@vellumai/assistant 0.9.0 → 0.10.0-dev.202606192226.8ed8a6a

package/src/runtime/routes/workflow-routes.ts

@@ -5,21 +5,18 @@
  * shared ROUTES array. They are read/abort surfaces over the workflow run
  * manager and the saved-workflow library — a human (via the `vellum workflows`
  * CLI or the app) can inspect runs and abort an in-flight one.
- *
- * Every handler is gated on the `workflows` feature flag: when it is off, the
- * routes behave as if they do not exist (404), so disabling the flag fully
- * hides the surface.
  */
 
 import { z } from "zod";
 
-import { isAssistantFeatureFlagEnabled } from "../../config/assistant-feature-flags.js";
-import { getConfig } from "../../config/loader.js";
-import type { AssistantConfig } from "../../config/schema.js";
 import { getAutoApproveThreshold } from "../../permissions/gateway-threshold-reader.js";
 import { isFullAccessThreshold } from "../../permissions/threshold.js";
 import { manifestGrantsSideEffects } from "../../workflows/capabilities.js";
-import type { WorkflowRun } from "../../workflows/journal-store.js";
+import {
+  getJournal,
+  type WorkflowJournalEntry,
+  type WorkflowRun,
+} from "../../workflows/journal-store.js";
 import { listWorkflows } from "../../workflows/library.js";
 import {
   getWorkflowRunManager,
@@ -46,19 +43,16 @@ export interface WorkflowRoutesDeps {
     "list" | "status" | "abort" | "resume"
   >;
   listWorkflows: typeof listWorkflows;
-  getConfig: () => AssistantConfig;
-  isFlagEnabled: (config: AssistantConfig) => boolean;
   getAutoApproveThreshold: typeof getAutoApproveThreshold;
+  getJournal: typeof getJournal;
 }
 
 function defaultDeps(): WorkflowRoutesDeps {
   return {
     getManager: getWorkflowRunManager,
     listWorkflows,
-    getConfig,
-    isFlagEnabled: (config) =>
-      isAssistantFeatureFlagEnabled("workflows", config),
     getAutoApproveThreshold,
+    getJournal,
   };
 }
 
@@ -105,21 +99,33 @@ const savedWorkflowSchema = z.object({
   path: z.string(),
 });
 
+const workflowLeafSchema = z.object({
+  seq: z.number(),
+  kind: z.enum(["agent", "workflow"]),
+  label: z.string().optional(),
+  phase: z.string().optional(),
+  promptSummary: z.string().optional(),
+  status: z.string(),
+  resultSummary: z.string().optional(),
+  inputTokens: z.number().optional(),
+  outputTokens: z.number().optional(),
+  createdAt: z.number().nullable(),
+});
+
+const workflowJournalSchema = z.object({
+  runId: z.string(),
+  status: z.enum(VALID_RUN_STATUSES).optional(),
+  agentsSpawned: z.number().optional(),
+  inputTokens: z.number().optional(),
+  outputTokens: z.number().optional(),
+  phase: z.string().optional(),
+  leaves: z.array(workflowLeafSchema),
+});
+
 // ---------------------------------------------------------------------------
 // Handlers (transport-agnostic)
 // ---------------------------------------------------------------------------
 
-/**
- * Throw a 404 when the `workflows` flag is off, hiding the whole surface. The
- * NotFoundError (rather than a 403) keeps a disabled-flag indistinguishable
- * from a route that does not exist.
- */
-function assertFlagEnabled(): void {
-  if (!deps.isFlagEnabled(deps.getConfig())) {
-    throw new NotFoundError("Workflows are not enabled.");
-  }
-}
-
 /**
  * The single compact-run wire contract, inferred from {@link workflowRunSchema}.
  * The HTTP routes return this shape; other producers (e.g. the CLI's client-side
@@ -145,6 +151,64 @@ export function toWireRun(run: WorkflowRun): WorkflowRunWire {
   };
 }
 
