@inixiative/agent-session 0.3.0 → 0.4.0

package/README.md

@@ -96,6 +96,11 @@ const result = await decisions.decide(
 );
 ```
 
+Run Codex decisions on a private `CODEX_HOME` that holds only the login (link
+`auth.json` from the account's home; a copy forks its refresh token): Codex has no
+setting that drops the user's own `AGENTS.md`, and a decision thread that reports
+any instruction source is refused.
+
 Codex hosts every key as a thread of one `app-server` process per account and
 forks the primed thread per cycle; Claude forks a persisted primed session with
 a pre-spawned spare. Measured on a ChatGPT login: warm Codex decisions 2.45 s

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inixiative/agent-session",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Drive coding-agent CLIs as persistent, streaming, event-captured sessions over interchangeable transports, with primed decision sessions, subscription pools, routing, limit polling and continuity.",
   "type": "module",
   "main": "src/index.ts",
@@ -18,7 +18,7 @@
     "prepublishOnly": "bun run check",
     "measure:primed": "bun scripts/measure-primed.ts",
     "lint": "biome check .",
-    "prepare": "lefthook install"
+    "prepare": "if git rev-parse --git-dir >/dev/null 2>&1; then lefthook install; fi"
   },
   "keywords": [
     "claude-code",
@@ -34,9 +34,12 @@
     "eval"
   ],
   "license": "MIT",
+  "dependencies": {
+    "@inixiative/json-rules": "^3.4.1"
+  },
   "devDependencies": {
     "@biomejs/biome": "2.5.2",
-    "@inixiative/config": "^0.5.40",
+    "@inixiative/config": "^0.5.62",
     "@types/bun": "1.4.2",
     "lefthook": "2.1.9",
     "typescript": "6.0.3"

package/src/codex-primed.ts

@@ -75,15 +75,19 @@ export const CODEX_DECISION_DISABLED_FEATURES: readonly string[] = [
 ];
 
 /**
- * Per-thread configuration for decisions: no notify hook, no built-in MCP server,
- * no project docs or skills, and none of the instruction surfaces that describe
- * tools or the environment. Applied on thread/start and thread/fork (verified
- * equivalent to launch-level `-c` overrides), so the launch argv carries only
- * approval, web-search and feature flags that credential launchers accept.
+ * Per-thread configuration for decisions: no notify hook, no project docs or skills,
+ * and none of the instruction surfaces that describe tools or the environment.
+ * Applied on thread/start and thread/fork (verified equivalent to launch-level `-c`
+ * overrides), so the launch argv carries only approval, web-search and feature flags
+ * that credential launchers accept.
+ *
+ * The user's own CODEX_HOME (its AGENTS.md, memories, MCP servers) is not a thread
+ * setting: run decisions on a private CODEX_HOME holding only the login. A thread
+ * that reports an instruction source is refused, and an MCP server that starts is a
+ * violation.
  */
 export const CODEX_DECISION_THREAD_CONFIG: Readonly<Record<string, unknown>> = Object.freeze({
   notify: [],
-  'mcp_servers.node_repl.enabled': false,
   project_doc_max_bytes: 0,
   'skills.enabled': false,
   include_permissions_instructions: false,
@@ -213,6 +217,19 @@ interface Branch {
   wake(): void;
 }
 
+/** Instruction files Codex loaded into a thread (the user's AGENTS.md, project docs); a decision allows none. */
+const instructionSources = (response: Record<string, unknown> | undefined): string | undefined => {
+  const sources = response?.instructionSources;
+  return Array.isArray(sources) && sources.length ? sources.map(String).join(', ') : undefined;
+};
+const instructionLeak = (sources: string) =>
+  new DecisionError(
+    `Codex loaded instructions into a decision thread (${sources}); run decisions on a private CODEX_HOME`,
+    'violation',
+    'not-dispatched',
+    true,
+  );
+
 const object = (value: unknown): Record<string, unknown> | undefined =>
   value !== null && typeof value === 'object' && !Array.isArray(value)
     ? (value as Record<string, unknown>)
@@ -1045,6 +1062,11 @@ export class CodexPrimedSessions implements PrimedSessions {
         'not-dispatched',
         true,
       );
+    const leaked = instructionSources(started);
+    if (leaked) {
+      void conn.request('thread/delete', { threadId: baseId }, 10_000).catch(() => undefined);
+      throw instructionLeak(leaked);
+    }
     const branch = this._branch(conn, baseId, spec.key);
     let ok = false;
     try {
@@ -1287,6 +1309,8 @@ export class CodexPrimedSessions implements PrimedSessions {
       );
       const id = object(response?.thread)?.id;
       if (typeof id !== 'string' || !id) throw Error('Codex returned no decision thread');
+      const leaked = instructionSources(response);
+      if (leaked) throw instructionLeak(leaked);
       model ??= typeof response?.model === 'string' ? response.model : undefined;
       return { threadId: id, branch: this._branch(conn, id, spec.key) };
     };
@@ -1294,6 +1318,7 @@ export class CodexPrimedSessions implements PrimedSessions {
       if (Date.now() >= deadline || signal?.aborted) throw expired();
       const t1 = performance.now();
       const opened = await openBranch().catch((error) => {
+        if (error instanceof DecisionError) throw error;
         // The runtime refusing the fork means the primed thread is gone: retire it and prime again off-path.
