@vellumai/assistant 0.9.0 → 0.10.0-dev.202606192226.8ed8a6a

package/src/daemon/conversation-process.ts

@@ -28,7 +28,10 @@ import {
 import { extractPreferences } from "../notifications/preference-extractor.js";
 import { createPreference } from "../notifications/preferences-store.js";
 import type { ContextWindowResult } from "../plugins/defaults/compaction/window-manager.js";
-import { routeGuardianReply } from "../runtime/guardian-reply-router.js";
+import {
+  type GuardianPendingScope,
+  routeGuardianReply,
+} from "../runtime/guardian-reply-router.js";
 import { publishConversationMessagesChanged } from "../runtime/sync/resource-sync-events.js";
 import { getLogger } from "../util/logger.js";
 import type { CleanResult, Conversation } from "./conversation.js";
@@ -153,7 +156,7 @@ function resolveQueuedTurnInterfaceContext(
 }
 
 /** Build a SlashContext from the current conversation state and config. */
-function buildSlashContext(
+export function buildSlashContext(
   content: string,
   conversation: Conversation,
 ): SlashContext | undefined {
@@ -1407,9 +1410,14 @@ export async function processMessage(
           "vellum",
         ).map((request) => request.id)
       : [];
-  const canonicalPendingRequestIdsForConversation =
+  // Empty hints → leave the scope unset (identity-fallback): the desktop
+  // guardian can still resolve their pending work by identity/principal.
+  const pendingScope: GuardianPendingScope | undefined =
     canonicalPendingRequestHintIdsForConversation.length > 0
-      ? canonicalPendingRequestHintIdsForConversation
+      ? {
+          mode: "scoped",
+          requestIds: canonicalPendingRequestHintIdsForConversation,
+        }
       : undefined;
 
   // ── Canonical guardian reply router (desktop/conversation path) ──
@@ -1428,7 +1436,7 @@ export async function processMessage(
           conversation.trustContext?.guardianPrincipalId ?? undefined,
       },
       conversationId: conversation.conversationId,
-      pendingRequestIds: canonicalPendingRequestIdsForConversation,
+      pendingScope,
       // Desktop path: disable NL classification to avoid consuming non-decision
       // messages while a tool confirmation is pending. Deterministic code-prefix
       // and callback parsing remain active.

package/src/daemon/conversation-runtime-assembly.ts

@@ -9,9 +9,9 @@ import { statSync } from "node:fs";
 import { join } from "node:path";
 
