phaedo-mcp 0.2.2 → 0.3.0

package/vendor/context-block.js

@@ -291,7 +291,9 @@ function extractValueSignals(fingerprint) {
   let hasValues = false, valueCount = 0, futureOriented = false, growthMinded = false;
   for (const layer of Object.values(fingerprint.layers || {})) {
     for (const { answer } of layer.responses || []) {
-      const t = (answer || '').trim();
+      // Coerced, not assumed. `answer` is not required by fingerprint.schema.json, so a legal
+      // fingerprint can carry any type here — `(answer || '')` still throws on a number or object.
+      const t = (typeof answer === 'string' ? answer : '').trim();
       if (!t) continue;
       if (/\b(what matters (most )?(to me|for me)|I believe in|at my core|my (core )?(principle|value|belief)|I care (deeply|strongly )?(about|for)|what I (value|stand for)|fundamentally I|it('s| is) important to me|I('m| am) committed to)\b/i.test(t)) {
         hasValues = true; valueCount++;
@@ -470,14 +472,132 @@ const INJECT_SOURCE_ALLOW = new Set([
 // and inject as extra bullets / pseudo-headings, derailing the block's structure.
 // Render-time chokepoint catches every writer (popup, conflict-review, mobile,
 // historical data already on disk) without chasing each call site.
+// The block's own closing tag. Anything that renders inside the block and reproduces this ends
+// the persona early as far as the model is concerned — everything after the forged tag reads as
+// outside it. Reached from summaries, interview answers, layer labels and rule text, all of which
+// carry attacker-influenceable content (see extraction/direct.js for the upstream chain).
+// Neutralised by breaking the tag, not by deleting the text: the subject's own words are never
+// silently removed from what the model is told about them.
+const BLOCK_TAG_RE = /<\/?\s*phaedo_user_profile\s*>/gi;
+function neutralizeBlockTag(s) {
+  return String(s == null ? '' : s).replace(BLOCK_TAG_RE, (m) => m.replace('<', '‹'));
+}
+
 function sanitizeRuleLine(s) {
-  return String(s == null ? '' : s).replace(/[\r\n\t]+/g, ' ').replace(/\s+/g, ' ').trim();
+  return neutralizeBlockTag(String(s == null ? '' : s)).replace(/[\r\n\t]+/g, ' ').replace(/\s+/g, ' ').trim();
+}
+// §5.2 scope activation (v0.2 / OQ5) for domain/task-scoped rules. MIRRORS
+// user-config.js instructionActiveFor (this file is vendored standalone into
+// mcp/vendor/, so it cannot require the §5 module; parity is locked by
+// scripts/test_user_config.mjs). Same substring namespace as the §10.5 resolver:
+// the session's domain/task_hint CONTAINS the rule's scope entry, case-insensitive.
+// Fail-closed: scoped + context known + no match → inactive.
+function scopeActive(rule, sessionContext) {
+  const scope = rule && rule.scope;
+  if (scope !== 'domain' && scope !== 'task') return true;
+  const ctx = sessionContext && typeof sessionContext === 'object' ? sessionContext : {};
+  const hay = scope === 'domain'
+    ? (typeof ctx.domain === 'string' ? ctx.domain.toLowerCase() : '')
+    : (typeof ctx.task_hint === 'string' ? ctx.task_hint.toLowerCase() : '');
+  if (!hay) return false;
+  const keys = scope === 'domain' ? rule.scope_domains : rule.scope_tasks;
+  return (Array.isArray(keys) ? keys : []).some(k => typeof k === 'string' && k && hay.includes(k.toLowerCase()));
+}
+// A scoped rule injected WITHOUT session context gets an explicit conditional
+// prefix — the consuming model activates it contextually (the §5.2 model-mediated
+// branch). A consumer that CAN evaluate scope filters deterministically instead.
+function scopePrefix(rule) {
+  const scope = rule && rule.scope;
+  if (scope === 'domain' && Array.isArray(rule.scope_domains) && rule.scope_domains.length) {
+    return `Only when the session involves ${rule.scope_domains.map(sanitizeRuleLine).join(' or ')}: `;
+  }
+  if (scope === 'task' && Array.isArray(rule.scope_tasks) && rule.scope_tasks.length) {
+    return `Only when the task involves ${rule.scope_tasks.map(sanitizeRuleLine).join(' or ')}: `;
+  }
+  return '';
+}
+// Which of two identical rules to keep. Mirrors sync-merge.js `richness` deliberately — the merge
+// prefers the copy carrying a structured decision value or an exception, and the injection seam
+// must not then discard the copy the merge chose to keep.
