@miadi/connector 0.1.19 → 0.1.20

package/README.md

@@ -62,7 +62,9 @@ A mission is found by the issue it implements (jgwill/Miadi#913). `request_autho
 
 `request_session_steer` sends one authorized follow-up to one existing live agent, within the steering grant an approved run carries (`steering: { max_attempts, expires_at, pane }` on `request_authorized_run`). It peeks at the bound pane — the grant's pane or the session's first pane, never whichever pane is active — refuses a busy agent or a pane that is not an agent, types the exact instruction literally, and re-peeks to verify the agent accepted it (`accepted`) or only holds it at the prompt (`submitted`). Every attempt leaves a durable artifact with the instruction's sha256, its grant, its target and both captures. When the factory recorded the mission's pane, the steer goes to that pane id and nowhere else: another session is `stale_binding`, another pane `wrong_pane`, a replaced pane `stale_binding`, and text already at the prompt `composing` (nothing typed, Enter not pressed). A pane whose prompt box cannot be read (any TUI but Claude Code's today) is `blocked`. Every tmux address is exact (`=name:w.p`), because tmux otherwise matches a session by the start of its name. Only a steer that typed its instruction uses one of the grant's attempts (`typed`, and `attempts` in the answer). The connector's service steers through the tmux server of the user it runs as; `get_capabilities.steering` says whether that transport answers now, and while it does not, `request_session_steer` records nothing and uses no attempt. A steer the grant does not cover waits for one explicit scoped human decision on its `approval_url`, which runs exactly that instruction once.
 
-`request_authorized_run` may name a `provider` (`codex`, `pi`, `copilot`, `claude`). The connector verifies it is installed on the host before recording anything; an unknown or unavailable provider answers `provider_unavailable` and the mission stays unstarted. With no provider named, the first installed provider in the preference order is resolved and named in the brief; Claude Code is never chosen silently — it runs only when named. `provider_capabilities` (write tier) reports what the host has installed, the sign-in evidence, the preference order, and the read-only Jev check: `unconfigured` without `JEV_AI_API_KEY` or `TYPESAFE_API_KEY` in the connector's environment, else the models Jev lists for the key (no charge). A provider name inside a task's text selects nothing.
+`request_authorized_run` may name a `provider` (`codex`, `pi`, `copilot`, `claude`). The connector verifies it is installed on the host before recording anything; an unknown or unavailable provider answers `provider_unavailable` and the mission stays unstarted. With no provider named, the first installed provider in the preference order that may be picked by default (Pi, then Copilot) is resolved and named in the brief; Codex and Claude Code are never chosen silently, each runs only when named. `provider_capabilities` (write tier) reports what the host has installed, the sign-in evidence, the preference order, and the read-only Jev check: `unconfigured` without `JEV_AI_API_KEY` or `TYPESAFE_API_KEY` in the connector's environment, else the models Jev lists for the key (no charge). A provider name inside a task's text selects nothing.
+
+**Codex runs only on its requester's own choice (jgwill/Miadi#926).** The provider field is the caller's: the connector cannot read the chat, so `provider: "codex"` chooses nothing for the person. A run that names Codex is recorded, and its answer says it `needs_person_choice`. The approval page then shows no Approve button. Only the requester, signed in there with their own Miadi person token, can tick and send "Choose codex for this mission". That `provider_choice` record is bound to the request id, its version and its content hash, must be under 24 hours old when the request is approved, and covers that one mission. A revision makes it stale. A generic Approve, on the page or on a card, is refused as `provider_choice_required`, and so is a choice by any other person or by a service token. The requester can instead set their own policy at `/providers` so their requests may name Codex without a per-mission choice; that policy is theirs only and revisable. The check runs at request, revision, approval, and where the brief is written (approval and every rerun). The brief carries `provider_authorization` and `provider_choice` (or `provider_policy`), and the factory runner refuses to launch Codex for a connector brief without them. `request_authorized_run`, `revise_pending_request`, `mission_status`, `show_decisions` and `mission_model_preflight` show `provider_authorization`; after approval it is also in the request's `completion_receipt`, which `get_run_result` returns. A Codex launch without it is named on the mission and fails the preflight closed as `provider_not_authorized`. A brief the runner refuses goes to `queue/refused/` with its reason, and the request shows it. Other providers keep their regular policy, and nothing falls back to Codex. What this does not cover: anyone who can write `/srv/miadi/factory/queue` or the connector's state directory can forge a brief or a record (the folder's permissions are the boundary); a configured launcher that runs Codex behind a wrapper whose name does not say codex is trusted as configured; a brief to an existing session reaches only an idle Claude Code agent today, so it is not checked; and an agent that starts `codex` itself from inside its session is outside the connector's reach.
 
