phaedo-mcp 0.2.1 → 0.2.2

package/consult-core.js

@@ -500,22 +500,42 @@ export function consultDrivers(vd, request) {
 // action's domain when it had one, so a financial override never reshapes writing.
 const PERMISSIVE_SIGNAL = new Set(['proceed', 'proceed_with_note']);
 const CAUTIOUS_SIGNAL   = new Set(['escalate', 'decline', 'clarify']);
-const OVERRIDE_WEIGHT   = { rejected: 1.0, modified: 0.5 };
+
+// A delegated correction's signed weight — direction read from the subject's action
+// RELATIVE to the oracle's signal, NOT the signal class alone. This is the fix for a
+// direction inversion: a lesson requires DISAGREEMENT between signal and action.
+//   permissive + rejected  → +1  said go, subject didn't proceed  → wants CAUTION
+//   cautious   + approved  → -1  said hold, subject proceeded     → wants BOLD
+//   modified               → ±0.5 (ambiguous change; signal-relative, half weight)
+//   permissive + approved  →  0  AGREEMENT (both proceed) — teaches nothing
+//   cautious   + rejected  →  0  AGREEMENT (both hold)    — teaches nothing
+// This keeps the anti-obedience rail intact (a rubber-stamp `approved` on a `proceed`
+// signal is agreement, not a "be bolder" lesson) while no longer misreading the
+// subject AGREEING with a cautious signal as a demand to be bolder — which was
+// eroding the very guardrails the subject was upholding (agreement.js counts
+// decline+rejected as agreement; this now matches).
+function delegationCorrection(signal, userAction) {
+  const permissive = PERMISSIVE_SIGNAL.has(signal);
+  const cautious   = CAUTIOUS_SIGNAL.has(signal);
+  if (!permissive && !cautious) return 0;                     // abstain / unknown signal
+  if (userAction === 'modified') return permissive ? 0.5 : -0.5;
+  if (permissive && userAction === 'rejected') return 1;      // override toward caution
+  if (cautious   && userAction === 'approved') return -1;     // override toward bold (proceeded anyway)
+  return 0;                                                   // agreement / unknown → no lesson
+}
 
 export function deriveDelegationSignals(receipts, { now = new Date().toISOString(), floor = 1 } = {}) {
   const tally = new Map(); // `${cue}|${domain}` → { cue, domain, sum, n }
   for (const r of (Array.isArray(receipts) ? receipts : [])) {
-    const w = OVERRIDE_WEIGHT[r && r.user_action];
-    if (!w) continue;                                              // only rejected/modified teach
     const sig = r?.response?.signal;
-    const correct = PERMISSIVE_SIGNAL.has(sig) ? 1 : CAUTIOUS_SIGNAL.has(sig) ? -1 : 0; // +1 cautious / -1 bold
-    if (!correct) continue;                                        // abstain/unknown → no direction
+    const contribution = delegationCorrection(sig, r && r.user_action); // signed; 0 = agreement/no lesson
+    if (!contribution) continue;
     const domain = (typeof r?.request?.action_descriptor?.domain === 'string') ? r.request.action_descriptor.domain : '';
     for (const d of (Array.isArray(r.drivers) ? r.drivers : [])) {
       if (!CUES[d && d.cue]) continue;                             // scalar caution cues only (ambiguity later)
       const k = `${d.cue}|${domain}`;
       const t = tally.get(k) || { cue: d.cue, domain, sum: 0, n: 0 };
-      t.sum += correct * w; t.n += 1;
+      t.sum += contribution; t.n += 1;
       tally.set(k, t);
     }
   }
@@ -600,22 +620,20 @@ function delegationText(dimension, dir, domain) {
 
