@miadi/connector 0.1.12 → 0.1.14

package/dist/tools.js

@@ -16,10 +16,12 @@ import { reviewIdOf, videoIdOf } from "./reviews.js";
 import { SCOPE_APPROVE, SCOPE_CONTRIBUTE } from "./oauth.js";
 import { CIRCLES, CIRCLE_IDS, CLAIM_CATEGORIES, DOMAINS, HANDOFF_STATES, current, newRecordId, } from "./records.js";
 import { VERSION } from "./version.js";
-import { AlreadyDecided, DECISIONS, KIND_LABELS, consequenceOf, decide, isApprovable, readQueueState, requestProjection } from "./approve.js";
+import { AlreadyDecided, DECISIONS, KIND_LABELS, StaleVersion, consequenceOf, decide, isApprovable, isBeingDecided, readQueueState, requestProjection } from "./approve.js";
+import { RevisionRefused, requestHistory, revisionRecord, supersedeRecords, versionOf } from "./revisions.js";
 import { DECISIONS_CARD_HTML, DECISIONS_CARD_URI, DECISION_TOKENS_META } from "./decisions.js";
-import { discoverProviders, resolveProvider, routerPreflight, PROVIDERS } from "./providers.js";
-import { missionStatus } from "./mission-status.js";
+import { discoverProviders, jevConfigOf, resolveProvider, routerPreflight, PROVIDERS } from "./providers.js";
+import { authorizesActions, missionStatus, primaryIssueOf, resolveMissionSubject } from "./mission-status.js";
+import { candidatesFor, CRITICALITIES, jevAdapter, modelPreflight, PREFLIGHT_CONTRACT, PREFLIGHT_VERSION, TASK_TYPES, } from "./model-preflight.js";
 import { checkGrant, isBusy, steerAttempts, steeringGrantOf, steerSession } from "./steer.js";
 import { join } from "node:path";
 import { artefactVisibility, readArtefactWeave, saveResearchArtefact } from "@miadi/inquiry-weave";
@@ -84,6 +86,29 @@ const WRITE = { readOnlyHint: false, destructiveHint: false, openWorldHint: fals
 const refs = z.array(z.string()).max(50).default([]).describe("References: miadi-review:<uuid>, miadi-chronicle://<n>, owner/repo#n, session:<uuid>, a record id, or a URL.");
 const circle = z.enum(CIRCLE_IDS);
 const claim = z.enum(CLAIM_CATEGORIES).describe("observed, hypothesis, desired_future, fiction or verified_implementation.");
+const primaryIssue = z
+    .string()
+    .regex(/^[\w.-]+\/[\w.-]+#\d+$/)
+    .optional()
+    .describe("owner/repo#n: the one issue this mission implements. Other refs stay related. Without it, mission_status can only infer the mission from the first issue in refs (jgwill/Miadi#913).");
+/** Refs with the declared primary issue first, never duplicated. */
+function withPrimary(refs, primary) {
+    return primary ? [primary, ...refs.filter((r) => r !== primary)] : refs;
+}
+/**
+ * Why GitHub did not answer a reference (jgwill/Miadi#913 B). A 404 without a
+ * token is a private repository as often as a missing issue, so nothing here is
+ * ever reported as not found.
+ */
+export function githubAccess(status, hasToken) {
+    if (status === 404)
+        return hasToken ? "not_visible_to_token" : "no_github_token";
+    if (status === 401)
+        return "token_rejected";
+    if (status === 403 || status === 429)
+        return "forbidden_or_rate_limited";
+    return `github_${status}`;
+}
 function episodeRef(input) {
     // miadi-chronicle://316, miadi-chronicle:316, chronicle:<folder>, a folder, or a number
     return encodeURIComponent(input.replace(/^miadi-chronicle:(\/\/)?/, "").replace(/^chronicle:/, "").trim());
@@ -227,7 +252,7 @@ export function registerTools(server, ctx) {
                 signal: AbortSignal.timeout(15_000),
             });
             if (!res.ok)
-                return { ref: r, kind: "github_issue", state: res.status === 404 ? "not_found_or_private" : `github_${res.status}`, cited_by: cited };
+                return { ref: r, kind: "github_issue", state: "unverified", access: githubAccess(res.status, Boolean(process.env.GITHUB_TOKEN)), cited_by: cited };
             const i = await res.json();
             return {
                 ref: r,
@@ -614,18 +639,20 @@ export function registerTools(server, ctx) {
             return { state: "not_found", record_id };
         return {
             record: r,
+            version: versionOf(r),
+            ...(versionOf(r) > 1 ? { history: "Earlier versions: get_request_history." } : {}),
             approval_url: r.approval_state === "awaiting_approval" ? approvalUrl(r.id) : undefined,
             queue: r.kind === "run_request" || r.kind === "work_proposal" ? readQueueState(r, ctx.factoryDir) : undefined,
             // Where the request stands, in the words every surface uses (jgwill/Miadi#889).