+function ruleRichness(r) {
+  return (r && r.decision && r.decision.value != null ? 2 : 0) + (r && r.exception ? 1 : 0);
 }
-function renderOperatingRules(fingerprint) {
+
+// Does this rule NARROW what the agent may do? Only §5.2 `authorization` rules carry an `effect`,
+// and `autoproceed` / `bias_bold` are the two that EXPAND autonomy — the same split
+// mcp/consult-policy.js calls RELAXING. Anything without an effect is a plain instruction, and an
+// instruction is a constraint on behaviour, so it counts as restrictive. Erring that way is the
+// point: the budget should shed permissions, not prohibitions.
+const RELAXING_EFFECTS = new Set(['autoproceed', 'bias_bold']);
+function isRestrictiveRule(r) {
+  return !(r && typeof r.effect === 'string' && RELAXING_EFFECTS.has(r.effect));
+}
+
+/**
+ * How many authored rules the injection budget is currently dropping, and which.
+ *
+ * Exposed so the POPUP can tell the subject. The console warning inside renderOperatingRules is
+ * for a developer; the person whose rules are being silently withheld is not reading the service
+ * worker log. Computed by running the REAL selection — a second implementation that agreed today
+ * and drifted tomorrow would report a number the injected block does not honour, which is worse
+ * than saying nothing.
+ */
+function operatingRulesBudget(fingerprint, sessionContext) {
+  const before = _lastDropped;
+  _lastDropped = null;
+  try {
+    renderOperatingRules(fingerprint, sessionContext);
+    const dropped = _lastDropped || [];
+    return { dropped: dropped.length, texts: dropped.map(r => String(r.text || '').trim()) };
+  } finally {
+    _lastDropped = before;
+  }
+}
+let _lastDropped = null;
+
+function renderOperatingRules(fingerprint, sessionContext) {
+  // Scope semantics (§5.2 v0.2): with session context, scoped rules filter
+  // deterministically (fail-closed); without it, they inject with a conditional
+  // prefix. hasContext is per-scope-relevant field: a context carrying only a
+  // domain still leaves task-scoped rules on the conditional-prefix branch.
+  const ctx = sessionContext && typeof sessionContext === 'object' ? sessionContext : null;
+  const hasDomainCtx = !!(ctx && typeof ctx.domain === 'string' && ctx.domain);
+  const hasTaskCtx = !!(ctx && typeof ctx.task_hint === 'string' && ctx.task_hint);
   const rules = Array.isArray(fingerprint && fingerprint.standing_rules) ? fingerprint.standing_rules : [];
-  const seen = new Set();
-  const chosen = rules
+  let chosen = rules
     .filter(r => r && typeof r.text === 'string' && r.text.trim())
+    // LAPSED RULES ARE NOT INJECTED. §9 never read `expires_at`, while the §10.5 resolver
+    // enforces it — so the consult path correctly refused a grant the injection path was
+    // simultaneously telling the model the subject had endorsed. Same artifact, two answers,
+    // and the injected one presents it as a standing hard constraint.
+    //
+    // ABSENT and UNREADABLE differ, exactly as in mcp/consult-policy.js: absent means no expiry,
+    // present-but-unparseable means already lapsed. An unreadable bound must never read as an
+    // unbounded one.
+    .filter(r => {
+      if (r.expires_at === undefined || r.expires_at === null) return true;
+      if (typeof r.expires_at !== 'string') return false;
+      const t = Date.parse(r.expires_at);
+      return Number.isFinite(t) && Date.now() < t;
+    })
+    .filter(r => {
+      if (r.scope !== 'domain' && r.scope !== 'task') return true;
+      // A DEGENERATE scope — `scope:'domain'` with no usable `scope_domains` — is dropped, not
+      // rendered. Without this it survived the filter (no context => "keep, prefixed below") and
+      // then `scopePrefix` returned '' because the key list was empty, so a rule the subject
+      // scoped to something narrow rendered as an UNCONDITIONAL global constraint.
+      //
+      // The deterministic consumer already treats it as permanently inactive
+      // (user-config.js instructionActiveFor is fail-closed), so the two consumers disagreed
+      // completely about the same rule. spec/validate-fingerprint.mjs warns about exactly this
+      // — "or worse, a lenient consumer would apply it globally" — but the validator is a CI
+      // tool, not on the read path. Fail closed here too.
+      const keys = r.scope === 'domain' ? r.scope_domains : r.scope_tasks;
+      const usable = Array.isArray(keys) && keys.some((k) => typeof k === 'string' && k.trim());
+      if (!usable) return false;
+      const canEvaluate = r.scope === 'domain' ? hasDomainCtx : hasTaskCtx;
+      return canEvaluate ? scopeActive(r, ctx) : true;   // no context → keep, prefixed below
+    })
     // Curation: the Operating-rules block is for DELIBERATE hard constraints —
     // authored rules + interview-elicited decision rules + act-as-me (delegation) are
     // ALWAYS injected. Auto-promoted style signals (source:'delta_promotion') inject
@@ -493,10 +613,69 @@ function renderOperatingRules(fingerprint) {
       }
       return INJECT_SOURCE_ALLOW.has(r.source);                       // explicit allow-list
     })
-    // Dedup by normalized text — defensive against near-duplicate authored rules.