+/**
+ * Render an arbitrary journal value (prompt, result, `{ error }`) into a short
+ * single-string preview, truncating to `max` characters. Objects are
+ * JSON-stringified so a structured result still produces a readable summary.
+ */
+function summarize(value: unknown, max = 200): string | undefined {
+  if (value === undefined || value === null) return undefined;
+  let text: string;
+  if (typeof value === "string") {
+    text = value;
+  } else {
+    try {
+      text = JSON.stringify(value);
+    } catch {
+      return undefined;
+    }
+  }
+  return text.length > max ? `${text.slice(0, max)}…` : text;
+}
+
+/**
+ * Project a journal entry into the bounded leaf wire shape, dropping the bulky
+ * raw `request`/`result` payloads in favor of short summaries. The `request`
+ * and `result` columns are `unknown`, so read their fields defensively.
+ */
+export function toWireLeaf(
+  entry: WorkflowJournalEntry,
+): z.infer<typeof workflowLeafSchema> {
+  const request =
+    entry.request && typeof entry.request === "object"
+      ? (entry.request as Record<string, unknown>)
+      : undefined;
+  const opts =
+    request?.opts && typeof request.opts === "object"
+      ? (request.opts as Record<string, unknown>)
+      : undefined;
+  const label = typeof opts?.label === "string" ? opts.label : undefined;
+  const phase = typeof opts?.phase === "string" ? opts.phase : undefined;
+  const promptSummary = summarize(request?.prompt);
+  const resultSummary = summarize(entry.result);
+  return {
+    seq: entry.seq,
+    kind: entry.kind,
+    ...(label !== undefined ? { label } : {}),
+    ...(phase !== undefined ? { phase } : {}),
+    ...(promptSummary !== undefined ? { promptSummary } : {}),
+    status: entry.status,
+    ...(resultSummary !== undefined ? { resultSummary } : {}),
+    ...(entry.inputTokens !== undefined
+      ? { inputTokens: entry.inputTokens }
+      : {}),
+    ...(entry.outputTokens !== undefined
+      ? { outputTokens: entry.outputTokens }
+      : {}),
+    createdAt: entry.createdAt,
+  };
+}
+
 function parseLimit(raw: string | undefined): number | undefined {
   if (raw === undefined) return undefined;
   const n = Number(raw);
@@ -162,7 +226,6 @@ function parseStatus(
 }
 
 function handleListRuns(queryParams: Record<string, string>) {
-  assertFlagEnabled();
   const limit = parseLimit(queryParams.limit);
   const status = parseStatus(queryParams.status);
   const runs = deps.getManager().list({
@@ -173,7 +236,6 @@ function handleListRuns(queryParams: Record<string, string>) {
 }
 
 function handleGetRun(id: string) {
-  assertFlagEnabled();
   const run = deps.getManager().status(id);
   if (!run) {
     throw new NotFoundError(`Workflow run ${id} not found`);
@@ -181,8 +243,29 @@ function handleGetRun(id: string) {
   return toWireRun(run);
 }
 
+function handleGetRunJournal(id: string) {
+  const run = deps.getManager().status(id);
+  if (!run) {
+    throw new NotFoundError(`Workflow run ${id} not found`);
+  }
+  return {
+    runId: run.id,
+    status: run.status,
+    agentsSpawned: run.agentsSpawned,
+    inputTokens: run.inputTokens,
+    outputTokens: run.outputTokens,
+    // Only agent leaves; the live `workflow_leaf_*` stream is emitted solely for
+    // agent leaves (nested workflow resolutions never reach it), so the
+    // backfilled set must match. `kind: "workflow"` entries carry no label and
+    // would render as phantom unlabeled nodes.
+    leaves: deps
+      .getJournal(id)
+      .filter((entry) => entry.kind === "agent")
+      .map(toWireLeaf),
+  };
+}
+
 function handleAbortRun(id: string) {
-  assertFlagEnabled();
   // status() is the source of truth for existence; abort() itself is a no-op
   // for unknown/finished runs, so 404 on an unknown id is surfaced here.
   const manager = deps.getManager();
@@ -194,7 +277,6 @@ function handleAbortRun(id: string) {
 }
 
 async function handleResumeRun(id: string) {
-  assertFlagEnabled();
   const manager = deps.getManager();
   // status() is the source of truth for existence, so 404 an unknown id here
   // (matching abort) rather than letting resume's "not_found" reach the client
@@ -245,7 +327,6 @@ async function handleResumeRun(id: string) {
 }
 
 function handleListSavedWorkflows() {
-  assertFlagEnabled();
   return { workflows: deps.listWorkflows() };
 }
 
