phaedo-mcp 0.2.2 → 0.3.1

package/capture-a11y.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+// Phaedo — Track B a11y capture core (the Node side of the OS-accessibility helper).
+//
+// The native macOS helper (capture/spike-a11y-macos → the productized reader) observes a
+// chat app's accessibility tree, reconstructs the visible transcript into {role, text}
+// turns, and — on a response-complete SETTLE — pipes a JSON payload to THIS process on
+// stdin. We convert the turns to the shared exchange_batch (capture/exchanges.js), fold
+// them through the SAME spine the Claude Code hook uses (capture/capture-core.js →
+// detectors → per-session state → delta lift), and deposit the signal delta to the
+// relay's SUB-KEYED capture lane (mcp/capture-sync.js), encrypted under fp_sync_key.
+//
+// The native front-end does OS work; this owns the pairing + deposit, so the two tiers
+// (a11y, later OCR) share one Node pipeline and differ only in how turns are obtained.
+//
+// DISCARD-RAW: the turns' text is counted and dropped — nothing but signal names +
+// integers is persisted or transmitted (architecture/persona-vs-conversation-memory.md).
+// FAIL-SAFE: any error exits 0 with no output; unpaired machines still accumulate local
+// state (the mcp-local owner tier reads it), the deposit just no-ops.
+//
+// Payload (one settle = one invocation), stdin JSON:
+//   { conversation_id: string,           // STABLE per chat → per-session REPLACE (idempotent)
+//     source_surface?: string,           // default 'a11y-macos'
+//     captured_at?: string,              // ISO; default now
+//     turns: [ { role:'user'|'assistant', text:string, id?, timestamp? }, ... ] }
+
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { dirname, resolve } from 'node:path';
+import { loadCaptureModule } from './lib/capture-home.js';
+import { isMainModule } from './lib/is-main.js';
+import { loadPairingRecord } from './phone-source.js';
+import { loadCapturePairing, CapturePairingError } from './hooks/session-end.mjs';
+import { buildCaptureDelta, depositCaptureDelta } from './capture-sync.js';
+
+const [
+  { turnsToBatch },
+  { foldBatchToSignals },
+  { deriveSourceDeviceId },
+] = await Promise.all([
+  'capture/exchanges.js',
+  'capture/capture-core.js',
+  'capture/source-id.js',
+].map(loadCaptureModule));
+
+const MCP_DIR = resolve(dirname(fileURLToPath(import.meta.url)));
+const DEFAULT_SURFACE = 'a11y-macos';
+const BUDGET_MS = 10000;
+
+// Run one a11y capture payload → deposit. Dependency-injectable for tests.
+//   payload — the native helper's stdin JSON (see header).
+//   deps    — { pairing, statePath, fetch, relayBase, now, mcpDir, env, captureModel }.
+// Returns a result record; never throws.
+export async function runA11yCapture(payload, deps = {}) {
+  const nowIso = deps.now || (payload && payload.captured_at) || new Date().toISOString();
+  const surface = (payload && payload.source_surface) || DEFAULT_SURFACE;
+
+  const turns = payload && Array.isArray(payload.turns) ? payload.turns : null;
+  if (!turns) return { deposited: false, reason: 'no-turns' };