 `mission_model_preflight` (write tier) answers, for one mission, which provider and model fit its task type and criticality, and how that is known: contract `miadi.mission_model_preflight` v1, candidates with their configured default model, sign-in evidence (config directory only), quota `unknown`, policy eligibility, a review floor, and a recommendation or an abstention with reasons. Its `decider.source` is `static_fallback`, `jev` or `synthetic_fixture`. Jev is asked only with `consult_jev: true` and a key on the host; it is sent task type, criticality and candidates, never task text, mission id or repository, and its answer is advisory: uncalibrated, below 0.8 or outside the contract, the preflight abstains. A reported `launch` on another provider than the approved one answers `provider_mismatch` before anything is asked. It authorizes nothing. `bench/model-preflight-bench.mjs` compares the 0.1.12 baseline, the static preflight and Jev on synthetic scenarios; `bench/results/` keeps the runs.
 

package/dist/approve.d.ts

@@ -17,6 +17,7 @@ import { type MiadiPerson } from "./people.js";
 import { type ConnectorRecord } from "./records.js";
 import { type RequestProjection } from "./request-state.js";
 import { type TmuxLike } from "./steer.js";
+import { type ProviderAuthorization } from "./provider-policy.js";
 export { factoryDir, runBriefFile, readQueueState } from "./queue-state.js";
 export interface ApprovalDeps {
     config: ConnectorConfig;
@@ -55,7 +56,7 @@ export declare const DECISIONS: readonly ["approve", "approve_with_changes", "re
 export type Decision = (typeof DECISIONS)[number];
 /** The task a work proposal asks for, written from the proposal's own fields. */
 export declare function proposalTask(record: ConnectorRecord): string;
-export declare function runBrief(record: ConnectorRecord, approver: MiadiPerson, sessions: string[], instructions?: string): {
+export declare function runBrief(record: ConnectorRecord, approver: MiadiPerson, sessions: string[], instructions?: string, providerAttrs?: Record<string, string>): {
     to: string;
     brief: string;
 };
@@ -83,6 +84,14 @@ export declare class StaleVersion extends AlreadyDecided {
     readonly decidedVersion: number;
     constructor(currentVersion: number, decidedVersion: number);
 }
+/**
+ * An approval of a run whose provider needs the requester's own choice for this mission,
+ * and has none (jgwill/Miadi#926). Declining or sending it back stays possible.
+ */
+export declare class ProviderChoiceRequired extends Error {
+    readonly authorization: ProviderAuthorization;
+    constructor(authorization: ProviderAuthorization);
+}
 /** What a decision answers: the state it left, its receipt, and `replayed` when it repeats a decision already taken. */
 export interface Decided {
     decision: NonNullable<ConnectorRecord["approval_state"]>;
@@ -135,7 +144,7 @@ export declare function rerun(r: ConnectorRecord, person: MiadiPerson, deps: App
 }>;
 export declare function isApprovable(r: ConnectorRecord | undefined): r is ConnectorRecord;
 /** What approving a request does, in one sentence, for the card a person decides on. */
-export declare function consequenceOf(r: ConnectorRecord): string;
+export declare function consequenceOf(r: ConnectorRecord, authorization?: ProviderAuthorization): string;
 export declare function registerApprovalRoutes(app: Express, deps: ApprovalDeps): void;
 /** The request, and the decision form for a write-tier person (their token carried in the form they just signed into). */
 /**
@@ -146,5 +155,7 @@ export declare function requestProjection(record: ConnectorRecord, opts?: {
     reviewBase?: string;
     factoryDir?: string;
 }): RequestProjection | null;
+/** The person's own provider policy page: read and change it, signed in with their person token (jgwill/Miadi#926). */
+export declare function registerProviderPolicyRoutes(app: Express, deps: Pick<ApprovalDeps, "ledger" | "identify" | "log">): void;
 /** How a request is named to a person. */
 export declare const KIND_LABELS: Record<string, string>;