         // A timeout proves nothing about the primed thread.
         if (session && error instanceof JsonRpcError) this._retire(session, 'reprime');

package/src/index.ts

@@ -87,15 +87,25 @@ export {
 export {
   assessCandidate,
   type CandidateRequest,
+  DEFAULT_STRATEGY,
   type ExclusionReason,
+  type OrderBy,
+  type OrderingSpec,
+  type OrderingTerm,
   type RankedCandidate,
   type RepositoryRoute,
-  type RoutingMode,
+  type ResolvedOrdering,
+  ROUTING_STRATEGIES,
+  type RoutingField,
   type RoutingRequest,
+  type RoutingStrategy,
   rankCandidates,
   rankSubscriptionAccounts,
   repositoryIdentity,
+  resolveOrdering,
+  type SortDir,
   type SubscriptionCandidate,
+  type UnknownUtilizationPolicy,
 } from './routing';
 // Transports: how a session reaches its model, with declared capabilities.
 export {

package/src/pool.ts

@@ -20,8 +20,9 @@ import { type LimitSnapshot, mergeLimits } from './limits';
 import { probeClaudeLimits, probeCodexLimits } from './limits-probe';
 import {
   type ExclusionReason,
+  type OrderingSpec,
   type RankedCandidate,
-  type RoutingMode,
+  type ResolvedOrdering,
   rankCandidates,
   type SubscriptionCandidate,
 } from './routing';
@@ -48,6 +49,8 @@ export interface InstanceConfig {
   readonly models?: Readonly<Record<string, readonly string[]>>;
   /** Concurrent leases. Default 1. */
   readonly concurrencyLimit?: number;
+  /** Lower serves first under a priority ordering. Default 0. */
+  readonly priority?: number;
   readonly enabled?: boolean;
   readonly authentication?: 'subscription' | 'api-key';
   /** Session config merged into every session opened on this instance (bin, spawn, SDK query…). */
@@ -60,7 +63,9 @@ export interface PoolRequest {
   readonly effort?: string;
   readonly organizationId?: string;
   readonly preferredInstanceId?: string;
-  readonly mode?: RoutingMode;
+  readonly ordering?: OrderingSpec;
+  /** Only the preferred instance may serve. Requires preferredInstanceId. */
+  readonly pinned?: boolean;
   /** Restrict to these transports (e.g. only resumable ones). */
   readonly transports?: readonly TransportKind[];
   readonly excludeInstanceIds?: readonly string[];
@@ -90,8 +95,8 @@ export type PoolEvent =
       readonly leaseId: string;
       readonly instanceId: string;
       readonly transport: PooledTransport;
-      readonly mode: RoutingMode;
-      readonly utilizationPercent: number;
+      readonly ordering: ResolvedOrdering;
+      readonly utilizationPercent: number | null;
       readonly rank: number;
     }
   | { readonly type: 'released'; readonly leaseId: string; readonly instanceId: string }
@@ -288,6 +293,7 @@ export class SubscriptionPool {
   rank(request: PoolRequest): {
     candidates: RankedCandidate[];
     excluded: Record<string, ExclusionReason>;
+    ordering: ResolvedOrdering;
   } {
     const now = this._now();
     const effort = request.effort ?? 'default';
@@ -304,6 +310,7 @@ export class SubscriptionPool {
         models: state.config.models ?? { [request.model]: [effort] },
         activeRuns: state.leases.size,
         concurrencyLimit: state.config.concurrencyLimit ?? 1,
+        priority: state.config.priority ?? 0,
         windows: (limits?.windows ?? []).map((w) => ({
           usedPercent: w.usedPercent,
           reservedPercent: reserved,
@@ -323,7 +330,8 @@ export class SubscriptionPool {
         effort,
         now,
         maximumObservationAgeMs: this._maxAge,
-        mode: request.mode,
+        ordering: request.ordering,
+        ...(request.pinned !== undefined ? { pinned: request.pinned } : {}),
         organizationId: request.organizationId,
