phaedo-mcp 0.2.2 → 0.3.1

package/ap2.js

@@ -0,0 +1,214 @@
+// Anamnesis ↔ AP2 profile — standing authorizations as Intent Mandates.
+//
+// WHY THIS EXISTS. The standing risk to Anamnesis is not that a rival builds a
+// better decision oracle; it is the standards cold-start. One implementer is a
+// format, not a standard, and evangelism has not moved that number. Binding to a
+// standard that ALREADY has implementers does: every AP2 participant becomes a
+// partial Anamnesis consumer without adopting Anamnesis.
+//
+// AP2 (Google → FIDO Alliance, May 2026; Mastercard's Verifiable Intent
+// co-contributed; the FIDO Payments TWG is chaired by Mastercard and Visa) defines
+// an INTENT MANDATE: a verifiable credential, signed by the user with a
+// hardware-backed device key, TTL'd, carrying structured constraints and the
+// agent's stated understanding of the request ("prompt playback"), plus an
+// intentionally open-ended risk payload.
+//
+// Read that against §10.5. An Intent Mandate is a standing authorization
+// (`match` + `amount_gt` + `expires_at`) rendered as a credential the card networks
+// already accept — and Phaedo's escalate-to-phone flow is architecturally the signing
+// ceremony, once §8.3 gives the phone a signing key. The two designs arrived
+// at the same primitive from opposite ends. "Prompt playback" is the payments
+// industry independently discovering §10.2 `action_binding`.
+//
+// WHAT THIS MODULE DOES, AND DOES NOT. It is a PURE SERIALIZER: it renders the
+// subject's authorizations into the Intent Mandate payload shape, and renders a
+// consultation signal into a risk-payload entry. It does NOT sign — and today
+// NOTHING does: §8.3 asymmetric signing is unbuilt, so no subject signing key
+// exists anywhere in the product yet. That is the honest current state; the
+// intended design is that the key is generated non-extractably on the phone and
+// the ceremony that turns this payload into a credential is the phone's, not the
+// server's. Deliberately unreachable from here either way. Scope + the P-256 vs
+// Ed25519 decision: docs/roadmap/asymmetric-signing-scope-2026-07-23.md.
+//
+// The mapping is lossy in ONE direction on purpose. Anamnesis carries dispositions
+// and inferred signals that have no place in a payment credential, so only the
+// deterministic, subject-authored half crosses: authorizations, their bounds, and
+// their expiry. Nothing inferred, no layer content, no persona. That is the §10.4
+// boundary applied to a new transport, and it is also why this is safe to hand to a
+// merchant's stack.
+//
+// PURE: no I/O, no crypto, no network.
+
+import { signingInput } from './signing.js';
+
+const MAG_RANK = { low: 0, medium: 1, high: 2 };
+
+const isObj = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+
+// AP2 expresses shopping constraints as structured fields, not prose. §10.5 `match`
+// is already structured, so the translation is mechanical — the only real decision is
+// which constraints have a faithful counterpart and which must be dropped rather than
+// approximated. `magnitude` has none (it is a behavioral notion, not a commerce one),
+// so it is carried as an advisory annotation, never as a spend limit.
+function matchToConstraints(match) {
+  const m = isObj(match) ? match : {};
+  const out = {};
+  const domains = Array.isArray(m.domains) ? m.domains.map((d) => String(d)).filter(Boolean) : [];
+  if (domains.length) out.categories = domains;
+  // AP2's `max_amount` is a spend cap, so only a genuine CEILING may fill it.
+  // `amount_lt` is that ceiling. `amount_gt` is a FLOOR — "fires above N" — and on an
+  // autoproceed rule it means "auto-proceed only the LARGE ones", the opposite of a
+  // cap. Mapping it to `max_amount` (as this did before `amount_lt` existed) would
+  // have told a merchant the subject capped spending at exactly the figure above
+  // which they wanted extra scrutiny. It is carried as an annotation instead.