             projection: requestProjection(r, { reviewBase: ctx.approval?.config.reviewUrl, factoryDir: ctx.factoryDir }),
             ...(r.approval_state === "revision_requested"
-                ? { revision: { instructions: r.completion_receipt?.instructions, next: `Submit a revised request that cites ${r.id} in refs.` } }
+                ? { revision: { instructions: r.completion_receipt?.instructions, next: `Revise it in place: revise_pending_request with request_id ${r.id} and expected_version ${versionOf(r)}.` } }
                 : {}),
         };
     }));
     server.registerTool("mission_status", {
         title: "Where a mission stands",
-        description: "One mission, joined and verified: its source request and decision, the sessions bound to it (live or not), its issues and PRs, what is approved, queued, delivered, running, merged, released or closed — each by its evidence, never inferred from an idle pane — and the next authorized action. Operator details need Miadi's write tier. jgwill/Miadi#893.",
+        description: "One mission, joined and verified: its source request and decision, the sessions bound to it (live or not), its issues and PRs, what is approved, queued, delivered, running, merged, released or closed — each by its evidence, never inferred from an idle pane — and the next authorized action. An issue or session resolves only through the request that holds it as primary; several are ambiguous_mission, citations alone are related_only, and an inference authorizes nothing (identity.authorizes_actions). Released needs a release receipt with artifact, target, production check and a fresh time; closed needs an approved session ending that cites the mission. Operator details need Miadi's write tier. jgwill/Miadi#893, #913.",
         inputSchema: {
             ref: z
                 .string()
@@ -667,10 +694,11 @@ export function registerTools(server, ctx) {
                 }
                 const res = await f(`https://api.github.com/repos/${owner}/${repo}/issues/${n}`, { headers, signal: AbortSignal.timeout(15_000) });
                 if (!res.ok)
-                    return { state: res.status === 404 ? "not_found_or_private" : `github_${res.status}` };
+                    return { state: "unverified", access: githubAccess(res.status, Boolean(process.env.GITHUB_TOKEN)) };
                 const i = await res.json();
                 return { state: i.state, title: i.title };
             },
+            liveVersionOf: (pkg) => (pkg === "@miadi/connector" ? VERSION : undefined),
         });
     }));
     server.registerTool("provider_capabilities", {
@@ -689,6 +717,63 @@ export function registerTools(server, ctx) {
             note: "A provider name in a task's text selects nothing; request_authorized_run's provider field is verified against this list, and an unavailable provider leaves the mission unstarted.",
         };
     }));
+    server.registerTool("mission_model_preflight", {
+        title: "Which provider and model fits a mission, and how that is known",
+        description: "A typed, versioned, read-only preflight for one mission (jgwill/Miadi#913): the candidate providers with their concrete model when the host shows one, sign-in evidence (config directory only), quota unknown, policy eligibility (the approved provider is kept; Claude Code only when named), a review floor, and a recommendation or an abstention with its reasons. It says where the choice came from: static_fallback, jev or a synthetic fixture. Jev is asked only with consult_jev and a Jev key in the connector's environment; that call is charged, and it carries no task text, mission id or repository name. A reported launch on another provider than the approved one fails closed as provider_mismatch. It authorizes nothing. Needs Miadi's write tier.",
+        inputSchema: {
+            ref: z.string().min(1).describe("The mission: run_request:<id> or work_proposal:<id> (an issue or session ref resolves only through its primary relation)."),
+            task_type: z.enum(TASK_TYPES),
+            criticality: z.enum(CRITICALITIES).default("normal"),
+            consult_jev: z.boolean().default(false).describe("Ask Jev to choose among the eligible options. Charged by Jev; off by default."),
+            launch: z
+                .object({
+                provider: z.enum(["codex", "pi", "copilot", "claude"]),
+                model: z.string().max(120).optional(),
+                evidence: z.string().min(1).max(500).describe("What shows it: a process line, a pane header."),
+            })