         preferredId: request.preferredInstanceId,
       },
@@ -333,7 +341,7 @@ export class SubscriptionPool {
 
   /** Lease the best instance now, or throw PoolExhaustedError with every exclusion reason. */
   acquire(request: PoolRequest): Lease {
-    const { candidates, excluded } = this.rank(request);
+    const { candidates, excluded, ordering } = this.rank(request);
     const best = candidates[0];
     if (!best) {
       this._emit({ type: 'exhausted', runtime: request.runtime, model: request.model, excluded });
@@ -346,12 +354,7 @@ export class SubscriptionPool {
         excluded,
       );
     }
-    return this._lease(
-      this._state(best.accountId),
-      request.mode ?? 'quartile-balanced',
-      best.utilizationPercent,
-      0,
-    );
+    return this._lease(this._state(best.accountId), ordering, best.utilizationPercent, 0);
   }
 
   /** Refresh stale limits, lease an instance and open a session on it. The lease ends with the session. */
@@ -429,7 +432,7 @@ export class SubscriptionPool {
       );
     const allowed = new Set(shared.map((s) => s.config.id));
     await this._refreshStale(request, allowed);
-    const { candidates, excluded } = this.rank({
+    const { candidates, excluded, ordering } = this.rank({
       ...request,
       excludeInstanceIds: [
         ...(request.excludeInstanceIds ?? []),
@@ -451,12 +454,7 @@ export class SubscriptionPool {
       );
     binding.session?.kill();
     binding.lease?.release();
-    const lease = this._lease(
-      this._state(best.accountId),
-      request.mode ?? 'quartile-balanced',
-      best.utilizationPercent,
-      0,
-    );
+    const lease = this._lease(this._state(best.accountId), ordering, best.utilizationPercent, 0);
     try {
       const session = this._session(
         lease,
@@ -566,8 +564,8 @@ export class SubscriptionPool {
   }
   private _lease(
     state: InstanceState,
-    mode: RoutingMode,
-    utilizationPercent: number,
+    ordering: ResolvedOrdering,
+    utilizationPercent: number | null,
     rank: number,
   ): Lease {
     const leaseId = crypto.randomUUID();
@@ -593,7 +591,7 @@ export class SubscriptionPool {
       leaseId,
       instanceId: state.config.id,
       transport: state.config.transport,
-      mode,
+      ordering,
       utilizationPercent,
       rank,
     });

package/src/routing.ts

@@ -8,18 +8,83 @@
 // does not mint authority, read credentials or call a model, and a routing
 // preference never widens a grant (organization, runtime, model, billing).
 //
-// Strategies:
-//   quartile-balanced (default)  lowest usage quartile first; the preferred
-//                                (owning) instance wins within its quartile.
-//   owner-first                  the preferred instance while eligible, then
-//                                spillover by utilization.
-//   pinned                       the preferred instance only; otherwise none.
+// Ordering is an ordered list of terms over the fields projected onto each
+// eligible candidate, in `@inixiative/json-rules`' `OrderBy` vocabulary.
+// Named strategies are presets over that list; a caller may pass its own terms
+// instead. `id` is always the final term, so ranking is total and deterministic.
 //
-// Unknown, stale, future or reset-crossing limit observations exclude an
-// instance: routing never guesses capacity.
+// Eligibility is separate from ordering: `pinned` restricts which instances may
+// serve at all, and unknown, stale, future or reset-crossing limit observations
+// mean routing has no capacity reading for an instance. By default that excludes
+// it — routing never guesses capacity.
