@miadi/connector 0.1.11 → 0.1.13

package/README.md

@@ -20,13 +20,14 @@ Call `get_capabilities` first. It names the signed-in person, their Miadi API ti
 
 | kind | tools |
 |---|---|
-| reads | `get_capabilities` `get_context` `list_circles` `get_circle` `list_sessions` `get_session` `get_evidence` `read_episode_file` `get_evaluations` `get_narrative_beats` `review_lookup` `review_versions` `handoff_status` `list_records` `get_run_result` `mission_status` `provider_capabilities` `search` `fetch` |
+| reads | `get_capabilities` `get_context` `list_circles` `get_circle` `list_sessions` `get_session` `get_evidence` `read_episode_file` `get_evaluations` `get_narrative_beats` `review_lookup` `review_versions` `handoff_status` `list_records` `get_run_result` `mission_status` `provider_capabilities` `mission_model_preflight` `search` `fetch` |
 | contributions | `append_observation` `open_inquiry` `link_records` `propose_narrative_beat` `record_evaluation` `register_source_intent` `record_handoff` `update_handoff` `prepare_calendar_event` `save_research` |
 | requests (approved by a person) | `propose_work` `propose_session_completion` `request_authorized_run` `request_session_steer` `request_review_operation` `request_deep_diver` `link_review_to_episode` `request_inquiry_episode` |
 | decisions in the conversation | `show_decisions` (cards), `decide_request` (called by the card only) |
 
 - **Reads** need Miadi's read tier and stay within it. A person Miadi gives no API tier reaches only `get_capabilities`. Sessions need the write tier, because a session's name and pane are operator data. For the same reason, below the write tier a record someone else made shows no session, working folder or seat, and no long bodies.
 - **Episode files.** `get_evidence` lists an episode's files; each text file Miadi can preview carries a `read_ref` (`miadi-chronicle://<n>/<path>`). `read_episode_file` (or `fetch` with that ref) returns the file's whole UTF-8 text, read as the person through Miadi's file door, so Miadi's audience and room rules apply. The answer names the episode, the path, the content type, the byte count and the sha256, and `verified` says whether the text received hashes to what Miadi read. Only md, txt, yaml, yml and json files up to 512 KiB are read. A traversal, absolute, hidden or encoded path is refused before any URL is built. A longer text comes in pages cut on character boundaries: pass `page.next` back, and the joined pages hash to `sha256`. Other kinds answer `unsupported`, a file over the limit `too_large`, a missing one `not_found`, a ceremony note below the write gate `forbidden`.
+- **One narrow grant.** A person with no Miadi API tier who holds `chronicle_foundations_read` (ticked by an admin under /admin → People → Additional permissions; admins hold it through their role) reaches `read_episode_file` for foundation documents only: `foundations/<topic>/*.md`, read through Miadi's `GET /api/chronicle/episodes/<ref>/foundations/<topic>/<file>.md`, which checks the permission on every read. Naming the episode alone lists them. Every other file and every other tool stays refused, and the permission gives no API tier. Unticking it refuses the next read. `get_capabilities` reports it under `foundation_read`, from Miadi's answer at that moment.
 - **Contributions** need Miadi's read tier and the `miadi:contribute` scope, chosen at sign-in. A record is moved on (`update_handoff`) only by its author or the write tier, and a request's receipt comes only from its decision. They append a record to the ledger and change nothing else, except `save_research`: it saves a report on the inquiry shelf as a new folder (the Markdown exactly as given, owner and visibility recorded, private by default), opens the folder's inquiry issue, and commits and pushes the folder in the shelf's repository. A long report is sent in parts (`part`, `parts`, `upload_id`) and saved when the last part arrives; the answer returns its bytes, sha256 and first and last lines.
 - **Requests** append a record that waits for a decision. The answer gives an `approval_url`; Miadi's `/research` page offers the same decisions to a signed-in person with the write tier, and `show_decisions` shows them as cards inside the conversation (below). The person approves, approves with changes (their instructions are carried into what runs), sends it back for revision with instructions (`revision_requested`, nothing runs, `get_run_result` returns the instructions), or declines. Only the approval door runs a request, once, as that person; a second decision on the same request, at the same time or later, is refused:
   - a run becomes a brief in the factory queue, which the intake delivers to a session;
@@ -45,9 +46,13 @@ The model that asked cannot approve its own request.
 
 `mission_status` joins one mission read-only: its source request and decision, the sessions bound to it (each with how it is bound — a signed `session:` ref, the delivered brief's target, or the requested name), its issues and PRs, its steering grant, and where it stands stage by stage — approved, queued, delivered, running, merged, released, closed — each by its evidence, so an idle pane or a merge is never read as completion. Live panes and Miadi's session view are joined only for the write tier.
 