+  // Both ceiling forms map to `max_amount`, and when both are present the LOWER wins — AP2 has
+  // one field and no way to say "exclusive", so the credential must not assert more headroom than
+  // the rule grants. `amount_lte: 20` becomes `max_amount: 20`; `amount_lt: 20` also becomes 20,
+  // which is the pre-existing (slightly generous by one cent) mapping, unchanged.
+  const ceilings = [m.amount_lt, m.amount_lte].filter((v) => typeof v === 'number' && Number.isFinite(v));
+  if (ceilings.length) {
+    out.max_amount = Math.min(...ceilings);
+  }
+  if (typeof m.amount_gt === 'number' && Number.isFinite(m.amount_gt)) {
+    out.annotations = { ...(out.annotations || {}), anamnesis_amount_floor: m.amount_gt };
+  }
+  if (typeof m.reversible === 'boolean') out.refundable_only = m.reversible;
+  if (m.magnitude_max && MAG_RANK[m.magnitude_max] !== undefined) {
+    out.annotations = { ...(out.annotations || {}), anamnesis_magnitude_max: m.magnitude_max };
+  }
+  return out;
+}
+
+// One §10.5 authorization → the Intent Mandate constraint block it corresponds to,
+// or null when it has no faithful translation.
+//
+// Only AUTOPROCEED authorizations become mandates. That is the whole semantic match:
+// an Intent Mandate is a grant of authority to act without the human present, and
+// `autoproceed` is the only Anamnesis effect that grants anything. An `escalate` or
+// `decline` rule is the ABSENCE of a mandate — the correct AP2 rendering of "ask me
+// first" is not a restrictive credential, it is no credential at all, and emitting
+// one would invert its meaning to a merchant.
+export function authorizationToIntentConstraints(rule, { now = Date.now() } = {}) {
+  if (!isObj(rule)) return null;
+  if (rule.kind !== undefined && rule.kind !== 'authorization') return null;
+  if (rule.effect !== 'autoproceed') return null;
+  // A lapsed authorization must not be exported as live authority.
+  const exp = Date.parse(rule.expires_at);
+  if (Number.isFinite(exp) && exp <= now) return null;
+  // Nor must a CLIENT-SCOPED one (§10.5 `agents`). AP2 has no vocabulary for "this
+  // specific paired client", so a scoped grant cannot be expressed in a mandate — and
+  // emitting it unscoped would tell a merchant the subject granted unconditionally
+  // what they in fact granted to exactly one client. That is the same inversion this
+  // function already refuses for restrictive rules, and it crosses to a third party,
+  // where it is least correctable. A scope that cannot be carried must instead
+  // withhold the credential: the correct AP2 rendering of a grant this format cannot
+  // express is no grant at all. (An ABSENT `agents` is unscoped and exports normally;
+  // an empty array is a scope naming nobody, so it withholds too.)
+  if (Array.isArray(rule.agents)) return null;
+  return {
+    source_rule_id: rule.instruction_id || rule.id || null,
+    constraints: matchToConstraints(rule.match),
+    // §10.5 require_binding maps onto AP2's own posture that a mandate authorizes a
+    // BOUNDED transaction, not open-ended spending. Carried through so a verifier can
+    // see the subject demanded the agent commit to a concrete action.
+    requires_action_binding: rule.require_binding === true,
+    expires_at: Number.isFinite(exp) ? new Date(exp).toISOString() : null,
+  };
+}
+
+// The unsigned Intent Mandate payload for a subject's live authorizations.
+//
+// Returns null when the subject has granted nothing — which is the common case and
+// the right answer: no authority, no mandate. Callers MUST NOT synthesize an empty
+// mandate, because an empty credential reads to a merchant as "authorized with no
+// constraints", the exact inversion this module exists to avoid.