 // ---------------------------------------------------------------------------
 
-export type RoutingMode = 'quartile-balanced' | 'owner-first' | 'pinned';
+import type { OrderBy, SortDir } from '@inixiative/json-rules';
+
+export type { OrderBy, SortDir };
+
+export type RoutingField = 'priority' | 'utilization' | 'quartile' | 'headroom' | 'preferred';
+
+export interface OrderingTerm {
+  readonly field: RoutingField;
+  readonly dir?: SortDir;
+}
+
+export type RoutingStrategy =
+  | 'quartile-balanced'
+  | 'owner-first'
+  | 'priority-balanced'
+  | 'priority-strict'
+  | 'least-used';
+
+export type OrderingSpec = RoutingStrategy | readonly OrderingTerm[];
+
+/** Every term carries a direction. Assignable to json-rules' `OrderBy`. */
+export type ResolvedOrdering = { field: RoutingField; dir: SortDir }[];
+
+/** The direction that puts the better candidate first when a term omits one. */
+const NATURAL_DIRECTION: Record<RoutingField, SortDir> = {
+  priority: 'asc',
+  utilization: 'asc',
+  quartile: 'asc',
+  headroom: 'desc',
+  preferred: 'desc',
+};
+
+export const ROUTING_STRATEGIES: Record<RoutingStrategy, readonly OrderingTerm[]> = {
+  'quartile-balanced': [{ field: 'quartile' }, { field: 'preferred' }, { field: 'utilization' }],
+  'owner-first': [{ field: 'preferred' }, { field: 'utilization' }],
+  // Load decides between tiers that differ by a quartile; priority decides within one.
+  'priority-balanced': [
+    { field: 'quartile' },
+    { field: 'priority' },
+    { field: 'preferred' },
+    { field: 'utilization' },
+  ],
+  // Priority dominates: a lower tier serves only once every higher one is excluded.
+  'priority-strict': [{ field: 'priority' }, { field: 'utilization' }],
+  'least-used': [{ field: 'utilization' }],
+};
+
+export const DEFAULT_STRATEGY: RoutingStrategy = 'quartile-balanced';
+
+const ROUTING_FIELDS = Object.keys(NATURAL_DIRECTION) as RoutingField[];
+
+/** Resolve a strategy name or explicit term list into terms, each with a direction. */
+export const resolveOrdering = (spec: OrderingSpec = DEFAULT_STRATEGY): ResolvedOrdering => {
+  if (typeof spec === 'string') {
+    const preset = ROUTING_STRATEGIES[spec];
+    if (!preset) throw Error(`Unknown routing strategy "${spec}"`);
+    return resolveOrdering(preset);
+  }
+  if (!spec.length) throw Error('Ordering requires at least one term');
+  return spec.map((term) => {
+    if (!ROUTING_FIELDS.includes(term.field)) throw Error(`Unknown ordering field "${term.field}"`);
+    if (term.dir !== undefined && term.dir !== 'asc' && term.dir !== 'desc')
+      throw Error(`Unknown sort direction "${term.dir}"`);
+    return { field: term.field, dir: term.dir ?? NATURAL_DIRECTION[term.field] };
+  });
+};
 
 export interface RepositoryRoute {
   repository: string;
@@ -37,6 +102,8 @@ export interface SubscriptionCandidate {
   models: Readonly<Record<string, readonly string[]>>;
   activeRuns: number;
   concurrencyLimit: number;
+  /** Lower serves first. Absent is 0, so prioritized and unprioritized instances order together. */
+  priority?: number;
   /** All provider enforcement windows, plus locally retained reservations. `resetsAt: Infinity` means none reported. */
   windows: readonly {
     usedPercent: number | null;
@@ -50,6 +117,16 @@ export interface SubscriptionCandidate {
   unavailableUntil?: number;
 }
 
+/**
+ * What to do with an instance routing has no usable capacity reading for.
+ *
+ * `exclude` (default) suits provider-enforced subscription windows, where an
+ * unread login may already be exhausted and sending work there fails the turn.
+ * `rank-last` suits capacity whose spend is bounded elsewhere (Kingdom gates on
+ * allocation policies), where a never-observed instance must stay usable.
