phaedo-mcp 0.1.1 → 0.2.0

package/vendor/context-block.js

@@ -323,10 +323,43 @@ function buildLayerConfidence(fingerprint) {
   });
 }
 
+// Mutually-exclusive behavioral signal pairs. When both fire, injecting both
+// produces a self-contradicting instruction (e.g. "Act without checking" AND
+// "Confirm before acting" under Autonomy). Resolve to the dominant side by
+// observation count; on an exact tie neither is a reliable directive, so drop
+// both rather than inject a contradiction.
+const OPPOSING_SIGNALS = [
+  ['fewer_questions', 'wants_confirmation'],
+  ['fewer_options', 'wants_options'],
+  ['prefers_casual', 'prefers_formal'],
+  ['avoid_bullets', 'prefer_bullets'],
+  ['no_headers', 'use_headers'],
+  ['skip_reasoning', 'show_reasoning'],
+  ['conceptual_only', 'wants_implementation'],
+  ['too_long', 'too_short'],
+  ['no_examples', 'wants_examples'],
+  ['stay_scoped', 'wants_proactive'],
+  ['skip_meta', 'show_meta'],
+];
+
+function resolveOpposingSignals(flat) {
+  const out = { ...flat };
+  for (const [a, b] of OPPOSING_SIGNALS) {
+    const av = out[a] || 0, bv = out[b] || 0;
+    if (av > 0 && bv > 0) {
+      if (av > bv)      delete out[b];
+      else if (bv > av) delete out[a];
+      else { delete out[a]; delete out[b]; }   // tie → omit both
+    }
+  }
+  return out;
+}
+
 function synthesizeResponseInstructions(behavioralSignals, cognitiveProfile) {
-  const flat = {};
+  const raw = {};
   for (const layer of Object.values(behavioralSignals))
-    for (const [k, v] of Object.entries(layer)) flat[k] = (flat[k] || 0) + v;
+    for (const [k, v] of Object.entries(layer)) raw[k] = (raw[k] || 0) + v;
+  const flat = resolveOpposingSignals(raw);
 
   const inst = { format: [], tone: [], depth: [], autonomy: [], decisions: [], pace: [] };
 
@@ -401,11 +434,106 @@ function synthesizeResponseInstructions(behavioralSignals, cognitiveProfile) {
   return inst;
 }
 
