pi-roundtable 0.20.0 → 0.21.0

package/CHANGELOG.md

@@ -5,6 +5,12 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.21.0] - 2026-10-20
+
+### Added
+
+- A held call's approval card can be its speaker's alone (`pi-roundtable`). A hold answers `{ text, approval: "speaker" }` (`HoldDescription.approval`, beside `copy` and `supersede`; a tool's `hold` and a rule's `describeInTurn` both may) and the card reaches the surface as `ApprovalOptions.speakerOnly`. Only the speaker whose turn made the call answers it, on any of their identities the surface knows and at the call's tier, checked again when they press: in a shared conversation no owner does, and an owner's press or decline is refused with the card's own line while the card stays open for the speaker. A speaker below the tier, a turn with no speaker and a speaker with no Discord identity get `unavailable` at once, shown to no one, so the call stays held. With `approvers` the card is still the speaker's alone, and the runtime accepts their press only when the approvers name them or they are an owner. The option governs the card only; a message that confirms the held call is judged as before, so a tool that must act on the speaker's press alone checks `ToolTurn.approvedPrompt` and `ToolTurn.approvedBy` in `run`. Without it every card behaves as before. The Discord cards and the web chat honour it, and `SurfaceContractSubject.speakerOnly` makes `describeSurfaceContract` check, with an `owner`, that an owner's answer leaves such an approval open in a shared conversation; a subject that does not declare it skips the check.
+
 ## [0.20.0] - 2026-10-18
 
 ### Added

package/docs/plugins.md

@@ -876,6 +876,21 @@ A rule whose verdict depends on the input, such as one that holds only a `delete
 It is asked when the input is not known yet, as for a [precheck script](#precheck-scripts-prechecks-the-agent-writes)'s call whose arguments are computed when it runs; a rule without it is judged by `describe` with an empty input.
 A rule whose held call stands for others can answer `approvalTier(tool, input, context)`: the lowest tier that may approve it when higher than the tool's own. The held call keeps it as `minTier`, and both its card and a confirming message require it. A card is answered, and a confirming message accepted, from the speaker whose turn held the call, when their tier is at least `minTier`, and from the owners where the conversation is shared ([who answers a prompt](#who-answers-a-prompt-promptscope)); nobody else in the channel may approve it. The held call records that speaker as `PendingConfirmation.speakerId` and their principal as `principalId`, so a confirming message from another identity of theirs counts after a restart too; a call held without them is the owners' to approve, and one held before 0.9, without a principal, is matched by `speakerId`.
 
+#### A hold that makes its card the speaker's alone
+
+By default the speaker whose turn made a held call may answer its card, and in a shared conversation so may every owner. A hold that wants only the speaker to press, such as one whose tool books something under the speaker's name, answers `{ text, approval: "speaker" }` (`HoldDescription.approval`, beside `copy` and `supersede`; a tool's `hold` and a rule's `describeInTurn` both may):
+
+```ts
+hold: async ({ draft }, turn) => ({ text: await summaryOf(draft, turn), approval: "speaker" }),
+```
+
+- Only the speaker answers the card: their principal, on any of their identities the surface knows, at the call's tier, checked again when they press. An owner's press is refused with the card's own line, the card stays open for the speaker, and the owner's decline is refused too. An owner who is the speaker answers as the speaker.
+- It holds for a late press as well: a card answered after the turn stopped waiting is still the speaker's alone, so the turn that follows is started by the speaker.
+- A speaker below the call's tier, a turn with no speaker, and a surface that cannot tell who the speaker is get `unavailable` at once, shown to no one, and the call stays held, as for any card nobody may answer. It never falls back to the owners.
+- Combined with [approvers](#a-hold-that-names-its-approvers) the card is still the speaker's alone, and the runtime accepts the press only when the approvers name the speaker (or they are an owner); otherwise the call stays held.
+- The option governs the card only. A message that confirms the held call is judged as for any call, so an owner's message can still release it. A tool that must act on the speaker's press alone checks in `run` that `turn.approvedPrompt` is set (a message sets none) and that `turn.approvedBy?.speakerId` is the speaker's.
+- Anything but `"speaker"` leaves the card as every card is. A surface implements this through `ApprovalOptions.speakerOnly`; the Discord cards and the web chat (whose prompts are its person's alone) honour it, and the contract checks it where a subject declares `speakerOnly`.
+
 #### A hold that names its approvers
 