-    .filter(r => { const k = r.text.trim().toLowerCase().replace(/\s+/g, ' '); if (seen.has(k)) return false; seen.add(k); return true; })
-    .sort((a, b) => (Number.isFinite(a.priority) ? a.priority : 1e9) - (Number.isFinite(b.priority) ? b.priority : 1e9))
-    .slice(0, OPERATING_RULES_BUDGET);
+    // SORT BEFORE DEDUP. It used to run the other way, and dedup keeps the first entry it sees —
+    // so of two identical-text copies at different priorities, whichever the merge happened to
+    // put first survived. Keeping the weaker one then loses it to the budget below while the
+    // stronger one has already been discarded. Priority order first, so the copy that survives
+    // is the one the subject weighted highest, on every device.
+    .sort((a, b) => (Number.isFinite(a.priority) ? a.priority : 1e9) - (Number.isFinite(b.priority) ? b.priority : 1e9));
+
+  // Collapse identical rules — and collapse them the way sync-merge.js does, keeping the RICHER
+  // copy. Plain first-wins discarded an authored `exception`, so the block told the model the
+  // subject endorsed an UNQUALIFIED hard constraint they had actually qualified. Which copy won
+  // depended purely on array order, and §5.2 rules merge by UNION across devices, so that order
+  // is arbitrary — the same vault could render either version.
+  //
+  // The key includes the SCOPE, not just the text. An unscoped copy and a domain-scoped copy of
+  // the same sentence are different constraints, and collapsing them either widens a rule the
+  // subject narrowed (finding I4's failure, reintroduced through the back door) or narrows a
+  // global one. They stay separate lines.
+  //
+  // COUPLED TO sync-merge.js `richness`: the merge already prefers the copy with an exception or
+  // a structured decision value. This is the same choice at the injection seam, and
+  // scripts/test_injection_integrity.mjs asserts the two agree rather than trusting the comment.
+  const byKey = new Map();
+  for (const r of chosen) {
+    const scopeKey = r.scope === 'domain' ? `d:${(r.scope_domains || []).join(',')}`
+                   : r.scope === 'task'   ? `t:${(r.scope_tasks || []).join(',')}`
+                   : '';
+    const k = `${scopeKey}|${r.text.trim().toLowerCase().replace(/\s+/g, ' ')}`;
+    const prev = byKey.get(k);
+    // Strictly greater: the priority sort already put the stronger copy first, so an equal-richness
+    // later copy must not displace it.
+    if (!prev || ruleRichness(r) > ruleRichness(prev)) byKey.set(k, r);
+  }
+  chosen = [...byKey.values()];
+
+  // THE BUDGET DROPS GRANTS BEFORE PROHIBITIONS. Truncation is deliberate curation — rules must
+  // not crowd out the rest of the persona — but it was purely priority-ordered, and a rule with
+  // no `priority` sorts to 1e9 and goes first. That is the wrong fail direction: this codebase's
+  // rule is that missing grants fail safe and missing prohibitions do not. A dropped
+  // "auto-proceed on low-stakes X" costs a confirmation prompt; a dropped "never do X" costs X.
+  //
+  // Selection is re-ordered, RENDERING is not — the lines below stay in priority order, so a
+  // priority-90 prohibition does not get read as outranking a priority-1 instruction.
+  const overBudget = chosen.length - OPERATING_RULES_BUDGET;
+  let droppedRules = [];
+  if (overBudget > 0) {
+    const keep = new Set(chosen
+      .map((r, i) => ({ r, i, restrictive: isRestrictiveRule(r) }))
+      .sort((a, b) => (b.restrictive - a.restrictive) || (a.i - b.i))
+      .slice(0, OPERATING_RULES_BUDGET)
+      .map(e => e.r));
+    const dropped = chosen.filter(r => !keep.has(r));
+    droppedRules = dropped;
+    chosen = chosen.filter(r => keep.has(r));
+    // Not silent. The subject authored these and the block does not carry them; saying so in the
+    // block itself would tell the model it is missing constraints, which invites hedging on every
+    // answer — so it goes to the console instead. Surfacing it in the popup, where the subject can
+    // actually act on it, is tracked in docs/roadmap/next-steps.md.