+// ─── Operating rules (Proposal 0007: authored standing_rules → §9 injection) ──
+// Authored, user-confirmed rules render VERBATIM (§5.2 — never summarized) at the
+// TOP of the profile, above inferred style, so a confirmed rule wins when it
+// conflicts with an inferred habit (§4.3 conflict-priority). Sources every
+// `standing_rules` entry carrying `text` (a kind:"instruction", or a
+// kind:"authorization" that also chose to surface its rule). Ordered by §5.2
+// `priority` (lower first), capped so rules never crowd out the rest of the persona.
+// Raised 8 → 16 once free-form authoring shipped: a subject with the interview's
+// decision rules (priorities 10–40) plus a few hand-authored rules exceeds 8, and
+// the highest-priority-number (newest hand-authored) rule was being silently
+// dropped from the injected block even though the vault + popup kept it.
+const OPERATING_RULES_BUDGET = 16;
+// A delta-promotion injects as a hard constraint only when its evidence-weighted
+// priority (set by rule-review.js deltaPriority) is at/below this — i.e. strongly
+// backed. Legacy flat-50 endorsements sit above it and stay out of injection.
+const DELTA_INJECT_THRESHOLD = 45;
+// Known-safe sources for injection (allow-list). Was a deny-list ("anything not
+// delta_promotion"), which let any unknown / future / typo'd source through silently.
+// New sources must be added here deliberately. `undefined` source is also allowed
+// (legacy test fixtures + kind:'authorization' rules that don't stamp source — the
+// existing behavior we don't want to regress); delta_promotion is conditional on the
+// evidence-weighted priority gate above. Keep in sync with the source values
+// producers actually write (see grep -E "source:\s*['\"]\w+['\"]"); adding a new
+// producer source without listing it here = the rule silently won't inject.
+const INJECT_SOURCE_ALLOW = new Set([
+  'interview',             // popup.js addOperatingRule + edited questionnaire decision rules
+  'interview_template',    // chip-picked-unedited questionnaire rule
+  'conflict_resolution',   // conflict-review.js resolveConflict + revertOverride
+  'delegation_promotion',  // act-as-me, §9 normative
+]);
+// Newlines/tabs collapse to a single space — the Operating Rules block is a
+// one-line-per-rule block. Without scrub, a user-typed rule containing "\n" (or a
+// future producer that emits multi-line text) would silently break out of its line
+// and inject as extra bullets / pseudo-headings, derailing the block's structure.
+// Render-time chokepoint catches every writer (popup, conflict-review, mobile,
+// historical data already on disk) without chasing each call site.
+function sanitizeRuleLine(s) {
+  return String(s == null ? '' : s).replace(/[\r\n\t]+/g, ' ').replace(/\s+/g, ' ').trim();
+}
+function renderOperatingRules(fingerprint) {
+  const rules = Array.isArray(fingerprint && fingerprint.standing_rules) ? fingerprint.standing_rules : [];
+  const seen = new Set();
+  const chosen = rules
+    .filter(r => r && typeof r.text === 'string' && r.text.trim())
+    // Curation: the Operating-rules block is for DELIBERATE hard constraints —
+    // authored rules + interview-elicited decision rules + act-as-me (delegation) are
+    // ALWAYS injected. Auto-promoted style signals (source:'delta_promotion') inject
+    // ONLY when strongly evidenced — rule-review.js stamps them an evidence-weighted
+    // priority (lower = stronger), so a well-backed endorsement (≤ threshold) earns a
+    // slot while thin/legacy flat-50 ones stay out. Excluded promotions remain on the
+    // fingerprint and still drive §10 consult; they just don't dilute injection (the
+    // binding constraint is instruction-following fidelity, not tokens).
+    .filter(r => {
+      if (r.source == null) return true;                              // legacy / no-source — defensive
+      if (r.source === 'delta_promotion') {                           // priority-gated
+        return (Number.isFinite(r.priority) ? r.priority : 1e9) <= DELTA_INJECT_THRESHOLD;
+      }
+      return INJECT_SOURCE_ALLOW.has(r.source);                       // explicit allow-list
+    })
+    // Dedup by normalized text — defensive against near-duplicate authored rules.
+    .filter(r => { const k = r.text.trim().toLowerCase().replace(/\s+/g, ' '); if (seen.has(k)) return false; seen.add(k); return true; })
+    .sort((a, b) => (Number.isFinite(a.priority) ? a.priority : 1e9) - (Number.isFinite(b.priority) ? b.priority : 1e9))
+    .slice(0, OPERATING_RULES_BUDGET);
+  if (!chosen.length) return [];
+  const lines = [
+    '\n## Operating rules (user-confirmed)',
+    'Explicit rules this person has endorsed. Treat them as hard constraints on decisions',
+    'and recommendations, higher priority than inferred style. Apply them silently; do not',
+    'restate them or open replies with "as someone who...".',
+  ];
+  for (const r of chosen) {
+    const exc = typeof r.exception === 'string' && r.exception.trim() ? ` (Exception: ${sanitizeRuleLine(r.exception)})` : '';
+    lines.push(`- ${sanitizeRuleLine(r.text)}${exc}`);
+  }
+  return lines;
+}
+
 // ─── Context block assembly ───────────────────────────────────────────────────
 
 function buildContextBlock(fingerprint, behavioralSignals = {}, linguisticProfile = {}, cognitiveProfile = null, sessionMetrics = {}, mentalModels = null) {
   const lines = ['<phaedo_user_profile>'];
 