 A held call is approved by the speaker whose turn made it, or by an owner where the conversation is shared. A tool whose call stands for someone else, such as a message sent under another person's name, can name who approves it instead:
@@ -2645,6 +2660,8 @@ A surface's prompts keep these rules:
 - Without a scope, as for a turn with no speaker, the prompts are the owners'.
 - An approval that names [approvers](#a-hold-that-names-its-approvers) (`ApprovalOptions.approvers`, which `confirm` receives beside the scope) is theirs **instead of the speaker's**, where the scope escalates to the owners: each named principal answers on any of their identities the surface knows, at the tier it needs, checked again when they answer; the speaker does not answer it unless named, and an owner still does. When none of the named has an identity on the surface, or none is named, it is the owners' alone. Where the scope escalates to no one, the person alone answers, and only when they are named or an owner: for anyone else the approval resolves `unavailable` at once, shown to no one. The runtime also refuses such a call before it asks, whatever the surface does.
 
+- An approval that is the [speaker's alone](#a-hold-that-makes-its-card-the-speakers-alone) (`ApprovalOptions.speakerOnly`) is theirs without the owner escalation, whatever the scope says: the speaker's principal answers on any of their identities the surface knows, at the tier it needs, checked again when they answer, and no owner does. Without a scope, or when the speaker is below the tier or has no identity on the surface, it resolves `unavailable` at once, shown to no one.
+
 On Discord a card for named approvers mentions every Discord identity of every named principal that has one, in a thread, and refuses anyone else with a line that says it is for the people it names and the owners.
 The web chat shows prompts to the conversation's person only. The runtime never asks it about a call that names approvers the person is neither among nor an owner of, and the person is the approver of one that names them.
 
@@ -2656,7 +2673,7 @@ The web chat shows prompts to the conversation's person only: its owners are not
 
 `confirm(title, message, signal?, minTier?, wait?, details?, options?)` takes the approval twice: `message` is the card as markdown text, and the optional `details` (`ApprovalDetails`: `{ action, tool, input, files? }`) is the same held call as data, with its whole input (the web chat cuts it only past 256 KiB and says so with `truncated`), and each file it sends by path as `{ path, bytes? }`.
 The confirmation gate and a coding worker's cards pass both.
-`options` (`ApprovalOptions`) says who else may approve the call and hears who did: `approvers`, the principal ids that approve it instead of the speaker (see [who answers a prompt](#who-answers-a-prompt-promptscope)), and `approvedBy(by)`, which a surface that knows who answered calls with `{ principalId, speakerId, name, owner? }` (`ApprovedBy`; `owner` when they approved as an owner) before `confirm` resolves `approved`. `approvedPrompt(prompt)` is called, likewise before `confirm` resolves `approved`, with the id of the card that approved the call, for `ToolTurn.approvedPrompt`; a surface whose cards have no stable id leaves it uncalled. A surface may ignore all three for a call that names no approvers. For one that does, the runtime accepts the approval only from a surface that calls `approvedBy` with a named principal or an `owner`, so a surface that cannot say who answered must not offer such a call to a shared conversation.
+`options` (`ApprovalOptions`) says who else may approve the call and hears who did: `approvers`, the principal ids that approve it instead of the speaker (see [who answers a prompt](#who-answers-a-prompt-promptscope)), `speakerOnly`, true when the card is the speaker's alone and no owner may answer it (see [a hold that makes its card the speaker's alone](#a-hold-that-makes-its-card-the-speakers-alone); a surface that cannot honour it resolves `unavailable` instead of showing the card to the owners), and `approvedBy(by)`, which a surface that knows who answered calls with `{ principalId, speakerId, name, owner? }` (`ApprovedBy`; `owner` when they approved as an owner) before `confirm` resolves `approved`. `approvedPrompt(prompt)` is called, likewise before `confirm` resolves `approved`, with the id of the card that approved the call, for `ToolTurn.approvedPrompt`; a surface whose cards have no stable id leaves it uncalled. A surface may ignore all three for a call that names no approvers. For one that does, the runtime accepts the approval only from a surface that calls `approvedBy` with a named principal or an `owner`, so a surface that cannot say who answered must not offer such a call to a shared conversation.
 A surface that shows text, such as Discord, uses `message` and reads only `details.copy` (below); the web chat sends `details` to the client as the prompt frame's `approval`, beside the unchanged `title` and `message`.
 A surface or a `Prompts` of your own may ignore it: nothing requires reading it.
 