@@ -299,6 +380,27 @@ export const ROUTES: RouteDefinition[] = [
     additionalResponses: { "404": { description: "Run not found" } },
     handler: ({ pathParams }: RouteHandlerArgs) => handleGetRun(pathParams!.id),
   },
+  {
+    operationId: "getWorkflowRunJournal",
+    endpoint: "workflows/runs/:id/journal",
+    method: "GET",
+    // Unlike the run list/status routes (settings metadata), the journal returns
+    // per-leaf prompt/result summaries — conversation/work-product content — so it
+    // requires `chat.read`, matching the subagent-detail route (the analogous
+    // content surface), not the `settings.read` used by the management routes.
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Get workflow run journal",
+    description:
+      "Return a workflow run's leaf journal as bounded per-leaf summaries (one entry per finished leaf).",
+    tags: ["workflows"],
+    responseBody: workflowJournalSchema,
+    additionalResponses: { "404": { description: "Run not found" } },
+    handler: ({ pathParams }: RouteHandlerArgs) =>
+      handleGetRunJournal(pathParams!.id),
+  },
   {
     operationId: "abortWorkflowRun",
     endpoint: "workflows/runs/:id/abort",

package/src/runtime/routes/workspace-greetings.ts

@@ -0,0 +1,55 @@
+import { existsSync, readFileSync } from "node:fs";
+
+import { getWorkspacePromptPath } from "../../util/platform.js";
+
+function readWorkspaceFile(name: string): string {
+  try {
+    const path = getWorkspacePromptPath(name);
+    if (!existsSync(path)) return "";
+    return readFileSync(path, "utf-8");
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Parse the `## Greetings` section from SOUL.md. Returns bullet items as an
+ * array of strings, or `null` if the section is missing or empty.
+ */
+export function parseGreetingsSection(content: string): string[] | null {
+  let inSection = false;
+  let sectionLevel: number | null = null;
+  const greetings: string[] = [];
+
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    const heading = /^(#{1,6})\s+(.+?)\s*#*$/.exec(trimmed);
+    if (heading) {
+      const level = heading[1]!.length;
+      const title = heading[2]!.trim();
+      if (inSection) {
+        if (sectionLevel !== null && level <= sectionLevel) break;
+        continue;
+      }
+      if (level === 2 && /^greetings$/i.test(title)) {
+        inSection = true;
+        sectionLevel = level;
+      }
+      continue;
+    }
+    if (!inSection) continue;
+    const bullet = /^(?:[-*+]\s+|\d+[.)]\s+)(.+)$/.exec(trimmed);
+    const greeting = bullet?.[1]?.trim();
+    if (greeting) {
+      greetings.push(greeting);
+    }
+  }
+
+  return greetings.length > 0 ? greetings : null;
+}
+
+export function readWorkspaceGreetings(): string[] | null {
+  const soulContent = readWorkspaceFile("SOUL.md");
+  if (!soulContent) return null;
+  return parseGreetingsSection(soulContent);
+}

package/src/runtime/sync/resource-sync-events.ts

@@ -29,17 +29,7 @@ export function publishIdentityChanged(
     emoji: fields.emoji,
     home: fields.home,
   });
-  void publishSyncInvalidation(
-    [SYNC_TAGS.assistantIdentity, SYNC_TAGS.assistantIdentityIntro],
-    originClientId,
-  );
-}
-
-export function publishIdentityIntroChanged(originClientId?: string): void {
-  void publishSyncInvalidation(
-    [SYNC_TAGS.assistantIdentityIntro],
-    originClientId,
-  );
+  void publishSyncInvalidation([SYNC_TAGS.assistantIdentity], originClientId);
 }
 
 export function publishConfigChanged(originClientId?: string): void {

package/src/runtime/tool-grant-request-helper.ts

@@ -13,12 +13,14 @@
 
 import type { ChannelId } from "../channels/types.js";
 import {
-  createCanonicalGuardianDelivery,
   createCanonicalGuardianRequest,
   listCanonicalGuardianRequests,
 } from "../memory/canonical-guardian-store.js";
+import {
+  recordApprovalCardDelivery,
+  recordGuardianRequestDeliveries,
+} from "../notifications/canonical-delivery-recorder.js";
 import { emitNotificationSignal } from "../notifications/emit-signal.js";
-import type { NotificationSourceChannel } from "../notifications/signal.js";
 import { getLogger } from "../util/logger.js";
 import { getGuardianBinding } from "./channel-verification-service.js";
 import { GUARDIAN_APPROVAL_TTL_MS } from "./routes/channel-route-shared.js";
@@ -140,12 +142,16 @@ export function createOrReuseToolGrantRequest(
     canonicalRequest.requestCode ??
     canonicalRequest.id.slice(0, 6).toUpperCase();
 