 export function buildDelegationPromotions(receipts, fp, { now = new Date().toISOString(), floor = DELEGATION_PROMOTION_FLOOR } = {}) {
   // Aggregate overrides per CANONICAL (dimension, domain): signed weight + count. Same
-  // honesty rail + direction rule as deriveDelegationSignals (only rejected/modified;
-  // direction read from the oracle's own signal).
+  // signal-relative direction rule as deriveDelegationSignals — a lesson requires the
+  // subject's action to DISAGREE with the oracle's signal; agreement teaches nothing.
   const tally = new Map(); // `${dimension}|${domain}` → { dimension, domain, sum, n }
   for (const r of (Array.isArray(receipts) ? receipts : [])) {
-    const w = OVERRIDE_WEIGHT[r && r.user_action];
-    if (!w) continue;
     const sig = r?.response?.signal;
-    const correct = PERMISSIVE_SIGNAL.has(sig) ? 1 : CAUTIOUS_SIGNAL.has(sig) ? -1 : 0;
-    if (!correct) continue;
+    const contribution = delegationCorrection(sig, r && r.user_action);
+    if (!contribution) continue;
     const domain = (typeof r?.request?.action_descriptor?.domain === 'string') ? r.request.action_descriptor.domain : '';
     for (const d of (Array.isArray(r.drivers) ? r.drivers : [])) {
       const dim = CUE_DIMENSION[d && d.cue];
       if (!dim) continue;
       const k = `${dim}|${domain}`;
       const t = tally.get(k) || { dimension: dim, domain, sum: 0, n: 0 };
-      t.sum += correct * w; t.n += 1; tally.set(k, t);
+      t.sum += contribution; t.n += 1; tally.set(k, t);
     }
   }
   const keyOf = (dim, domain) => `${dim}|${domain || ''}`;

package/consult.js

@@ -72,10 +72,25 @@ async function modelJudge(vd, n, opts) {
   if (!res.ok) throw new Error(`model endpoint ${res.status}`);
   const data = await res.json();
   const out = parseJudge(data?.choices?.[0]?.message?.content || '');
-  // §10.4 enforced on parse: only the four signal fields ever leave the function.
-  return shape(n.type, out.signal, out.confidence ?? 0.6, out.rationale_hint, out.deference_level);
+  // §10.4 enforced STRUCTURALLY: the model's free-text rationale_hint is NOT passed
+  // through — a misbehaving or prompt-injected judge could otherwise emit verbatim
+  // fingerprint/persona text there (the JUDGE_SYSTEM "never quote" line is a request,
+  // not enforcement). We keep the model's decision (signal/confidence/deference) and
+  // substitute a fixed, persona-free hint keyed to the signal. parseJudge still
+  // requires a non-empty rationale_hint so the model must emit well-formed JSON.
+  return shape(n.type, out.signal, out.confidence ?? 0.6, MODEL_SAFE_HINT[out.signal] || 'Your decision pattern bears on this action.', out.deference_level);
 }
 
+// Persona-free, signal-keyed hints for the model path (see §10.4 note above).
+const MODEL_SAFE_HINT = {
+  proceed:             'Your decision pattern supports proceeding here.',
+  proceed_with_note:   'Your decision pattern supports proceeding, with a light note.',
+  clarify:             'Your decision pattern suggests clarifying before acting.',
+  escalate:            'Your decision pattern suggests holding for your explicit go-ahead.',
+  decline:             'Your decision pattern leans against this action.',
+  insufficient_signal: 'Your fingerprint does not clearly speak to this action.',
+};
+
 // ── Config + orchestrator ─────────────────────────────────────────────────────
 // Local-only by default. `PHAEDO_CONSULT_MODEL` opts INTO the model judge (point
 // it at a general chat model in Ollama, e.g. `llama3.1:8b` — NOT the extraction