package/dist/approve.js

@@ -24,6 +24,8 @@ import { factoryDir, runBriefFile, readQueueState } from "./queue-state.js";
 import { factoryLedgerPath, readFactoryReceipts, receiptsForRecord } from "./factory-receipt.js";
 import { steerAttempts, steerSession, tmuxAdapter } from "./steer.js";
 import { contentHash, versionOf } from "./revisions.js";
+import { canReadReading } from "./reading/privacy.js";
+import { authorizationReceipt, authorizeProvider, briefAttributes, CHOICE_TTL_MS, CODEX_POLICIES, isPersonId, needsPersonChoice, providerPolicyOf, } from "./provider-policy.js";
 export { factoryDir, runBriefFile, readQueueState } from "./queue-state.js";
 /**
  * One line per step of a decision, for the journal: the request, a correlation id,
@@ -103,8 +105,10 @@ export function proposalTask(record) {
     }
     return lines.join("\n");
 }
-export function runBrief(record, approver, sessions, instructions) {
+export function runBrief(record, approver, sessions, instructions, providerAttrs = {}) {
     const body = (record.kind === "work_proposal" ? { task: proposalTask(record) } : record.body);
+    // A request recorded before providers were resolved (jgwill/Miadi#893) names only what was asked (#926 review RR7).
+    const provider = body.resolved_provider ?? body.provider;
     const short = record.id.split(":")[1]?.slice(0, 8) ?? "run";
     const to = body.session && sessions.includes(body.session) ? body.session : `new:${body.session ?? `connector-${yymmdd()}-${short}`}`;
     // A new session opens where the request says, else where the factory runner's config says (defaultCwd): no host path here (#911).
@@ -116,7 +120,9 @@ export function runBrief(record, approver, sessions, instructions) {
         `record="${attr(record.id)}"`,
         `version="${versionOf(record)}"`,
         // The provider the connector verified at request time (jgwill/Miadi#893); the intake may honour it or record why not.
-        ...(body.resolved_provider ? [`provider="${attr(body.resolved_provider)}"`] : []),
+        ...(provider ? [`provider="${attr(provider)}"`] : []),
+        // What authorizes a provider that needs the requester's own choice; the runner refuses Codex without it (jgwill/Miadi#926).
+        ...Object.entries(providerAttrs).map(([k, v]) => `${k}="${attr(v)}"`),
         ...(to.startsWith("new:") && cwd ? [`cwd="${attr(cwd)}"`] : []),
     ];
     const lines = [
@@ -189,6 +195,11 @@ export async function executeApproved(record, approver, deps, instructions) {
         return { status: res.status, ok: res.ok, response: parsed };
     };
     const queueBrief = () => {
+        // Checked again where the brief is written: an approval, and every rerun of it (jgwill/Miadi#926).
+        const authorization = record.kind === "run_request" ? authorizeProvider(record, deps.ledger.all()) : undefined;
+        if (authorization && !authorization.authorized) {
+            return { outcome: "failed", provider_authorization: authorizationReceipt(authorization), message: `No brief was written. ${authorization.explanation}` };
+        }
         const queue = join(deps.factoryDir ?? factoryDir(), "queue");
         mkdirSync(queue, { recursive: true });
         // A lister that cannot answer means no session is known live: the brief opens a new one (#922 R16).
@@ -199,10 +210,16 @@ export async function executeApproved(record, approver, deps, instructions) {
         catch {
             sessions = [];
         }
-        const { to, brief } = runBrief(record, approver, sessions, instructions);
+        const { to, brief } = runBrief(record, approver, sessions, instructions, authorization ? briefAttributes(authorization) : {});
         const file = runBriefFile(record);
         writeFileSync(join(queue, file), brief, { flag: "wx", mode: 0o640 });
-        return { outcome: "queued", to, file, note: "The factory intake delivers queued briefs every 5 minutes." };
+        return {
+            outcome: "queued",
+            to,
+            file,
+            ...(authorization ? { provider_authorization: authorizationReceipt(authorization) } : {}),
+            note: "The factory intake delivers queued briefs every 5 minutes.",
+        };
     };
     switch (record.kind) {
         case "run_request":
@@ -357,6 +374,17 @@ export class StaleVersion extends AlreadyDecided {
         this.decidedVersion = decidedVersion;
     }
 }
+/**
+ * An approval of a run whose provider needs the requester's own choice for this mission,
+ * and has none (jgwill/Miadi#926). Declining or sending it back stays possible.
+ */
+export class ProviderChoiceRequired extends Error {
+    authorization;
+    constructor(authorization) {
+        super(authorization.explanation);
+        this.authorization = authorization;
+    }
+}
 /** The decisions being recorded now, by request id: one at a time per request, in this process. */
 const deciding = new Map();
 /** Whether a decision on this request is being recorded now, its run may still be going. */
@@ -414,6 +442,14 @@ export async function decide(r, person, choice, deps, opts) {