+  // The vellum delivery row is created up front in onConversationCreated so the
+  // in-app client sees it immediately; the post-resolve recorder reuses it.
+  let vellumDeliveryId: string | undefined;
+
   // Emit notification so guardian is alerted. Uses 'guardian.question' as
   // sourceEventName so that existing request-code guidance in the notification
   // pipeline is preserved.
   const signalPromise = emitNotificationSignal({
     sourceEventName: "guardian.question",
-    sourceChannel: sourceChannel as NotificationSourceChannel,
+    sourceChannel,
     sourceContextId: conversationId,
     requiresConversation: true,
     attentionHints: {
@@ -167,25 +173,21 @@ export function createOrReuseToolGrantRequest(
     },
     dedupeKey: `tool-grant-request:${canonicalRequest.id}`,
     onConversationCreated: (info) => {
-      createCanonicalGuardianDelivery({
+      vellumDeliveryId = recordApprovalCardDelivery({
         requestId: canonicalRequest.id,
-        destinationChannel: "vellum",
-        destinationConversationId: info.conversationId,
-      });
+        channel: "vellum",
+        conversationId: info.conversationId,
+      })?.id;
     },
   });
 
   // Record deliveries from the notification pipeline results (fire-and-forget).
   void signalPromise.then((signalResult) => {
-    for (const result of signalResult.deliveryResults) {
-      if (result.channel === "vellum") continue; // handled in onConversationCreated
-      createCanonicalGuardianDelivery({
-        requestId: canonicalRequest.id,
-        destinationChannel: result.channel,
-        destinationChatId:
-          result.destination.length > 0 ? result.destination : undefined,
-      });
-    }
+    recordGuardianRequestDeliveries({
+      requestId: canonicalRequest.id,
+      deliveryResults: signalResult.deliveryResults,
+      vellumDeliveryId,
+    });
   });
 
   log.info(

package/src/runtime/trust-context-resolver.ts

@@ -16,6 +16,7 @@ import {
   type ResolveActorTrustInput,
   toTrustContext,
 } from "./actor-trust-resolver.js";
+import { resolveCapabilities } from "./capabilities.js";
 
 /**
  * Resolve route-level trust context from canonical identity state.
@@ -64,14 +65,15 @@ export interface RoutingState {
  * Compute the routing state for a channel actor turn.
  *
  * Guardian actors are always interactive (they self-approve).
- * Trusted contacts are only interactive when a guardian binding exists
- * to receive approval notifications. Unknown actors are never interactive.
+ * Trusted and unverified contacts are only interactive when a guardian
+ * binding exists to receive approval notifications. Unknown actors are
+ * never interactive.
  */
 export function resolveRoutingState(
   ctx: Pick<TrustContext, "trustClass" | "guardianExternalUserId">,
 ): RoutingState {
+  const caps = resolveCapabilities(ctx.trustClass);
   const isGuardian = ctx.trustClass === "guardian";
-  const isTrustedContact = ctx.trustClass === "trusted_contact";
 
   // Guardians self-approve — they are always interactive and route-resolvable.
   if (isGuardian) {
@@ -82,12 +84,13 @@ export function resolveRoutingState(
     };
   }
 
-  // Trusted contacts can be interactive only if a guardian destination
+  // Identity-known non-guardian contacts (trusted_contact /
+  // unverified_contact) can be interactive only if a guardian destination
   // exists. The guardian binding populates guardianExternalUserId during
   // trust resolution; its presence means there is a verified guardian
   // to route approval notifications to.
   const guardianRouteResolvable = !!ctx.guardianExternalUserId;
-  if (isTrustedContact) {
+  if (caps.mayBeInteractive) {
     return {
       canBeInteractive: true,
       guardianRouteResolvable,

package/src/schedule/inference-profile.ts

@@ -1,4 +1,4 @@
-import { getConfigReadOnly } from "../config/loader.js";
+import { validateInferenceProfileKey } from "../config/inference-profile-validation.js";
 