 import { type ChannelId, parseInterfaceId } from "../channels/types.js";
-import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
 import { resolveCallSiteConfig } from "../config/llm-resolver.js";
 import { getConfig } from "../config/loader.js";
+import { isMemoryV3Live } from "../config/memory-v3-gate.js";
 import type { LLMCallSite, LLMConfig } from "../config/schemas/llm.js";
 import {
   NOW_SCRATCHPAD_STRIP_PREFIXES,
@@ -62,11 +62,11 @@ import type {
 import type { ContentBlock, Message } from "../providers/types.js";
 import {
   type ActorTrustContext,
-  isUntrustedTrustClass,
   resolveActorTrust,
   type TrustClass,
 } from "../runtime/actor-trust-resolver.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
+import { resolveCapabilities } from "../runtime/capabilities.js";
 import { channelStatusToMemberStatus } from "../runtime/routes/inbound-stages/acl-enforcement.js";
 import { getSubagentManager } from "../subagent/index.js";
 import type { SubagentState } from "../subagent/types.js";
@@ -125,8 +125,8 @@ export interface InboundActorContext {
   actorSenderDisplayName?: string;
   /** Guardian-managed display name from the contact record. */
   actorMemberDisplayName?: string;
-  /** Trust classification: guardian, trusted_contact, or unknown. */
-  trustClass: "guardian" | "trusted_contact" | "unknown";
+  /** Trust classification: see TrustClass. */
+  trustClass: TrustClass;
   /** Guardian identity for this (assistant, channel) binding. */
   guardianIdentity?: string;
   /** Member status when the actor has a contact record. */
@@ -916,7 +916,7 @@ function filterSlackConversationRowsForActor(
   rows: MessageRow[],
   trustClass: TrustClass | undefined,
 ): MessageRow[] {
-  if (!isUntrustedTrustClass(trustClass)) return rows;
+  if (resolveCapabilities(trustClass).canAccessMemory) return rows;
   const nonSlackVisibleRows = filterMessagesForUntrustedActor(rows);
   const nonSlackVisibleIds = new Set(nonSlackVisibleRows.map((row) => row.id));
   return rows.filter((row) => {
@@ -1009,6 +1009,7 @@ function rowToRenderable(row: SlackTranscriptInputRow): RenderableSlackMessage {
       if (
         outer.provenanceTrustClass === "guardian" ||
         outer.provenanceTrustClass === "trusted_contact" ||
+        outer.provenanceTrustClass === "unverified_contact" ||
         outer.provenanceTrustClass === "unknown"
       ) {
         provenanceTrustClass = outer.provenanceTrustClass;
@@ -1322,9 +1323,9 @@ export function loadSlackChronologicalContext(
     options,
   );
   return assembleSlackChronologicalContext(rows, capabilities, {
-    contextSummary: isUntrustedTrustClass(options.trustClass)
-      ? null
-      : options.contextSummary,
+    contextSummary: resolveCapabilities(options.trustClass).canAccessMemory
+      ? options.contextSummary
+      : null,
   });
 }
 
@@ -1536,8 +1537,8 @@ export interface RuntimeInjectionBlocks {
    */
   memoryV3InjectedBlock?: string;
   /**
-   * True when memory-v3 superseded v2 as this turn's `<memory>` source — the
-   * `memory-v3-live` flag is on AND the v3 injector produced a block (possibly
+   * True when memory-v3 superseded v2 as this turn's `<memory>` source —
+   * `memory.v3.live` is on AND the v3 injector produced a block (possibly
    * empty-text on an all-repeat turn), i.e. exactly when assembly stripped
    * v2's fresh tail block. The user-prompt-submit hook keys v2's
    * `memoryInjectedBlock` metadata persist off this so a stripped v2 block is
@@ -2177,7 +2178,7 @@ export async function applyRuntimeInjections(
   // no-op, keeping the v2 path bit-for-bit identical.
   let runMessagesForAssembly = stripSpotlightInjections(runMessages);
 
-  // v2 suppression: when the `memory-v3-live` flag is on AND the v3 injector
+  // v2 suppression: when `memory.v3.live` is on AND the v3 injector
   // produced a block this turn (possibly empty-text on an all-repeat turn), v3
   // owns the `<memory>` layer. v2's `prepareMemory` already prepended its own
   // fresh `<memory>` block to the tail user message — strip the TAIL's v2
@@ -2196,10 +2197,7 @@ export async function applyRuntimeInjections(
   // (`produce()` → null) leaves v2's block intact — fallback rather than a
   // memory-less turn. Idempotent: re-injection sites that already stripped
   // see no change. Flag off → bit-for-bit identical to the v2 path.
-  const suppressV2MemoryForV3 = isAssistantFeatureFlagEnabled(
-    "memory-v3-live",
-    getConfig(),
-  );
+  const suppressV2MemoryForV3 = isMemoryV3Live(getConfig());
   const v3ProducedBlock = afterMemory.some((b) => b.id === MEMORY_V3_BLOCK_ID);
   const memoryV3Active = suppressV2MemoryForV3 && v3ProducedBlock;
   if (memoryV3Active) {

package/src/daemon/conversation-slash.ts

@@ -7,6 +7,7 @@ import {
   loadRawConfig,
   saveRawConfig,
 } from "../config/loader.js";
+import { orderProfileKeys } from "../config/profile-order.js";
 import { getConversationOverrideProfile } from "../memory/conversation-crud.js";
 import { getConfiguredProviders } from "../providers/provider-availability.js";
 import { getVisibleProviderCatalog } from "../providers/provider-catalog-visibility.js";
@@ -130,28 +131,6 @@ function parseModelCommand(trimmed: string): ModelCommandParse | null {
   return { kind: "switch", profileName: rest };
 }
 