+    _lastDropped = droppedRules;
+    if (typeof console !== 'undefined' && console.warn) {
+      console.warn(`[phaedo] ${dropped.length} authored rule(s) exceeded the ${OPERATING_RULES_BUDGET}-rule injection budget and were not injected:`,
+        dropped.map(r => r.text.trim().slice(0, 60)));
+    }
+  }
   if (!chosen.length) return [];
   const lines = [
     '\n## Operating rules (user-confirmed)',
@@ -506,14 +685,18 @@ function renderOperatingRules(fingerprint) {
   ];
   for (const r of chosen) {
     const exc = typeof r.exception === 'string' && r.exception.trim() ? ` (Exception: ${sanitizeRuleLine(r.exception)})` : '';
-    lines.push(`- ${sanitizeRuleLine(r.text)}${exc}`);
+    // Prefix a scoped rule only when this render could NOT evaluate its scope
+    // (matched-and-filtered rules render plain — the condition already held).
+    const needsPrefix = (r.scope === 'domain' && !hasDomainCtx) || (r.scope === 'task' && !hasTaskCtx);
+    const pre = needsPrefix ? scopePrefix(r) : '';
+    lines.push(`- ${pre}${sanitizeRuleLine(r.text)}${exc}`);
   }
   return lines;
 }
 
 // ─── Context block assembly ───────────────────────────────────────────────────
 
-function buildContextBlock(fingerprint, behavioralSignals = {}, linguisticProfile = {}, cognitiveProfile = null, sessionMetrics = {}, mentalModels = null) {
+function buildContextBlock(fingerprint, behavioralSignals = {}, linguisticProfile = {}, cognitiveProfile = null, sessionMetrics = {}, mentalModels = null, sessionContext = null) {
   const lines = ['<phaedo_user_profile>'];
 
   // ── Framing (2026-07-04): declares the block as background about the subject,
@@ -532,7 +715,7 @@ function buildContextBlock(fingerprint, behavioralSignals = {}, linguisticProfil
   );
 
   // ── 0. Operating rules (authored, user-confirmed — highest priority) ─────────
-  lines.push(...renderOperatingRules(fingerprint));
+  lines.push(...renderOperatingRules(fingerprint, sessionContext));
 
   // ── 1. Response instructions (derived from observed behavioral corrections) ──
   const inst = synthesizeResponseInstructions(behavioralSignals, cognitiveProfile);
@@ -593,9 +776,14 @@ function buildContextBlock(fingerprint, behavioralSignals = {}, linguisticProfil
     for (const [layerId, layer] of Object.entries(fingerprint.layers)) {
       // A layer may be extraction-only (added by Loop 2 reconcile) with no
       // questionnaire responses — guard before filtering.
-      const answered = (layer.responses || []).filter(r => r.answer.trim());
+      // `answer` is NOT required by fingerprint.schema.json, so a schema-LEGAL fingerprint could
+      // omit it — and `r.answer.trim()` then threw. The throw escapes rebuildContext inside an
+      // un-wrapped async chrome.storage callback in content.js, so the injection AND the capture
+      // wiring after it never ran: no persona at all, silently. buildLayerConfidence already
+      // type-guarded this exact field; this line did not.
+      const answered = (layer.responses || []).filter(r => typeof r?.answer === 'string' && r.answer.trim());
       if (!answered.length) continue;
-      lines.push(`\n### ${layer.label}`);
+      lines.push(`\n### ${neutralizeBlockTag(layer.label)}`);
       // A2 residual fix (2026-07-05): content-side softening of the
       // Domain-and-expertise section. The persona-eval §7.4 residual
       // showed the block front-loading a persona domain (e.g. immigration)
@@ -613,8 +801,11 @@ function buildContextBlock(fingerprint, behavioralSignals = {}, linguisticProfil
       if (layerId === 'domain_and_expertise') {
         lines.push('*Use as background context about who the subject is — do not steer general prompts toward these topics unless the prompt names them.*');
       }
+      // Neutralised, not stripped — an authored answer is the subject's own words. `answer` is
+      // free text the subject typed and `label`/`question` come from the questionnaire schema,
+      // but a restored or synced fingerprint can carry either from elsewhere.