+                .optional()
+                .describe("What actually launched, as observed. A provider other than the approved one fails closed."),
+        },
+        annotations: READ,
+    }, wrap(async (a, extra) => {
+        const { person } = who(extra);
+        requireTier(person, "write");
+        const found = resolveMissionSubject(String(a.ref).trim(), records());
+        if (!found?.record) {
+            return {
+                contract: PREFLIGHT_CONTRACT,
+                version: PREFLIGHT_VERSION,
+                state: "mission_unresolved",
+                ref: a.ref,
+                identity: found ? { resolution: found.resolution, candidates: found.candidates } : { resolution: "not_found", candidates: [] },
+                note: "Name one mission by its record id; no model is chosen for an unidentified mission.",
+            };
+        }
+        const record = found.record;
+        const body = record.body;
+        const provider = (typeof body.resolved_provider === "string" ? body.resolved_provider : typeof body.provider === "string" ? body.provider : null);
+        const basis = record.approval_state === "approved" ? "approved" : "requested";
+        const candidates = candidatesFor(discoverProviders(ctx.providersProbe), provider, ctx.modelOf, basis);
+        const jevConfig = jevConfigOf(process.env);
+        const jev = a.consult_jev ? (ctx.jevAdapter ?? (jevConfig ? jevAdapter(jevConfig, ctx.approval?.fetchImpl ?? fetch) : undefined)) : undefined;
+        const configured = Boolean(jevConfig);
+        const primary = primaryIssueOf(record);
+        return modelPreflight({
+            mission: {
+                id: record.id,
+                resolution: found.resolution,
+                authorizes_actions: authorizesActions(found),
+                ...(primary ? { primary_issue: primary.ref } : {}),
+            },
+            approved_provider: provider,
+            provider_basis: basis,
+            task: a.task_type,
+            criticality: a.criticality,
+            candidates,
+            ...(a.launch ? { launch: a.launch } : {}),
+            ...(jev ? { adapter: jev } : { routerWhenAbsent: configured ? "not_requested" : "router_unconfigured" }),
+        });
+    }));
     // search / fetch: the pair ChatGPT uses for connectors in search and deep research.
     server.registerTool("search", {
         title: "Search Miadi",
@@ -969,12 +1054,13 @@ export function registerTools(server, ctx) {
     }));
     server.registerTool("propose_work", {
         title: "Propose work to a circle",
-        description: "Propose a bounded piece of work: what should exist when it is done, the circle accountable, the sources. Nothing starts until a person decides. Approving it starts the work as a factory run, with any changes the person writes; the person may instead send it back for revision with instructions (approval_state revision_requested, instructions in completion_receipt): then submit a revised proposal citing the old id in refs.",
+        description: "Propose a bounded piece of work: what should exist when it is done, the circle accountable, the sources. Nothing starts until a person decides. Approving it starts the work as a factory run, with any changes the person writes; the person may instead send it back for revision with instructions (approval_state revision_requested, instructions in completion_receipt): then revise it in place with revise_pending_request (same id). To change a proposal still awaiting a decision, revise it the same way rather than proposing again.",
         inputSchema: {
             title: z.string().min(1).max(200),
             desired_outcome: z.string().min(1).max(6000),
             circle,
             refs,
+            primary_issue: primaryIssue,
             repo: z.string().max(120).optional(),
             ...base,
         },
@@ -984,13 +1070,13 @@ export function registerTools(server, ctx) {
         requireContribute(auth);
         const r = append("work_proposal", person, auth, {
             circle: a.circle,
-            refs: a.refs,
+            refs: withPrimary(a.refs, a.primary_issue),
             intention: a.intention,
             role: a.role,
             idempotency_key: a.idempotency_key,
             state: "pending",
             approval_state: "awaiting_approval",
-            body: { title: a.title, desired_outcome: a.desired_outcome, repo: a.repo },
+            body: { title: a.title, desired_outcome: a.desired_outcome, repo: a.repo, ...(a.primary_issue ? { primary_issue: a.primary_issue } : {}) },