+ */
+export type UnknownUtilizationPolicy = 'exclude' | 'rank-last';
+
 export interface RoutingRequest {
   repository: string;
   organizationId?: string;
@@ -58,7 +135,9 @@ export interface RoutingRequest {
   effort: string;
   now: number;
   maximumObservationAgeMs: number;
-  mode?: RoutingMode;
+  ordering?: OrderingSpec;
+  pinned?: boolean;
+  unknownUtilization?: UnknownUtilizationPolicy;
 }
 
 /** Repository resolution already done by the caller (or not needed). */
@@ -70,13 +149,19 @@ export interface CandidateRequest {
   effort: string;
   now: number;
   maximumObservationAgeMs: number;
-  mode?: RoutingMode;
+  ordering?: OrderingSpec;
+  /** Only the preferred instance may serve; others are excluded as `not-pinned`. */
+  pinned?: boolean;
+  unknownUtilization?: UnknownUtilizationPolicy;
 }
 
 export interface RankedCandidate {
   accountId: string;
-  utilizationPercent: number;
-  quartile: number;
+  /** Null when no usable observation exists and the policy is `rank-last`. */
+  utilizationPercent: number | null;
+  quartile: number | null;
+  priority: number;
+  headroom: number;
   preferred: boolean;
 }
 
@@ -133,13 +218,14 @@ export function repositoryIdentity(remote: string): string {
 export function assessCandidate(
   request: CandidateRequest,
   account: SubscriptionCandidate,
-): { excluded: ExclusionReason } | { utilizationPercent: number } {
+): { excluded: ExclusionReason } | { utilizationPercent: number | null } {
   if (
     !account.id ||
     !Number.isSafeInteger(account.activeRuns) ||
     account.activeRuns < 0 ||
     !Number.isSafeInteger(account.concurrencyLimit) ||
-    account.concurrencyLimit < 1
+    account.concurrencyLimit < 1 ||
+    (account.priority !== undefined && !Number.isFinite(account.priority))
   )
     return { excluded: 'invalid' };
   if (!account.enabled) return { excluded: 'disabled' };
@@ -151,13 +237,16 @@ export function assessCandidate(
     return { excluded: 'organization' };
   if (account.runtime !== request.runtime) return { excluded: 'runtime' };
   if (!account.models[request.model]?.includes(request.effort)) return { excluded: 'model' };
-  if (request.mode === 'pinned' && account.id !== request.preferredId)
-    return { excluded: 'not-pinned' };
+  if (request.pinned && account.id !== request.preferredId) return { excluded: 'not-pinned' };
   if (account.unavailableUntil !== undefined && account.unavailableUntil > request.now)
     return { excluded: 'unavailable' };
   if (account.activeRuns >= account.concurrencyLimit) return { excluded: 'occupied' };
   if (account.blocked) return { excluded: 'blocked' };
-  if (account.windows.length === 0) return { excluded: 'no-observation' };
+  const unreadable = request.unknownUtilization === 'rank-last' ? null : undefined;
+  if (account.windows.length === 0) {
+    if (unreadable === undefined) return { excluded: 'no-observation' };
+    return { utilizationPercent: null };
+  }
   const fractions: number[] = [];
   for (const window of account.windows) {
     if (
@@ -168,7 +257,7 @@ export function assessCandidate(
       !Number.isFinite(window.reservedPercent) ||
       window.reservedPercent < 0
     )
-      return { excluded: 'invalid' };
+      return unreadable === undefined ? { excluded: 'invalid' } : { utilizationPercent: null };
     // resetsAt === Infinity: the provider reported no reset for this window, so no reset can have crossed the observation.
