@vellumai/assistant 0.9.0 → 0.10.0-staging.2

package/src/__tests__/compactor-image-manifest-trust.test.ts

@@ -41,7 +41,11 @@ function resetTables(): void {
 
 async function addImageMessage(
   conversationId: string,
-  provenanceTrustClass: "guardian" | "trusted_contact" | "unknown",
+  provenanceTrustClass:
+    | "guardian"
+    | "trusted_contact"
+    | "unverified_contact"
+    | "unknown",
   filename: string,
 ): Promise<void> {
   const inserted = await addMessage(
@@ -109,4 +113,20 @@ describe("collectImageManifest trust filtering", () => {
     expect(filenames).toContain("contact.png");
     expect(filenames).not.toContain("guardian-secret.png");
   });
+
+  test("unverified_contact actor manifest excludes guardian images but keeps unverified-provenance images", async () => {
+    // GIVEN a conversation with a guardian image and an unverified-contact image
+    const conv = createConversation();
+    await addImageMessage(conv.id, "guardian", "guardian-secret.png");
+    await addImageMessage(conv.id, "unverified_contact", "unverified.png");
+
+    // WHEN the manifest is built for an unverified_contact actor
+    const manifest = collectImageManifest(conv.id, "unverified_contact");
+
+    // THEN the unverified-provenance image is listed and the guardian image
+    // is excluded — unverified_contact is treated as untrusted downstream.
+    const filenames = manifest.map((e) => e.filename);
+    expect(filenames).toContain("unverified.png");
+    expect(filenames).not.toContain("guardian-secret.png");
+  });
 });