+export function buildIntentMandatePayload(fp, opts = {}) {
+  const {
+    now = Date.now(),
+    agentId = null,
+    promptPlayback = null,          // the agent's stated understanding (AP2 "prompt playback")
+    consultSignal = null,           // §10.3 signal, if a consultation preceded this
+  } = opts;
+
+  // A standing authorization lives in EITHER home (spec §10.5: "a `consult_policies` rule
+  // or `standing_rules` authorization"), so an Intent Mandate — the subject's live
+  // authorizations — must read both. Reading only `standing_rules` silently dropped every
+  // autoproceed guardrail authored through the extension's Decision-guardrails form (which
+  // writes `consult_policies`), so a subject with real grants got an empty mandate. The
+  // per-rule guards are unchanged and live in authorizationToIntentConstraints: autoproceed
+  // only, not lapsed, and never a client-scoped grant (AP2 can't express `agents`).
+  const standingRules = Array.isArray(fp?.standing_rules) ? fp.standing_rules : [];
+  const policyRules   = Array.isArray(fp?.consult_policies?.rules) ? fp.consult_policies.rules : [];
+  // §10.5 tombstones — a REVOKED authorization must never become a mandate grant. This is
+  // the highest-stakes read of the two homes: a grant here is what a payment credential is
+  // minted against, so a rule the subject revoked that survived in a stale or restored copy
+  // would sign away authority they took back. Same consumer MUST as normalizePolicies.
+  const revoked = new Set(
+    (Array.isArray(fp?.consult_policies?.revoked) ? fp.consult_policies.revoked : [])
+      .map((t) => (t && typeof t === 'object' && t.id != null ? String(t.id) : null))
+      .filter(Boolean)
+  );
+  const grants = [];
+  const seen = new Set();   // dedupe by source rule id — the same authorization must not
+  for (const r of [...standingRules, ...policyRules]) {           // become two mandate grants
+    if (r && typeof r === 'object') {
+      const rid = r.id != null ? String(r.id) : (r.instruction_id != null ? String(r.instruction_id) : null);
+      if (rid && revoked.has(rid)) continue;
+    }
+    const g = authorizationToIntentConstraints(r, { now });
+    if (!g) continue;
+    if (g.source_rule_id && seen.has(g.source_rule_id)) continue;
+    if (g.source_rule_id) seen.add(g.source_rule_id);
+    grants.push(g);
+  }
+  if (!grants.length) return null;
+
+  // The mandate expires with the FIRST grant to lapse — an aggregate credential must
+  // not outlive the narrowest authority inside it.
+  const expiries = grants.map((g) => Date.parse(g.expires_at)).filter(Number.isFinite);
+  const expiresAt = expiries.length ? new Date(Math.min(...expiries)).toISOString() : null;
+
+  return {
+    mandate_type: 'intent',
+    // Version the profile, not the payment protocol: AP2 moves on its own cadence and
+    // a verifier needs to know which mapping produced this.
+    anamnesis_profile: '0.1',
+    issued_at: new Date(now).toISOString(),
+    expires_at: expiresAt,
+    ...(agentId ? { agent_id: String(agentId) } : {}),
+    ...(promptPlayback ? { prompt_playback: String(promptPlayback).slice(0, 500) } : {}),
+    grants,
+    // AP2 leaves the risk payload open-ended for exactly this kind of signal. It is
+    // the ONE place a behavioral system has something to say to a payments network,
+    // and it says it in the §10.4 currency: a constrained signal, never persona.
+    risk_payload: buildRiskPayload({ consultSignal }),
+    // Unsigned by construction. The server CANNOT sign: per §8.3 the subject's key is
+    // non-extractable in the phone's Secure Enclave, so signing is a ceremony that belongs
+    // to the device holding the key. `intentMandateSigningInput()` below computes the exact
+    // bytes the phone would be asked to sign. Until a signature comes back, this object is
+    // a proposal, never a credential.
+    signature: null,
+  };
+}
+
+/**
+ * The exact bytes a §8.3 signature over an Intent Mandate covers: the §6 RFC 8785 canonical
+ * form of the payload with `signature` omitted. This is the seam between the server (which
+ * builds the mandate) and the phone (which holds the only key that can sign it) — both sides
+ * must agree on these bytes or the resulting signature verifies nowhere.