@@ -3419,9 +3436,9 @@ test("the production configuration registers every plugin", async () => {
 ### `describeSurfaceContract`: what every chat surface keeps
 
 A plugin that contributes a `ChatSurface` can test it against the contract every surface keeps.
-`describeSurfaceContract(name, make)` registers one test per check, each on a fresh `SurfaceContractSubject` from `make`: the `surface`, a `channel` of it, and one person on its network, who can `write(text)`, whose `observations()` list what they have seen (`SurfaceObservation`: a reply's text and file names, typing and stop controls going on and off, progress, and prompts opening and closing), and who may `answer(prompt, approved)` an approval; `speaker` is who they are to `surface.prompts`, given as `promptScope(speaker, visibility)`, an owner by default, and every approval the contract asks for needs exactly their tier. `stranger`, when given, is someone else on the network, another principal and not an owner, who knows the id of the person's open approval and may `join()` and `answer(prompt, approved)` it; `owner`, when given, is an owner on the network, another principal than the person, who does the same in the person's private conversation. Both are `SurfaceContractAnswerer`s. `approver`, when given, is a third person on the network with a `principalId`, not an owner and at the person's tier, whom the contract names in `approvers`; `privateOnly` marks a surface that serves only conversations private to one person, such as the web chat.
+`describeSurfaceContract(name, make)` registers one test per check, each on a fresh `SurfaceContractSubject` from `make`: the `surface`, a `channel` of it, and one person on its network, who can `write(text)`, whose `observations()` list what they have seen (`SurfaceObservation`: a reply's text and file names, typing and stop controls going on and off, progress, and prompts opening and closing), and who may `answer(prompt, approved)` an approval; `speaker` is who they are to `surface.prompts`, given as `promptScope(speaker, visibility)`, an owner by default, and every approval the contract asks for needs exactly their tier. `stranger`, when given, is someone else on the network, another principal and not an owner, who knows the id of the person's open approval and may `join()` and `answer(prompt, approved)` it; `owner`, when given, is an owner on the network, another principal than the person, who does the same in the person's private conversation. Both are `SurfaceContractAnswerer`s. `approver`, when given, is a third person on the network with a `principalId`, not an owner and at the person's tier, whom the contract names in `approvers`; `speakerOnly` marks a surface that honours `ApprovalOptions.speakerOnly` in a shared conversation, which the contract then checks with the `owner`; `privateOnly` marks a surface that serves only conversations private to one person, such as the web chat.
 The contract starts the surface, calls the subject's `join()`, and stops the surface after the subject's `close()`.
-It checks that the surface names a prefix and owns its channel, delivers what the person writes, and shows every chunk of a reply; and, for the parts the surface offers, that it delivers files when `supportsFiles` is set, ends typing and stop controls idempotently, shows progress, and resolves an approval as the person approves or declines it, or `cancelled` when the turn stops or its plugin withdraws it (`ApprovalOptions.supersede`; one answered first stays answered), with a `stranger`, that the stranger's answer leaves the person's approval open, and with an `owner`, that an owner's answer leaves it open in a private conversation; with an `approver` and a `stranger`, that an approval naming the approver is answered by the approver and not by the person or the stranger, unless the surface is `privateOnly`, and, with an `approver`, that a private conversation ignores the names; and, for a speaker below the owner tier, that a private conversation's approval above their tier resolves `unavailable` (or `expired`, as older surfaces answer) at once and is not shown.
+It checks that the surface names a prefix and owns its channel, delivers what the person writes, and shows every chunk of a reply; and, for the parts the surface offers, that it delivers files when `supportsFiles` is set, ends typing and stop controls idempotently, shows progress, and resolves an approval as the person approves or declines it, or `cancelled` when the turn stops or its plugin withdraws it (`ApprovalOptions.supersede`; one answered first stays answered), with a `stranger`, that the stranger's answer leaves the person's approval open, and with an `owner`, that an owner's answer leaves it open in a private conversation; with an `approver` and a `stranger`, that an approval naming the approver is answered by the approver and not by the person or the stranger, unless the surface is `privateOnly`, and, with an `approver`, that a private conversation ignores the names; with a `speakerOnly` subject and an `owner`, that an owner's answer leaves an approval that is the speaker's alone open in a shared conversation, unless the surface is `privateOnly`; and, for a speaker below the owner tier, that a private conversation's approval above their tier resolves `unavailable` (or `expired`, as older surfaces answer) at once and is not shown.
 A check for a part the surface does not offer passes.
 The contract has no check for `ApprovalDetails.copy`: a surface that shows it keeps it informational, so using it never resolves, approves or declines the prompt, whoever uses it.
 A subject that gives `answerQuestionnaire` (and a `stranger` that gives its own) must declare `asks` and also keeps the questionnaire checks.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable",
-	"version": "0.20.0",
+	"version": "0.21.0",
 	"description": "A plugin-driven Pi agent server for one owner, reached through Discord or the web",
 	"type": "module",
 	"license": "MIT",