package/src/__tests__/compactor-summary-call-truncation.test.ts

@@ -0,0 +1,223 @@
+/**
+ * The compaction summary call bounds its own input to the context window.
+ *
+ * With no tool pair to anchor an emergency split, an overflow recovery routes
+ * the full conversation straight into `runAssistantDrivenCompaction`. If that
+ * history exceeds the window, the summary call must front-truncate its own
+ * request or it overflows in turn and recovery stalls. Below the window the
+ * request is sent untouched so its prefix stays byte-aligned with the agent's
+ * warm cache (the budget-path cache reuse must not regress).
+ */
+import { describe, expect, mock, test } from "bun:test";
+
+function makeLoggerStub(): Record<string, unknown> {
+  const stub: Record<string, unknown> = {};
+  for (const m of [
+    "info",
+    "warn",
+    "error",
+    "debug",
+    "trace",
+    "fatal",
+    "silent",
+    "child",
+  ]) {
+    stub[m] = m === "child" ? () => makeLoggerStub() : () => {};
+  }
+  return stub;
+}
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () => makeLoggerStub(),
+}));
+
+mock.module("../memory/conversation-crud.js", () => ({
+  getMessages: () => [],
+}));
+
+mock.module("../memory/attachments-store.js", () => ({
+  getAttachmentMetadataForMessage: () => [],
+  getAttachmentContent: () => null,
+}));
+
+mock.module("../memory/llm-request-log-store.js", () => ({
+  recordRequestLog: () => {},
+}));
+
+import { runAssistantDrivenCompaction } from "../context/compactor.js";
+import { estimatePromptTokens } from "../context/token-estimator.js";
+import type { Message, Provider } from "../providers/types.js";
+
+const TRUNCATION_MARKER = "summary covers only the visible portion";
+
+function turnTimestamp(turn: number): string {
+  const hour = String(10 + Math.floor(turn / 60)).padStart(2, "0");
+  const minute = String(turn % 60).padStart(2, "0");
+  return `2026-05-21 (Thursday) ${hour}:${minute}:00 -05:00 (America/Chicago)`;
+}
+
+function userTurn(turn: number, body: string): Message {
+  return {
+    role: "user",
+    content: [
+      {
+        type: "text",
+        text: `<turn_context>\ncurrent_time: ${turnTimestamp(
+          turn,
+        )}\n</turn_context>\n[U${turn}] ${body}`,
+      },
+    ],
+  };
+}
+
+function assistantTurn(turn: number, body: string): Message {
+  return {
+    role: "assistant",
+    content: [{ type: "text", text: `[A${turn}] ${body}` }],
+  };
+}
+
+const SUMMARY = "Earlier turns summarized in the assistant's own voice.";
+
+function compactionResponse(tailTurn: number, preview: string): string {
+  return `<compaction_result>
+<summary>
+${SUMMARY}
+</summary>
+<key_state>
+- Nothing critical pending.
+</key_state>
+<tail_start timestamp="${turnTimestamp(tailTurn)}" preview="${preview}" />
+</compaction_result>`;
+}
+
+function makeCapturingProvider(response: string): {
+  provider: Provider;
+  lastRequest: () => Message[] | null;
+} {
+  let captured: Message[] | null = null;
+  const provider: Provider = {
+    name: "mock-provider",
+    sendMessage: async (messages: Message[]) => {
+      captured = messages;
+      return {
+        content: [{ type: "text", text: response }],
+        model: "mock-model",
+        usage: { inputTokens: 100, outputTokens: 50 },
+        stopReason: "end_turn",
+      };
+    },
+  };
+  return { provider, lastRequest: () => captured };
+}
+
+function estimate(messages: Message[]): number {
+  return estimatePromptTokens(messages, "system", {
+    providerName: "mock-provider",
+  });
+}
+
+describe("runAssistantDrivenCompaction — summary call self-truncation", () => {
+  test("front-truncates the outbound request when the full history exceeds the context window", async () => {
+    // GIVEN a tool-pair-free history whose estimate exceeds the window, so an
+    // overflow recovery would route it straight into the summary call.
+    const messages: Message[] = [];
+    for (let i = 0; i < 40; i++) {
+      messages.push(
+        userTurn(
+          i,
+          "Heavy user turn body that carries real weight. ".repeat(8),
+        ),
+      );
+      messages.push(
+        assistantTurn(
+          i,
+          "Heavy assistant reply that also carries weight. ".repeat(8),
+        ),
+      );
+    }
+
+    const maxInputTokens = 10_000;
+    // Budget mirrors compactor.compactionPrefixBudget: window minus the
+    // instruction reserve (800) and the 15% output reserve.
+    const prefixBudget =
+      maxInputTokens - 800 - Math.floor(maxInputTokens * 0.15);
+    expect(estimate(messages)).toBeGreaterThan(prefixBudget);
+
+    const { provider, lastRequest } = makeCapturingProvider(
+      compactionResponse(38, "Heavy user turn body"),
+    );
+
+    // WHEN the summary call runs against that oversized history.
+    const result = await runAssistantDrivenCompaction({
+      conversationId: "conv-test",
+      messages,
+      provider,
+      systemPrompt: "system",
+      compaction: { enabled: true, autoThreshold: 0.7 },
+      maxInputTokens,
+      force: true,
+      previousEstimatedInputTokens: 90_000,
+    });
+
+    expect(result.compacted).toBe(true);
+
+    // THEN the request actually sent fits within the context window.
+    const sent = lastRequest();
+    expect(sent).not.toBeNull();
+    expect(estimate(sent ?? [])).toBeLessThan(maxInputTokens);
+
+    // AND it opens with a marker noting the dropped leading messages so the
+    // model knows the summary covers only the visible portion.
+    const firstBlock = sent?.[0]?.content[0];
+    const firstText = firstBlock && "text" in firstBlock ? firstBlock.text : "";
+    expect(firstText).toContain(TRUNCATION_MARKER);
+  });
+
+  test("sends the full history untouched when it already fits below the budget", async () => {
+    // GIVEN a small history whose estimate is well under the window — the
+    // common budget-triggered compaction.
+    const messages: Message[] = [];
+    for (let i = 0; i < 8; i++) {
+      messages.push(userTurn(i, "short user turn body"));
+      messages.push(assistantTurn(i, "short assistant reply body"));
+    }
+
+    const maxInputTokens = 200_000;
+    const prefixBudget =
+      maxInputTokens - 800 - Math.floor(maxInputTokens * 0.15);
+    expect(estimate(messages)).toBeLessThan(prefixBudget);
+
+    const { provider, lastRequest } = makeCapturingProvider(
+      compactionResponse(6, "short user turn body"),
+    );
+
+    // WHEN the summary call runs against the below-budget history.
+    const result = await runAssistantDrivenCompaction({
+      conversationId: "conv-test",
+      messages,
+      provider,
+      systemPrompt: "system",
+      compaction: { enabled: true, autoThreshold: 0.7 },
+      maxInputTokens,
+      force: true,
+      previousEstimatedInputTokens: 90_000,
+    });
+
+    expect(result.compacted).toBe(true);
+
+    // THEN no truncation marker is prepended and the request carries every
+    // history message plus the single instruction, with the leading message
+    // byte-identical to the original — keeping the prefix cache warm.
+    const sent = lastRequest();
+    expect(sent).not.toBeNull();
+    expect(sent?.length).toBe(messages.length + 1);
+    const firstBlock = sent?.[0]?.content[0];
+    const firstText = firstBlock && "text" in firstBlock ? firstBlock.text : "";
+    expect(firstText).not.toContain(TRUNCATION_MARKER);
+    const originalFirst = messages[0]?.content[0];
+    expect(firstText).toBe(
+      originalFirst && "text" in originalFirst ? originalFirst.text : "",
+    );
+  });
+});