+ *
+ * Omitting `signature` is what keeps the input stable once the signature is attached, so a
+ * verifier recomputes the same bytes from the finished credential.
+ */
+export function intentMandateSigningInput(payload) {
+  return signingInput(payload, { field: 'signature' });
+}
+
+// §10.3 signal → AP2 risk-payload entry. Deliberately minimal: a merchant learns
+// that the subject's own oracle was consulted and what it said — which is exactly the
+// claim that makes a mandate more trustworthy — and learns nothing about the subject.
+export function buildRiskPayload({ consultSignal = null } = {}) {
+  const payload = { anamnesis_consulted: !!consultSignal };
+  if (consultSignal) payload.anamnesis_signal = String(consultSignal);
+  return payload;
+}

package/autonomy-promotion.js

@@ -0,0 +1,280 @@
+// §10.7 — fatigue-aware autonomy promotion.
+//
+// THE PROBLEM THIS SOLVES. Phaedo can add a gate and never remove one. The
+// delegation-promotion channel learns only from DISAGREEMENTS
+// (consult-core.js `buildDelegationPromotions`), and §10.5 permanently caps what
+// an authored disposition may do at `bias_cautious`: "an authored disposition may
+// make the agent MORE deferential, never less." Expanding autonomy requires the
+// subject to hand-author a `kind:"authorization"` rule with a `match`. Almost
+// nobody will. So in real use the oracle accumulates friction and never sheds it,
+// and the 2026 approval-fatigue literature is unanimous about where that ends:
+// approval stops being a decision and becomes a reflex, which is both a usability
+// failure and an attack surface.
+//
+// THE OBJECTION, AND WHY IT SHAPES THE DESIGN. "Learn from approvals" is exactly
+// what the honesty rail forbids — rubber stamps must not teach. That objection is
+// correct, and it is the reason this module is not a counter. A subject clicking
+// approve fourteen times in ninety seconds is not expressing a policy; they are
+// tired. So the gate here is not "how many approvals" but "is this evidence of
+// DELIBERATION":
+//
+//   - spread over distinct days, not a single sitting (volume ≠ deliberation)
+//   - no contrary evidence at all: one rejection or modification in the class kills it
+//   - the oracle must already be tracking the subject well in that domain
+//     (agreement rate — the interlock the agreement read-out exists to provide)
+//   - not batch-marked: approvals recorded in one burst are bookkeeping, not consent
+//
+// AND WHAT IS PROPOSED IS DELIBERATELY SMALL. Reversible only. Never `high`
+// magnitude. A priced class is bounded by an `amount_lt` CEILING set to the
+// SECOND-highest amount approved, never the highest — one outlier must not set the
+// bar (see spendCeiling). Always `require_binding: true`, so the relaxation cannot
+// be unlocked by a fabricated descriptor. Always `expires_at`, so an autonomy grant
+// the subject stops wanting lapses by itself.
+//
+// AND IT IS STILL ONLY A PROPOSAL. This writes nothing authored. It stages a
+// `suggested_rules` entry the subject reviews and endorses, exactly like every
+// other promotion channel — the authored-only invariant holds. The producer
+// stages; the user authors.
+//
+// PURE: (receipts, fp, agreement, opts) -> suggestions[]. No I/O, no globals.