package/src/core/discord/card-audience.ts

@@ -58,7 +58,9 @@ export class CardAudiences {
 		scope: PromptScope | undefined,
 		minTier: Tier,
 		named?: readonly string[],
+		speakerOnly = false,
 	): Promise<Audience | undefined> {
+		if (speakerOnly) return this.#speakers(scope, minTier);
 		let approvers = named;
 		// A private conversation's person is the only one who answers, so a call naming others is theirs only if named or an owner.
 		if (approvers && scope?.escalate === "none") {
@@ -78,6 +80,51 @@ export class CardAudiences {
 		);
 	}
 
+	/**
+	 * The card of a call that is its speaker's alone (`ApprovalOptions.speakerOnly`): the scope's
+	 * principal on any of their Discord identities still theirs when they press, at the tier the
+	 * call needs, checked again then, and no owner as such, whatever the scope escalates to. The
+	 * primary owner answers their own card, and where there is no identity service the primary owner
+	 * is the only speaker who has one. Undefined, so the call is unavailable at once, when there is
+	 * no scope, or the speaker is below the tier or has no Discord identity.
+	 */
+	async #speakers(
+		scope: PromptScope | undefined,
+		minTier: Tier,
+	): Promise<Audience | undefined> {
+		if (!scope) return undefined;
+		const { ownerId, identity } = this.#options;
+		if (!identity) {
+			// Without an identity service the primary owner is the only one who answers, and the only speaker who can.
+			if (scope.speakerId !== ownerId) return undefined;
+			return {
+				allows: async (user) => user.id === ownerId,
+				mentions: [ownerId],
+				note: "",
+				refusal: messages().cardOwnerOnly,
+				approver: (user) => this.#approver(user),
+			};
+		}
+		const own = await this.#ownIdentities(scope, minTier);
+		if (!own) return undefined;
+		const mentions = own.includes(scope.speakerId) ? [scope.speakerId] : own;
+		const primary = own.includes(ownerId);
+		return {
+			allows: async (user) =>
+				own.includes(user.id) &&
+				// Read the links again: one moved or unlinked since the card was posted is no longer theirs.
+				(await this.#stillOwn(scope.principalId, user.id)) &&
+				((primary && user.id === ownerId) ||
+					(await this.#owners.holds(user, minTier, scope.principalId))),
+			mentions,
+			note: primary ? "" : messages().cardApproversNote(...mentions),
+			refusal: primary
+				? messages().cardOwnerOnly
+				: messages().cardApproversRefusal,
+			approver: (user) => this.#approver(user),
+		};
+	}
+
 	/** Who may answer a question; undefined when no one may. */
 	question(scope: PromptScope | undefined): Promise<Audience | undefined> {
 		return this.#audience(scope, undefined, {