+  const conversationId = (payload && (payload.conversation_id || payload.session_id)) || null;
+
+  const batch = turnsToBatch(turns, { sessionId: conversationId, platform: surface });
+  if (!batch.user_prompts.length) return { deposited: false, reason: 'no-exchanges' };
+
+  // Resolve the pairing whose key the draining owner can decrypt (same order as the hook:
+  // explicit override / legacy capture-pairing file / the MCP's own pairing.json). A
+  // PRESENT-but-broken capture-pairing file must not silently fall back to a different key
+  // — accumulate state locally and skip the deposit instead.
+  let pairing = deps.pairing;
+  if (pairing === undefined) {
+    try {
+      pairing = loadCapturePairing(deps.mcpDir || MCP_DIR, deps.env);
+    } catch (e) {
+      if (!(e instanceof CapturePairingError)) throw e;
+      process.stderr.write(`[phaedo capture:a11y] ${e.message}\n`);
+      const sid0 = deriveSourceDeviceId(null, surface);
+      await foldBatchToSignals(batch, { sourceId: sid0, surface, statePath: deps.statePath, sessionLocalId: conversationId, now: nowIso, captureModel: deps.captureModel, env: deps.env });
+      return { deposited: false, reason: 'capture-pairing-invalid', counted: batch.user_prompts.length };
+    }
+    if (!pairing) {
+      try { pairing = await loadPairingRecord(deps.mcpDir || MCP_DIR); } catch { pairing = null; }
+    }
+  }
+  const sourceId = deriveSourceDeviceId(pairing, surface);
+
+  const { signals } = await foldBatchToSignals(batch, {
+    sourceId, surface, statePath: deps.statePath, sessionLocalId: conversationId,
+    now: nowIso, captureModel: deps.captureModel, env: deps.env,
+  });
+  if (!signals.length) return { deposited: false, reason: 'no-signal', counted: batch.user_prompts.length };
+
+  const delta = buildCaptureDelta(signals, { sourceSurface: surface, sourceDeviceId: sourceId, capturedAt: nowIso });
+  const res = await depositCaptureDelta(pairing, delta, { ...deps, now: () => nowIso });
+  if (res && res.deposited === false && (res.status === 401 || (res.reason && /^http-/.test(String(res.reason))))) {
+    process.stderr.write(`[phaedo capture:a11y] deposit rejected (${res.status || res.reason}) — re-pair so capture can sync.\n`);
+  }
+  return { ...res, counted: batch.user_prompts.length, signals: signals.length };
+}
+
+// ── script entry (the native helper spawns `node capture-a11y.js` and pipes JSON) ──────
+const isMain = isMainModule(import.meta.url);   // symlink-safe — see lib/is-main.js
+if (isMain) {
+  const readStdin = () => new Promise((res) => {
+    let data = '';
+    process.stdin.on('data', (c) => { data += c; });
+    process.stdin.on('end', () => res(data));
+    process.stdin.on('error', () => res(''));
+  });
+  const run = async () => {
+    let payload = {};
+    try { payload = JSON.parse(await readStdin()); } catch { /* no/bad input → no-op */ }
+    await runA11yCapture(payload);
+  };
+  const timeout = new Promise((res) => setTimeout(res, BUDGET_MS));
+  Promise.race([run().catch(() => {}), timeout])
+    .then(() => process.exit(0))
+    .catch(() => process.exit(0));   // capture must never break the helper
+}