-function orderedProfileNames(
-  profiles: Record<
-    string,
-    { label?: string; description?: string; status?: "active" | "disabled" }
-  >,
-  profileOrder: readonly string[] | undefined,
-): string[] {
-  const order = profileOrder ?? [];
-  const seen = new Set<string>();
-  const ordered: string[] = [];
-  for (const name of order) {
-    if (profiles[name] != null && !seen.has(name)) {
-      ordered.push(name);
-      seen.add(name);
-    }
-  }
-  const tail = Object.keys(profiles)
-    .filter((n) => !seen.has(n))
-    .sort();
-  return [...ordered, ...tail];
-}
-
 async function resolveModelCommand(
   parse: ModelCommandParse,
 ): Promise<SlashResolution> {
@@ -160,7 +139,7 @@ async function resolveModelCommand(
     string,
     { label?: string; description?: string; status?: "active" | "disabled" }
   >;
-  const profileNames = orderedProfileNames(profiles, config.llm.profileOrder);
+  const profileNames = orderProfileKeys(profiles, config.llm.profileOrder);
   const activeProfile = config.llm.activeProfile;
 
   if (parse.kind === "list") {

package/src/daemon/conversation-surfaces.ts

@@ -291,6 +291,32 @@ export function markSurfaceCompleted(
   }
 }
 
+/**
+ * Complete a `ui_surface` card and notify live clients, addressed only by
+ * conversation + surface id.
+ *
+ * Unlike {@link completeSurfaceFromAction}, this needs no live `Conversation`
+ * instance, so it can run from flows that don't own one — projecting a
+ * terminal guardian-request status onto its in-app approval card when the
+ * request was resolved on another surface (or by the expiry sweep). Persists
+ * the completion (reload-safe) and broadcasts `ui_surface_complete` so every
+ * connected client of this guardian converges. No-ops when the surface block
+ * isn't found in the conversation.
+ */
+export function completeSurfaceAndNotify(
+  conversationId: string,
+  surfaceId: string,
+  summary: string,
+): void {
+  markSurfaceCompleted({ conversationId }, surfaceId, summary);
+  broadcastMessage({
+    type: "ui_surface_complete",
+    conversationId,
+    surfaceId,
+    summary,
+  });
+}
+
 /**
  * Remove a `ui_surface` content block from history so a passively dismissed
  * surface does not survive a reload. The live client drops a dismissed surface

package/src/daemon/conversation-tool-setup.ts

@@ -17,16 +17,21 @@ import type { LLMCallSite } from "../config/schemas/llm.js";
 import { getBindingByConversation } from "../memory/external-conversation-store.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
+import { advisorEnabledForProfile } from "../plugins/defaults/advisor/advisor-gate.js";
 import type { Message, ToolDefinition } from "../providers/types.js";
 import { assistantEventHub } from "../runtime/assistant-event-hub.js";
 import { registerConversationSender } from "../tools/browser/browser-screencast.js";
 import type { ToolExecutor } from "../tools/executor.js";
-import { getMcpToolDefinitions } from "../tools/registry.js";
+import { getMcpToolDefinitions, getTool } from "../tools/registry.js";
 import {
   ACTIVITY_SKIP_SET,
   injectActivityField,
 } from "../tools/schema-transforms.js";
-import { resolveSkillExecuteInput } from "../tools/skills/execute.js";
+import {
+  augmentSkillExecuteError,
+  recoverSkillExecuteEnvelope,
+  resolveSkillExecuteInput,
+} from "../tools/skills/execute.js";
 import { resolveToolInvocationAlias } from "../tools/tool-name-aliases.js";
 import {
   isDiskPressureCleanupToolName,
@@ -52,7 +57,7 @@ import {
 } from "./doordash-steps.js";
 import type { ServerMessage, UiSurfaceShow } from "./message-protocol.js";
 import { runPostExecutionSideEffects } from "./tool-side-effects.js";
-import { resolveTrustClass } from "./trust-context.js";
+import { FALLBACK_TURN_TRUST, resolveTrustClass } from "./trust-context.js";
 