+
+import { computeAgreement, DEFAULT_WINDOW_DAYS } from './agreement.js';
+
+// ── The bar. Every one of these is a way of asking "was this deliberate?" ─────
+export const MIN_APPROVALS = 5;          // enough instances to be a pattern
+export const MIN_DISTINCT_DAYS = 3;      // ...spread across days, not one sitting
+export const MIN_AGREEMENT = 0.8;        // ...in a domain the oracle already tracks well
+export const MIN_AGREEMENT_SCORED = 5;   // ...on enough scored decisions to mean anything
+export const BATCH_WINDOW_MS = 60_000;   // marks this close together are bookkeeping
+export const MAX_BATCH_FRACTION = 0.5;   // ...and may not carry the majority of the evidence
+export const DEFAULT_TTL_DAYS = 30;      // a grant expires unless re-earned
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const MAG_RANK = { low: 0, medium: 1, high: 2 };
+const RANK_MAG = ['low', 'medium', 'high'];
+
+const uuid = () =>
+  (typeof crypto !== 'undefined' && crypto.randomUUID) ? crypto.randomUUID()
+    : `aut-${Math.random().toString(36).slice(2, 10)}`;
+
+const utcDay = (iso) => String(iso || '').slice(0, 10);   // RFC 3339 → YYYY-MM-DD
+
+// A promotable class is (domain × reversible-true). Magnitude is not part of the
+// key — it is the CEILING we derive from what was actually observed, so a class
+// seen only at `low` never proposes a rule that would fire at `medium`.
+function classKey(domain) { return String(domain || '').toLowerCase(); }
+
+// Receipts that count as evidence FOR autonomy in a class. Deliberately narrow:
+// the oracle must have been decisive, the subject must have approved, and the
+// action must be one we would ever propose relaxing.
+function isPromotableApproval(r) {
+  const ad = r?.request?.action_descriptor || {};
+  if (r?.user_action !== 'approved') return false;
+  if (r?.response?.signal !== 'proceed' && r?.response?.signal !== 'proceed_with_note') return false;
+  if (ad.reversible !== true) return false;                       // irreversible is never auto-proceeded
+  if (ad.magnitude === 'high') return false;                      // nor is a major action
+  if (ad.amount !== undefined && !(typeof ad.amount === 'number' && Number.isFinite(ad.amount) && ad.amount >= 0))
+    return false;                                                 // a malformed amount is not evidence of anything
+  if (!ad.domain) return false;                                   // an unscoped autoproceed rule is a blank cheque
+  return true;
+}
+
+// The spend ceiling for a money class: the SECOND-highest amount approved, not the
+// highest.
+//
+// Using the maximum would let ONE outlier set the bar — approve five $20 orders and a
+// single $500 one, and the rule would thereafter auto-proceed anything up to $500.
+// Requiring two approvals at a level before the rule reaches it is the money-shaped
+// version of the "spread across days, not one sitting" rule: a bound has to be
+// demonstrated more than once.
+//
+// Returns null when the class carries no amounts at all (then no ceiling is needed),
+// or when fewer than two priced approvals exist (then no ceiling can be justified, so
+// the class is not promotable).
+export function spendCeiling(receipts) {
+  const amounts = receipts
+    .map((r) => r?.request?.action_descriptor?.amount)
+    .filter((a) => typeof a === 'number' && Number.isFinite(a));
+  if (!amounts.length) return null;                 // unpriced class — no ceiling needed
+  if (amounts.length < 2) return undefined;         // one priced approval cannot justify a bound
+  const sorted = amounts.slice().sort((a, b) => b - a);
+  return sorted[1];
+}
+
+// Anything that argues AGAINST relaxing this class. One is enough to disqualify:
+// a class the subject has ever rejected or edited is not settled.
+function isContraryEvidence(r, domain) {
+  const ad = r?.request?.action_descriptor || {};
+  if (classKey(ad.domain) !== domain) return false;
+  return r?.user_action === 'rejected' || r?.user_action === 'modified';
+}
+
+// Were these approvals RECORDED in a burst? Marking a screenful of receipts in one
+// pass is bookkeeping, not consent — so if most of the supporting evidence was
+// stamped inside one short window, it does not support a policy. Receipts without
+// a mark timestamp (older stores) are treated as non-batch: absence of evidence
+// is not evidence of fatigue, and the other gates still apply.