       for (const { label, question, answer } of answered)
-        lines.push(`${label || question}: ${answer.trim()}`);
+        lines.push(`${neutralizeBlockTag(label || question)}: ${neutralizeBlockTag(answer.trim())}`);
       const layerSigs = behavioralSignals[layerId];
       if (layerSigs) {
         const observed = Object.entries(layerSigs)
@@ -641,7 +832,7 @@ function buildContextBlock(fingerprint, behavioralSignals = {}, linguisticProfil
     if (layer && typeof layer.summary === 'string' && layer.summary.trim()) {
       const clean = sanitizeSummary(layer.summary);            // P0 hygiene: drop episodic/opaque/dup lines
       if (clean) {
-        learnedLines.push(`\n### ${layer.label || layerId.replace(/_/g, ' ')}`);
+        learnedLines.push(`\n### ${neutralizeBlockTag(layer.label || layerId.replace(/_/g, ' '))}`);
         learnedLines.push(clean);
       }
     }
@@ -714,6 +905,14 @@ function validateVaultData(vd) {
   }
   for (const k of ['phaedo_behavioral_signals', 'phaedo_linguistic_profile', 'phaedo_session_metrics'])
     if (vd[k] !== undefined && vd[k] !== null && !isPlainObject(vd[k])) errors.push(`${k} must be an object`);
+  // §5 sibling artifact (config home migration, part 2). Shape-guard only — full
+  // §5 conformance is spec/validate-fingerprint.mjs validateUserConfiguration.
+  const cfg = vd.phaedo_user_configuration;
+  if (cfg !== undefined && cfg !== null) {
+    if (!isPlainObject(cfg)) errors.push('phaedo_user_configuration must be an object');
+    else if (cfg.standing_instructions !== undefined && !Array.isArray(cfg.standing_instructions))
+      errors.push('phaedo_user_configuration.standing_instructions must be an array');
+  }
   return { ok: errors.length === 0, empty, errors };
 }
 
@@ -725,7 +924,13 @@ function validateVaultData(vd) {
 var SUMMARY_EPISODIC_RE = /(https?:\/\/|\bwww\.)|[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}|\b[a-z0-9][a-z0-9-]*\.(com|org|net|io|so|co|ai|app|xyz|info)\b/i;
 var SUMMARY_DIM_RE = /^[-*\s]*([^:]{1,60}):\s*(.+)$/;
 var SUMMARY_OPAQUE_RE = /^[a-z]\d(?:[ _][a-z0-9]+)*$/i;
+// Summary lines carry EXTRACTION output — the most attacker-influenceable content in the block
+// (extraction/direct.js documents the chain). Tag-neutralised before any other hygiene runs.
 function sanitizeSummary(text) {
+  return _sanitizeSummaryInner(neutralizeBlockTag(text));
+}
+
+function _sanitizeSummaryInner(text) {
   const out = [];
   const seen = new Set();
   for (const raw of String(text).split('\n')) {
@@ -752,14 +957,41 @@ function renderContextBlock(vd, opts) {
     ctxWarn(msg);              // loud, not silent — a malformed producer is a bug
     return '';                 // …but still degrade gracefully (don't crash the page)
   }
-  const fingerprint = vd.phaedo_fingerprint;
+  let fingerprint = vd.phaedo_fingerprint;
   if (!fingerprint) return ''; // v.empty — legitimately nothing to render
+  // §5 canonical when present (config home migration, part 2): the sibling
+  // artifact's standing_instructions REPLACE the A-home standing_rules for this
+  // render. Inline mirror of user-config.js foldStandingInstructions (this file
+  // is vendored standalone); parity locked by scripts/test_context_block.mjs.
+  //
+  // §5.4 is checked HERE too, not just at the drain: the configuration must name THIS
+  // fingerprint. Replace the fingerprint (a §8.2 restore, or a merge from another device) while
+  // an older configuration is still in the vault and its fingerprint_id names something gone —
+  // folding it anyway would put one identity's authored rules into another's context block, and
+  // the rendered output looks perfectly well-formed either way.
+  const cfg = vd.phaedo_user_configuration;
+  const cfgGoverns = cfg && typeof cfg === 'object' && fingerprint
+    && typeof fingerprint.fingerprint_id === 'string' && fingerprint.fingerprint_id
+    && cfg.fingerprint_id === fingerprint.fingerprint_id
+    && !(typeof fingerprint.subject_id === 'string' && fingerprint.subject_id
+         && typeof cfg.subject_id === 'string' && cfg.subject_id
+         && cfg.subject_id !== fingerprint.subject_id);
+  if (cfgGoverns && Array.isArray(cfg.standing_instructions)) {
+    fingerprint = { ...fingerprint };
+    if (cfg.standing_instructions.length) fingerprint.standing_rules = cfg.standing_instructions;
+    else delete fingerprint.standing_rules;
+  }
   const behavioralSignals = vd.phaedo_behavioral_signals || {};
   const linguisticProfile = vd.phaedo_linguistic_profile || {};
   const sessionMetrics    = vd.phaedo_session_metrics    || {};
   const cognitiveProfile  = synthesizeCognitiveProfile(linguisticProfile, sessionMetrics);
   const mentalModels      = synthesizeMentalModels(linguisticProfile);
-  return buildContextBlock(fingerprint, behavioralSignals, linguisticProfile, cognitiveProfile, sessionMetrics, mentalModels);
+  // §5.2 v0.2 scope activation: a consumer that knows the session's domain /
+  // task_hint (e.g. the MCP injection request's §9.2 session_context) passes it
+  // via opts.sessionContext so scoped rules filter deterministically; without it
+  // they render with a conditional scope prefix.