+A mission is found by the issue it implements (jgwill/Miadi#913). `request_authorized_run` and `propose_work` take `primary_issue`; older requests are read by their first issue ref, as an inference. An issue held as primary by several requests answers `ambiguous_mission` with the candidates, an issue only cited answers `related_only`, and only a record id or a declared primary that no older request holds by inference (`contested`) authorizes a steer, release or closure (`identity.authorizes_actions`). A release receipt names artifact, target, production check and check time; record it as `completion_receipt.release` on a handoff that cites the mission. `released` is `verified` only when the connector confirms it itself (the target is `miadi-connector` and the running version is the one released); any other complete receipt within seven days is `receipt_recorded`, with who recorded it and whether that was the approver. Old checks are `stale`; a version string, a future date or an incomplete receipt is `claimed_unverified`. `closed` needs an approved `propose_session_completion` ending (`exit` or `complete_then_exit`) that names the mission in its `mission` field and ends one of the mission's sessions; a completed request is `request_completed`. A GitHub reference the connector cannot read is `unverified`, with the reason (`no_github_token`, `not_visible_to_token`…), never `not_found`.
+
 `request_session_steer` sends one authorized follow-up to one existing live agent, within the steering grant an approved run carries (`steering: { max_attempts, expires_at, pane }` on `request_authorized_run`). It peeks at the bound pane — the grant's pane or the session's first pane, never whichever pane is active — refuses a busy agent or a pane that is not an agent, types the exact instruction literally, and re-peeks to verify the agent accepted it (`accepted`) or only holds it at the prompt (`submitted`). Every attempt leaves a durable artifact with the instruction's sha256, its grant, its target and both captures. A steer the grant does not cover waits for one explicit scoped human decision on its `approval_url`, which runs exactly that instruction once.
 
-`request_authorized_run` may name a `provider` (`codex`, `pi`, `copilot`, `claude`). The connector verifies it is installed on the host before recording anything; an unknown or unavailable provider answers `provider_unavailable` and the mission stays unstarted. With no provider named, the first installed provider in the preference order is resolved and named in the brief; Claude Code is never chosen silently — it runs only when named. `provider_capabilities` (write tier) reports what the host has installed, the sign-in evidence, the preference order, and the read-only Jev routing preflight (`unconfigured` without `MIADI_JEV_URL`). A provider name inside a task's text selects nothing.
+`request_authorized_run` may name a `provider` (`codex`, `pi`, `copilot`, `claude`). The connector verifies it is installed on the host before recording anything; an unknown or unavailable provider answers `provider_unavailable` and the mission stays unstarted. With no provider named, the first installed provider in the preference order is resolved and named in the brief; Claude Code is never chosen silently — it runs only when named. `provider_capabilities` (write tier) reports what the host has installed, the sign-in evidence, the preference order, and the read-only Jev check: `unconfigured` without `JEV_AI_API_KEY` or `TYPESAFE_API_KEY` in the connector's environment, else the models Jev lists for the key (no charge). A provider name inside a task's text selects nothing.
+
+`mission_model_preflight` (write tier) answers, for one mission, which provider and model fit its task type and criticality, and how that is known: contract `miadi.mission_model_preflight` v1, candidates with their configured default model, sign-in evidence (config directory only), quota `unknown`, policy eligibility, a review floor, and a recommendation or an abstention with reasons. Its `decider.source` is `static_fallback`, `jev` or `synthetic_fixture`. Jev is asked only with `consult_jev: true` and a key on the host; it is sent task type, criticality and candidates, never task text, mission id or repository, and its answer is advisory: uncalibrated, below 0.8 or outside the contract, the preflight abstains. A reported `launch` on another provider than the approved one answers `provider_mismatch` before anything is asked. It authorizes nothing. `bench/model-preflight-bench.mjs` compares the 0.1.12 baseline, the static preflight and Jev on synthetic scenarios; `bench/results/` keeps the runs.
 
 ### Deciding inside the conversation
 

package/dist/episode-files.d.ts

@@ -1,5 +1,14 @@
 /** The extensions Miadi's vessel reads as text (@medicine-wheel/episode-vessel TEXT_EXTENSIONS). */
 export declare const TEXT_TYPES: Record<string, string>;
+/**
+ * The one Miadi permission that reads foundation documents without an API
+ * tier (jgwill/Miadi#905). Miadi checks it on every read at
+ * GET /api/chronicle/episodes/<ref>/foundations/<topic>/<file>.md.
+ */
+export declare const FOUNDATIONS_PERMISSION = "chronicle_foundations_read";
+/** `foundations/<topic>/…/<file>.md`: what that permission reads, and nothing else. */
+export declare function isFoundationDoc(segments: string[]): boolean;
+export declare function holdsFoundationRead(permissions: readonly string[] | undefined): boolean;
 /** The vessel's own limit for reading text whole (MAX_TEXT_BYTES). */
 export declare const MAX_TEXT_BYTES: number;
 export declare const DEFAULT_PAGE_BYTES = 100000;