+  // ── Framing (2026-07-04): declares the block as background about the subject,
+  // not conversational history. Closes the confabulation defect surfaced by the
+  // persona-eval cross-judge (see docs/persona-extraction/persona-effectiveness-eval.md
+  // §7.4 Category A) where the model was writing "you mentioned…" attributing
+  // fingerprint content to prior turns the user never spoke.
+  lines.push(
+    'This is a persona model of the subject — background about how they',
+    'communicate and decide, learned across prior sessions. It is NOT part of',
+    'this conversation; the subject has NOT said any of what follows in this',
+    'session. Use it to calibrate tone, depth, format, and how decisions are',
+    'framed. Do NOT attribute anything below to the subject as if they said it',
+    'here (never "you mentioned…", "as you noted…", or "given your focus on X"',
+    'citing content from this profile) — those attributions would be fabrications.',
+  );
+
+  // ── 0. Operating rules (authored, user-confirmed — highest priority) ─────────
+  lines.push(...renderOperatingRules(fingerprint));
+
   // ── 1. Response instructions (derived from observed behavioral corrections) ──
   const inst = synthesizeResponseInstructions(behavioralSignals, cognitiveProfile);
   const hasInst = Object.values(inst).some(a => a.length > 0);
@@ -468,6 +596,23 @@ function buildContextBlock(fingerprint, behavioralSignals = {}, linguisticProfil
       const answered = (layer.responses || []).filter(r => r.answer.trim());
       if (!answered.length) continue;
       lines.push(`\n### ${layer.label}`);
+      // A2 residual fix (2026-07-05): content-side softening of the
+      // Domain-and-expertise section. The persona-eval §7.4 residual
+      // showed the block front-loading a persona domain (e.g. immigration)
+      // on prompts that didn't name or invite it. A previous framing-
+      // directive iteration at the block-top level (A2, PR #115) net-
+      // regressed by making the model over-hedgy on unrelated prompts.
+      // This localized directive is scoped ONLY to the Domain-and-expertise
+      // section — the specific place where domain content actually gets
+      // read as topical steering. Concrete: for Randy this section says
+      // "Primary Expertise: Building operational frameworks... business
+      // immigration matters...", which the model was reading as "front-
+      // load immigration on any HR-adjacent prompt." The framing tells
+      // it to treat those answers as BACKGROUND about the subject rather
+      // than topics to steer generic prompts toward.
+      if (layerId === 'domain_and_expertise') {
+        lines.push('*Use as background context about who the subject is — do not steer general prompts toward these topics unless the prompt names them.*');
+      }
       for (const { label, question, answer } of answered)
         lines.push(`${label || question}: ${answer.trim()}`);
       const layerSigs = behavioralSignals[layerId];
@@ -494,8 +639,11 @@ function buildContextBlock(fingerprint, behavioralSignals = {}, linguisticProfil
   const learnedLines = [];
   for (const [layerId, layer] of Object.entries(fingerprint.layers)) {
     if (layer && typeof layer.summary === 'string' && layer.summary.trim()) {
-      learnedLines.push(`\n### ${layer.label || layerId.replace(/_/g, ' ')}`);
-      learnedLines.push(layer.summary.trim());
+      const clean = sanitizeSummary(layer.summary);            // P0 hygiene: drop episodic/opaque/dup lines
+      if (clean) {
+        learnedLines.push(`\n### ${layer.label || layerId.replace(/_/g, ' ')}`);
+        learnedLines.push(clean);
+      }
     }
   }
   if (learnedLines.length) {
@@ -569,6 +717,33 @@ function validateVaultData(vd) {
   return { ok: errors.length === 0, empty, errors };
 }
 