     }
     if (versionOf(live) !== decidedVersion)
         throw new StaleVersion(versionOf(live), decidedVersion);
+    // A generic approval never chooses Codex: the requester's own fresh choice or policy must already stand (jgwill/Miadi#926).
+    if (live.kind === "run_request" && approvalStateOf(choice) === "approved") {
+        const authorization = authorizeProvider(live, deps.ledger.all(), { requireFresh: true });
+        if (!authorization.authorized) {
+            logDecision(deps, { phase: "provider_choice_required", record: r.id, via: opts.via, choice, provider: authorization.provider });
+            throw new ProviderChoiceRequired(authorization);
+        }
+    }
     const entry = { ...asked, correlation: randomUUID(), started: Date.now() };
     deciding.set(r.id, entry);
     entry.promise = decideOnce(live, person, choice, deps, { ...opts, correlation: entry.correlation, started: entry.started });
@@ -602,11 +638,13 @@ export function isApprovable(r) {
     return Boolean(r && APPROVABLE.has(r.kind));
 }
 /** What approving a request does, in one sentence, for the card a person decides on. */
-export function consequenceOf(r) {
+export function consequenceOf(r, authorization) {
     const b = r.body;
     switch (r.kind) {
         case "run_request":
-            return "Approving queues a brief for the factory intake, which opens or reaches an agent session within minutes.";
+            return authorization && !authorization.authorized
+                ? `Approving is refused until ${r.actor.name} chooses ${authorization.provider} for this mission on its approval page; approving does not choose it. Declining or sending it back stays possible.`
+                : `Approving queues a brief for the factory intake, which opens or reaches an agent session within minutes${authorization?.provider ? ` with ${authorization.provider}` : ""}.`;
         case "work_proposal":
             return "Approving starts the work: a brief written from the proposal and your instructions is queued for an agent session.";
         case "review_operation_request":
@@ -658,8 +696,43 @@ export function registerApprovalRoutes(app, deps) {
         if (!writer && r.actor.person_id !== person.id) {
             return void res.status(403).type("html").send(signInToRead(r, `Reading and deciding this request needs Miadi's write tier; ${person.name} has ${person.api_tier ?? "no API tier"}.`));
         }
+        const requester = r.actor.person_id === person.id && isPersonId(person.id);
         if (!body.decision)
-            return void res.type("html").send(approvePage(deps, r, { token: writer ? token : undefined }));
+            return void res.type("html").send(approvePage(deps, r, { token: writer ? token : undefined, chooserToken: requester ? token : undefined }));
+        if (body.decision === "choose_provider") {
+            // The requester's own, separate choice of a provider that needs one, for this version only (jgwill/Miadi#926).
+            const live = find(r.id);
+            const again = (status, error) => void res.status(status).type("html").send(approvePage(deps, live, { token: writer ? token : undefined, chooserToken: requester ? token : undefined, error }));
+            if (!requester) {
+                return again(403, isPersonId(r.actor.person_id)
+                    ? `Only ${r.actor.name}, who asked, can choose a provider for their own mission.`
+                    : `${r.actor.name} is a service token: only a person chooses a provider, for a request of their own. Name another provider for this request.`);
+            }
+            if (live.approval_state !== "awaiting_approval" || isBeingDecided(live.id))
+                return again(409, "A provider is chosen only while the request awaits a decision.");
+            const provider = String(body.provider ?? "");
+            const named = authorizeProvider(live, deps.ledger.all(), { requireFresh: true });
+            if (!needsPersonChoice(provider) || provider !== named.provider)
+                return again(400, `This request names ${named.provider ?? "no provider"}; only that provider can be chosen here.`);
+            if (Number(body.version) !== versionOf(live))
+                return again(409, `This request is now at version ${versionOf(live)}. Read it and choose again.`);
+            if (body.confirm !== "yes")
+                return again(400, `Tick the box to choose ${provider} for this mission.`);
+            if (!named.authorized || named.state !== "person_choice") {
+                deps.ledger.append({
+                    id: newRecordId("provider_choice"),
+                    kind: "provider_choice",
+                    created_at: new Date().toISOString(),
+                    actor: { person_id: person.id, name: person.name, client_id: "approval-page" },
+                    refs: [live.id],
+                    evidence_refs: [],
+                    claim_category: "observed",
+                    body: { request_id: live.id, provider, version: versionOf(live), content_hash: contentHash(live) },