package/dist/episode-files.js

@@ -21,6 +21,19 @@ export const TEXT_TYPES = {
     ".yml": "application/yaml; charset=utf-8",
     ".json": "application/json; charset=utf-8",
 };
+/**
+ * The one Miadi permission that reads foundation documents without an API
+ * tier (jgwill/Miadi#905). Miadi checks it on every read at
+ * GET /api/chronicle/episodes/<ref>/foundations/<topic>/<file>.md.
+ */
+export const FOUNDATIONS_PERMISSION = "chronicle_foundations_read";
+/** `foundations/<topic>/…/<file>.md`: what that permission reads, and nothing else. */
+export function isFoundationDoc(segments) {
+    return segments.length >= 3 && segments[0] === "foundations" && extensionOf(segments.join("/")) === ".md";
+}
+export function holdsFoundationRead(permissions) {
+    return Boolean(permissions?.includes("*") || permissions?.includes(FOUNDATIONS_PERMISSION));
+}
 /** The vessel's own limit for reading text whole (MAX_TEXT_BYTES). */
 export const MAX_TEXT_BYTES = 512 * 1024;
 export const DEFAULT_PAGE_BYTES = 100_000;

package/dist/index.d.ts

@@ -5,7 +5,8 @@ export { MiadiOAuthProvider, SCOPES, SCOPE_READ, SCOPE_CONTRIBUTE, type Person }
 export { CIRCLES, CIRCLE_IDS, CLAIM_CATEGORIES, DOMAINS, HANDOFF_STATES, RECORD_KINDS, current, type ConnectorRecord, type CircleId, type ClaimCategory, type RecordKind, } from "./records.js";
 export { TOOL_STATUS } from "./tools.js";
 export { runBrief, readQueueState } from "./approve.js";
-export { PROVIDERS, discoverProviders, resolveProvider, routerPreflight, type ProviderAvailability, type ProviderId, type ProviderResolution, type RouterPreflight, } from "./providers.js";
-export { missionStatus, resolveMissionSubject, type MissionStatus, type MissionStatusDeps } from "./mission-status.js";
+export { PROVIDERS, discoverProviders, jevConfigOf, resolveProvider, routerPreflight, type JevConfig, type ProviderAvailability, type ProviderId, type ProviderResolution, type RouterPreflight, } from "./providers.js";
+export { missionStatus, primaryIssueOf, resolveMissionSubject, type MissionStatus, type MissionStatusDeps, type MissionIdentity } from "./mission-status.js";
+export { modelPreflight, candidatesFor, buildJevRequest, decisionState, jevAdapter, reviewFloor, PREFLIGHT_CONTRACT, PREFLIGHT_VERSION, JEV_CONFIDENCE_FLOOR, type ModelPreflight, type ModelCandidate, type JevAdapter, type JevRequest, } from "./model-preflight.js";
 export { AGENT_COMMANDS, BUSY_PATTERNS, STEER_STATUSES, checkGrant, isBusy, readSteerArtifact, steerAttempts, steerSession, steeringGrantOf, tmuxAdapter, type SteerDeps, type SteerResult, type SteerStatus, type SteeringGrant, type TmuxLike, } from "./steer.js";
 export { VERSION } from "./version.js";

package/dist/index.js

@@ -5,7 +5,8 @@ export { MiadiOAuthProvider, SCOPES, SCOPE_READ, SCOPE_CONTRIBUTE } from "./oaut
 export { CIRCLES, CIRCLE_IDS, CLAIM_CATEGORIES, DOMAINS, HANDOFF_STATES, RECORD_KINDS, current, } from "./records.js";
 export { TOOL_STATUS } from "./tools.js";
 export { runBrief, readQueueState } from "./approve.js";
-export { PROVIDERS, discoverProviders, resolveProvider, routerPreflight, } from "./providers.js";
-export { missionStatus, resolveMissionSubject } from "./mission-status.js";
+export { PROVIDERS, discoverProviders, jevConfigOf, resolveProvider, routerPreflight, } from "./providers.js";
+export { missionStatus, primaryIssueOf, resolveMissionSubject } from "./mission-status.js";
+export { modelPreflight, candidatesFor, buildJevRequest, decisionState, jevAdapter, reviewFloor, PREFLIGHT_CONTRACT, PREFLIGHT_VERSION, JEV_CONFIDENCE_FLOOR, } from "./model-preflight.js";
 export { AGENT_COMMANDS, BUSY_PATTERNS, STEER_STATUSES, checkGrant, isBusy, readSteerArtifact, steerAttempts, steerSession, steeringGrantOf, tmuxAdapter, } from "./steer.js";
 export { VERSION } from "./version.js";