+// Projection hygiene (P0, 2026-06-16): defense-in-depth on the injected summary.
+// The producer's renderLayerSummary guards at generation, but a stale or
+// third-party producer could store a violating summary; drop episodic + opaque
+// value lines and dedupe repeated dimensions so the AI never sees them. Regexes
+// MUST stay in sync with checkSummary() in spec/validate-fingerprint.mjs.
+var SUMMARY_EPISODIC_RE = /(https?:\/\/|\bwww\.)|[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}|\b[a-z0-9][a-z0-9-]*\.(com|org|net|io|so|co|ai|app|xyz|info)\b/i;
+var SUMMARY_DIM_RE = /^[-*\s]*([^:]{1,60}):\s*(.+)$/;
+var SUMMARY_OPAQUE_RE = /^[a-z]\d(?:[ _][a-z0-9]+)*$/i;
+function sanitizeSummary(text) {
+  const out = [];
+  const seen = new Set();
+  for (const raw of String(text).split('\n')) {
+    const t = raw.trim();
+    if (!t) { out.push(raw); continue; }
+    if (SUMMARY_EPISODIC_RE.test(t)) continue;                 // drop episodic (§4.6)
+    const m = t.match(SUMMARY_DIM_RE);
+    if (m) {
+      const dim = m[1].trim().toLowerCase();
+      if (seen.has(dim)) continue;                             // drop duplicate dimension
+      if (SUMMARY_OPAQUE_RE.test(m[2].trim())) continue;       // drop opaque value
+      seen.add(dim);
+    }
+    out.push(raw);
+  }
+  return out.join('\n').trim();
+}
+
 function renderContextBlock(vd, opts) {
   const v = validateVaultData(vd);
   if (!v.ok) {

package/vendor/envelope.js

@@ -126,5 +126,8 @@
   }
 
   globalThis.Phaedo = globalThis.Phaedo || {}
-  globalThis.Phaedo.Envelope = { wrap, unwrap }
+  // canonicalStringify is exposed for the conformance test vectors (spec §6 /
+  // spec/test-vectors): it is the only canonicalization v0.1 actually performs
+  // (the metadata AAD binding). See its doc-comment for the RFC 8785 subset note.
+  globalThis.Phaedo.Envelope = { wrap, unwrap, canonicalStringify }
 })()

package/vendor/kdf.js

@@ -44,6 +44,21 @@
     )
   }
 
+  /**
+   * Fingerprint-sync mailbox key (Proposal 0008). A distinct sub-key of pair_key,
+   * so the store-and-forward fingerprint envelope is decryptable by either device
+   * with NO live session or biometric — and never reuses pair_key's HMAC role or
+   * seed_key's. Re-derivable from the stored pair_key, so neither side holds state.
+   */
+  async function deriveFpSyncKey(pairKey) {
+    return hkdfBytes(
+      pairKey,
+      new Uint8Array(0),
+      utf8(P.HKDF_INFO.FP_SYNC_KEY),
+      P.SIZES.AES_KEY,
+    )
+  }
+
   async function deriveSessionKey(ephemeralShared, sessionToken) {
     return hkdfBytes(
       ephemeralShared,
@@ -108,7 +123,7 @@
 
   globalThis.Phaedo = globalThis.Phaedo || {}
   globalThis.Phaedo.Kdf = {
-    derivePairKey, deriveSeedKey, deriveSessionKey, deriveSAS, formatSAS,
+    derivePairKey, deriveSeedKey, deriveFpSyncKey, deriveSessionKey, deriveSAS, formatSAS,
     authEphemeral, verifyAuthEphemeral,
   }
 })()

package/vendor/protocol.js

@@ -29,6 +29,10 @@
       // Seed-transfer key for QR-free pairing (spec §8.4). A sub-key of
       // pair_key so the GCM seed envelope never reuses pair_key's HMAC role.
       SEED_KEY:        'phaedo-seed-v0.1',
+      // Fingerprint-sync mailbox key (Proposal 0008). A distinct sub-key of
+      // pair_key so the store-and-forward fingerprint envelope is decryptable by
+      // either device with no live session — and never reuses any other role's key.
+      FP_SYNC_KEY:     'phaedo-fp-sync-v0.1',
     },
 
     /** Sizes in bytes — fixed by spec §7.2. */