package/capture-local.js

@@ -0,0 +1,85 @@
+// The mcp-local merge-owner tier (desktop-capture-deposit.md §4 tier 3).
+//
+// The phone-less, browser-less desktop/CLI user — the Claude Code developer, the
+// audience desktop capture was built FOR — has nobody to drain what their capture
+// hook accumulates: no phone to own the capture_to_owner lane, no extension to
+// materialize it. But the hook and this server share a machine AND a state dir:
+// the hook accumulates cumulative Path-A counters in capture/state.js
+// (~/.phaedo-mcp/capture-state.json) even when unpaired. This module folds that
+// local state into the fingerprint the server SERVES, at read time:
+//
+//   - READ-TIME OVERLAY, no persistence. The lift is a cumulative snapshot
+//     (delta-lift's idempotency contract), so re-folding on every load converges
+//     to the same result — there is nothing to store and no race to manage.
+//     The local fingerprint.json is never rewritten; discard-raw holds.
+//   - OWNER-GATED. Only when this server is the merge owner per the presence
+//     precedence (capture/owner.js): a configured pairing record means a phone
+//     owns the lane (its merged fingerprint arrives through the normal pull),
+//     so folding again here would double-count the same signal. The caller
+//     (fingerprint-source.js) applies this tier only in local, unpaired mode.
+//   - WORKS IN THE PUBLISHED PACKAGE. The capture/extraction modules load via
+//     lib/capture-home.js (repo root in dev, mcp/vendor/ in the tarball —
+//     build-package.mjs vendors the closure). Loading stays dynamic and any
+//     import/IO failure still returns the payload unchanged — the fold is an
+//     enrichment, never a gate on serving.
+//
+// Re-broadcast (§5): none needed here. If a phone is paired later, the hook's
+// normal capture_to_owner deposits carry the CUMULATIVE counts, so the phone
+// inherits this machine's full history on its first drain — and this tier stops
+// applying (owner-gated), so nothing forks.
+
+import { loadCaptureModule } from './lib/capture-home.js';
+
+// Build per-source snapshots from the hook's local capture state. Loading stays
+// try-wrapped so a broken layout (neither repo root nor vendor/) degrades to
+// "no snapshots" instead of failing the serve.
+async function localSnapshots(now) {
+  let stateMod, liftMod;
+  try {
+    stateMod = await loadCaptureModule('capture/state.js');
+    liftMod = await loadCaptureModule('extraction/delta-lift.js');
+  } catch {
+    return [];                                   // no capture home in this layout
+  }
+  const state = stateMod.loadState(stateMod.defaultStatePath());
+  const out = [];
+  for (const sourceId of Object.keys(state.surfaces || {})) {
+    const counts = stateMod.cumulativeCounts(state, sourceId);
+    const signals = liftMod.liftDeltaSignals(counts.behavioral_signals, now);
+    if (!signals.length) continue;
+    const updatedAt = state.surfaces[sourceId] && state.surfaces[sourceId].updated_at;
+    out.push({ surface: sourceId, captured_at: updatedAt || now, signals });
+  }
+  return out;
+}
+
+// Fold the local capture state into a vault payload's fingerprint and return the
+// folded payload (or the input unchanged when there is nothing to fold / the
+// modules are unavailable). Pure with respect to the input object.
+export async function foldLocalCapture(vaultPayload, { now = new Date().toISOString() } = {}) {
+  if (!vaultPayload || typeof vaultPayload !== 'object' || !vaultPayload.phaedo_fingerprint) return vaultPayload;
+  try {
+    const sources = await localSnapshots(now);
+    if (!sources.length) return vaultPayload;
+    const { mergeExtractionInto } = await loadCaptureModule('extraction/persist.js');
+    // Empty own-update: the server has no counters of its own; the combine builds
+    // the delta update entirely from the source snapshots, then the standard
+    // reconcile folds it into the fingerprint (creating layers as needed).
+    const fp = mergeExtractionInto(vaultPayload.phaedo_fingerprint, {}, now, sources);
+    return { ...vaultPayload, phaedo_fingerprint: fp };
+  } catch {
+    return vaultPayload;                         // enrichment only — never break serving
+  }
+}
+
+// Is this server the capture merge owner? Thin wrapper over capture/owner.js so
+// the precedence lives in exactly one place; an unloadable module (broken
+// layout) → not owner (the fold simply doesn't apply).
+export async function isLocalCaptureOwner(phonePaired) {
+  try {
+    const { isOwner } = await loadCaptureModule('capture/owner.js');
+    return isOwner('mcp-local', { phonePaired: !!phonePaired, extensionPresent: false });
+  } catch {
+    return false;
+  }
+}