 const log = getLogger("conversation-tool-setup");
 
@@ -88,8 +93,10 @@ export type {
  * agent's). The conversation id is threaded as the mix selection seed so
  * mix-profile arms match what the dispatch path actually ran.
  *
- * Returns `null` on any failure: attribution is telemetry-only and must
- * never break tool execution (or skill loads, which reuse this helper).
+ * Returns `null` on any failure: attribution must never break tool execution
+ * (or skill loads, which reuse this helper). Consumers read it best-effort —
+ * usage telemetry, and `subagent_spawn`, which inherits the resolved
+ * `appliedProfile` so a child defaults to the invoking turn's profile.
  */
 export function resolveConversationAttribution(
   ctx: Pick<
@@ -178,28 +185,32 @@ export function createToolExecutor(
       markDoordashStepInProgress(ctx, executionInput);
     }
 
-    // Build the context object shared by both the skill_execute interception
-    // path and the regular executor path.
+    // Per-turn trust snapshot: prefer the snapshot captured at turn start so
+    // a concurrent owner meta command (/status, /clean) that mutates the live
+    // trustContext cannot elevate the in-flight turn to guardian.
+    const turnTrust =
+      ctx.currentTurnTrustContext ?? ctx.trustContext ?? FALLBACK_TURN_TRUST;
+
     const toolContext: ToolContext = {
       workingDir: ctx.workingDir,
       conversationId: ctx.conversationId,
       assistantId: ctx.assistantId,
       requestId: ctx.currentRequestId,
       taskRunId: ctx.taskRunId,
-      trustClass: resolveTrustClass(ctx.trustContext),
-      executionChannel: ctx.trustContext?.sourceChannel,
-      sourceActorPrincipalId: ctx.trustContext?.guardianPrincipalId,
+      trustClass: resolveTrustClass(turnTrust),
+      executionChannel: turnTrust.sourceChannel,
+      sourceActorPrincipalId: turnTrust.guardianPrincipalId,
       callSessionId: ctx.callSessionId,
       triggeredBySurfaceAction:
         ctx.surfaceActionRequestIds?.has(ctx.currentRequestId ?? "") ?? false,
       approvedViaPrompt: ctx.approvedViaPromptThisTurn || undefined,
       batchAuthorizedByTask: false,
-      requesterExternalUserId: ctx.trustContext?.requesterExternalUserId,
-      requesterChatId: ctx.trustContext?.requesterChatId,
-      requesterIdentifier: ctx.trustContext?.requesterIdentifier,
-      requesterDisplayName: ctx.trustContext?.requesterDisplayName,
+      requesterExternalUserId: turnTrust.requesterExternalUserId,
+      requesterChatId: turnTrust.requesterChatId,
+      requesterIdentifier: turnTrust.requesterIdentifier,
+      requesterDisplayName: turnTrust.requesterDisplayName,
       channelPermissionChannelId:
-        ctx.trustContext?.sourceChannel === "slack"
+        turnTrust.sourceChannel === "slack"
           ? getBindingByConversation(ctx.conversationId)?.externalChatId
           : undefined,
       onOutput,
@@ -211,6 +222,7 @@ export function createToolExecutor(
       isPlatformHosted: getIsPlatform(),
       transportInterface: ctx.transportInterface,
       overrideProfile: ctx.currentTurnOverrideProfile,
+      invokingCallSite: ctx.currentCallSite ?? "mainAgent",
       attribution: resolveConversationAttribution(ctx),
       onToolLifecycleEvent: handleToolLifecycleEvent,
       sendToClient: (msg) => {
@@ -295,9 +307,16 @@ export function createToolExecutor(
     // risk level, permission checks, hooks, and lifecycle events all fire
     // with the real tool name.
     if (executionName === "skill_execute") {
+      // Recover an envelope the provider wrapped as unparseable when MiniMax's
+      // coercion failed to JSON-decode a bare-string `input` (see
+      // recoverSkillExecuteEnvelope), then resolve the inner tool + params.
+      const envelope = recoverSkillExecuteEnvelope(executionInput);
       const rawToolName =
-        typeof executionInput.tool === "string" ? executionInput.tool : "";
-      const rawToolInput = resolveSkillExecuteInput(executionInput);
+        typeof envelope.tool === "string" ? envelope.tool : "";
+      const innerSchema = rawToolName
+        ? getTool(rawToolName)?.input_schema
+        : undefined;
+      const rawToolInput = resolveSkillExecuteInput(envelope, innerSchema);
 