package/src/__tests__/config-loader-backfill.test.ts

@@ -75,7 +75,12 @@ import {
   loadConfig,
   mergeDefaultWorkspaceConfig,
 } from "../config/loader.js";
-import { seedInferenceProfiles } from "../config/seed-inference-profiles.js";
+import {
+  MANAGED_PROFILE_NAMES,
+  materializeProfile,
+  OS_BETA_PROFILE_TEMPLATE,
+  seedInferenceProfiles,
+} from "../config/seed-inference-profiles.js";
 import type { DrizzleDb } from "../memory/db-connection.js";
 import { migrateCreateProviderConnections } from "../memory/migrations/243-provider-connections.js";
 import { migrateProviderConnectionStatusLabel } from "../memory/migrations/244-provider-connection-status-label.js";
@@ -417,6 +422,24 @@ describe("loadConfig startup behavior", () => {
     expect(raw.memory?.jobs?.workerConcurrency).toBe(4);
   });
 
+  test("strips daemon.reapOrphanedSubprocesses from existing user configs", () => {
+    // `daemon.reapOrphanedSubprocesses` is a deprecated opt-in flag: the
+    // orphan-subprocess reaper runs by default whenever the daemon is PID 1 on
+    // Linux. Existing configs that have it written to disk should load cleanly
+    // with the field silently stripped.
+    writeConfig({
+      provider: "anthropic",
+      daemon: { reapOrphanedSubprocesses: true, standaloneRecording: false },
+    });
+
+    loadConfig();
+
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    expect(raw.daemon?.reapOrphanedSubprocesses).toBeUndefined();
+    // Sibling fields under daemon are preserved
+    expect(raw.daemon?.standaloneRecording).toBe(false);
+  });
+
   test("still writes a default config on first launch when file is absent", () => {
     // Discoverability: when no config.json exists, write one populated with
     // all schema defaults so users can see and edit available options.
@@ -462,9 +485,11 @@ describe("loadConfig startup behavior", () => {
       "anthropic-personal",
     );
     // Managed profiles exist as well.
-    expect(config.llm.profiles.balanced?.model).toBe("claude-sonnet-4-6");
+    expect(config.llm.profiles.balanced?.model).toBe(
+      "accounts/fireworks/models/minimax-m3",
+    );
     expect(config.llm.profiles.balanced?.provider_connection).toBe(
-      "anthropic-managed",
+      "fireworks-managed",
     );
 
     const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
@@ -473,7 +498,9 @@ describe("loadConfig startup behavior", () => {
       model: "claude-opus-4-7",
     });
     expect(raw.llm.activeProfile).toBe("custom-balanced");
-    expect(raw.llm.profiles.balanced.model).toBe("claude-sonnet-4-6");
+    expect(raw.llm.profiles.balanced.model).toBe(
+      "accounts/fireworks/models/minimax-m3",
+    );
   });
 