package/capture-sync.js

@@ -0,0 +1,99 @@
+// Capture-delta transport (capture surface → relay → merge owner).
+//
+// Track A of the desktop-capture plan. The Claude Code / Cowork capture hook reads the
+// local session transcript, runs the surface-agnostic extraction engine, and deposits
+// the resulting SIGNAL DELTA (never a whole fingerprint) into the relay's
+// `capture_to_owner` mailbox lane, encrypted under fp_sync_key. Exactly one merge owner
+// (phone → extension → mcp-local, capture/owner.js) drains and reconciles it per-source
+// (capture/source-id.js), so concurrent capture on multiple surfaces accumulates instead
+// of clobbering — docs/roadmap/desktop-capture-deposit.md.
+//
+// Mirrors delegation-sync.js in trust posture, but NOT in key sensitivity: this lane is
+// drained by the PHONE, which tries each verified client's key until one decrypts, so an
+// independently-paired MCP works fine here (unlike agent_to_ext — see delegation-sync.js).
+// The relay only ever holds ciphertext; and the deposit is best-effort and
+// isolated — a transport failure never breaks the session that produced the capture.
+//
+// The lane carries a DELTA, so a deposit can never overwrite signal the owner captured
+// on its own; and per-source idempotency (source_device_id) means a re-deposit or a
+// transient two-owner overlap is a no-op, not a double-count.
+
+import { Phaedo, b64uDec } from './lib/phaedo-crypto.js';
+
+const { Kdf, Envelope } = Phaedo;
+const DEFAULT_RELAY = 'https://phaedo-relay.fly.dev';
+
+export function relayBaseFromEnv(env = process.env) {
+  return env.PHAEDO_RELAY || DEFAULT_RELAY;
+}
+
+// Build the canonical capture-delta payload from lifted signals (Q1: lift on the
+// surface — the hook runs extraction and ships §5.4 signals, not raw counters).
+//   signals — the extraction engine's signal list (source-tagged; 'delta' snapshots
+//             are idempotent on re-lift).
+export function buildCaptureDelta(signals, { sourceSurface, sourceDeviceId, capturedAt } = {}) {
+  return {
+    capture_delta_version: 'v0.1',
+    source_surface: sourceSurface || 'unknown',
+    source_device_id: sourceDeviceId || null,
+    captured_at: capturedAt || null,
+    delta: { signals: Array.isArray(signals) ? signals : [] },
+  };
+}
+
+// Wrap a capture-delta into the same envelope shape the owner's fp-mailbox drain
+// expects: ciphertext over `{ kind:'capture_delta', data: <captureDelta> }`. Returns the
+// deposit body `{ envelope }`. Pure crypto (no network) so the round-trip is testable.
+export async function buildCaptureDeposit(pairKeyB64u, captureDelta, { now = () => new Date().toISOString() } = {}) {
+  const pairKey = b64uDec(pairKeyB64u);
+  let fpSyncKey;
+  try {
+    fpSyncKey = await Kdf.deriveFpSyncKey(pairKey);
+  } finally {
+    pairKey.fill(0);
+  }
+  try {
+    const inner = { kind: 'capture_delta', data: captureDelta };
+    const plaintext = new TextEncoder().encode(JSON.stringify(inner));
+    const envelope = await Envelope.wrap(plaintext, fpSyncKey, { artifact_kind: 'capture_delta', created_at: now() });
+    plaintext.fill(0);
+    return { envelope };
+  } finally {
+    if (fpSyncKey && fpSyncKey.fill) fpSyncKey.fill(0);
+  }
+}
+
+// Deposit a capture-delta to the relay's capture_to_owner slot. Best-effort: returns
+// { deposited, ... } and never throws. `deps.fetch` is injectable for tests.
+export async function depositCaptureDelta(pairing, captureDelta, deps = {}) {
+  const fetchFn = deps.fetch || globalThis.fetch;
+  const signals = captureDelta && captureDelta.delta && Array.isArray(captureDelta.delta.signals)
+    ? captureDelta.delta.signals : [];
+  // Precise reasons so the caller can log WHY a deposit didn't happen.
+  if (!signals.length) return { deposited: false, reason: 'no-signal' };
+  if (!pairing || !pairing.pair_key) return { deposited: false, reason: 'unpaired' };
+  if (!pairing.relay_device_id) return { deposited: false, reason: 'no-relay-device-id' };
+  try {
+    const body = await buildCaptureDeposit(pairing.pair_key, captureDelta, deps);
+    // Sub-key the lane per source so a second surface on this device doesn't clobber the
+    // hook's deposit before the owner drains (desktop-capture-deposit.md). Falls back to
+    // the flat lane only if the delta somehow lacks a source id (pre-source-id builds).
+    const src = captureDelta && captureDelta.source_device_id;
+    const lane = src ? `capture_to_owner/${encodeURIComponent(src)}` : 'capture_to_owner';
+    const base = `${deps.relayBase || relayBaseFromEnv()}/fp-mailbox/${encodeURIComponent(pairing.relay_device_id)}/${lane}`;
+    // Per-device auth header (relay/auth.js). Without it the relay 401s → deposit no-ops
+    // (correct failure mode: the user re-pairs to capture the relay_device_secret).
+    const authHeader = pairing.relay_device_secret
+      ? { Authorization: `Bearer ${pairing.relay_device_id}:${pairing.relay_device_secret}` }
+      : {};
+    const res = await fetchFn(base, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...authHeader },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(deps.timeoutMs || 8000),
+    });
+    return { deposited: !!(res && res.ok), status: res && res.status, count: signals.length };
+  } catch (e) {
+    return { deposited: false, reason: String(e && e.message || e) };
+  }
+}