+export function batchFraction(receipts, { windowMs = BATCH_WINDOW_MS } = {}) {
+  const stamps = receipts
+    .map((r) => Date.parse(r?.user_action_at))
+    .filter((t) => Number.isFinite(t))
+    .sort((a, b) => a - b);
+  if (stamps.length < 2) return 0;
+  let best = 1;
+  for (let i = 0; i < stamps.length; i++) {
+    let j = i;
+    while (j < stamps.length && stamps[j] - stamps[i] <= windowMs) j++;
+    best = Math.max(best, j - i);
+  }
+  return best / receipts.length;
+}
+
+function proposedText(domain, magMax, ceiling = null) {
+  const scope = magMax === 'low' ? 'small, reversible' : 'routine, reversible';
+  // The ceiling is the single most consequential term on a money rule, so it belongs
+  // in the sentence the subject reads — not only in the terms line beneath it.
+  // "up to", not "under" — the ceiling is INCLUSIVE now (M7), and this sentence is what the
+  // subject reads before endorsing. Prose that says "under 20" for a rule that fires AT 20
+  // misdescribes the authority being granted, on the one screen where accuracy is consent.
+  const under = ceiling !== null ? ` up to ${ceiling}` : '';
+  return `Let agents go ahead with ${scope} ${domain} actions${under} without asking me first.`;
+}
+
+// (receipts, fp, opts) -> suggestion[]  — the §10.5 authorizations worth PROPOSING.
+//
+// `fp` supplies what is already authored or already staged, so an endorsed or
+// pending suggestion is never re-proposed (the no-nag rule every promotion
+// channel follows).
+export function buildAutonomyPromotions(receipts, fp, opts = {}) {
+  const {
+    now = Date.now(),
+    windowDays = DEFAULT_WINDOW_DAYS,
+    minApprovals = MIN_APPROVALS,
+    minDistinctDays = MIN_DISTINCT_DAYS,
+    minAgreement = MIN_AGREEMENT,
+    minAgreementScored = MIN_AGREEMENT_SCORED,
+    maxBatchFraction = MAX_BATCH_FRACTION,
+    ttlDays = DEFAULT_TTL_DAYS,
+  } = opts;
+
+  const list = Array.isArray(receipts) ? receipts : [];
+  const since = now - windowDays * DAY_MS;
+  const inWindow = list.filter((r) => {
+    const t = Date.parse(r?.created_at);
+    return Number.isFinite(t) && t >= since && t <= now;
+  });
+
+  // Already covered? An authored autoproceed for the domain, or a live suggestion.
+  const authored = new Set(
+    (Array.isArray(fp?.standing_rules) ? fp.standing_rules : [])
+      .filter((r) => r?.kind === 'authorization' && r?.effect === 'autoproceed')
+      .flatMap((r) => (Array.isArray(r?.match?.domains) ? r.match.domains : []).map(classKey)),
+  );
+  const staged = new Set(
+    (Array.isArray(fp?.suggested_rules) ? fp.suggested_rules : [])
+      .filter((s) => s?.source === 'autonomy_promotion')
+      .flatMap((s) => (Array.isArray(s?.match?.domains) ? s.match.domains : []).map(classKey)),
+  );
+
+  const agreement = computeAgreement(list, { windowDays, now });
+
+  const byClass = new Map();
+  for (const r of inWindow) {
+    if (!isPromotableApproval(r)) continue;
+    const key = classKey(r.request.action_descriptor.domain);
+    const bucket = byClass.get(key) || { receipts: [], days: new Set(), magRank: 0, clients: new Set() };
+    bucket.receipts.push(r);
+    bucket.days.add(utcDay(r.created_at));
+    bucket.magRank = Math.max(bucket.magRank, MAG_RANK[r.request.action_descriptor.magnitude] ?? 0);
+    // §10.5 scoping (step 5): WHICH paired client's actions earned this. Recorded from
+    // the receipt's `client_id` — the serving client, established out-of-band with the
+    // phone — never from `agent_id`, which is the caller's claim about itself.