   test("on-platform hatch seeds only managed profiles", () => {
@@ -501,9 +528,11 @@ describe("loadConfig startup behavior", () => {
     const config = loadConfig();
 
     expect(config.llm.activeProfile).toBe("balanced");
-    expect(config.llm.profiles.balanced?.model).toBe("claude-sonnet-4-6");
+    expect(config.llm.profiles.balanced?.model).toBe(
+      "accounts/fireworks/models/minimax-m3",
+    );
     expect(config.llm.profiles.balanced?.provider_connection).toBe(
-      "anthropic-managed",
+      "fireworks-managed",
     );
     // No user profiles created on platform.
     expect(config.llm.profiles["custom-balanced"]).toBeUndefined();
@@ -545,10 +574,10 @@ describe("loadConfig startup behavior", () => {
     expect(raw.llm.profiles["custom-balanced"].provider_connection).toBe(
       "anthropic-personal",
     );
-    // Managed balanced profile is seeded for anthropic-managed.
-    expect(raw.llm.profiles.balanced.provider).toBe("anthropic");
+    // Managed balanced profile is seeded for fireworks-managed (MiniMax M3).
+    expect(raw.llm.profiles.balanced.provider).toBe("fireworks");
     expect(raw.llm.profiles.balanced.provider_connection).toBe(
-      "anthropic-managed",
+      "fireworks-managed",
     );
   });
 
@@ -582,9 +611,9 @@ describe("loadConfig startup behavior", () => {
     const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
     // On-platform: no user profiles created, active resets to managed balanced.
     expect(raw.llm.activeProfile).toBe("balanced");
-    expect(raw.llm.profiles.balanced.provider).toBe("anthropic");
+    expect(raw.llm.profiles.balanced.provider).toBe("fireworks");
     expect(raw.llm.profiles.balanced.provider_connection).toBe(
-      "anthropic-managed",
+      "fireworks-managed",
     );
     // The old custom-balanced is preserved on disk but no longer active.
     expect(raw.llm.profiles["custom-balanced"].provider).toBe("openai");
@@ -636,10 +665,10 @@ describe("loadConfig startup behavior", () => {
       "gpt-5.4-nano",
     );
 
-    // Managed profiles are also seeded (balanced uses Anthropic).
-    expect(raw.llm.profiles.balanced.provider).toBe("anthropic");
+    // Managed profiles are also seeded (balanced uses Fireworks/MiniMax M3).
+    expect(raw.llm.profiles.balanced.provider).toBe("fireworks");
     expect(raw.llm.profiles.balanced.provider_connection).toBe(
-      "anthropic-managed",
+      "fireworks-managed",
     );
     expect(raw.llm.profiles.balanced.source).toBe("managed");
     expect(raw.llm.profiles["quality-optimized"].provider).toBe("anthropic");
@@ -667,13 +696,84 @@ describe("loadConfig startup behavior", () => {
     mergeDefaultConfigAndSeedInferenceProfiles();
     const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
 
-    expect(raw.llm.profiles.balanced.model).toBe("claude-sonnet-4-6");
+    expect(raw.llm.profiles.balanced.model).toBe(
+      "accounts/fireworks/models/minimax-m3",
+    );
+    expect(raw.llm.profiles.balanced.provider_connection).toBe(
+      "fireworks-managed",
+    );
+    expect(raw.llm.activeProfile).toBe("balanced");
+  });
+
+  test("on-platform managed profiles reconcile to the code template on every boot", () => {
+    // Headline behavior: on-platform installs now reconcile managed profile
+    // content from the code template on every boot (same as off-platform), so
+    // model/config updates ship in a release without a workspace migration.
+    process.env.IS_PLATFORM = "true";
+
+    writeConfig({
+      llm: {
+        profiles: {
+          balanced: {
+            source: "managed",
+            provider: "anthropic",
+            model: "old-model-from-previous-release",
+            maxTokens: 1,
+            provider_connection: "anthropic-managed",
+          },
+        },
+        activeProfile: "balanced",
+      },
+    });
+
+    // Non-hatch boot (no overlay). Content is refreshed from the template.
+    mergeDefaultConfigAndSeedInferenceProfiles();
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+
+    expect(raw.llm.profiles.balanced.model).toBe(
+      "accounts/fireworks/models/minimax-m3",
+    );
+    expect(raw.llm.profiles.balanced.maxTokens).toBe(32000);
+    expect(raw.llm.profiles.balanced.topP).toBe(0.95);
     expect(raw.llm.profiles.balanced.provider_connection).toBe(
-      "anthropic-managed",
+      "fireworks-managed",
     );
     expect(raw.llm.activeProfile).toBe("balanced");
   });
 