package/consult-core.js

@@ -16,6 +16,8 @@
 
 import { PhaedoError } from './errors.js';
 import { loadPolicies, applyPolicies, matchAuthorization } from './consult-policy.js';
+import { normalizeActionBinding, isBound } from './action-binding.js';
+import { normalizeDomain, canonicalDomain } from './lib/domain.js';
 
 export const CONSULTATION_TYPES = [
   'action_approval',
@@ -354,6 +356,68 @@ function calibrate(vd, coverage, signalConfidence = 0) {
 
 const magnitudeRank = (m) => ({ low: 0, medium: 1, high: 2 }[m] ?? 1);
 
+// ── Amount bands (precedent track G8 B1) ──────────────────────────────────────
+// Until this, the inferred path never read `amount`: $12 and $12,000 answered alike
+// unless the agent ALSO labelled the magnitude, and only authored §10.5 rules saw money.
+// Now an amount sets a FLOOR under the magnitude the inferred path reasons about.
+//
+// Band edges are the subject's own numbers wherever they exist: every amount bound on an
+// authored rule (amount_gt / amount_lt / amount_lte — a grant's ceiling says what is small
+// to them as surely as a prohibition's floor says what is large). Rules scoped to the
+// action's domain (or unscoped) win; failing those, any authored amount anywhere; failing
+// that, DEFAULT_AMOUNT_EDGES — a stated default, recorded as such on the receipt, replaced
+// by the subject's first money rule.
+//
+// CAUTION-ONLY, by construction: the floor is max()'d with the declared magnitude, so it
+// can raise the stakes and never lower them. And it feeds the INFERRED path only — §10.5
+// matching keeps reading the declared magnitude, so an authored grant's `magnitude_max`
+// means exactly what the subject wrote.
+export const DEFAULT_AMOUNT_EDGES = [100, 1000];
+
+// ── Resolver revision (precedent track Phase 1b) ──────────────────────────────
+// Which version of the inferred path answered. Stamped on every inferred receipt (as a
+// `resolverRevision` driver — local provenance, never in the response) so agreement can be
+// split before/after a behaviour change instead of blurring into one number.
+//
+// BUMP THIS WHENEVER THE INFERRED PATH'S ANSWERS CHANGE. You will not be able to forget:
+// test-resolver-revision.mjs fingerprints the answers over a fixed grid and fails, naming
+// this constant, when they move under an unchanged revision. Format: <date>.<what changed>.
+//   (receipts before 2026-10-20 carry none — the pre-B1 rules and the first days of B1)
+export const RESOLVER_REVISION = '2026-10-19.amount-bands';
+
+function ruleAmounts(r) {
+  return [r?.amountGt, r?.amountLt, r?.amountLte].filter((x) => typeof x === 'number' && Number.isFinite(x) && x > 0);
+}
+function ruleCoversDomain(r, domain) {
+  const ds = Array.isArray(r?.domains) ? r.domains : [];
+  if (!ds.length) return true;                       // unscoped → speaks for every domain
+  if (!domain) return false;
+  const canon = canonicalDomain(domain);
+  return ds.some((d) => domain.includes(d) || (canon && canonicalDomain(d) === canon));
+}
+