 /**
  * Validate a schedule's inference-profile key against the configured
@@ -12,17 +12,5 @@ import { getConfigReadOnly } from "../config/loader.js";
 export function validateScheduleInferenceProfile(
   profile: string,
 ): string | null {
-  if (!profile.trim()) {
-    return "inferenceProfile must be a non-empty string";
-  }
-  const profiles = getConfigReadOnly().llm?.profiles ?? {};
-  if (!Object.prototype.hasOwnProperty.call(profiles, profile)) {
-    const available = Object.keys(profiles).sort();
-    const hint =
-      available.length > 0
-        ? ` Available profiles: ${available.join(", ")}.`
-        : " No profiles defined in llm.profiles.";
-    return `Inference profile "${profile}" is not defined in llm.profiles.${hint}`;
-  }
-  return null;
+  return validateInferenceProfileKey(profile);
 }

package/src/schedule/schedule-store.ts

@@ -158,7 +158,7 @@ export function createSchedule(params: {
   const routingIntent = params.routingIntent ?? "all_channels";
   const routingHints = params.routingHints ?? {};
   const quiet = params.quiet ?? false;
-  const reuseConversation = params.reuseConversation ?? !isOneShot;
+  const reuseConversation = params.reuseConversation ?? false;
   const maxRetries = params.maxRetries ?? 3;
   const retryBackoffMs = params.retryBackoffMs ?? 60000;
   const timeoutMs = params.timeoutMs ?? null;

package/src/schedule/scheduler-types.ts

@@ -7,7 +7,11 @@
 import type { LLMCallSite } from "../config/schemas/llm.js";
 
 export interface ScheduleMessageOptions {
-  trustClass?: "guardian" | "trusted_contact" | "unknown";
+  trustClass?:
+    | "guardian"
+    | "trusted_contact"
+    | "unverified_contact"
+    | "unknown";
   taskRunId?: string;
   /**
    * Optional LLM call-site identifier propagated to the per-call provider

package/src/security/__tests__/provider-key-env-fallback.test.ts

@@ -53,6 +53,7 @@ describe("getProviderKeyAsync env-var fallback (regression #27126)", () => {
     "BRAVE_API_KEY",
     "PERPLEXITY_API_KEY",
     "TAVILY_API_KEY",
+    "FIRECRAWL_API_KEY",
     "ANTHROPIC_API_KEY",
     "OPENAI_API_KEY",
   ];
@@ -103,6 +104,11 @@ describe("getProviderKeyAsync env-var fallback (regression #27126)", () => {
     expect(await getProviderKeyAsync("tavily")).toBe("tavily-env-test");
   });
 
+  test("returns FIRECRAWL_API_KEY from process.env when secure store is empty", async () => {
+    process.env.FIRECRAWL_API_KEY = "fc-env-test";
+    expect(await getProviderKeyAsync("firecrawl")).toBe("fc-env-test");
+  });
+
   test("returns ANTHROPIC_API_KEY from process.env when secure store is empty (LLM regression)", async () => {
     process.env.ANTHROPIC_API_KEY = "anthropic-env-test";
     expect(await getProviderKeyAsync("anthropic")).toBe("anthropic-env-test");

package/src/security/secret-patterns.ts

@@ -133,4 +133,7 @@ export const PREFIX_PATTERNS: SecretPrefixPattern[] = [
 
   // -- Tavily --
   { label: "Tavily API Key", regex: /tvly-[A-Za-z0-9]{20,}/ },
+
+  // -- Firecrawl --
+  { label: "Firecrawl API Key", regex: /fc-[A-Za-z0-9]{20,}/ },
 ];

package/src/subagent/manager.ts

@@ -237,10 +237,17 @@ export class SubagentManager {
         config.systemPromptOverride ??
         buildSubagentSystemPrompt({ ...config, id: subagentId }, role);
     }
-    const maxTokens = resolveCallSiteConfig(
-      "subagentSpawn",
-      appConfig.llm,
-    ).maxTokens;
+    // Resolve under the same profile the run will use (forwarded via
+    // `SubagentConfig`) so the constructed conversation's default token cap
+    // matches the inherited profile rather than the static `subagentSpawn`
+    // default. Per-call routing re-resolves the model anyway; this keeps the
+    // initial value consistent.
+    const maxTokens = resolveCallSiteConfig("subagentSpawn", appConfig.llm, {
+      ...(config.overrideProfile
+        ? { overrideProfile: config.overrideProfile }
+        : {}),
+      ...(config.forceOverrideProfile ? { forceOverrideProfile: true } : {}),
+    }).maxTokens;
     const workingDir = getSandboxWorkingDir();
 