+  test("on-platform reseed preserves user-edited label and status on managed profiles", () => {
+    // The only two fields a user may override on a managed profile — label and
+    // status — survive the on-platform reconcile, exactly as off-platform.
+    process.env.IS_PLATFORM = "true";
+
+    writeConfig({
+      llm: {
+        profiles: {
+          balanced: {
+            source: "managed",
+            provider: "anthropic",
+            model: "old-model-from-previous-release",
+            provider_connection: "anthropic-managed",
+            label: "My Default",
+            status: "disabled",
+          },
+        },
+        activeProfile: "balanced",
+      },
+    });
+
+    mergeDefaultConfigAndSeedInferenceProfiles();
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+
+    // Content refreshes from the template...
+    expect(raw.llm.profiles.balanced.model).toBe(
+      "accounts/fireworks/models/minimax-m3",
+    );
+    // ...but the user's label and status overrides are preserved.
+    expect(raw.llm.profiles.balanced.label).toBe("My Default");
+    expect(raw.llm.profiles.balanced.status).toBe("disabled");
+  });
+
   test("off-platform reseed preserves user-edited label on managed profiles (Codex P1 on PR #30362)", () => {
     // Simulate a user who renamed the managed "balanced" profile via
     // PUT /v1/config/llm/profiles/balanced { label: "My Default" }.
@@ -696,7 +796,9 @@ describe("loadConfig startup behavior", () => {
     const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
 
     // Model still gets the new template value (provider-controlled).
-    expect(raw.llm.profiles.balanced.model).toBe("claude-sonnet-4-6");
+    expect(raw.llm.profiles.balanced.model).toBe(
+      "accounts/fireworks/models/minimax-m3",
+    );
     // But the user's label override is preserved across the reseed.
     expect(raw.llm.profiles.balanced.label).toBe("My Default");
   });
@@ -724,7 +826,51 @@ describe("loadConfig startup behavior", () => {
 
     expect(raw.llm.profiles.balanced.status).toBe("disabled");
     // Model still refreshes — only label/status are user-owned.
-    expect(raw.llm.profiles.balanced.model).toBe("claude-sonnet-4-6");
+    expect(raw.llm.profiles.balanced.model).toBe(
+      "accounts/fireworks/models/minimax-m3",
+    );
+  });
+
+  test("reseed preserves user-edited topP on managed profiles", () => {
+    // Simulate a user who overrode topP on the managed "balanced" profile via
+    // PUT /v1/config/llm/profiles/balanced { topP: 0.5 }. The override must
+    // survive the reconcile instead of reverting to the template's 0.95.
+    writeConfig({
+      llm: {
+        profiles: {
+          balanced: {
+            source: "managed",
+            provider: "anthropic",
+            model: "old-model-from-previous-release",
+            provider_connection: "anthropic-managed",
+            topP: 0.5,
+          },
+        },
+        activeProfile: "balanced",
+      },
+    });
+
+    mergeDefaultConfigAndSeedInferenceProfiles();
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+
+    // The user's topP override is preserved across the reseed (not reverted to
+    // the template default of 0.95).
+    expect(raw.llm.profiles.balanced.topP).toBe(0.5);
+    // Model still refreshes — topP is user-owned, the rest is template-owned.
+    expect(raw.llm.profiles.balanced.model).toBe(
+      "accounts/fireworks/models/minimax-m3",
+    );
+  });
+
+  test("reseed seeds the template topP on a fresh managed balanced profile", () => {
+    // No previous on-disk entry → the balanced profile materializes with the
+    // template's topP default of 0.95.
+    writeConfig({ llm: {} });
+
+    mergeDefaultConfigAndSeedInferenceProfiles();
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+
+    expect(raw.llm.profiles.balanced.topP).toBe(0.95);
   });
 