       // Clone to avoid mutating shared input objects
       const { name: toolName, input: toolInput } = resolveToolInvocationAlias(
@@ -320,7 +339,12 @@ export function createToolExecutor(
       const innerRejection = rejectNonAllowlistedTool(toolName);
       if (innerRejection) return innerRejection;
 
-      const result = await executor.execute(toolName, toolInput, toolContext);
+      const rawResult = await executor.execute(
+        toolName,
+        toolInput,
+        toolContext,
+      );
+      const result = augmentSkillExecuteError(toolName, toolInput, rawResult);
       if (toolContext.approvedViaPrompt) {
         ctx.approvedViaPromptThisTurn = true;
       }
@@ -371,7 +395,7 @@ export function createProxyApprovalCallback(
  * history or explicit preactivation. Without this, their tools are
  * unavailable in fresh conversations until `skill_load` is called.
  */
-const DEFAULT_PREACTIVATED_SKILL_IDS = ["tasks", "notifications", "subagent"];
+const DEFAULT_PREACTIVATED_SKILL_IDS = ["notifications", "subagent"];
 
 /**
  * Subset of Conversation state that the resolveTools callback reads at each
@@ -576,6 +600,16 @@ export function isToolActiveForContext(
       return true;
     }
   }
+  if (name === "advisor") {
+    // Gated per chat-profile (`ProfileEntry.advisorEnabled`): when the resolved
+    // profile disables the advisor, omit the tool from the wire list so the
+    // model never sees a tool it can only no-op on. Resolves the profile the
+    // same way the advisor's execution-time guard does (the per-turn override,
+    // else the active profile). The wire list is fixed before PRE_MODEL_CALL
+    // hooks run, so a hook that re-routes the profile mid-turn (the model-router
+    // lever on `PreModelCallContext.modelProfile`) is not reflected here.
+    return advisorEnabledForProfile(ctx.currentTurnOverrideProfile ?? null);
+  }
   if (UI_SURFACE_TOOL_NAMES.has(name)) {
     if (
       channelCapabilities?.channel === "slack" &&

package/src/daemon/conversation.ts

@@ -80,12 +80,10 @@ import {
 } from "../prompts/system-prompt.js";
 import type { ContentBlock, Message } from "../providers/types.js";
 import type { Provider } from "../providers/types.js";
-import {
-  isUntrustedTrustClass,
-  type TrustClass,
-} from "../runtime/actor-trust-resolver.js";
+import { type TrustClass } from "../runtime/actor-trust-resolver.js";
 import { broadcastMessage } from "../runtime/assistant-event-hub.js";
 import type { AuthContext } from "../runtime/auth/types.js";
+import { resolveCapabilities } from "../runtime/capabilities.js";
 import type { InteractiveUiResult } from "../runtime/interactive-ui.js";
 import { publishSyncInvalidation } from "../runtime/sync/sync-publisher.js";
 import {
@@ -107,7 +105,7 @@ import {
   runAgentLoopImpl,
 } from "./conversation-agent-loop.js";
 import type { HistoryConversationContext } from "./conversation-history.js";
-import { undo as undoImpl } from "./conversation-history.js";
+import { isToolResultBlock, undo as undoImpl } from "./conversation-history.js";
 import {
   abortConversation,
   disposeConversation,
@@ -175,6 +173,36 @@ import { TraceEmitter } from "./trace-emitter.js";
 