+                });
+                logDecision(deps, { phase: "provider_chosen", record: live.id, provider, version: versionOf(live) });
+            }
+            return void res.type("html").send(approvePage(deps, find(r.id), { token: writer ? token : undefined, chooserToken: token }));
+        }
         if (!writer)
             return void res.status(403).type("html").send(approvePage(deps, r, { error: `Deciding needs Miadi's write tier; ${person.name} has ${person.api_tier ?? "no API tier"}.` }));
         if (body.decision === "rerun") {
@@ -705,6 +778,9 @@ export function registerApprovalRoutes(app, deps) {
             decided = settled;
         }
         catch (error) {
+            if (error instanceof ProviderChoiceRequired) {
+                return void res.status(409).type("html").send(approvePage(deps, find(r.id), { token, chooserToken: requester ? token : undefined, error: error.message }));
+            }
             if (error instanceof StaleVersion)
                 return void res.status(409).type("html").send(approvePage(deps, find(r.id), { token, error: error.message }));
             if (error instanceof AlreadyDecided)
@@ -746,6 +822,9 @@ export function registerApprovalRoutes(app, deps) {
         const r = find(String(req.params.id));
         if (!r)
             return void res.status(404).type("html").send(page("Not found", "<h1>No record with that id</h1>"));
+        if (!canReadReading(r, current(deps.ledger.all()), person)) {
+            return void res.status(403).type("html").send(page("Miadi record", recordForm(String(req.params.id), "This source and its reading are private to the source owner and factory operators.")));
+        }
         if (!person.api_tier && r.actor.person_id !== person.id) {
             return void res.status(403).type("html").send(page("Miadi record", recordForm(String(req.params.id), `Reading records needs Miadi's read tier; ${person.name} has none.`)));
         }
@@ -806,8 +885,12 @@ function approvePage(deps, r, o = {}) {
     const open = r.approval_state === "awaiting_approval";
     // A decision being recorded offers no buttons: a second click would decide the same request again.
     const actionable = open && !isBeingDecided(r.id);
+    // Freshness binds a decision still to come; a decided run shows the authorization it holds (#926 review R1).
+    const authorization = r.kind === "run_request" ? authorizeProvider(r, deps.ledger.all(), { requireFresh: open }) : undefined;
+    const blocked = Boolean(authorization && !authorization.authorized);
     return page("Approve a Miadi request", `<h1>${open ? "Approve a request" : "A decided request"}</h1>
-${actionable ? `<p>${escapeHtml(consequenceOf(r))} Declining records your refusal. Either is kept in the ledger with your name.</p>` : ""}
+${actionable ? `<p>${escapeHtml(consequenceOf(r, authorization))} Declining records your refusal. Either is kept in the ledger with your name.</p>` : ""}
+${authorization ? providerSection(r, authorization, actionable ? o.chooserToken : undefined) : ""}
 ${summary(r)}
 ${projectionBlock(projectionOf(r, deps), open ? undefined : r.completion_receipt)}
 ${o.error ? `<p class="err" role="alert">${escapeHtml(o.error)}</p>` : ""}
@@ -818,8 +901,10 @@ ${actionable && o.token
 <label for="i">Instructions (needed to approve with changes or to send back)</label>
 <textarea id="i" name="instructions" rows="4"></textarea>
 <div class="row">
-<button class="primary" type="submit" name="decision" value="approve">Approve and run</button>
-<button type="submit" name="decision" value="approve_with_changes">Approve with my changes</button>
+${blocked
+            ? ""
+            : `<button class="primary" type="submit" name="decision" value="approve">Approve and run</button>
+<button type="submit" name="decision" value="approve_with_changes">Approve with my changes</button>`}
 <button type="submit" name="decision" value="request_revision">Send back for revision</button>
 <button type="submit" name="decision" value="decline">Decline</button>
 </div></form>`
@@ -834,6 +919,87 @@ ${actionable && o.token
 <div class="row"><button class="primary" type="submit" name="decision" value="rerun">Run it again</button></div></form>`
                     : ""}`);
 }
+/**
+ * Which provider a run launches with, who chose it, and, when the requester's own choice is
+ * missing, the separate control only the requester sees (jgwill/Miadi#926).
+ */
+function providerSection(r, a, chooserToken) {
+    const lines = [
+        `<dt>Provider</dt><dd>${escapeHtml(a.provider ?? "the factory runner's default")}</dd>`,
+        `<dt>Asked for</dt><dd>${escapeHtml(a.requested ?? "none named")}${a.requester.client ? ` (through ${escapeHtml(a.requester.client)})` : ""}</dd>`,
+        `<dt>Authorized by</dt><dd>${escapeHtml(a.state.replace(/_/g, " "))}</dd>`,
+    ].join("");
+    const choose = a.state === "needs_person_choice" && chooserToken && a.provider
+        ? `<form method="post">
+<input type="hidden" name="person_token" value="${escapeHtml(chooserToken)}">