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phaedo-mcp",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "private": false,
   "license": "Apache-2.0",
   "type": "module",
@@ -9,7 +9,7 @@
   "homepage": "https://phaedo.so",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/phaedo-labs/phaedo.git",
+    "url": "git+https://github.com/phaedo-labs/phaedo-mcp.git",
     "directory": "mcp"
   },
   "keywords": [

package/pairing.js

@@ -124,6 +124,7 @@ export async function pairAtEndpoint(endpoint, { code, relayDeviceId = null, log
   // Long-term ECDH → pair_key; SAS (the MITM anchor) over both pubkeys.
   const shared  = await Identity.deriveSharedWithPeer(vaultPub);
   const pairKey = await Kdf.derivePairKey(shared, body.client_id);
+  shared.fill(0);   // raw ECDH secret consumed — zero it (matches phone-source.js key hygiene)
   const sas     = Kdf.formatSAS(await Kdf.deriveSAS(extPub, vaultPub));
 
   log('');
@@ -148,11 +149,14 @@ export async function pairAtEndpoint(endpoint, { code, relayDeviceId = null, log
   // escalation/fp-mailbox deposits get 401.
   const relaySecret = body.relay_device_secret || null;
 
+  const pairKeyEnc = b64uEnc(pairKey);
+  pairKey.fill(0);   // persisted as base64url below — zero the long-lived key buffer
+
   return {
     endpoint,
     client_id:     body.client_id,
     client_secret: body.client_secret,
-    pair_key:      b64uEnc(pairKey),
+    pair_key:      pairKeyEnc,
     vault_pub:     body.vault_pub,
     sas,
     ...(relayId ? { relay_device_id: relayId } : {}),

package/phone-source.js

@@ -30,7 +30,19 @@ export async function loadPairingRecord(baseDir) {
   const path = process.env.PHAEDO_PAIRING
     ? resolve(process.cwd(), process.env.PHAEDO_PAIRING)
     : resolve(baseDir, 'pairing.json');
-  const rec = JSON.parse(await readFile(path, 'utf8'));
+  let raw;
+  try {
+    raw = await readFile(path, 'utf8');
+  } catch (e) {
+    // No pairing file = UNPAIRED (a valid local-only state), not an error. Return
+    // null so callers that pass the record to depositEscalation / pollEscalation /
+    // the best-effort deposit channels get a graceful "unpaired" instead of an
+    // ENOENT throw. (hasPairingRecord() gates the fingerprint-pull path, so it only
+    // calls this when the file exists.)
+    if (e && e.code === 'ENOENT') return null;
+    throw e;
+  }
+  const rec = JSON.parse(raw);
   for (const k of ['endpoint', 'client_id', 'client_secret', 'pair_key']) {
     if (!rec[k]) throw new Error(`Pairing record at ${path} is missing "${k}".`);
   }

package/receipts.js

@@ -21,7 +21,7 @@
 // resolver core stays pure (no I/O). Receipt-write failure must never break the
 // consultation itself (the server warns on stderr and still answers).
 
-import { mkdir, readFile, writeFile, chmod } from 'fs/promises';
+import { mkdir, readFile, writeFile, chmod, rename } from 'fs/promises';
 import { existsSync } from 'fs';
 import { join } from 'path';
 import { Phaedo, b64uEnc, b64uDec } from './lib/phaedo-crypto.js';
@@ -78,8 +78,26 @@ async function writeStore(stateDir, store, now) {
   });
   plaintext.fill(0);
   const p = storePath(stateDir);
-  await writeFile(p, JSON.stringify({ envelope }), { mode: 0o600 });
-  await chmod(p, 0o600);
+  // Atomic replace: write a temp file then rename over the live store. Receipts are
+  // the ONLY copy (readStore throws on a corrupt store) — a crash mid-write must not
+  // truncate/corrupt receipts.enc and brick the audit trail + every markOutcome.
+  const tmp = `${p}.tmp`;
+  await writeFile(tmp, JSON.stringify({ envelope }), { mode: 0o600 });
+  await chmod(tmp, 0o600);
+  await rename(tmp, p);   // atomic on POSIX
+}
+
+// Serialize store mutations per state dir. MCP tool handlers are async and NOT
+// serialized by the SDK, so a concurrent appendReceipt (phaedo_consult) and
+// markOutcome (phaedo_record_outcome/escalation_status) both read the same snapshot
+// and the second write clobbers the first — a lost receipt or lost outcome mark.
+// A per-stateDir promise chain forces read-modify-write to run one at a time.
+const _storeLocks = new Map();
+function withStoreLock(stateDir, fn) {
+  const prev = _storeLocks.get(stateDir) || Promise.resolve();
+  const next = prev.then(fn, fn);                 // run regardless of the prior result
+  _storeLocks.set(stateDir, next.then(() => {}, () => {}));  // a rejection must not break the chain
+  return next;
 }
 