 const log = getLogger("conversation");
 
+/**
+ * Whether a persisted message starts a new conversation turn. A turn is
+ * delimited by a "real" user message; a user message whose content is entirely
+ * tool_result blocks is a continuation within the current turn, and assistant
+ * messages never start one. Mirrors the turn-boundary definition used by
+ * `getAssistantMessageIdsInTurn`/`getTurnTimeBounds` and the agent loop's
+ * per-turn `turnCount++`, so counting these reconstructs `turnCount` on load.
+ */
+function startsNewTurn(role: string, content: string): boolean {
+  if (role !== "user") return false;
+  try {
+    const parsed = JSON.parse(content);
+    if (
+      Array.isArray(parsed) &&
+      parsed.length > 0 &&
+      parsed.every(
+        (block: unknown) =>
+          block != null &&
+          typeof block === "object" &&
+          isToolResultBlock(block as Record<string, unknown>),
+      )
+    ) {
+      return false;
+    }
+  } catch {
+    // Non-JSON content is a plain user message — a turn boundary.
+  }
+  return true;
+}
+
 export interface CleanResult {
   previousEstimatedInputTokens: number;
   estimatedInputTokens: number;
@@ -366,6 +394,13 @@ export class Conversation {
     workspaceDir: string,
   ) => Pick<WorkspaceGitService, "ensureInitialized">;
   /** @internal */ commitTurnChanges?: typeof commitTurnChanges;
+  /**
+   * Abort-watchdog timeout (ms) for the agent loop's bounded-unwind backstop.
+   * Overridable in tests to fire the watchdog quickly; defaults to the
+   * production constant in the agent loop when unset.
+   * @internal
+   */
+  abortWatchdogMs?: number;
   /**
    * The conversation's immutable creation type (`interactive`, `background`,
    * `scheduled`, …) as stored on the DB row. Cached on load (and set directly
@@ -824,10 +859,25 @@ export class Conversation {
 
   async loadFromDb(): Promise<void> {
     const trustClass = this.trustContext?.trustClass;
+    const canAccessMemory = resolveCapabilities(trustClass).canAccessMemory;
     const allDbMessages = getMessages(this.conversationId);
-    const dbMessages = isUntrustedTrustClass(trustClass)
-      ? filterMessagesForUntrustedActor(allDbMessages)
-      : allDbMessages;
+    const dbMessages = canAccessMemory
+      ? allDbMessages
+      : filterMessagesForUntrustedActor(allDbMessages);
+
+    // Rehydrate the in-memory turn counter from persisted history. `turnCount`
+    // is otherwise a fresh-zero field, so a reloaded conversation (eviction,
+    // restart, fork) would restart its turn numbering at 0 and the next turn
+    // would reuse `turnIndex` 0 — colliding with the conversation's first turn.
+    // The memory-v3 selector memoizes per (conversationId, turnIndex) for the
+    // life of the daemon process, so a collided turnIndex serves a stale
+    // selection and skips retrieval. One turn per real (turn-starting) user
+    // message, matching the agent loop's per-turn `turnCount++`. Counted from
+    // the full unsliced history so it survives compaction and is independent of
+    // the viewer's trust class.
+    this.turnCount = allDbMessages.filter((m) =>
+      startsNewTurn(m.role, m.content),
+    ).length;
 