+<input type="hidden" name="version" value="${versionOf(r)}">
+<input type="hidden" name="provider" value="${escapeHtml(a.provider)}">
+<label><input type="checkbox" name="confirm" value="yes" required> I choose ${escapeHtml(a.provider)} for this mission (version ${versionOf(r)}) myself. It does not cover any other mission.</label>
+<div class="row"><button type="submit" name="decision" value="choose_provider">Choose ${escapeHtml(a.provider)} for this mission</button></div>
+</form>`
+        : a.state === "needs_person_choice" && !isPersonId(r.actor.person_id)
+            ? ""
+            : a.state === "needs_person_choice"
+                ? `<p>Only ${escapeHtml(r.actor.name)}, who asked, can choose ${escapeHtml(a.provider ?? "")} for this mission, signed in here. Within ${CHOICE_TTL_MS / 3_600_000} hours of that choice it can be approved.</p>`
+                : "";
+    return `<section aria-label="Provider"><dl>${lines}</dl><p>${escapeHtml(a.explanation)}</p>${choose}</section>`;
+}
+/** The person's own provider policy page: read and change it, signed in with their person token (jgwill/Miadi#926). */
+export function registerProviderPolicyRoutes(app, deps) {
+    const form = express.urlencoded({ extended: false, limit: "16kb" });
+    const signIn = (error) => page("Your provider policy", `<h1>Your provider policy</h1><p>Which agent providers a request made in your name may name. Sign in to read or change yours; it applies to your requests only.</p>
+${error ? `<p class="err" role="alert">${escapeHtml(error)}</p>` : ""}
+<form method="post"><label for="t">Your Miadi person token</label><input id="t" name="person_token" type="password" autocomplete="off" required>
+<div class="row"><button class="primary" type="submit">Read my policy</button></div></form>`);
+    app.get("/providers", (_req, res) => void res.type("html").send(signIn()));
+    app.post("/providers", form, async (req, res) => {
+        const body = (req.body ?? {});
+        const token = String(body.person_token ?? "").trim();
+        let person;
+        try {
+            person = await deps.identify(token);
+        }
+        catch (error) {
+            if (!(error instanceof MiadiUnavailable))
+                throw error;
+            return void res.status(503).type("html").send(signIn("Miadi could not be reached. Try again in a minute."));
+        }
+        if (!person)
+            return void res.status(401).type("html").send(signIn("Miadi did not recognise that person token."));
+        if (!isPersonId(person.id))
+            return void res.status(403).type("html").send(signIn("A service token has no provider policy; a person sets their own."));
+        let saved = "";
+        if (body.codex !== undefined) {
+            if (!CODEX_POLICIES.includes(body.codex))
+                return void res.status(400).type("html").send(signIn("Unknown Codex policy."));
+            if (providerPolicyOf(deps.ledger.all(), person.id).codex !== body.codex) {
+                deps.ledger.append({
+                    id: newRecordId("provider_policy"),
+                    kind: "provider_policy",
+                    created_at: new Date().toISOString(),
+                    actor: { person_id: person.id, name: person.name, client_id: "providers-page" },
+                    refs: [],
+                    evidence_refs: [],
+                    claim_category: "observed",
+                    body: { codex: body.codex },
+                });
+                logDecision(deps, { phase: "provider_policy_set", person: person.id, codex: body.codex });
+            }
+            saved = "<p>Saved. It applies to your requests from now on, including a failed run of yours that is run again. A per-mission choice you already made still covers its mission.</p>";
+        }
+        const policy = providerPolicyOf(deps.ledger.all(), person.id);
+        const option = (value, label) => `<label><input type="radio" name="codex" value="${value}"${policy.codex === value ? " checked" : ""}> ${escapeHtml(label)}</label>`;
+        res.type("html").send(page("Your provider policy", `<h1>${escapeHtml(person.name)}'s provider policy</h1>${saved}
+<dl><dt>Codex</dt><dd>${escapeHtml(policy.codex.replace(/_/g, " "))}${policy.source === "default" ? " (the default)" : `, set ${escapeHtml(policy.set_at ?? "")}`}</dd>
+<dt>Other providers</dt><dd>Pi, Copilot and Claude Code run when a request names them and they are installed; Pi and Copilot may also be picked by the host's order.</dd></dl>
+<form method="post"><input type="hidden" name="person_token" value="${escapeHtml(token)}">
+<fieldset><legend>When a request in my name names Codex</legend>
+${option("per_mission_choice", "Codex runs only when I choose it for that mission on its approval page (default).")}
+${option("selectable", "Codex may be named for my requests without a per-mission choice.")}
+</fieldset>
+<div class="row"><button class="primary" type="submit">Save my policy</button></div></form>`));
+    });
+}
 /** How a request is named to a person. */
 export const KIND_LABELS = {
     run_request: "Agent run",