package/src/core/discord/owner-cards.ts

@@ -141,6 +141,7 @@ export class OwnerCards implements InteractionModule {
 					scope,
 					minTier,
 					options?.approvers,
+					options?.speakerOnly === true,
 				);
 				// A private conversation's call above its person's tier is no one's to approve.
 				if (!audience) return "unavailable";

package/src/core/holds.ts

@@ -19,8 +19,20 @@ export interface HoldContext {
 
 /**
  * What a hold that runs in a turn answers with: the description of the call, or the description
- * as `text` with a `copy` the owner's approval card offers beside it (see `ApprovalDetails.copy`)
- * and a `supersede` signal to withdraw the call by.
+ * as `text` with a `copy` the owner's approval card offers beside it (see `ApprovalDetails.copy`),
+ * a `supersede` signal to withdraw the call by, and `approval: "speaker"` to make the card the
+ * speaker's alone.
+ *
+ * With `approval: "speaker"` only the speaker whose turn made the call may answer its card, on
+ * any of their identities the surface knows and at the call's tier; no owner may answer it as an
+ * owner (an owner who is the speaker answers as the speaker). A speaker below the call's tier, a
+ * turn with no speaker, or a surface that cannot tell who the speaker is gets `unavailable` at
+ * once and the call stays held. Combined with approvers the card is still the speaker's alone,
+ * and the runtime accepts their press only when the approvers name them or they are an owner;
+ * otherwise the call stays held. It governs the card only: a message that confirms the held call
+ * is judged as for any call, so a tool that must act on the speaker's press alone checks
+ * `ToolTurn.approvedPrompt` and `ToolTurn.approvedBy` in `run`. Anything but `"speaker"` leaves
+ * the card as every card is.
  *
  * Aborting `supersede` withdraws the call the hold held, when the plugin no longer wants it
  * (a newer request replaced it, its subject is gone): its approval card is closed, also after
@@ -39,6 +51,7 @@ export type HoldDescription =
 			text: string;
 			copy?: NonNullable<ApprovalDetails["copy"]>;
 			supersede?: AbortSignal;
+			approval?: "speaker";
 	  };
 
 /**

package/src/core/interactions/prompts.ts

@@ -95,6 +95,16 @@ export interface ApprovalOptions {
 	 * conversation an approval it does not name is not accepted for a call that names approvers.
 	 */
 	approvers?: readonly string[];
+	/**
+	 * When true the card is the scope's speaker's alone: they answer it on any of their identities
+	 * the surface knows, at the call's `minTier` checked again when they answer, and the owners do
+	 * not, whatever the scope escalates to. Without a speaker, below the tier, or on a surface that
+	 * cannot tell, it resolves `unavailable` at once. With `approvers`, the speaker's press is
+	 * accepted only if they are named (the runtime refuses the rest). A surface that cannot honour
+	 * it must resolve `unavailable` rather than show the card to the owners. Absent or false leaves
+	 * the card as every card is.
+	 */
+	speakerOnly?: boolean;
 	/**
 	 * Called with who approved the call, before the approval resolves `approved`; not called for a
 	 * refusal, or by a surface that does not know who answered.