     const conv = getConversation(this.conversationId);
     this.conversationType = conv?.conversationType ?? undefined;
@@ -855,12 +905,12 @@ export class Conversation {
     // than exist. Slack chronological context is a separate consumer that
     // applies its own trust filtering downstream, so it reads the raw
     // mirrored count rather than this in-context boundary.
-    const inContextCompactedCount = isUntrustedTrustClass(trustClass)
-      ? 0
-      : Math.min(this.contextCompactedMessageCount, dbMessages.length);
-    const contextSummaryForHistory = isUntrustedTrustClass(trustClass)
-      ? null
-      : this.contextSummary?.trim() || null;
+    const inContextCompactedCount = canAccessMemory
+      ? Math.min(this.contextCompactedMessageCount, dbMessages.length)
+      : 0;
+    const contextSummaryForHistory = canAccessMemory
+      ? this.contextSummary?.trim() || null
+      : null;
 
     // Every injection-strip event (`/clean` or compaction) updates
     // `historyStrippedAt`. Messages older than this should skip metadata
@@ -1556,8 +1606,65 @@ export class Conversation {
     }
   }
 
+  /**
+   * Token count for `messages` used to render the user-facing `/compact` and
+   * `/clean` figures. Prefers the provider's real `count_tokens` tokenizer (so
+   * the numbers match the context-window indicator's provider-reported usage)
+   * and falls back to the context-window manager's local estimate when the
+   * provider has no count endpoint or the count call fails — both measure the
+   * same system-prompt + tools composition the manager sizes against.
+   *
+   * The count is a network round-trip with its own rate limit, so this is for
+   * user-initiated actions only, never the per-turn auto-compaction gate.
+   */
+  private async calculateTokens(messages: Message[]): Promise<number> {
+    const countInputTokens = this.provider.countInputTokens;
+    if (!countInputTokens) {
+      return this.contextWindowManager.estimateInputTokens(messages);
+    }
+    try {
+      const { systemPrompt, tools } =
+        this.contextWindowManager.tokenCountInputs;
+      return await countInputTokens.call(
+        this.provider,
+        messages,
+        systemPrompt,
+        tools,
+      );
+    } catch (err) {
+      log.warn(
+        { err, conversationId: this.conversationId },
+        "Provider token count failed — falling back to local estimate",
+      );
+      return this.contextWindowManager.estimateInputTokens(messages);
+    }
+  }
+
   async forceCompact(): Promise<ContextWindowResult> {
-    return this.runCompaction(true);
+    // Report the user-facing before/after using the provider's real tokenizer
+    // (count_tokens) so the `/compact` line matches the context-window
+    // indicator, which reflects the provider's actual reported usage — rather
+    // than the local chars/4 estimate the compaction pipeline runs internally
+    // (it under-counts by ~25% on typical histories). `calculateTokens`
+    // falls back to that estimate when the provider has no count endpoint or
+    // the count call fails, so behavior degrades gracefully.
+    //
+    // Only the *displayed* numbers are overridden — the compaction log and
+    // circuit-breaker accounting inside `runCompaction` keep the estimate-based
+    // figures, leaving calibration and historical logs untouched.
+    const before = await this.calculateTokens(this.messages);
+    const result = await this.runCompaction(true);
+    // `runCompaction` applies the compacted history to `this.messages` in
+    // place, so after a successful compaction this re-counts the new history;
+    // a no-op leaves the context unchanged, so before === after.
+    const after = result.compacted
+      ? await this.calculateTokens(this.messages)
+      : before;
+    return {
+      ...result,
+      previousEstimatedInputTokens: before,
+      estimatedInputTokens: after,
+    };
   }
 