+  const sessionContext = (opts && opts.sessionContext) || null;
+  return buildContextBlock(fingerprint, behavioralSignals, linguisticProfile, cognitiveProfile, sessionMetrics, mentalModels, sessionContext);
 }
 
 globalThis.PhaedoContext = {
@@ -767,6 +999,7 @@ globalThis.PhaedoContext = {
   synthesizeCognitiveProfile,
   synthesizeMentalModels,
   renderContextBlock,
+  operatingRulesBudget,
   validateVaultData,
   SIGNAL_LABELS,
 };

package/vendor/envelope.js

@@ -33,13 +33,59 @@
    * contains only strings. NOT full RFC 8785 — when §8.3 signing lands and we
    * canonicalize artifact bytes with numeric fields, switch to a JCS impl.
    */
+  // RFC 8785 (JCS) canonical JSON serialization — full method (spec §6, v0.1.44).
+  // In ECMAScript, JSON.stringify already emits RFC 8785-conformant scalars:
+  // shortest-round-trip ES number formatting ("1e+21", "1e-7", -0 → "0") and
+  // minimal string escaping (short escapes \b \t \n \f \r \" \\, with \u00XX
+  // only for the remaining control chars < 0x20). What it does NOT guarantee is
+  // recursive key ordering, and it silently serializes non-finite numbers as
+  // null. Full RFC 8785 here = UTF-16 code-unit key sort (Array.prototype.sort's
+  // default string order) + explicit REJECTION of values JSON cannot express
+  // (NaN/Infinity throw instead of corrupting the canonical bytes as "null";
+  // a top-level undefined throws instead of returning the invalid "undefined").
+  // Inside containers, undefined/function/symbol follow JSON.stringify
+  // semantics: omitted from objects, null in arrays. (The pre-v0.1.44 subset
+  // emitted invalid JSON for an undefined-valued object property.)
+  // MUST stay byte-identical to mobile/src/lib/envelope.ts (and the mirror in
+  // scripts/test_cross_compat.mjs); locked by TC-CANON vectors.
+  const notJson = (v) => v === undefined || typeof v === 'function' || typeof v === 'symbol'
   function canonicalStringify(value) {
-    if (value === null || typeof value !== 'object') return JSON.stringify(value)
+    if (typeof value === 'number' && !Number.isFinite(value)) {
+      throw new Error('canonicalStringify: non-finite numbers are not expressible in RFC 8785 JSON')
+    }
+    if (value === null || typeof value !== 'object') {
+      const s = JSON.stringify(typeof value === 'string' ? value.normalize('NFC') : value)
+      if (s === undefined) throw new Error('canonicalStringify: a ' + typeof value + ' is not expressible in JSON')
+      return s
+    }
     if (Array.isArray(value)) {
-      return '[' + value.map(canonicalStringify).join(',') + ']'
+      return '[' + value.map(v => notJson(v) ? 'null' : canonicalStringify(v)).join(',') + ']'
+    }
+  // §6.2 NFC. "Implementations MUST normalize text to NFC before canonicalization to avoid
+  // signature breakage from equivalent but byte different strings." It was implemented NOWHERE.
+  //
+  // Not currently breaking §8.3, because signer and verifier work from the same bytes — but that
+  // holds only while nothing re-normalizes, and Apple platforms produce NFD routinely (HFS+/APFS
+  // filename APIs, some IME and paste paths). The failure it protects against is the worst kind:
+  // a signature that verified yesterday stops verifying today, with both sides holding text that
+  // compares equal to a human and to `===` after normalization, and nothing in the error saying
+  // why. Cheap now; archaeology later.
+  //
+  // KEYS TOO, not just values. Two objects whose keys differ only by normalization would
+  // otherwise canonicalize to different bytes AND could collide into one key after
+  // normalization — so the sort happens on the NORMALIZED keys, and a collision is rejected
+  // rather than silently dropping one of them.
+    const seen = new Map()
+    for (const k of Object.keys(value)) {
+      if (notJson(value[k])) continue
+      const nk = k.normalize('NFC')
+      if (seen.has(nk)) throw new Error('canonicalStringify: keys collide under NFC: ' + JSON.stringify(k))
+      seen.set(nk, value[k])
     }
-    const keys = Object.keys(value).sort()
-    return '{' + keys.map(k => JSON.stringify(k) + ':' + canonicalStringify(value[k])).join(',') + '}'
+    const keys = [...seen.keys()].sort()   // UTF-16 code-unit order (RFC 8785 §3.2.3), post-NFC
+    const parts = []
+    for (const k of keys) parts.push(JSON.stringify(k) + ':' + canonicalStringify(seen.get(k)))
+    return '{' + parts.join(',') + '}'
   }
 
   function utf8(s) { return new TextEncoder().encode(s) }

package/vendor/extraction/capture-combine.js

@@ -0,0 +1,160 @@
+// Phaedo capture — cross-surface delta combination (the owner-side merge core).