package/src/core/runtime/extensions/card-ask.ts

@@ -18,6 +18,8 @@ export interface CardAsk {
 	wait: PromptWait;
 	details: ApprovalDetails;
 	approvers: readonly string[] | undefined;
+	/** Only the speaker may answer the card; see `HoldDescription`. */
+	speakerOnly: boolean;
 	/** The call's watch, when its plugin may withdraw it. */
 	watch: Watch | undefined;
 }
@@ -41,6 +43,7 @@ export async function askOnCard(
 	const found: Omit<CardAnswer, "answer"> = {};
 	const options: ApprovalOptions = {
 		...(ask.approvers ? { approvers: ask.approvers } : {}),
+		...(ask.speakerOnly ? { speakerOnly: true } : {}),
 		approvedBy: (by) => {
 			found.approvedBy = by;
 		},

package/src/core/runtime/extensions/confirmation-gate.ts

@@ -334,6 +334,7 @@ export class ConfirmationGate {
 				wait: { late: (late) => this.#late(call, late, watch) },
 				details: approvalDetails(call, this.#fileRoot, needing.copy),
 				approvers: call.approverIds,
+				speakerOnly: needing.speakerOnly === true,
 				watch,
 			},
 		);
@@ -446,6 +447,7 @@ export class ConfirmationGate {
 			held: call,
 			...(judged.copy ? { copy: judged.copy } : {}),
 			...(judged.supersede ? { supersede: judged.supersede } : {}),
+			...(judged.speakerOnly ? { speakerOnly: judged.speakerOnly } : {}),
 		};
 	}
 

package/src/core/runtime/extensions/gate-refusals.ts

@@ -34,6 +34,8 @@ export type Needing =
 			copy?: NonNullable<ApprovalDetails["copy"]>;
 			/** Aborts when the plugin withdraws the call; see `HoldDescription`. */
 			supersede?: AbortSignal;
+			/** The card is the speaker's alone; see `HoldDescription`. */
+			speakerOnly?: true;
 	  }
 	| { released: Release };
 

package/src/core/runtime/extensions/hold-lookups.ts

@@ -32,6 +32,8 @@ export interface Judgment {
 	/** Aborts when the plugin withdraws the call; see `HoldDescription`. */
 	supersede?: AbortSignal;
 	approvers?: readonly string[];
+	/** The card is the speaker's alone; see `HoldDescription`. */
+	speakerOnly?: true;
 }
 
 export type Judged = Judgment | undefined | typeof STOPPED;
@@ -55,13 +57,16 @@ function isSignal(value: unknown): value is AbortSignal {
 export function described(
 	answer: HoldDescription,
 	tool: string,
-): Pick<Judgment, "action" | "copy" | "supersede"> {
+): Pick<Judgment, "action" | "copy" | "supersede" | "speakerOnly"> {
 	if (typeof answer === "string") return { action: answer };
 	if (typeof answer !== "object" || answer === null)
 		return { action: messages().holdGeneric(tool) };
-	const { text, copy, supersede } = answer;
+	const { text, copy, supersede, approval } = answer;
 	if (typeof text !== "string") return { action: messages().holdGeneric(tool) };
-	const withdrawal = isSignal(supersede) ? { supersede } : {};
+	const withdrawal = {
+		...(isSignal(supersede) ? { supersede } : {}),
+		...(approval === "speaker" ? { speakerOnly: true as const } : {}),
+	};
 	if (
 		!copy ||
 		typeof copy !== "object" ||
@@ -125,7 +130,12 @@ export function joinApprovers(
 	if (!lookup) return withoutApprovers(answer, tool);
 	const join = (action: Described): Judged | Promise<Judged> => {
 		if (action === STOPPED || action === undefined) return action;
-		const { action: text, copy, supersede } = described(action, tool);
+		const {
+			action: text,
+			copy,
+			supersede,
+			speakerOnly,
+		} = described(action, tool);
 		const controller = new AbortController();
 		if (turn.signal?.aborted) controller.abort();
 		let named:
@@ -149,6 +159,7 @@ export function joinApprovers(
 				action: text,
 				...(copy ? { copy } : {}),
 				...(supersede ? { supersede } : {}),
+				...(speakerOnly ? { speakerOnly } : {}),
 				...(named ? { approvers: named } : {}),
 			};
 		}
@@ -159,6 +170,7 @@ export function joinApprovers(
 					action: text,
 					...(copy ? { copy } : {}),
 					...(supersede ? { supersede } : {}),
+					...(speakerOnly ? { speakerOnly } : {}),
 					...(approvers ? { approvers } : {}),
 				};
 			},