package/dist/mission-status.js

@@ -108,7 +108,9 @@ function nextAction(record, standing, queue, result) {
         case "dispatching":
             return queue?.state === "delivered"
                 ? "The brief is with its session. Follow it, or steer it with request_session_steer inside the approved grant."
-                : "Wait for the factory intake to deliver the brief.";
+                : queue?.state === "refused"
+                    ? "The factory runner refused to launch its provider; nothing runs. The requester decides on a new request with a provider they chose."
+                    : "Wait for the factory intake to deliver the brief.";
         case "failed":
             return standing.rerun.available ? "A write-tier person may run it again with the same approval." : "Read the failure and decide.";
         case "completed":

package/dist/model-preflight.d.ts

@@ -1,4 +1,5 @@
 import { type JevConfig, type ProviderAvailability, type ProviderId } from "./providers.js";
+import { type ProviderAuthorization } from "./provider-policy.js";
 export declare const PREFLIGHT_CONTRACT = "miadi.mission_model_preflight";
 export declare const PREFLIGHT_VERSION = 1;
 /** Below this, a Jev choice is not acted on (the ≥0.8 practice of jgwill/Miadi#770). */
@@ -34,7 +35,7 @@ export interface LaunchEvidence {
     /** What shows it (a process line, a pane header); reported by the caller, not checked by the connector. */
     evidence: string;
 }
-export type PreflightState = "recommended" | "abstained" | "provider_mismatch";
+export type PreflightState = "recommended" | "abstained" | "provider_mismatch" | "provider_not_authorized";
 export type DeciderSource = "jev" | "static_fallback" | "synthetic_fixture";
 export type RouterState = "answered" | "not_requested" | "router_unconfigured" | "router_unavailable" | "invalid_answer";
 export interface ModelPreflight {
@@ -57,6 +58,8 @@ export interface ModelPreflight {
     /** approved: the request was approved with this provider. requested: it is not approved (yet); the provider is only asked for. */
     provider_basis: "approved" | "requested";
     candidates: ModelCandidate[];
+    /** Whether the mission's provider is authorized and by whom (jgwill/Miadi#926). */
+    provider_authorization?: Record<string, unknown>;
     decider: {
         source: DeciderSource;
         router: RouterState;
@@ -117,7 +120,7 @@ export interface JevRequest {
 }
 /** The model a provider's own config names, when it names one. Only that key is read. */
 export declare function configuredModel(provider: ProviderId, home?: string): string | null;
-export declare function candidatesFor(found: ProviderAvailability[], approved: ProviderId | null, modelOf?: (p: ProviderId) => string | null, basis?: "approved" | "requested"): ModelCandidate[];
+export declare function candidatesFor(found: ProviderAvailability[], approved: ProviderId | null, modelOf?: (p: ProviderId) => string | null, basis?: "approved" | "requested", authorization?: Pick<ProviderAuthorization, "authorized" | "provider" | "requester">): ModelCandidate[];
 /** The least review a task gets, whatever any decider says. Jev may raise it, never lower it. */
 export declare function reviewFloor(task: TaskType, criticality: Criticality): ReviewTier;
 export declare function decisionState(task: TaskType, criticality: Criticality, candidates: ModelCandidate[]): Record<string, unknown>;
@@ -134,6 +137,10 @@ export interface PreflightInput {
     task: TaskType;
     criticality: Criticality;
     candidates: ModelCandidate[];
+    /** Whether the mission's provider is authorized, and by whom (jgwill/Miadi#926); shown as given. */
+    provider_authorization?: Record<string, unknown> & {
+        authorized?: boolean;
+    };
     launch?: LaunchEvidence;
     /** The decider to consult, when the caller asked for one; absent means static fallback only. */
     adapter?: JevAdapter;

package/dist/model-preflight.js

@@ -7,6 +7,9 @@
  *   is kept (no switching without a person), Claude Code only when named, an
  *   uninstalled or sign-in-less provider is ineligible, and a reported launch on
  *   another provider fails closed as provider_mismatch before anything is asked.
+ * - Codex is eligible only with its requester's own choice for the mission or
+ *   their own policy (provider-policy.ts, jgwill/Miadi#926); a reported Codex
+ *   launch without either fails closed as provider_not_authorized.
  * - Jev is consulted only when the caller asks (consult_jev) and the connector's
  *   environment holds a Jev key. The state sent holds the task type, the
  *   criticality and the candidates: no task text, mission id, repository name or
@@ -25,6 +28,7 @@ import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { PROVIDERS } from "./providers.js";
+import { needsPersonChoice } from "./provider-policy.js";
 export const PREFLIGHT_CONTRACT = "miadi.mission_model_preflight";
 export const PREFLIGHT_VERSION = 1;
 /** Below this, a Jev choice is not acted on (the ≥0.8 practice of jgwill/Miadi#770). */
@@ -52,7 +56,7 @@ export function configuredModel(provider, home = homedir()) {
     }
     return null;
 }
-export function candidatesFor(found, approved, modelOf = (p) => configuredModel(p), basis = "approved") {
+export function candidatesFor(found, approved, modelOf = (p) => configuredModel(p), basis = "approved", authorization) {
     return PROVIDERS.map((spec) => {
         const a = found.find((p) => p.id === spec.id);
         const installed = Boolean(a?.installed);
@@ -68,6 +72,9 @@ export function candidatesFor(found, approved, modelOf = (p) => configuredModel(
             [eligible, reason] = [false, `Not the ${basis} provider (${approved}); switching needs a person's approval.`];
         else if (!approved && !spec.selectable_by_default)
             [eligible, reason] = [false, `${spec.name} runs only when a request names it.`];
+        else if (needsPersonChoice(spec.id) && !(authorization?.authorized && authorization.provider === spec.id)) {
+            [eligible, reason] = [false, `${spec.name} runs only when ${authorization?.requester.name ?? "the requester"} chooses it for this mission, or their own policy allows it (jgwill/Miadi#926).`];
+        }
         return {
             option: model ? `${spec.id}:${model}` : spec.id,
             provider: spec.id,
@@ -212,6 +219,7 @@ export async function modelPreflight(input) {
         approved_provider,
         provider_basis: input.provider_basis ?? "approved",
         candidates,
+        ...(input.provider_authorization ? { provider_authorization: input.provider_authorization } : {}),
         evidence: { model_cost: "unknown", quota: "unknown" },
         policy: {
             deterministic: true,
@@ -223,6 +231,20 @@ export async function modelPreflight(input) {
         ? { approved_provider, actual: { ...input.launch, source: "reported" }, mismatch: approved_provider ? input.launch.provider !== approved_provider : null }
         : { approved_provider, actual: "unverified", mismatch: null };
     // Fail closed before anything is asked or spent.
+    if (input.launch && needsPersonChoice(input.launch.provider) && !(input.provider_authorization?.authorized && approved_provider === input.launch.provider)) {
+        return {
+            ...base,
+            state: "provider_not_authorized",
+            decider: { source: "static_fallback", router: "not_requested", calibration: "not_applicable", derivation: "deterministic policy: Codex launched without its requester's own choice or policy (jgwill/Miadi#926)" },
+            recommendation: {
+                confidence: null,
+                review_tier: floor,
+                explanation: `Reported running on ${input.launch.provider}, which no choice of the requester's authorizes for this mission. Nothing proceeds on it; the requester chooses it on the approval page, or the mission runs on another provider.`,
+                abstain_reasons: ["provider_not_authorized"],
+            },
+            launch,
+        };
+    }
     if (launch.mismatch) {
         return {
             ...base,