   /**
@@ -1676,15 +1783,17 @@ export class Conversation {
    * activations are no longer deduped against the prior session.
    */
   async forceClean(): Promise<CleanResult> {
-    const previousEstimatedInputTokens =
-      this.contextWindowManager.estimateInputTokens(this.messages);
+    // Use the provider's real tokenizer for the displayed before/after (see
+    // `forceCompact` for why); falls back to the local estimate when count
+    // isn't available.
+    const previousEstimatedInputTokens = await this.calculateTokens(
+      this.messages,
+    );
     const stripped = stripInjectionsForCompaction(this.messages);
     this.messages = stripped;
     await this.graphMemory.onCompacted(0);
     setConversationHistoryStrippedAt(this.conversationId, Date.now());
-    const estimatedInputTokens = this.contextWindowManager.estimateInputTokens(
-      this.messages,
-    );
+    const estimatedInputTokens = await this.calculateTokens(this.messages);
     return {
       previousEstimatedInputTokens,
       estimatedInputTokens,
@@ -1847,6 +1956,8 @@ export class Conversation {
        * this value via {@link SubagentManager.spawn}.
        */
       overrideProfile?: string;
+      /** Float `overrideProfile` above call-site layers for this run. */
+      forceOverrideProfile?: boolean;
     },
   ): Promise<void> {
     const { onEvent, ...rest } = options ?? {};

package/src/daemon/disk-pressure-policy.ts

@@ -1,5 +1,6 @@
 import type { InterfaceId } from "../channels/types.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
+import { resolveCapabilities } from "../runtime/capabilities.js";
 import type { DiskPressureStatus } from "./disk-pressure-guard.js";
 import type { ConversationType } from "./message-types/shared.js";
 import type { TrustContext } from "./trust-context.js";
@@ -74,11 +75,11 @@ export function classifyDiskPressureTurnPolicy(
   }
 
   const trustClass = metadata.trustContext?.trustClass;
-  if (trustClass === "guardian") {
+  if (resolveCapabilities(trustClass).canActUnderDiskPressureCleanup) {
     return { action: "allow-cleanup-mode", reason: "guardian" };
   }
 
-  if (trustClass === "trusted_contact") {
+  if (trustClass === "trusted_contact" || trustClass === "unverified_contact") {
     return { action: "block", reason: "trusted-contact" };
   }
 
@@ -156,6 +157,7 @@ function isExplicitLocalOwnerCleanupTurn(
   }
   return (
     metadata.trustContext == null ||
-    metadata.trustContext.trustClass === "guardian"
+    resolveCapabilities(metadata.trustContext.trustClass)
+      .canActUnderDiskPressureCleanup
   );
 }

package/src/daemon/handlers/__tests__/config-a2a-complete.test.ts

@@ -121,7 +121,6 @@ describe("completeA2AInvite", () => {
     const invite = findById(created.inviteId!);
     const contact = getContact(invite!.contactId);
     expect(contact!.channels[0]!.address).toBe("upper-case-id-123");
-    expect(contact!.channels[0]!.externalUserId).toBe("UPPER-Case-ID-123");
   });
 
   test("assistantContactMetadata has correct assistantId and gatewayUrl", () => {

package/src/daemon/handlers/__tests__/config-a2a-redeem.test.ts

@@ -120,7 +120,6 @@ describe("redeemA2AInvite", () => {
 
     const contact = getContact(result.contactId!);
     expect(contact!.channels[0]!.address).toBe("upper-case-sender-id");
-    expect(contact!.channels[0]!.externalUserId).toBe("UPPER-Case-SENDER-ID");
   });
 
   test("does not make outbound fetch calls", () => {

package/src/daemon/handlers/config-a2a.ts

@@ -221,7 +221,6 @@ export function completeA2AInvite(params: {
       {
         type: "a2a",
         address: params.acceptor.assistantId.toLowerCase(),
-        externalUserId: params.acceptor.assistantId,
         status: "active",
         policy: "allow",
       },
@@ -289,7 +288,6 @@ export function redeemA2AInvite(params: {
       {
         type: "a2a",
         address: params.sender.assistantId.toLowerCase(),
-        externalUserId: params.sender.assistantId,
         status: "active",
         policy: "allow",
       },