package/dist/mission-status.d.ts

@@ -1,8 +1,19 @@
 /**
- * Read-only mission status (jgwill/Miadi#893, Phase 1A): where one mission
- * stands, joined from the connector ledger, the factory queue, tmux, Miadi's
- * session view and GitHub — with every stage named by its evidence, so an idle
- * pane or a merge is never read as completion.
+ * Read-only mission status (jgwill/Miadi#893, Phase 1A; corrected by #913): where
+ * one mission stands, joined from the connector ledger, the factory queue, tmux,
+ * Miadi's session view and GitHub — with every stage named by its evidence, so an
+ * idle pane, a merge, a version string or a completed request is never read as
+ * release or closure.
+ *
+ * Mission identity (#913 A). A record's *primary* issue is the one it implements:
+ * `body.primary_issue` when the requester declared it (provenance `declared`),
+ * else, for records made before that field, the first owner/repo#n in its refs
+ * (provenance `first_issue_ref`, an inference). Every other issue it cites is
+ * *related*. An issue or session reference resolves to one mission only when one
+ * candidate holds it as primary; several are `ambiguous_mission`, and a reference
+ * cited only as related is `related_only`. Newest-first selection is gone.
+ * Only `exact` (a record id) and `declared_primary` authorize a steer, release or
+ * closure against the answer; an inference names its candidate and authorizes nothing.
  *
  * The caller (tools.ts) decides the viewer's tier first: without the write
  * tier there are no operator details (live panes, session internals); the
@@ -19,20 +30,96 @@ export interface MissionSession {
     /** Present when Miadi's session view was joined (write tier). */
     miadi?: unknown;
 }
+/** What the connector could establish about a GitHub reference. `unverified` is never `not_found`: without access the connector cannot tell. */
+export interface IssueLookup {
+    state: string;
+    title?: string;
+    merged?: boolean;
+    /** Why the state is `unverified`: no_github_token, not_visible_to_token, token_rejected, forbidden_or_rate_limited, github_<status>, unreachable. */
+    access?: string;
+}
+/** A release receipt: what was released, where, and how production was checked, when. */
+export interface ReleaseEvidence {
+    artifact: string;
+    target: string;
+    verified_at: string;
+    verification: string;
+    /** The record that carries it and who made it. */
+    record: string;
+    by: string;
+    /** The receipt was recorded by the person who approved the mission. */
+    by_approver: boolean;
+    /** The version the connector itself is running, when the receipt's target is the connector. */
+    live_version?: string;
+}
+export interface ClosureEvidence {
+    record: string;
+    ending: string;
+    session_id: string;
+    /** The ending names one of the mission's own sessions. False when the mission names none to compare. */
+    session_bound: boolean;
+    decided_by?: string;
+    decided_at?: string;
+}
 export interface MissionStageTruth {
     approved: boolean;
+    /** The decision as taken: approve or approve_with_changes, the approver's instructions and what is still outstanding. */
+    approval: {
+        state: string;
+        choice?: string;
+        instructions?: string;
+        outstanding: string[];
+    };
     queued: boolean;
     delivered: boolean;
     /** "evidence" only while a bound session is live; an idle pane proves nothing. */
     running: "evidence" | "no_evidence";
-    pr_merged: "merged" | "open_or_absent" | "no_pr";
-    released: "evidence" | "no_evidence";
+    /** The run_request or work_proposal finished. This is the request, not the mission. */
+    request_completed: boolean;
+    /** "unverified": GitHub could not be read, so no merge state is claimed either way. */
+    pr_merged: "merged" | "open_or_absent" | "no_pr" | "unverified";
+    /**
+     * verified: the connector itself confirmed it: the receipt targets miadi-connector and the running version
+     * is the one released. receipt_recorded: a complete, fresh receipt (artifact, target, production check, time)
+     * recorded by the named person; the connector cannot check it. stale: the check is older than the freshness
+     * window. live_mismatch: the connector runs another version than its receipt names. claimed_unverified: a
+     * version, a published flag, an incomplete or future-dated release object. no_evidence: nothing.