+//
+// A capture surface (the Claude Code hook, later the a11y helper) deposits its
+// CUMULATIVE Path-A counters as lifted source='delta' signals. The owner must
+// fold those in so that counts ACCUMULATE ACROSS SURFACES — web too_long ×11 +
+// claude-code too_long ×2 must merge to ×13 — but reconcile's delta semantics
+// are replace-by-key (a delta signal is a snapshot, mergeSignal replaces it
+// wholesale). Feeding a surface's signals straight into reconcile would therefore
+// CLOBBER the web-accumulated counts with the (smaller) surface counts.
+//
+// The fix is to combine BEFORE reconcile, from first-party inputs only:
+//   - the extension's OWN lift (from its raw phaedo_behavioral_signals counters —
+//     never from counts already stored in the fingerprint, which are themselves
+//     combined and would double-count on re-merge), plus
+//   - each capture source's latest snapshot (vault `phaedo_capture_sources`,
+//     replaced per source_device_id on drain — idempotent).
+// The combined signal (summed observation_count, confidence recomputed from the
+// total) then flows through the existing replace-by-key reconcile unchanged, so
+// stored shape, rendering, and §4.7 resolution are untouched.
+//
+// Every delta-writing merge path MUST pass captureSources (background.js does,
+// for both the extract path and the drain path) — a path that skips it would
+// replace the combined count with an own-only count on its next write.
+
+import { countConfidence } from './delta-lift.js';
+import { buildFingerprintUpdate } from './fingerprint-update.js';
+import { valKey } from './resolve.js';
+
+// Identity of one underlying counter across surfaces. Same counter name → same
+// (layer, field, polarity, value[, domain]) via SIGNAL_MAP on every surface, so
+// value is part of the key (too_long/'short' vs too_short/'thorough' share
+// field+polarity but are different counters and must NOT merge).
+const combineKey = (s) =>
+  `${s.layer}::${s.field}::${s.polarity}::${valKey(s.value)}${typeof s.domain === 'string' ? `::${s.domain}` : ''}`;
+
+// The dimension key WITHOUT the value — this is exactly reconcile.js sigKey. Two delta
+// signals that share it but differ in value (too_long/'short' vs too_short/'thorough',
+// same field+positive polarity) are OPPOSING counters that reconcile would collapse
+// (mergeSignal's delta branch replaces wholesale on key match), keeping whichever is
+// enumerated last. See the majority-resolution pass in combineDeltaSignals.
+const dimKey = (s) =>
+  `${s.layer}::${s.field}::${s.polarity}${typeof s.domain === 'string' ? `::${s.domain}` : ''}`;
+
+// Combine the extension's own lifted delta signals with capture-source snapshots.
+// Returns one delta signal per RECONCILE DIMENSION (field, polarity[, domain]) with
+// observation_count = Σ of that value's counters across surfaces, and — when opposing
+// values collide on a dimension — only the MAJORITY value survives. Non-delta signals
+// must not be passed here (callers strip; applyCaptureSources below does it).
+export function combineDeltaSignals(ownSignals, sources, now) {
+  // Pass 1: sum each distinct counter (value included) across surfaces.
+  const byKey = new Map();
+  const fold = (sig) => {
+    if (!sig || sig.source !== 'delta') return;
+    const k = combineKey(sig);
+    const prev = byKey.get(k);
+    if (!prev) { byKey.set(k, { ...sig, session_refs: [] }); return; }
+    const total = (prev.observation_count || 0) + (sig.observation_count || 0);
+    byKey.set(k, {
+      ...prev,
+      observation_count: total,
+      confidence: countConfidence(total),
+      last_observed: [prev.last_observed, sig.last_observed].filter(Boolean).sort().pop() || now,
+    });
+  };
+  for (const sig of ownSignals || []) fold(sig);
+  for (const src of sources || []) for (const sig of (src && src.signals) || []) fold(sig);
+
+  // Pass 2: resolve opposing values on the same reconcile dimension to the MAJORITY
+  // (highest observation_count) — WITHOUT this, reconcile silently keeps the
+  // last-enumerated value (deterministically the capture source's minority signal),
+  // inverting the fingerprint (web too_long×11 'short' lost to hook too_short×2
+  // 'thorough'). Ties and array-valued fields (which reconcile UNIONS, not replaces —
+  // formatting_prefs etc.) keep every entry: a tie leaves no majority to assert, and
+  // union fields don't collide. Deterministic: higher count wins, then valKey order.