   test("off-platform reseed preserves an explicit null label (user cleared it)", () => {
@@ -765,12 +911,20 @@ describe("loadConfig startup behavior", () => {
     const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
 
     expect(raw.llm.profiles.balanced.label).toBe("Balanced (Managed)");
-    expect(raw.llm.profiles.balanced.model).toBe("claude-sonnet-4-6");
+    expect(raw.llm.profiles.balanced.model).toBe(
+      "accounts/fireworks/models/minimax-m3",
+    );
     // Status is unset by default — must not appear as `undefined`.
     expect("status" in raw.llm.profiles.balanced).toBe(false);
   });
 
-  test("platform-provided profile fragments are not polluted by managed seeds", () => {
+  test("platform overlay fragment wins its hatch boot, then content reconciles to the code template (label preserved)", () => {
+    // The overlay is authoritative for the boot it is supplied: its `balanced`
+    // fragment lands verbatim and is never polluted by template fields it omits
+    // (no maxTokens/thinking leak in). On the next boot — overlay archived —
+    // managed profile *content* reconciles to the code template, since the
+    // templates are the single source of truth for content. Only the
+    // user/overlay-set `label` survives the reconcile.
     process.env.IS_PLATFORM = "true";
 
     writeConfig({
@@ -824,6 +978,7 @@ describe("loadConfig startup behavior", () => {
     const config = loadConfig();
     const mainAgentConfig = resolveCallSiteConfig("mainAgent", config.llm);
 
+    // Hatch boot: overlay fragment is preserved verbatim (preserveProfileNames).
     expect(config.llm.activeProfile).toBe("balanced");
     expect(config.llm.profiles.balanced).toEqual({
       source: "managed",
@@ -844,16 +999,26 @@ describe("loadConfig startup behavior", () => {
     expect(raw.llm.profiles.balanced.maxTokens).toBeUndefined();
     expect(raw.llm.profiles.balanced.thinking).toBeUndefined();
 
+    // Next boot, no overlay: content reconciles to the fireworks-managed code
+    // template; only the overlay-set label is carried across.
     mergeDefaultConfigAndSeedInferenceProfiles();
 
     const afterRestart = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
     expect(afterRestart.llm.activeProfile).toBe("balanced");
-    expect(afterRestart.llm.profiles.balanced).toEqual({
-      source: "managed",
-      provider: "openai",
-      model: "gpt-5.4",
-      label: "Platform Balanced",
+    expect(afterRestart.llm.profiles.balanced.provider).toBe("fireworks");
+    expect(afterRestart.llm.profiles.balanced.provider_connection).toBe(
+      "fireworks-managed",
+    );
+    expect(afterRestart.llm.profiles.balanced.model).toBe(
+      "accounts/fireworks/models/minimax-m3",
+    );
+    expect(afterRestart.llm.profiles.balanced.maxTokens).toBe(32000);
+    expect(afterRestart.llm.profiles.balanced.thinking).toEqual({
+      enabled: true,
+      streamThinking: true,
     });
+    // The user/overlay-set label is the one field that survives the reconcile.
+    expect(afterRestart.llm.profiles.balanced.label).toBe("Platform Balanced");
   });
 
   test("quarantines corrupt config before merging hatch overlay", () => {
@@ -892,7 +1057,9 @@ describe("loadConfig startup behavior", () => {
     // Off-platform hatch: user profiles are active.
     expect(raw.llm.activeProfile).toBe("custom-balanced");
     expect(raw.llm.profiles["custom-balanced"].provider).toBe("anthropic");
-    expect(raw.llm.profiles.balanced.model).toBe("claude-sonnet-4-6");
+    expect(raw.llm.profiles.balanced.model).toBe(
+      "accounts/fireworks/models/minimax-m3",
+    );
   });
 
   test("still quarantines corrupt JSON", () => {
@@ -989,6 +1156,11 @@ describe("seedInferenceProfiles BYOK-mode managed profile labels", () => {
 