+     */
+    released: "verified" | "receipt_recorded" | "stale" | "live_mismatch" | "claimed_unverified" | "no_evidence";
+    release_evidence?: ReleaseEvidence;
+    /** True only with an approved ending (exit or complete_then_exit) naming this mission in its `mission` field, for one of its sessions. A completed request is not a closure. */
     closed: boolean;
+    closure_evidence?: ClosureEvidence;
+}
+export type MissionResolution = "exact" | "declared_primary" | "inferred_primary" | "ambiguous_mission" | "related_only";
+export interface MissionCandidate {
+    id: string;
+    kind: string;
+    created_at: string;
+    /** primary: the reference is this record's primary issue. related: an issue it cites and does not implement. cited: a session it cites. */
+    relation: "primary" | "related" | "cited";
+    /** declared: body.primary_issue. first_issue_ref: inferred from the first issue in refs. cited_ref: the reference is in its refs. */
+    provenance: "declared" | "first_issue_ref" | "cited_ref";
+    primary_issue?: string;
+}
+export interface MissionIdentity {
+    resolution: MissionResolution;
+    /** A declared primary that another request also holds by inference: reported, not authorizing. */
+    contested?: boolean;
+    /** True only for exact and an uncontested declared_primary: a steer, release or closure may name this mission. */
+    authorizes_actions: boolean;
+    primary_issue?: {
+        ref: string;
+        provenance: "declared" | "first_issue_ref";
+    };
+    /** Every request citing the reference, newest first, with its relation. Empty for an exact id. */
+    candidates: MissionCandidate[];
 }
 export interface MissionStatus {
     ref: string;
     found: boolean;
     via?: string;
+    identity?: MissionIdentity;
     subject?: {
         id: string;
         kind: string;
@@ -48,9 +135,11 @@ export interface MissionStatus {
     sessions?: MissionSession[];
     issues?: {
         ref: string;
+        relation: "primary" | "related";
         state: string;
         title?: string;
         merged?: boolean;
+        access?: string;
     }[];
     steering?: {
         grant: "none" | "active" | "expired_grant" | "exhausted";
@@ -72,16 +161,33 @@ export interface MissionStatusDeps {
     paneBusy?: (session: string) => "busy" | "idle" | "unknown";
     /** Miadi's session view by session:<uuid> (write tier only). */
     sessionOf?: (id: string) => Promise<unknown>;
-    issueOf?: (owner: string, repo: string, n: string) => Promise<{
-        state: string;
-        title?: string;
-        merged?: boolean;
-    }>;
+    issueOf?: (owner: string, repo: string, n: string) => Promise<IssueLookup>;
+    /** The version a package runs at on this host, when the connector can know it (its own VERSION). */
+    liveVersionOf?: (pkg: string) => string | undefined;
+    /** How old a production check may be and still count as verified. Default seven days. */
+    releaseFreshnessMs?: number;
     now?: () => Date;
 }
-/** The record a mission reference resolves to, and how it was found. */
-export declare function resolveMissionSubject(ref: string, records: ConnectorRecord[]): {
-    record: ConnectorRecord;
+export declare const RELEASE_FRESHNESS_MS: number;
+/** The issue a mission implements, and how that is known. */
+export declare function primaryIssueOf(record: ConnectorRecord): {
+    ref: string;
+    provenance: "declared" | "first_issue_ref";
+} | undefined;
+export interface ResolvedSubject {
+    record?: ConnectorRecord;
     via: string;
-} | null;
+    resolution: MissionResolution;
+    contested?: boolean;
+    candidates: MissionCandidate[];
+}
+/** Whether a resolved reference may be acted on: an exact id, or a declared primary nobody else holds. */
+export declare function authorizesActions(found: Pick<ResolvedSubject, "resolution" | "contested">): boolean;
+/**
+ * The record a mission reference resolves to, how it was found, and every other
+ * candidate. `record` is absent when the reference is ambiguous or only related.
+ * Expects the folded ledger (`current()`), so a superseding record never stands
+ * as a mission of its own.
+ */
+export declare function resolveMissionSubject(ref: string, records: ConnectorRecord[]): ResolvedSubject | null;
 export declare function missionStatus(ref: string, records: ConnectorRecord[], deps: MissionStatusDeps): Promise<MissionStatus>;