+    if (typeof r.client_id === 'string' && r.client_id) bucket.clients.add(r.client_id);
+    byClass.set(key, bucket);
+  }
+
+  const out = [];
+  for (const [domain, bucket] of byClass) {
+    if (authored.has(domain) || staged.has(domain)) continue;          // no-nag
+    if (bucket.receipts.length < minApprovals) continue;               // not yet a pattern
+    if (bucket.days.size < minDistinctDays) continue;                  // one sitting is not a policy
+    if (inWindow.some((r) => isContraryEvidence(r, domain))) continue; // any pushback disqualifies the class
+    if (batchFraction(bucket.receipts, opts) > maxBatchFraction) continue;  // batch-marked = bookkeeping
+
+    // The interlock: don't hand autonomy to an oracle that isn't tracking this
+    // subject here. `(none)` is how computeAgreement keys undomained receipts.
+    const dom = agreement.domains[domain];
+    if (!dom || dom.scored < minAgreementScored || dom.rate === null || dom.rate < minAgreement) continue;
+
+    // Money needs a ceiling, and a ceiling needs to have been demonstrated twice.
+    // `undefined` means the class is priced but cannot justify a bound — skip it
+    // rather than propose an unbounded spend authorization.
+    const ceiling = spendCeiling(bucket.receipts);
+    if (ceiling === undefined) continue;
+    if (ceiling !== null && !(ceiling > 0)) continue;                  // a 0 ceiling can never match
+
+    const magMax = RANK_MAG[bucket.magRank] || 'low';
+
+    // §10.5 `agents` — scope the proposed grant to the clients that EARNED it.
+    //
+    // Only meaningful now that scoping is enforced (v0.1.53) and authorable on the
+    // phone (#197). Before that, writing this field would have shipped something that
+    // looked like a boundary and was not — the reason it was deliberately left off.
+    //
+    // Strictly narrowing versus the previous behaviour, which granted every paired
+    // client whatever any one of them earned. A client that contributed approvals but
+    // cannot be attributed (receipts written before v0.1.53 carry no `client_id`) is
+    // simply left out — it keeps asking, which is the fail-safe direction.
+    //
+    // The empty case is the one that matters: when NO receipt in the class can be
+    // attributed, the field is OMITTED rather than written as `[]`. Absent means
+    // unscoped (today's behaviour, preserved for pre-v0.1.53 history); `[]` means a
+    // scope naming nobody, which would stage a grant that can never fire. Getting
+    // those two confused is precisely the defect the v0.1.54 hardening pass caught.
+    const agents = [...bucket.clients].sort();
+    out.push({
+      suggestion_id: uuid(),
+      status: 'suggested',
+      kind: 'authorization',
+      source: 'autonomy_promotion',
+      proposed_text: proposedText(domain, magMax, ceiling),
+      match: {
+        domains: [domain],
+        reversible: true,
+        magnitude_max: magMax,
+        // INCLUSIVE (M7). This staged `amount_lt: ceiling`, and `ceiling` is the SECOND-HIGHEST
+        // amount approved — so five $20 approvals minted a rule matching `amount < 20`, which
+        // excludes every purchase that earned it. The grant was unfireable by construction, and
+        // silently: it appeared in the subject's rules, read correctly in prose, and never
+        // matched. §10.5 gained `amount_lte` for this.
+        ...(ceiling !== null ? { amount_lte: ceiling } : {}),
+      },
+      effect: 'autoproceed',
+      // Non-negotiable on a PROPOSED relaxation: it may only apply to a request
+      // bound to a concrete call, and it lapses unless the subject re-earns it.
+      require_binding: true,
+      expires_at: new Date(now + ttlDays * DAY_MS).toISOString(),
+      ...(agents.length ? { agents } : {}),
+      note: agents.length
+        // Say the grant is limited, without printing an opaque `c_…` the subject
+        // cannot recognise — only the phone holds the registry that names it.
+        ? `you have approved every ${domain} action like this that Phaedo has seen — limited to the agent that earned it`
+        : `you have approved every ${domain} action like this that Phaedo has seen`,
+      evidence: {
+        observation_count: bucket.receipts.length,
+        distinct_days: bucket.days.size,
+        agreement_rate: dom.rate,
+        evidence_basis: 'observed',
+        last_observed: bucket.receipts[bucket.receipts.length - 1]?.created_at || null,
+        // Provenance for the audit: how many paired clients this evidence came from,
+        // and whether any of it predates client attribution. Distinct from `agents`,
+        // which is the enforceable scope.