     if (
       !Number.isFinite(window.observedAt) ||
@@ -177,28 +266,50 @@ export function assessCandidate(
       (window.resetsAt !== Number.POSITIVE_INFINITY &&
         (!Number.isFinite(window.resetsAt) || window.resetsAt <= request.now))
     )
-      return { excluded: 'stale-observation' };
+      return unreadable === undefined
+        ? { excluded: 'stale-observation' }
+        : { utilizationPercent: null };
     fractions.push(window.usedPercent + window.reservedPercent);
   }
   if (fractions.some((p) => p >= 100)) return { excluded: 'exhausted' };
   return { utilizationPercent: Math.max(...fractions) };
 }
 
+const FIELD_VALUE: Record<RoutingField, (candidate: RankedCandidate) => number | null> = {
+  priority: (c) => c.priority,
+  utilization: (c) => c.utilizationPercent,
+  quartile: (c) => c.quartile,
+  headroom: (c) => c.headroom,
+  preferred: (c) => Number(c.preferred),
+};
+
+/** Nulls last in either direction: an unknown reading never outranks a known one. */
+const compare = (a: number | null, b: number | null, dir: SortDir): number => {
+  if (a === null) return b === null ? 0 : 1;
+  if (b === null) return -1;
+  return dir === 'desc' ? b - a : a - b;
+};
+
 /** Rank eligible candidates deterministically (ties broken by id). */
 export function rankCandidates(
   request: CandidateRequest,
   accounts: readonly SubscriptionCandidate[],
-): { candidates: RankedCandidate[]; excluded: Record<string, ExclusionReason> } {
+): {
+  candidates: RankedCandidate[];
+  excluded: Record<string, ExclusionReason>;
+  ordering: ResolvedOrdering;
+} {
   if (
     !Number.isFinite(request.now) ||
     !Number.isFinite(request.maximumObservationAgeMs) ||
     request.maximumObservationAgeMs <= 0
   )
     throw Error('Invalid observation policy');
-  if (request.mode === 'pinned' && !request.preferredId)
+  if (request.pinned && !request.preferredId)
     throw Error('Pinned routing requires a preferred instance');
   if (new Set(accounts.map((a) => a.id)).size !== accounts.length)
     throw Error('Duplicate account identity');
+  const ordering = resolveOrdering(request.ordering);
   const excluded: Record<string, ExclusionReason> = {};
   const ranked = accounts.flatMap((account) => {
     const assessed = assessCandidate(request, account);
@@ -211,22 +322,21 @@ export function rankCandidates(
       {
         accountId: account.id,
         utilizationPercent,
-        quartile: Math.floor(utilizationPercent / 25),
+        quartile: utilizationPercent === null ? null : Math.floor(utilizationPercent / 25),
+        priority: account.priority ?? 0,
+        headroom: account.concurrencyLimit - account.activeRuns,
         preferred: account.id === request.preferredId,
       },
     ];
   });
-  ranked.sort((a, b) =>
-    request.mode === 'owner-first' || request.mode === 'pinned'
-      ? Number(b.preferred) - Number(a.preferred) ||
-        a.utilizationPercent - b.utilizationPercent ||
-        a.accountId.localeCompare(b.accountId)
-      : a.quartile - b.quartile ||
-        Number(b.preferred) - Number(a.preferred) ||
-        a.utilizationPercent - b.utilizationPercent ||
-        a.accountId.localeCompare(b.accountId),
-  );
-  return { candidates: ranked, excluded };
+  ranked.sort((a, b) => {
+    for (const { field, dir } of ordering) {
+      const order = compare(FIELD_VALUE[field](a), FIELD_VALUE[field](b), dir);
+      if (order !== 0) return order;
+    }
+    return a.accountId.localeCompare(b.accountId);
+  });
+  return { candidates: ranked, excluded, ordering };
 }
 
 /** The draft's repository-scoped entry point: resolve ownership, then rank. */
@@ -249,7 +359,7 @@ export function rankSubscriptionAccounts(
     throw Error('Incomplete repository routing rule');
   if (request.organizationId && request.organizationId !== route.organizationId)
     throw Error('Explicit organization conflicts with repository ownership');
-  const { candidates } = rankCandidates(
+  const { candidates, ordering } = rankCandidates(
     {
       organizationId: route.organizationId,
       preferredId: route.preferredAccountId,
@@ -258,7 +368,11 @@ export function rankSubscriptionAccounts(
       effort: request.effort,
       now: request.now,
       maximumObservationAgeMs: request.maximumObservationAgeMs,
-      mode: request.mode,
+      ordering: request.ordering,
+      ...(request.pinned !== undefined ? { pinned: request.pinned } : {}),
+      ...(request.unknownUtilization !== undefined
+        ? { unknownUtilization: request.unknownUtilization }
+        : {}),
     },
     accounts,
   );
@@ -267,7 +381,7 @@ export function rankSubscriptionAccounts(
     organizationId: route.organizationId,
     model: request.model,
     effort: request.effort,
-    mode: request.mode ?? 'quartile-balanced',
+    ordering,
     candidates,
   };
 }