package/dist/mission-status.js

@@ -1,27 +1,69 @@
 import { steerAttempts, steeringGrantOf, checkGrant } from "./steer.js";
 const ISSUE_REF = /^([\w.-]+)\/([\w.-]+)#(\d+)$/;
 const SESSION_REF = /^session:([0-9a-f-]{36})$/;
-/** The record a mission reference resolves to, and how it was found. */
+const MISSION_KINDS = new Set(["run_request", "work_proposal"]);
+const CLOSING_ENDINGS = new Set(["exit", "complete_then_exit"]);
+export const RELEASE_FRESHNESS_MS = 7 * 24 * 3600_000;
+const CLOCK_SKEW_MS = 5 * 60_000;
+/** A release receipt whose target the connector can check itself. */
+const SELF_TARGET = /miadi-connector/;
+/** The issue a mission implements, and how that is known. */
+export function primaryIssueOf(record) {
+    const declared = record.body?.primary_issue;
+    if (typeof declared === "string" && ISSUE_REF.test(declared))
+        return { ref: declared, provenance: "declared" };
+    const first = record.refs.find((r) => ISSUE_REF.test(r));
+    return first ? { ref: first, provenance: "first_issue_ref" } : undefined;
+}
+const newestFirst = (a, b) => b.created_at.localeCompare(a.created_at);
+function candidate(r, relation, provenance) {
+    const primary = primaryIssueOf(r);
+    return { id: r.id, kind: r.kind, created_at: r.created_at, relation, provenance, ...(primary ? { primary_issue: primary.ref } : {}) };
+}
+/** Whether a resolved reference may be acted on: an exact id, or a declared primary nobody else holds. */
+export function authorizesActions(found) {
+    return found.resolution === "exact" || (found.resolution === "declared_primary" && !found.contested);
+}
+/**
+ * The record a mission reference resolves to, how it was found, and every other
+ * candidate. `record` is absent when the reference is ambiguous or only related.
+ * Expects the folded ledger (`current()`), so a superseding record never stands
+ * as a mission of its own.
+ */
 export function resolveMissionSubject(ref, records) {
     const exact = records.find((r) => r.id === ref);
     if (exact)
-        return { record: exact, via: "record_id" };
-    const session = SESSION_REF.exec(ref);
-    if (session) {
-        const citing = records
-            .filter((r) => (r.kind === "run_request" || r.kind === "work_proposal") && r.refs.includes(ref))
-            .sort((a, b) => b.created_at.localeCompare(a.created_at));
-        if (citing.length)
-            return { record: citing[0], via: "session_ref" };
-        return null;
+        return { record: exact, via: "record_id", resolution: "exact", candidates: [] };
+    const missions = records.filter((r) => MISSION_KINDS.has(r.kind)).sort(newestFirst);
+    if (SESSION_REF.test(ref)) {
+        const citing = missions.filter((r) => r.refs.includes(ref));
+        if (!citing.length)
+            return null;
+        if (citing.length === 1)
+            return { record: citing[0], via: "session_ref", resolution: "inferred_primary", candidates: [candidate(citing[0], "cited", "cited_ref")] };
+        return { via: "session_ref", resolution: "ambiguous_mission", candidates: citing.map((r) => candidate(r, "cited", "cited_ref")) };
     }
     if (ISSUE_REF.test(ref)) {
-        const citing = records
-            .filter((r) => (r.kind === "run_request" || r.kind === "work_proposal") && (r.refs.includes(ref) || r.evidence_refs.includes(ref)))
-            .sort((a, b) => b.created_at.localeCompare(a.created_at));
-        if (citing.length)
-            return { record: citing[0], via: "issue_ref" };
-        return null;
+        const citing = missions.filter((r) => r.refs.includes(ref) || r.evidence_refs.includes(ref));
+        if (!citing.length)
+            return null;
+        const cands = citing.map((r) => {
+            const primary = primaryIssueOf(r);
+            return primary?.ref === ref ? candidate(r, "primary", primary.provenance) : candidate(r, "related", "cited_ref");
+        });
+        const declared = cands.filter((c) => c.relation === "primary" && c.provenance === "declared");
+        const inferred = cands.filter((c) => c.relation === "primary" && c.provenance === "first_issue_ref");
+        const pick = (c) => citing.find((r) => r.id === c.id);
+        if (declared.length === 1) {
+            return { record: pick(declared[0]), via: "issue_ref", resolution: "declared_primary", ...(inferred.length ? { contested: true } : {}), candidates: cands };
+        }
+        if (declared.length > 1)
+            return { via: "issue_ref", resolution: "ambiguous_mission", candidates: cands };
+        if (inferred.length === 1)
+            return { record: pick(inferred[0]), via: "issue_ref", resolution: "inferred_primary", candidates: cands };
+        if (inferred.length > 1)
+            return { via: "issue_ref", resolution: "ambiguous_mission", candidates: cands };
+        return { via: "issue_ref", resolution: "related_only", candidates: cands };
     }
     return null;
 }
@@ -48,12 +90,108 @@ function nextAction(record, standing, queue) {
                 : "The request is done. A mission closes when its session's ending is decided, not when this request completes.";
     }
 }
+const str = (v) => (typeof v === "string" ? v.trim() : "");
+/** name@version from "npm:@scope/name@1.2.3" or "@scope/name@1.2.3". */
+function artifactVersion(artifact) {
+    const m = /^(?:npm:)?((?:@[\w.-]+\/)?[\w.-]+)@(\d[\w.+-]*)$/.exec(artifact.trim());
+    return m ? { pkg: m[1], version: m[2] } : undefined;
+}
+/** Records that carry evidence about this mission: itself, then any record citing its id, newest first. */