+  const byDim = new Map();
+  for (const s of byKey.values()) {
+    if (Array.isArray(s.value)) { byDim.set(combineKey(s), [s]); continue; } // union field — never collapse
+    const dk = dimKey(s);
+    const arr = byDim.get(dk) || [];
+    arr.push(s);
+    byDim.set(dk, arr);
+  }
+  const out = [];
+  for (const arr of byDim.values()) {
+    if (arr.length === 1) { out.push(arr[0]); continue; }
+    const scalars = arr.filter((s) => !Array.isArray(s.value));
+    if (scalars.length <= 1) { out.push(...arr); continue; }
+    const max = Math.max(...scalars.map((s) => s.observation_count || 0));
+    const top = scalars.filter((s) => (s.observation_count || 0) === max);
+    if (top.length > 1) { out.push(...arr); continue; }        // genuine tie → let reconcile keep both (no false majority)
+    out.push(top[0]);                                          // majority wins; minority opposing counters dropped from the update
+  }
+  return out;
+}
+
+// ── Per-source snapshot validity + merge (shared by every owner tier) ────────
+// A stored snapshot is { surface, captured_at, signals[] } keyed by
+// source_device_id. Deposits carry the surface's CUMULATIVE counts, so between
+// two snapshots of the same source the newer captured_at strictly supersedes the
+// older — replace, never sum. Mirrored on the phone in
+// mobile/src/lib/captureSources.js (keep in lockstep — the phone can't import
+// this ES module through Metro).
+
+// A snapshot is usable only if it carries at least one source='delta' signal —
+// the only kind the combine folds (a future extraction-backend deposit is
+// rejected at the drain, background.js mergeCaptureDelta).
+export function isValidSnapshot(snap) {
+  return !!(snap && typeof snap === 'object' && Array.isArray(snap.signals)
+    && snap.signals.some((s) => s && s.source === 'delta'));
+}
+
+// Merge an incoming per-source snapshot map (e.g. forwarded by the phone owner in
+// its to_ext deposit) into the locally stored one. Per source: missing → take;
+// newer captured_at → replace; older/equal-but-different → keep local (cumulative
+// counts only grow, so the newer stamp is always the superset). Returns
+// { changed, sources } without mutating either input.
+export function mergeSourceSnapshots(prior, incoming) {
+  const out = { ...(prior || {}) };
+  let changed = false;
+  for (const [sourceId, snap] of Object.entries(incoming || {})) {
+    if (!sourceId || !isValidSnapshot(snap)) continue;
+    const cur = out[sourceId];
+    if (cur && JSON.stringify(cur) === JSON.stringify(snap)) continue;   // idempotent re-forward
+    const curAt = cur && cur.captured_at ? String(cur.captured_at) : '';
+    const inAt = snap.captured_at ? String(snap.captured_at) : '';
+    if (cur && curAt >= inAt) continue;                                  // stale forward — keep the newer local copy
+    out[sourceId] = snap;
+    changed = true;
+  }
+  return { changed, sources: out };
+}
+
+// Rewrite an extraction `update` so its delta signals become the cross-surface
+// combined set. Pure: strips source='delta' signals out of each layer doc, combines
+// them with the capture sources, and folds the combined set back in (as layer docs
+// via the same builder the lift path uses). Extraction (non-delta) signals pass
+// through untouched. reconcileLayer recomputes per-layer confidence/summary at
+// merge time, so concatenating signals into the layer doc is sufficient here.
+export function applyCaptureSources(update, sources, now) {
+  const own = [];
+  const stripped = {};
+  for (const [layerId, doc] of Object.entries(update || {})) {
+    const signals = Array.isArray(doc.signals) ? doc.signals : [];
+    // Signals embedded in a layer doc have no `layer` field (the doc key IS the
+    // layer) — re-attach it, or the combine key would never match a source's.
+    own.push(...signals.filter((s) => s && s.source === 'delta').map((s) => ({ ...s, layer: s.layer || layerId })));
+    stripped[layerId] = { ...doc, signals: signals.filter((s) => !s || s.source !== 'delta') };
+  }
+  const combined = combineDeltaSignals(own, sources, now);
+  if (!combined.length) return stripped;
+  const deltaUpdate = buildFingerprintUpdate(combined, { now });
+  const out = { ...stripped };
+  for (const [layerId, doc] of Object.entries(deltaUpdate)) {
+    const base = out[layerId];
+    out[layerId] = base
+      ? { ...base, signals: [...(base.signals || []), ...(doc.signals || [])] }
+      : doc;
+  }
+  return out;
+}