+        client_count: bucket.clients.size,
+        unattributed: bucket.receipts.some((r) => !(typeof r.client_id === 'string' && r.client_id)),
+      },
+      created: new Date(now).toISOString(),
+    });
+  }
+  // Deterministic order — this rides a last-write-wins mailbox deposit.
+  return out.sort((a, b) => a.match.domains[0].localeCompare(b.match.domains[0]));
+}

package/build-package.mjs

@@ -1,22 +1,37 @@
 #!/usr/bin/env node
-// Make the npm package self-contained. The MCP server reaches two sets of files at
-// the repo root (one source of truth, shared with the extension): the injection
-// renderer (context-block.js, via projection.js) and the classic crypto modules
-// (protocol/envelope/kdf/identity.js, via lib/phaedo-crypto.js). The published
-// package ships only mcp/, so this copies those root modules into mcp/vendor/;
-// projection.js and lib/phaedo-crypto.js prefer the vendored copies when present
-// and fall back to the repo root in dev. Runs as `prepack` (npm pack / publish)
-// and `npm run build`. Idempotent; mcp/vendor/ is gitignored (a build artifact).
+// Make the npm package self-contained. The MCP server reaches three sets of files
+// at the repo root (one source of truth, shared with the extension): the injection
+// renderer (context-block.js, via projection.js), the classic crypto modules
+// (protocol/envelope/kdf/identity.js, via lib/phaedo-crypto.js), and the capture
+// stack — capture/* for the SessionEnd hook plus the extraction modules the hook
+// and the mcp-local tier-3 fold need (loaded via lib/capture-home.js). The
+// published package ships only mcp/, so this copies those root modules into
+// mcp/vendor/ (capture/extraction keep their subdirectories — their imports are
+// intra-directory relative, so the copies resolve each other unchanged); the
+// consumers prefer the location per their own doc-comments. Runs as `prepack`
+// (npm pack / publish), `pretest`, and `npm run build`. Idempotent; mcp/vendor/
+// is gitignored (a build artifact).
 
 import { copyFileSync, mkdirSync } from 'fs';
 import { dirname, join, resolve } from 'path';
 import { fileURLToPath } from 'url';
+import { ROOT_FILES, CAPTURE_FILES, EXTRACTION_FILES } from './vendored-files.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const ROOT = resolve(HERE, '..');
 const VENDOR = join(HERE, 'vendor');
-const FILES = ['context-block.js', 'protocol.js', 'envelope.js', 'kdf.js', 'identity.js'];
+// Single source of truth, shared with scripts/export-public-repo.mjs (they drifted once).
+const FILES = ROOT_FILES;
+// The capture hook + tier-3 fold closure. Keep in lockstep with what
+// lib/capture-home.js consumers actually import — test-vendored-capture.mjs
+// exercises the whole set from a rootless copy, so a missing module fails CI.
+
+
 
 mkdirSync(VENDOR, { recursive: true });
 for (const f of FILES) copyFileSync(resolve(ROOT, f), join(VENDOR, f));
-process.stdout.write(`[phaedo-mcp] bundled ${FILES.length} root modules → mcp/vendor/\n`);
+mkdirSync(join(VENDOR, 'capture'), { recursive: true });
+for (const f of CAPTURE_FILES) copyFileSync(resolve(ROOT, 'capture', f), join(VENDOR, 'capture', f));
+mkdirSync(join(VENDOR, 'extraction'), { recursive: true });
+for (const f of EXTRACTION_FILES) copyFileSync(resolve(ROOT, 'extraction', f), join(VENDOR, 'extraction', f));
+process.stdout.write(`[phaedo-mcp] bundled ${FILES.length} root + ${CAPTURE_FILES.length} capture + ${EXTRACTION_FILES.length} extraction modules → mcp/vendor/\n`);