+function evidenceRecords(record, records) {
+    const citing = records.filter((r) => r.id !== record.id && (r.refs.includes(record.id) || r.evidence_refs.includes(record.id))).sort(newestFirst);
+    return [record, ...citing];
+}
+function releaseTruth(record, records, deps, now) {
+    let claimed = false;
+    for (const r of evidenceRecords(record, records)) {
+        const receipt = (r.completion_receipt ?? {});
+        const rel = (receipt.release ?? r.body?.release);
+        if (rel && typeof rel === "object") {
+            const ev = { artifact: str(rel.artifact), target: str(rel.target), verified_at: str(rel.verified_at), verification: str(rel.verification) };
+            const at = Date.parse(ev.verified_at);
+            if (!ev.artifact || !ev.target || !ev.verification || Number.isNaN(at) || at > now.getTime() + CLOCK_SKEW_MS) {
+                claimed = true;
+                continue;
+            }
+            const approver = str((record.completion_receipt ?? {}).decided_by?.person_id);
+            const evidence = { ...ev, record: r.id, by: r.actor.name, by_approver: Boolean(approver) && r.actor.person_id === approver };
+            const av = artifactVersion(ev.artifact);
+            const self = av && SELF_TARGET.test(ev.target) ? deps.liveVersionOf?.(av.pkg) : undefined;
+            if (av && self !== undefined) {
+                evidence.live_version = self;
+                if (self !== av.version)
+                    return { released: "live_mismatch", release_evidence: evidence };
+            }
+            if (now.getTime() - at > (deps.releaseFreshnessMs ?? RELEASE_FRESHNESS_MS))
+                return { released: "stale", release_evidence: evidence };
+            return { released: self !== undefined ? "verified" : "receipt_recorded", release_evidence: evidence };
+        }
+        if (r.id === record.id && (receipt.published || receipt.version))
+            claimed = true;
+    }
+    return { released: claimed ? "claimed_unverified" : "no_evidence" };
+}
+/**
+ * The approved ending that closes this mission: it names the mission in its own `mission` field (one ending,
+ * one mission; a citation in refs is not enough) and, when the mission names sessions, ends one of them.
+ */
+function closureTruth(record, records, missionSessions) {
+    const endings = records
+        .filter((r) => {
+        const b = (r.body ?? {});
+        if (r.kind !== "session_completion_proposal" || r.approval_state !== "approved" || b.mission !== record.id)
+            return false;
+        if (!CLOSING_ENDINGS.has(str(b.ending)))
+            return false;
+        return missionSessions.size === 0 || missionSessions.has(str(b.session_id));
+    })
+        .sort(newestFirst);
+    const e = endings[0];
+    if (!e)
+        return undefined;
+    const receipt = (e.completion_receipt ?? {});
+    const sessionId = str(e.body.session_id);
+    return {
+        record: e.id,
+        ending: str(e.body.ending),
+        session_id: sessionId,
+        session_bound: missionSessions.has(sessionId),
+        ...(str(receipt.decided_by?.name) ? { decided_by: str(receipt.decided_by.name) } : {}),
+        ...(str(receipt.decided_at) ? { decided_at: str(receipt.decided_at) } : {}),
+    };
+}
 export async function missionStatus(ref, records, deps) {
     const notes = [];
     const found = resolveMissionSubject(ref, records);
     if (!found)
         return { ref, found: false, notes: ["No mission record resolves from this reference."] };
+    if (!found.record) {
+        const ambiguous = found.resolution === "ambiguous_mission";
+        return {
+            ref,
+            found: false,
+            via: found.via,
+            identity: { resolution: found.resolution, authorizes_actions: false, candidates: found.candidates },
+            next_authorized_action: "Name the mission by its record id. Nothing is steered, released or closed against this reference.",
+            notes: [
+                ambiguous
+                    ? "Several requests hold this reference as their primary mission; none is chosen for you, the newest included."
+                    : "Requests cite this reference only as related; none implements it, so it names no mission.",
+            ],
+        };
+    }
     const { record, via } = found;
+    const primary = primaryIssueOf(record);
+    const identity = {
+        resolution: found.resolution,
+        ...(found.contested ? { contested: true } : {}),
+        authorizes_actions: authorizesActions(found),
+        ...(primary ? { primary_issue: primary } : {}),
+        candidates: found.candidates,
+    };
+    if (found.resolution === "inferred_primary") {
+        notes.push(`Resolved by inference (${via === "session_ref" ? "the only request citing this session" : "the first issue in the request's refs"}). Name ${record.id} before any steer, release or closure.`);
+    }
     const standing = deps.projectOf(record) ?? undefined;
     const queue = deps.queueOf?.(record);
     const now = deps.now?.() ?? new Date();
@@ -64,7 +202,6 @@ export async function missionStatus(ref, records, deps) {
     const named = String(record.body.session ?? "") || undefined;
     const seen = new Set();
     const addSession = (session, association) => {
-        const key = `${association}:${session}`;
         if (seen.has(session))
             return;
         seen.add(session);
@@ -74,7 +211,6 @@ export async function missionStatus(ref, records, deps) {