         });
         return { ...r, approval_url: approvalUrl(r.id) };
     }));
@@ -1027,6 +1113,11 @@ export function registerTools(server, ctx) {
             session_id: z.string().min(8),
             ending: z.enum(["exit", "complete_then_exit", "record_only"]),
             reason: z.string().min(1).max(4000),
+            mission: z
+                .string()
+                .regex(/^(run_request|work_proposal):[\w-]+$/)
+                .optional()
+                .describe("The mission this ending closes, by record id. Only an approved exit or complete_then_exit that names the mission here closes it in mission_status (jgwill/Miadi#913)."),
             evidence_refs: refs,
         },
         annotations: WRITE,
@@ -1036,24 +1127,25 @@ export function registerTools(server, ctx) {
         const id = a.session_id.replace(/^session:/, "");
         const r = append("session_completion_proposal", person, auth, {
             circle: "continuity",
-            refs: [`session:${id}`],
+            refs: a.mission ? [`session:${id}`, a.mission] : [`session:${id}`],
             evidence_refs: a.evidence_refs,
             approval_state: "awaiting_approval",
-            idempotency_key: `${id}:${a.ending}`,
-            body: { session_id: id, ending: a.ending, reason: a.reason },
+            idempotency_key: a.mission ? `${id}:${a.ending}:${a.mission}` : `${id}:${a.ending}`,
+            body: { session_id: id, ending: a.ending, reason: a.reason, ...(a.mission ? { mission: a.mission } : {}) },
         });
         return { ...r, approval_url: approvalUrl(r.id) };
     }));
     // ── requests: recorded, approved by a person on the approval page, then run ──
     server.registerTool("request_authorized_run", {
         title: "Request a bounded agent run",
-        description: "Ask for an agent session to do one bounded task. The request waits for a person with Miadi's write tier to approve it on the returned approval_url; once approved, a brief is queued for the factory intake, which opens or reaches the session within minutes. Read it back with get_run_result.",
+        description: "Ask for an agent session to do one bounded task. The request waits for a person with Miadi's write tier to approve it on the returned approval_url; once approved, a brief is queued for the factory intake, which opens or reaches the session within minutes. Read it back with get_run_result. This is for a new mission only: to change a request that still awaits a decision, call revise_pending_request with its id, so the person keeps one card to decide.",
         inputSchema: {
             task: z.string().min(1).max(12000).describe("What the session does and what it returns."),
             circle,
             refs,
+            primary_issue: primaryIssue,
             session: z.string().regex(/^[A-Za-z0-9._-]{3,80}$/).optional().describe("An existing tmux session to hand it to, or a name for a new one."),
-            cwd: z.string().max(300).optional().describe("Working folder for a new session (default the Miadi checkout)."),
+            cwd: z.string().max(300).optional().describe("Working folder for a new session (default: the factory runner's defaultCwd on the host)."),
             provider: z
                 .enum(["codex", "pi", "copilot", "claude"])
                 .optional()
@@ -1081,7 +1173,7 @@ export function registerTools(server, ctx) {
         }
         const r = append("run_request", person, auth, {
             circle: a.circle,
-            refs: a.refs,
+            refs: withPrimary(a.refs, a.primary_issue),
             intention: a.intention,
             role: a.role,
             idempotency_key: a.idempotency_key,
@@ -1093,6 +1185,7 @@ export function registerTools(server, ctx) {
                 cwd: a.cwd,
                 provider: a.provider,
                 resolved_provider: resolution.provider.id,
+                ...(a.primary_issue ? { primary_issue: a.primary_issue } : {}),
                 ...(a.steering ? { steering: a.steering } : {}),
             },
         });
@@ -1102,6 +1195,178 @@ export function registerTools(server, ctx) {
             approval_url: approvalUrl(r.id),
         };
     }));
+    // ── one mission, many versions, one decision (jgwill/Miadi#919) ────────────
+    const revisionOut = (r) => {
+        const live = all().find((x) => x.id === r.id) ?? r;
+        return {
+            request_id: live.id,
+            version: versionOf(live),
+            approval_url: approvalUrl(live.id),