package/dist/provider-policy.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Codex runs only on its requester's own choice for that one mission (jgwill/Miadi#926).
+ *
+ * The assistant that asks (ChatGPT or any MCP client) may name provider "codex", but that
+ * name is the caller's, not the person's. The connector cannot read the chat, so it never
+ * treats the provider field as the person's choice. Codex is authorized for a run only by:
+ *
+ * - a `provider_choice` record the requester made themself on the request's approval page,
+ *   a browser form signed in with their own Miadi person token, outside the MCP channel
+ *   (an OAuth client never holds the person token). The choice is bound to the request id,
+ *   its version and its content hash, and must be fresh (CHOICE_TTL_MS) when the request
+ *   is approved. A revision makes it stale. It covers that mission only;
+ * - or the requester's own provider policy, set by them on the connector's /providers page,
+ *   saying Codex may be named for their requests without a per-mission choice.
+ *
+ * A generic approval (page or card), the caller's provider field, the host's preference
+ * order, a Jev recommendation, and a choice made by anyone other than the requester
+ * authorize nothing. Other providers keep their regular policy (jgwill/Miadi#893, #913).
+ * The check runs when a request is made or revised, when it is approved, when its brief
+ * is written (approval and every rerun), and the factory runner checks the brief again
+ * before it launches anything.
+ */
+import type { ConnectorRecord } from "./records.js";
+/** Providers a request may name only with the requester's own per-mission choice. */
+export declare const CHOICE_PROVIDERS: readonly string[];
+export declare const CODEX_POLICIES: readonly ["per_mission_choice", "selectable"];
+export type CodexPolicy = (typeof CODEX_POLICIES)[number];
+export declare const DEFAULT_CODEX_POLICY: CodexPolicy;
+/** How long a per-mission choice stays good for the approval that follows it. */
+export declare const CHOICE_TTL_MS: number;
+export declare function needsPersonChoice(provider: string | null | undefined): boolean;
+/** Whether a person id may make a choice or set a policy: a person, never a service token. */
+export declare function isPersonId(personId: string | undefined): boolean;
+export interface ProviderPolicy {
+    person_id: string;
+    codex: CodexPolicy;
+    source: "default" | "person";
+    record?: string;
+    set_at?: string;
+}
+/** A person's provider policy: the latest one they set themself, else the default. */
+export declare function providerPolicyOf(records: ConnectorRecord[], personId: string): ProviderPolicy;
+export interface ProviderChoiceView {
+    record: string;
+    provider: string;
+    by: {
+        person_id: string;
+        name: string;
+    };
+    at: string;
+    version: number;
+    content_hash: string;
+    via?: string;
+}
+export type AuthorizationState = "not_required" | "person_choice" | "policy_selectable" | "needs_person_choice";
+export interface ProviderAuthorization {
+    state: AuthorizationState;
+    authorized: boolean;
+    /** The provider the run would launch with (the resolved one), or null when the runner's default applies. */
+    provider: string | null;
+    /** The provider field as the caller wrote it: evidence of what was asked, never of who chose it. */
+    requested: string | null;
+    requester: {
+        person_id: string;
+        name: string;
+        client?: string;
+    };
+    policy: {
+        codex: CodexPolicy;
+        source: ProviderPolicy["source"];
+        record?: string;
+        set_at?: string;
+    };
+    choice?: ProviderChoiceView;
+    /** Choices recorded for this request that do not bind it (another version, another person, too old). */
+    not_binding?: Array<{
+        record: string;
+        why: string;
+    }>;
+    explanation: string;
+}
+/**
+ * Whether the provider a request names may launch, and why. Pure: the ledger is read,
+ * nothing is written. `requireFresh` (the approval) also refuses a choice older than
+ * CHOICE_TTL_MS; the brief written for an approved request checks the binding only.
+ */
+export declare function authorizeProvider(record: ConnectorRecord, records: ConnectorRecord[], opts?: {
+    now?: number;
+    requireFresh?: boolean;
+}): ProviderAuthorization;
+/** The authorization as the brief carries it to the factory runner: attributes it checks before launching. */
+export declare function briefAttributes(a: ProviderAuthorization): Record<string, string>;
+/** The authorization as a receipt keeps it: no body text, only who, what and which record. */
+export declare function authorizationReceipt(a: ProviderAuthorization): Record<string, unknown>;