             live: live ? (live.has(session) ? "running" : "absent") : "unknown",
             ...(deps.paneBusy && live?.has(session) ? { activity: deps.paneBusy(session) } : {}),
         });
-        void key;
     };
     if (typeof briefTo === "string" && briefTo)
         addSession(briefTo.replace(/^new:/, ""), "brief_target");
@@ -91,14 +227,22 @@ export async function missionStatus(ref, records, deps) {
         notes.push("Live session state was not joined (the viewer's tier or the host does not allow it).");
     const issues = [];
     if (deps.issueOf) {
-        for (const r of [...record.refs, ...record.evidence_refs]) {
+        for (const r of [...new Set([...record.refs, ...record.evidence_refs])]) {
             const m = ISSUE_REF.exec(r);
             if (!m)
                 continue;
-            const issue = await deps
-                .issueOf(m[1], m[2], m[3])
-                .catch(() => ({ state: "unavailable" }));
-            issues.push({ ref: r, state: issue.state, ...(issue.title ? { title: issue.title } : {}), ...(issue.merged !== undefined ? { merged: issue.merged } : {}) });
+            const issue = await deps.issueOf(m[1], m[2], m[3]).catch(() => ({ state: "unverified", access: "unreachable" }));
+            issues.push({
+                ref: r,
+                relation: primary?.ref === r ? "primary" : "related",
+                state: issue.state,
+                ...(issue.title ? { title: issue.title } : {}),
+                ...(issue.merged !== undefined ? { merged: issue.merged } : {}),
+                ...(issue.access ? { access: issue.access } : {}),
+            });
+        }
+        if (issues.some((i) => i.state === "unverified")) {
+            notes.push("Some GitHub references could not be read by the connector; they are unverified, not missing.");
         }
     }
     const grant = steeringGrantOf(record);
@@ -108,22 +252,47 @@ export async function missionStatus(ref, records, deps) {
     const receipt = (record.completion_receipt ?? {});
     const anyLive = sessions.some((s) => s.live === "running");
     const prs = issues.filter((i) => i.merged !== undefined);
+    const unverifiedRefs = issues.some((i) => i.state === "unverified");
+    const release = releaseTruth(record, records, deps, now);
+    const missionSessions = new Set(sessions.map((x) => x.session.replace(/^session:/, "")));
+    const closure = closureTruth(record, records, missionSessions);
+    const choice = standing?.decision?.choice ?? (str(receipt.decision) || undefined);
+    const instructions = standing?.decision?.instructions ?? (str(receipt.instructions) || undefined);
     const stageTruth = {
         approved: record.approval_state === "approved",
+        approval: {
+            state: record.approval_state ?? "not_required",
+            ...(choice ? { choice } : {}),
+            ...(instructions ? { instructions } : {}),
+            outstanding: standing?.outstanding ?? [],
+        },
         queued: queue?.state === "queued" || queue?.state === "delivered",
         delivered: queue?.state === "delivered",
         running: anyLive ? "evidence" : "no_evidence",
-        pr_merged: prs.length ? (prs.every((p) => p.merged) ? "merged" : "open_or_absent") : "no_pr",
-        released: receipt.published || receipt.version ? "evidence" : "no_evidence",
-        closed: standing?.stage === "completed" && standing?.standing === "done",
+        request_completed: record.state === "completed",
+        pr_merged: unverifiedRefs ? "unverified" : prs.length ? (prs.every((p) => p.merged) ? "merged" : "open_or_absent") : "no_pr",
+        released: release.released,
+        ...(release.release_evidence ? { release_evidence: release.release_evidence } : {}),
+        closed: Boolean(closure),
+        ...(closure ? { closure_evidence: closure } : {}),
     };
     if (stageTruth.running === "no_evidence" && record.approval_state === "approved") {
         notes.push("No bound session shows live; an idle or absent pane is not proof of completion or failure.");
     }
+    if (stageTruth.request_completed && !stageTruth.closed) {
+        notes.push("The request completed; the mission stays open until an approved session ending cites it.");
+    }
+    if (stageTruth.pr_merged === "merged" && stageTruth.released !== "verified" && stageTruth.released !== "receipt_recorded") {
+        notes.push("Merged is not released: no fresh production check is recorded for this mission.");
+    }
+    if (found.contested) {
+        notes.push("This request declares the issue, and an earlier request holds it by inference; neither is acted on by issue. Name the record id.");
+    }
     return {
         ref,
         found: true,
         via,
+        identity,
         subject: {
             id: record.id,
             kind: record.kind,
@@ -138,7 +307,9 @@ export async function missionStatus(ref, records, deps) {
         issues,
         steering: { grant: grantState, attempts_used: attempts, ...(grant?.max_attempts !== undefined ? { max_attempts: grant.max_attempts } : {}) },
         stage_truth: stageTruth,
-        next_authorized_action: nextAction(record, standing ?? null, queue),
+        next_authorized_action: identity.authorizes_actions
+            ? nextAction(record, standing ?? null, queue)
+            : `Not authorizing (${found.contested ? "contested" : "inferred"}): call mission_status with ${record.id} before acting. ${nextAction(record, standing ?? null, queue)}`,
         notes,
     };
 }