+            projection: requestProjection(live, { reviewBase: ctx.approval?.config.reviewUrl, factoryDir: ctx.factoryDir }),
+        };
+    };
+    server.registerTool("revise_pending_request", {
+        title: "Revise a request that still awaits a decision",
+        description: "Change an agent run or a work proposal that waits for a decision, or that its approver sent back for revision, without making a new request. The request keeps its id, its approval page and its one card; the new content becomes the next version and every earlier version stays readable with get_request_history. Pass the version you are revising as expected_version: a request revised or decided since then is refused. Give only the fields that change. A request already approved, queued or declined is not revised: a change after a decision is a new request or a steer. Call show_decisions afterwards so the person sees the one current card.",
+        inputSchema: {
+            request_id: z.string().min(1).describe("The request's id, run_request:<uuid> or work_proposal:<uuid>."),
+            expected_version: z.number().int().min(1).describe("The version you read and are revising (projection.version, 1 for a request never revised)."),
+            reason: z.string().min(1).max(2000).describe("Why it changes, in the person's words when they gave them."),
+            changes: z
+                .object({
+                task: z.string().min(1).max(12000).optional().describe("Agent run: what the session does and returns."),
+                title: z.string().min(1).max(200).optional().describe("Work proposal: its title."),
+                desired_outcome: z.string().min(1).max(6000).optional().describe("Work proposal: what should exist when it is done."),
+                repo: z.string().max(120).optional(),
+                intention: z.string().max(2000).optional(),
+                circle: circle.optional(),
+                refs: z.array(z.string()).max(50).optional().describe("The whole new list of refs, replacing the old one."),
+                primary_issue: primaryIssue,
+                session: z.string().regex(/^[A-Za-z0-9._-]{3,80}$/).optional(),
+                cwd: z.string().max(300).optional(),
+                provider: z.enum(["codex", "pi", "copilot", "claude"]).optional().describe("Verified installed on the connector host again, as request_authorized_run does."),
+                steering: z
+                    .object({ max_attempts: z.number().int().min(1).max(20), expires_at: z.string().optional(), pane: z.string().regex(/^\d+\.\d+$/).optional() })
+                    .optional(),
+            })
+                .describe("Only the fields that change."),
+            idempotency_key: z.string().max(200).optional().describe("Repeat the same key to get the same revision back instead of a second one."),
+        },
+        annotations: WRITE,
+    }, wrap(async (a, extra) => {
+        const { person, auth } = who(extra);
+        requireContribute(auth);
+        const raw = ledger.all();
+        if (a.idempotency_key) {
+            const prior = raw.find((r) => r.supersedes === a.request_id && r.revision && r.idempotency_key === a.idempotency_key && r.actor.person_id === person.id);
+            if (prior)
+                return { ...revisionOut({ ...prior, id: a.request_id }), revised: prior.revision, repeated: true };
+        }
+        const live = all().find((r) => r.id === a.request_id);
+        const c = (a.changes ?? {});
+        const body = { ...(live?.body ?? {}) };
+        let provider;
+        if (live?.kind === "run_request") {
+            for (const k of ["task", "session", "cwd"])
+                if (c[k] !== undefined)
+                    body[k] = c[k];
+            if (c.steering !== undefined)
+                body.steering = c.steering;
+            if (c.provider !== undefined) {
+                const resolution = resolveProvider(c.provider, discoverProviders(ctx.providersProbe));
+                if (resolution.state === "provider_unknown")
+                    throw new ToolRefusal("invalid_request", resolution.message, { available: resolution.available });
+                if (resolution.state !== "ok")
+                    return { state: resolution.state, message: resolution.message, available: resolution.available, note: "Nothing was recorded; the request stays at its version." };
+                body.provider = c.provider;
+                body.resolved_provider = resolution.provider.id;
+                provider = { requested: c.provider, resolved: resolution.provider.id, explicit: resolution.explicit, version: resolution.provider.version };