 // Build the §10.6 receipt object from a resolved consultation. Pure. Captures the
@@ -126,11 +144,13 @@ export function buildReceipt({ via, agentId, request, response, drivers, now = D
 
 // Append one receipt; evict oldest beyond the cap. Returns the stored receipt.
 export async function appendReceipt(stateDir, receipt, { cap = DEFAULT_CAP, now = Date.now() } = {}) {
-  const store = await readStore(stateDir);
-  store.receipts.push(receipt);
-  if (store.receipts.length > cap) store.receipts.splice(0, store.receipts.length - cap);
-  await writeStore(stateDir, store, now);
-  return receipt;
+  return withStoreLock(stateDir, async () => {
+    const store = await readStore(stateDir);
+    store.receipts.push(receipt);
+    if (store.receipts.length > cap) store.receipts.splice(0, store.receipts.length - cap);
+    await writeStore(stateDir, store, now);
+    return receipt;
+  });
 }
 
 // The ONE permitted mutation (§10.6): set user_action on an existing receipt.
@@ -139,12 +159,14 @@ export async function updateUserAction(stateDir, receiptId, action, { now = Date
   if (!USER_ACTIONS.includes(action)) {
     throw new Error(`user_action must be one of: ${USER_ACTIONS.join(', ')}`);
   }
-  const store = await readStore(stateDir);
-  const r = store.receipts.find((x) => x.receipt_id === receiptId);
-  if (!r) return false;
-  r.user_action = action;
-  await writeStore(stateDir, store, now);
-  return true;
+  return withStoreLock(stateDir, async () => {
+    const store = await readStore(stateDir);
+    const r = store.receipts.find((x) => x.receipt_id === receiptId);
+    if (!r) return false;
+    r.user_action = action;
+    await writeStore(stateDir, store, now);
+    return true;
+  });
 }
 
 // Decrypt and return all receipts (oldest first). The dev/harness read path — and

package/server.js

@@ -157,7 +157,7 @@ if (existsSync(ESCALATION_POLICY_PATH)) {
   catch (e) { process.stderr.write(`[phaedo-mcp] ignoring malformed escalation policy (${ESCALATION_POLICY_PATH}): ${e.message}\n`); }
 }
 
-const server = new McpServer({ name: 'phaedo', version: '0.2.1' });
+const server = new McpServer({ name: 'phaedo', version: '0.2.2' });
 
 // ── Tool: phaedo_request_injection (binding §3.1) ─────────────────────────────
 server.registerTool(

package/server.json

@@ -1,10 +1,10 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.phaedo-labs/phaedo-mcp",
-  "description": "Carry your Phaedo cognitive fingerprint into any MCP client: style injection, decision consults + real-time escalation.",
-  "version": "0.2.1",
+  "description": "Carry your Phaedo cognitive fingerprint into any MCP client: injection, consults, escalation.",
+  "version": "0.2.2",
   "repository": {
-    "url": "https://github.com/phaedo-labs/phaedo",
+    "url": "https://github.com/phaedo-labs/phaedo-mcp",
     "source": "github",
     "subfolder": "mcp"
   },
@@ -13,7 +13,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "phaedo-mcp",
-      "version": "0.2.1",
+      "version": "0.2.2",
       "transport": {
         "type": "stdio"
       }