBytes),
+          freeMb: bytesToMb(freeBytes),
+        };
       }
     }