+            }
+        }
+        else if (live?.kind === "work_proposal") {
+            for (const k of ["title", "desired_outcome", "repo"])
+                if (c[k] !== undefined)
+                    body[k] = c[k];
+        }
+        if (c.primary_issue !== undefined)
+            body.primary_issue = c.primary_issue;
+        const nextRefs = withPrimary(c.refs ?? live?.refs ?? [], c.primary_issue ?? body.primary_issue);
+        let record;
+        try {
+            record = revisionRecord(live, { intention: c.intention ?? live?.intention, circle: c.circle ?? live?.circle, refs: nextRefs, body }, {
+                id: newRecordId(live?.kind ?? "run_request"),
+                person: { id: person.id, name: person.name, writer: person.api_tier === "write" },
+                actor: actorOf(person, auth),
+                expectedVersion: a.expected_version,
+                reason: a.reason,
+                beingDecided: isBeingDecided(a.request_id),
+                idempotency_key: a.idempotency_key,
+            });
+        }
+        catch (error) {
+            if (error instanceof RevisionRefused) {
+                throw new ToolRefusal(error.code, error.message, { ...(error.detail ?? {}), ...(live ? revisionOut(live) : {}) });
+            }
+            throw error;
+        }
+        ledger.append(record);
+        return {
+            ...revisionOut(record.supersedes ? { ...record, id: record.supersedes } : record),
+            revised: record.revision,
+            ...(provider ? { provider } : {}),
+            note: `One request, one approval: its page and card now show version ${record.revision.version}. Earlier versions stay readable with get_request_history.`,
+        };
+    }));
+    server.registerTool("get_request_history", {
+        title: "Every version of a request",
+        description: "Every version of an agent run or work proposal, oldest first, with who changed it, when, why, which fields changed and each version's content hash, and the decisions taken on it. Earlier requests joined to it as its earlier versions (supersede_pending_requests) are included. A request retired that way names the request that stands.",
+        inputSchema: { request_id: z.string().min(1) },
+        annotations: READ,
+    }, wrap(async ({ request_id }, extra) => {
+        const { person } = who(extra);
+        const live = all().find((r) => r.id === request_id);
+        if (!live || !isApprovable(live))
+            return { state: "not_found", request_id };
+        if (person.api_tier !== "write" && live.actor.person_id !== person.id) {
+            throw new ToolRefusal("forbidden", "A request's history is read by whoever asked and by people with Miadi's write tier.");
+        }
+        const raw = ledger.all();
+        const versions = requestHistory(request_id, raw, all()).map((v) => {
+            const content = v.content;
+            const shownBody = redact({ ...live, body: (content.body ?? {}) }).body;
+            return { ...v, content: { ...content, body: shownBody } };
+        });
+        const decisions = raw
+            .filter((r) => r.supersedes && versions.some((v) => v.request_id === r.supersedes) && !r.revision && !r.lineage && r.completion_receipt)
+            .map((r) => {
+            const rc = r.completion_receipt;
+            return { request_id: r.supersedes, at: rc.decided_at ?? r.created_at, decision: rc.decision, by: rc.decided_by?.name, version: rc.version, superseded_by: rc.superseded_by, instructions: rc.instructions, reason: rc.reason };
+        });
+        const receipt = (live.completion_receipt ?? {});
+        return {
+            request_id,
+            version: versionOf(live),
+            versions,
+            decisions,
+            ...(receipt.decision === "superseded" ? { superseded_by: receipt.superseded_by, note: `This request was retired as an earlier version of ${receipt.superseded_by}; read that one's history for every version.` } : {}),
+            projection: requestProjection(live, { reviewBase: ctx.approval?.config.reviewUrl, factoryDir: ctx.factoryDir }),
+        };
+    }));
+    server.registerTool("supersede_pending_requests", {
+        title: "Join earlier requests to the one that stands",