     // ── Initialise state ────────────────────────────────────────────
@@ -453,6 +460,9 @@ export class SubagentManager {
         ...(managed.state.config.overrideProfile
           ? { overrideProfile: managed.state.config.overrideProfile }
           : {}),
+        ...(managed.state.config.forceOverrideProfile
+          ? { forceOverrideProfile: true }
+          : {}),
       });
 
       // Agent loop completed successfully.
@@ -641,6 +651,9 @@ export class SubagentManager {
           ...(managed.state.config.overrideProfile
             ? { overrideProfile: managed.state.config.overrideProfile }
             : {}),
+          ...(managed.state.config.forceOverrideProfile
+            ? { forceOverrideProfile: true }
+            : {}),
         })
         .catch((err) => {
           log.error({ subagentId, err }, "Subagent message processing failed");

package/src/subagent/types.ts

@@ -69,6 +69,12 @@ export interface SubagentConfig {
    * profile, every spawned subagent inherits it automatically.
    */
   overrideProfile?: string;
+  /**
+   * When true, the subagent's `overrideProfile` is an explicit spawn-time
+   * request and must float above call-site layers. Inherited parent profiles
+   * leave this unset so existing call-site precedence stays intact.
+   */
+  forceOverrideProfile?: boolean;
   /**
    * Tool-use id of the `skill_execute` call that spawned this subagent.
    * Forwarded into the `subagent_spawned` event so the client can anchor the

package/src/telemetry/trace-collection-policy.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  isDiagnosticsConsentVersionEligible,
+  TRACE_COLLECTION_MIN_DIAGNOSTICS_CONSENT_VERSION,
+} from "./trace-collection-policy.js";
+
+describe("isDiagnosticsConsentVersionEligible", () => {
+  test("the threshold version itself is eligible (>=, inclusive boundary)", () => {
+    expect(
+      isDiagnosticsConsentVersionEligible(
+        TRACE_COLLECTION_MIN_DIAGNOSTICS_CONSENT_VERSION,
+      ),
+    ).toBe(true);
+  });
+
+  test("a later version is eligible", () => {
+    expect(isDiagnosticsConsentVersionEligible("2999-01-01")).toBe(true);
+  });
+
+  test("an earlier version fails closed", () => {
+    expect(isDiagnosticsConsentVersionEligible("2000-01-01")).toBe(false);
+  });
+
+  test("the empty version (never accepted / unversioned default) fails closed", () => {
+    expect(isDiagnosticsConsentVersionEligible("")).toBe(false);
+  });
+});

package/src/telemetry/trace-collection-policy.ts

@@ -0,0 +1,30 @@
+/**
+ * Per-turn trace-collection disclosure gate (daemon side).
+ *
+ * A "trace" is the full transcript of one assistant turn. Traces are only
+ * collected from owners who accepted the diagnostics-sharing consent copy that
+ * *discloses* trace collection — identified by its accepted version.
+ *
+ * This mirrors the platform's authoritative ingest gate in
+ * `vellum-assistant-platform`:
+ *   - `django/app/core/trace_collection.py` (`is_trace_collection_enabled`)
+ *   - `config.settings.TRACE_COLLECTION_MIN_DIAGNOSTICS_CONSENT_VERSION`
+ *
+ * The daemon applies the same `share_diagnostics_accepted_version >= threshold`
+ * check the platform does, so traces for ineligible owners never leave the
+ * device. (The platform would drop them anyway, but checking here keeps the PII
+ * local — data minimization.)
+ *
+ * Keep this constant in lockstep with the platform setting. Versions are
+ * "YYYY-MM-DD" strings, so the lexicographic compare is chronological; ""
+ * (never accepted) and older versions fail closed.
+ */
+export const TRACE_COLLECTION_MIN_DIAGNOSTICS_CONSENT_VERSION = "2026-06-18";
+
+/**
+ * True iff `version` (the owner's `share_diagnostics_accepted_version`) is at or
+ * past the disclosing version. Fails closed for "" / older versions.
+ */
+export function isDiagnosticsConsentVersionEligible(version: string): boolean {
+  return version >= TRACE_COLLECTION_MIN_DIAGNOSTICS_CONSENT_VERSION;
+}