     // Personal profiles keep their bare labels — they're the daily driver.
     expect(config.llm.profiles["custom-balanced"]?.label).toBe("Balanced");
+
+    // top_p is scoped to the managed Balanced profile only; the BYOK
+    // custom-balanced profile must not pick it up.
+    expect(config.llm.profiles.balanced?.topP).toBe(0.95);
+    expect(config.llm.profiles["custom-balanced"]?.topP).toBeUndefined();
   });
 
   test("off-platform hatch initializes managed profile status to 'disabled'", () => {
@@ -1036,7 +1208,7 @@ describe("seedInferenceProfiles BYOK-mode managed profile labels", () => {
 
     expect(raw.llm.activeProfile).toBe("balanced");
     expect(raw.llm.profiles.balanced.provider_connection).toBe(
-      "anthropic-managed",
+      "fireworks-managed",
     );
     expect("status" in raw.llm.profiles.balanced).toBe(false);
     // Connections exist (status is no longer a connection-level concept).
@@ -1283,3 +1455,72 @@ describe("seedInferenceProfiles BYOK-mode managed profile labels", () => {
     expect(config.llm.profiles.balanced?.label).toBe("Balanced (Managed)");
   });
 });
+
+// ---------------------------------------------------------------------------
+// Tests: OS Beta flag-gated managed profile. The template is defined but
+// intentionally NOT part of MANAGED_PROFILE_TEMPLATES, so seedInferenceProfiles
+// must never create it. A later PR reconciles it in/out based on the `os-beta`
+// feature flag.
+// ---------------------------------------------------------------------------
+
+describe("OS Beta managed profile template", () => {
+  beforeEach(() => {
+    ensureTestDir();
+    const resetPaths = [
+      CONFIG_PATH,
+      join(WORKSPACE_DIR, "default-config.json"),
+      join(WORKSPACE_DIR, "hatch-overlay.json"),
+      join(WORKSPACE_DIR, "keys.enc"),
+      join(WORKSPACE_DIR, "data"),
+      join(WORKSPACE_DIR, "data", "memory"),
+    ];
+    for (const path of resetPaths) {
+      if (existsSync(path)) {
+        rmSync(path, { recursive: true, force: true });
+      }
+    }
+    ensureTestDir();
+    setStorePathForTesting(join(WORKSPACE_DIR, "keys.enc"));
+    delete process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH;
+    delete process.env.IS_PLATFORM;
+    invalidateConfigCache();
+  });
+
+  afterEach(() => {
+    setStorePathForTesting(null);
+    delete process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH;
+    delete process.env.IS_PLATFORM;
+    invalidateConfigCache();
+  });
+
+  test("seedInferenceProfiles does not create an os-beta profile", () => {
+    writeConfig({ llm: { default: { provider: "anthropic" } } });
+
+    mergeDefaultConfigAndSeedInferenceProfiles();
+    const raw = JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+
+    expect(raw.llm.profiles["os-beta"]).toBeUndefined();
+    expect((raw.llm.profileOrder as string[]).includes("os-beta")).toBe(false);
+  });
+
+  test("MANAGED_PROFILE_NAMES contains os-beta", () => {
+    expect(MANAGED_PROFILE_NAMES.has("os-beta")).toBe(true);
+  });
+
+  test("materializeProfile honors the explicit OS Beta model", () => {
+    const entry = materializeProfile(
+      OS_BETA_PROFILE_TEMPLATE,
+      "fireworks",
+      "fireworks-managed",
+    );
+
+    expect(entry.model).toBe("accounts/fireworks/models/glm-5p2");
+    expect(entry.provider_connection).toBe("fireworks-managed");
+    expect(entry.provider).toBe("fireworks");
+    expect(entry.label).toBe("OS Beta");
+    expect(entry.source).toBe("managed");
+    expect(entry.maxTokens).toBe(32000);
+    expect(entry.effort).toBe("high");
+    expect(entry.thinking?.enabled).toBe(true);
+  });
+});