+        description: "For requests made before revise_pending_request existed, one new request per revision: name the request that stands and, by exact id, the earlier requests that are its earlier versions. Each named request must still await a decision and be asked by the same person; each is retired (it can no longer be approved, and its card and page say which request to decide instead) and becomes an earlier version of the standing request, readable with get_request_history. All are checked before anything is written. Never infer which requests are duplicates: retire only ids the person named or confirmed. A request already approved or queued is refused, never cancelled.",
+        inputSchema: {
+            request_id: z.string().min(1).describe("The request that stands, the one the person will decide."),
+            supersede: z.array(z.string().min(1)).min(1).max(10).describe("The exact ids of the earlier requests it replaces."),
+            reason: z.string().min(1).max(2000).describe("Why they are one mission, in the person's words when they gave them."),
+        },
+        annotations: WRITE,
+    }, wrap(async (a, extra) => {
+        const { person, auth } = who(extra);
+        requireContribute(auth);
+        let out;
+        try {
+            out = supersedeRecords(all(), a.request_id, a.supersede, {
+                person: { id: person.id, name: person.name, writer: person.api_tier === "write" },
+                actor: actorOf(person, auth),
+                reason: a.reason,
+                beingDecided: isBeingDecided,
+                newId: newRecordId,
+            });
+        }
+        catch (error) {
+            if (error instanceof RevisionRefused)
+                throw new ToolRefusal(error.code, error.message, error.detail);
+            throw error;
+        }
+        for (const r of out)
+            ledger.append(r);
+        return {
+            ...revisionOut({ ...out[out.length - 1], id: a.request_id }),
+            retired: a.supersede,
+            note: "The standing request is now the one card to decide; the retired requests are its earlier versions (get_request_history).",
+        };
+    }));
     server.registerTool("request_session_steer", {
         title: "Send one authorized follow-up to a running agent",
         description: "Steer one existing live agent session within an approved run's steering grant (jgwill/Miadi#893): the exact instruction is typed into the mission's bound pane — never whichever pane is active — after a peek, and a re-peek verifies the agent accepted it. When the approved run carries no steering grant covering this, the steer waits for one explicit scoped human decision on the returned approval_url. Every attempt leaves a durable artifact with its hash and both captures.",
@@ -1449,7 +1714,8 @@ export function registerTools(server, ctx) {
                 id: r.id,
                 kind: r.kind,
                 kind_label: KIND_LABELS[r.kind] ?? r.kind,
-                title: titleOf(r),
+                title: versionOf(r) > 1 ? `${titleOf(r)} · version ${versionOf(r)}` : titleOf(r),
+                version: versionOf(r),
                 by: r.actor.name,
                 via: r.actor.client_name,
                 created_at: r.created_at,
@@ -1461,7 +1727,8 @@ export function registerTools(server, ctx) {
                 projection: requestProjection(r, { reviewBase: ctx.approval?.config.reviewUrl, factoryDir: ctx.factoryDir }),
             }));
             const actionable = decisions.filter((d) => d.projection?.stage === "awaiting_decision");
-            const tokens = canDecide ? Object.fromEntries(actionable.map((r) => [r.id, ctx.decisionTokens.issue(r.id, person.id, auth.clientId)])) : {};
+            // Each token is bound to the version its card shows: a card left open while the request is revised cannot approve it (#919).
+            const tokens = canDecide ? Object.fromEntries(actionable.map((r) => [r.id, ctx.decisionTokens.issue(r.id, person.id, auth.clientId, undefined, r.version)])) : {};
             const structured = {
                 decisions,
                 count: decisions.length,
@@ -1504,11 +1771,14 @@ export function registerTools(server, ctx) {
             const r = all().find((x) => x.id === a.record_id);
             if (!isApprovable(r))
                 throw new ToolRefusal("not_found", "No request with that id.");
-            const check = ctx.decisionTokens.verify(a.decision_token, r.id, person.id, auth.clientId);
-            if (check !== "ok")
-                throw new ToolRefusal(check === "expired" ? "token_expired" : "invalid_token", check === "expired" ? "This card is too old; show the requests again." : "This decision did not come from the person's card.");
             // A stale card or a second client gets where the request stands, not a bare refusal (jgwill/Miadi#889).