package/src/core/testing/surface-contract-support.ts

@@ -95,6 +95,7 @@ export async function answeredOnlyByThem(
 	other: SurfaceContractAnswerer | undefined,
 	visibility: "private" | "shared",
 	approvers?: readonly string[],
+	speakerOnly = false,
 ): Promise<void> {
 	const { surface, channel, answer } = running.subject;
 	const prompts = surface.prompts?.(
@@ -114,7 +115,12 @@ export async function answeredOnlyByThem(
 			speakerOf(running.subject).tier,
 			undefined,
 			undefined,
-			approvers ? { approvers } : undefined,
+			approvers || speakerOnly
+				? {
+						...(approvers ? { approvers } : {}),
+						...(speakerOnly ? { speakerOnly } : {}),
+					}
+				: undefined,
 		)
 		.then((value) => {
 			settled = value;

package/src/core/testing/surface-contract.ts

@@ -83,6 +83,12 @@ export interface SurfaceContractSubject {
 	 * named-approver checks are skipped.
 	 */
 	approver?: SurfaceContractAnswerer & { principalId: string };
+	/**
+	 * Set by a surface that honours `ApprovalOptions.speakerOnly` in a shared conversation, where
+	 * `owner` is on the network and could otherwise answer: the owner's answer to such an approval
+	 * settles nothing, the person's does. Without it, or without `owner`, the check is skipped.
+	 */
+	speakerOnly?: boolean;
 	/**
 	 * Set by a surface that serves only conversations private to one person, such as the web chat:
 	 * it has no shared conversation in which an approval is the named approvers', so it skips that
@@ -369,6 +375,23 @@ const CHECKS: readonly Check[] = [
 		run: (running) =>
 			answeredOnlyByThem(running, running.subject.owner, "private"),
 	},
+	{
+		name: "an approval that is the speaker's alone is not answered by an owner in a shared conversation",
+		applies: (subject) =>
+			subject.surface.prompts !== undefined &&
+			subject.answer !== undefined &&
+			subject.owner !== undefined &&
+			subject.speakerOnly === true &&
+			subject.privateOnly !== true,
+		run: (running) =>
+			answeredOnlyByThem(
+				running,
+				running.subject.owner,
+				"shared",
+				undefined,
+				true,
+			),
+	},
 	{
 		name: "a named approver answers an approval instead of the person; the person and another person cannot",
 		applies: (subject) =>
@@ -448,7 +471,8 @@ export async function checkSurfaceContract(
  * one its plugin withdraws (`ApprovalOptions.supersede`) as cancelled, ignores
  * another person's answer to the person's approval, and, in a private conversation, an owner's
  * too, and lets an approval above the person's tier there come back at once, shown to no one.
- * Where it can name approvers, an approval that does is answered by them, reported as the
+ * Where `speakerOnly` is declared, an approval that is the speaker's alone is not settled by an
+ * owner's answer in a shared conversation. Where it can name approvers, an approval that does is answered by them, reported as the
  * approver, and not by the person or another person, and a private conversation's is answered by
  * its person alone, whoever the call names besides them. A subject that gives
  * `answerQuestionnaire` must declare `asks`, and then questionnaires keep the same rules. Each