Only a person approves: an AI agent over MCP can draft and withdraw, never sign off #24

Issue #22 is built and committed on the branch, but I can't confirm the push landed. git push said "Everything up-to-date", yet git ls-remote origin doesn't list the branch. It lists main and the pull refs, and none of them match the branch's commit c2e96c2. The forge's check should show whether it arrived.

What changed

• Each approval now records the door it came through in a new asset.approved_via column. It is page, api or tty, added by a forward-only migration in src/db.ts. It is cleared when words are regenerated, edited or withdrawn. The listing page shows it beside "approved by <name> <when>".
• approveAsset in src/actions.ts takes the door. Over MCP, approved: true is refused with a new person_required failure. Its message says a person approves on the listing page. The refusal is audited like any refused change, and the asset stays unapproved.
• The MCP approve_asset description says the same. Withdrawing with approved: false still works, and get_listing still reports each asset's approval.
• The contract table is unchanged. The door rule lives in the action, not in a role comparison.
• The README's "What is real" now says assistants may draft and edit and only you approve. contract/openapi.json is updated for the new failure and field.
• src/listings.test.ts and src/tty.test.ts cover MCP approve refused and leaving the asset unapproved, MCP withdraw, page approval storing page, and terminal approval storing tty. src/contract.test.ts was also edited.

What I chose not to do

• The JSON API still approves, because a person's browser form posts there. A script that holds a person's session can therefore still approve. I left that alone rather than guess.

Checks

• bun test on src/listings.test.ts, src/contract.test.ts and src/tty.test.ts passes (35 tests).
• Two checks did not run. scripts/gate.ts doesn't exist in this clone. bun x tsc --noEmit couldn't run because there is no tsconfig.json, so the type check is unverified.

To try it

• Open a listing and approve a flyer. The page should show "approved by … via page".
• Call approve_asset over MCP with approved: true. It should be refused with person_required.

🤖 Generated with Claude Code

Closes #22

Issue #22 is built and committed on the branch, but I can't confirm the push landed. git push said "Everything up-to-date", yet git ls-remote origin doesn't list the branch. It lists main and the pull refs, and none of them match the branch's commit c2e96c2. The forge's check should show whether it arrived.

What changed

• Each approval now records the door it came through in a new asset.approved_via column. It is page, api or tty, added by a forward-only migration in src/db.ts. It is cleared when words are regenerated, edited or withdrawn. The listing page shows it beside "approved by <name> <when>".
• approveAsset in src/actions.ts takes the door. Over MCP, approved: true is refused with a new person_required failure. Its message says a person approves on the listing page. The refusal is audited like any refused change, and the asset stays unapproved.
• The MCP approve_asset description says the same. Withdrawing with approved: false still works, and get_listing still reports each asset's approval.
• The contract table is unchanged. The door rule lives in the action, not in a role comparison.
• The README's "What is real" now says assistants may draft and edit and only you approve. contract/openapi.json is updated for the new failure and field.
• src/listings.test.ts and src/tty.test.ts cover MCP approve refused and leaving the asset unapproved, MCP withdraw, page approval storing page, and terminal approval storing tty. src/contract.test.ts was also edited.

What I chose not to do

• The JSON API still approves, because a person's browser form posts there. A script that holds a person's session can therefore still approve. I left that alone rather than guess.

Checks

• bun test on src/listings.test.ts, src/contract.test.ts and src/tty.test.ts passes (35 tests).
• Two checks did not run. scripts/gate.ts doesn't exist in this clone. bun x tsc --noEmit couldn't run because there is no tsconfig.json, so the type check is unverified.

To try it

• Open a listing and approve a flyer. The page should show "approved by … via page".
• Call approve_asset over MCP with approved: true. It should be refused with person_required.

🤖 Generated with Claude Code

All four review points are addressed and pushed as 38a5d19 on the same branch. The five touched test files pass (50 tests). I couldn't run a type check or the design lint here, because the clone has no tsconfig.json and no scripts/design-lint.ts. scripts/gate.ts is also absent.

1. API approve. PATCH /api/listings/:id with approved: true is now refused with person_required (403) and audited; withdraw still works. approved_via is now only page or tty. api is gone from Door, the via enum, src/routes.ts and contract/openapi.json, and the PATCH summary now says the API only withdraws. A separate Caller type (Door plus api and mcp) is what the action takes, so those two doors can be named and refused.
2. README. It no longer claims a browser form posts to the JSON API. It says approval comes from the listing page or the terminal, and that the API and the MCP tool only withdraw.
3. Permit order. In approve, listingFor (permit) and the anonymous check now run before the door check. An anonymous or unauthorised caller gets the unauthorized or forbidden answer, not person_required. A new assertion covers the anonymous MCP case.
4. Minor.

- Import and doc comment. The type Door import is gone from src/actions.ts, replaced by type Caller in its sorted place, and the long doc-comment line is reflowed. - Contract test. src/contract.test.ts has a comment saying the MCP cell is probed with a withdraw and the approve path through the action's page door. - Existing tests. Tests that approved over the JSON API now post the page form. One of them moved to a fresh test user so it doesn't exhaust the 20-write rate limit that user shares with the other tests.

I also added person_required: 403 to the status map in src/routes.ts. Without it the API returned 200 on the refusal, which the new test caught.

I changed no contract cell.