             const projectionNow = () => requestProjection(all().find((x) => x.id === r.id) ?? r, { reviewBase: ctx.approval?.config.reviewUrl, factoryDir: ctx.factoryDir });
+            const check = ctx.decisionTokens.verify(a.decision_token, r.id, person.id, auth.clientId, undefined, versionOf(r));
+            if (check === "stale") {
+                throw new ToolRefusal("stale_version", `This card showed an earlier version; the request is now at version ${versionOf(r)}. Show the requests again and decide version ${versionOf(r)}.`, { projection: projectionNow() });
+            }
+            if (check !== "ok")
+                throw new ToolRefusal(check === "expired" ? "token_expired" : "invalid_token", check === "expired" ? "This card is too old; show the requests again." : "This decision did not come from the person's card.");
             if (r.approval_state !== "awaiting_approval") {
                 throw new ToolRefusal("already_decided", `This request is already ${r.approval_state}.`, { projection: projectionNow() });
             }
@@ -1522,9 +1792,12 @@ export function registerTools(server, ctx) {
                 decided = await decide(r, person, a.decision, ctx.approval, {
                     instructions,
                     via: `card:${String(client?.client_name ?? auth.clientId).slice(0, 50)}`,
+                    expectedVersion: versionOf(r),
                 });
             }
             catch (error) {
+                if (error instanceof StaleVersion)
+                    throw new ToolRefusal("stale_version", error.message, { projection: projectionNow() });
                 // A decision recorded a moment earlier, by another client, is reported with where it stands.
                 if (error instanceof AlreadyDecided)
                     throw new ToolRefusal("already_decided", error.message, { projection: projectionNow() });
@@ -1537,7 +1810,7 @@ export function registerTools(server, ctx) {
                 : decision === "revision_requested"
                     ? `Sent back for revision by ${person.name}.`
                     : `Declined by ${person.name}.`;
-            const out = { record_id: r.id, decision, state, summary, receipt, projection };
+            const out = { record_id: r.id, version: versionOf(r), decision, state, summary, receipt, projection };
             return { structuredContent: out, content: [{ type: "text", text: JSON.stringify(out, null, 2) }] };
         }
         catch (error) {
@@ -1613,6 +1886,7 @@ export const TOOL_STATUS = {
     list_records: "live",
     get_run_result: "live",
     mission_status: "live (operator details need the Miadi write tier)",
+    mission_model_preflight: "live, Miadi write tier (static policy; Jev only with consult_jev and a Jev key on the host, otherwise router_unconfigured)",
     provider_capabilities: "live, Miadi write tier",
     search: "live",
     fetch: "live",
@@ -1628,6 +1902,9 @@ export const TOOL_STATUS = {
     prepare_calendar_event: "live, contribute (draft and .ics only)",
     propose_session_completion: "live, contribute, needs_approval (decision recorded, nothing closed)",
     request_authorized_run: "live, contribute, needs_approval (queues a factory brief once approved; may name a verified provider and a bounded steering grant)",
+    revise_pending_request: "live, contribute (a waiting or sent-back run or proposal gets its next version; same id, same card)",
+    get_request_history: "live (every version of a request, oldest first; whoever asked, or the write tier)",
+    supersede_pending_requests: "live, contribute (retires named earlier requests still waiting and joins them as earlier versions of the one that stands)",
     request_session_steer: "live, contribute, write tier (runs inside an approved run's steering grant, else one scoped human decision)",
     request_review_operation: "live, contribute, needs_approval",
     request_deep_diver: "live, contribute, needs_approval",

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.1.12";
+export declare const VERSION = "0.1.14";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.1.12";
+export const VERSION = "0.1.14";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miadi/connector",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "The Miadi connector: one remote MCP service through which a person signed in with their Miadi person token, from ChatGPT or any MCP client, reads sessions, reviews, episodes and circles and records observations, inquiries, handoffs and proposals with their name on each record.",
   "license": "MIT",
   "author": "Miadi",