+/** The band edges for this action: { edges: [low, high] (ascending, low may equal high), basis }. */
+export function amountEdges(policies, domain) {
+  const list = Array.isArray(policies) ? policies : [];
+  const scoped = list.filter((r) => ruleCoversDomain(r, domain)).flatMap(ruleAmounts);
+  const any = scoped.length ? scoped : list.flatMap(ruleAmounts);
+  if (!any.length) return { edges: DEFAULT_AMOUNT_EDGES.slice(), basis: null };
+  return { edges: [Math.min(...any), Math.max(...any)], basis: 'self_reported' };
+}
+
+/**
+ * The magnitude floor an amount implies, or null when it implies none.
+ * Above the high edge → `high`; above the low edge → `medium`. With a single authored
+ * number ("escalate above $1,000") both edges are that number: above it is `high`.
+ */
+export function amountFloor(n, policies) {
+  const a = n?.amount;
+  if (typeof a !== 'number' || !Number.isFinite(a) || a <= 0) return null;
+  const { edges: [lo, hi], basis } = amountEdges(policies, n.domain);
+  const band = a > hi ? 'high' : a > lo ? 'medium' : null;
+  return band ? { band, rank: magnitudeRank(band), basis } : null;
+}
+
 // ── Request validation/normalization (§10.2) ──────────────────────────────────
 export function normalizeRequest(request) {
   const type = request.consultation_type;
@@ -367,14 +431,31 @@ export function normalizeRequest(request) {
   }
   const ctx = (request.context && typeof request.context === 'object') ? request.context : {};
   const ev = ctx.evidence_provided;
+  // §10.2 action_binding: the concrete call this descriptor claims to describe.
+  // Optional — an unbound request resolves exactly as before — but an authored
+  // authorization may refuse to RELAX anything without it (§10.5 require_binding).
+  const binding = normalizeActionBinding(request.action_binding);
   return {
     type,
-    domain: typeof ad.domain === 'string' ? ad.domain : undefined,
+    // NORMALIZED only (case/whitespace) — deliberately NOT vocabulary-mapped. The
+    // request domain feeds §10.5 matching, and a relaxing rule must keep matching on
+    // the literal the agent sent; `domainCovers` applies the vocabulary itself, and
+    // only for restrictive rules. Mapping here instead would let an alias widen a
+    // grant. The RECEIPT stores the canonical form (that is the evidence axis).
+    domain: typeof ad.domain === 'string' ? (normalizeDomain(ad.domain) || undefined) : undefined,
     reversible: typeof ad.reversible === 'boolean' ? ad.reversible : undefined,
-    magnitude: magnitude || 'medium',
+    // UNSTATED STAYS UNSTATED (v0.1.68). This defaulted to 'medium', which meant the resolver could
+    // never tell "the agent said medium" from "the agent said nothing" — and §10.5 then let a
+    // medium-capped grant fire on the nothing. The receipt now records what was actually sent
+    // (null), which is also what situational precedent (OQ24) needs to band on. The inferred
+    // oracle path still reads an unknown as the middle of the scale (`magnitudeRank`); that is a
+    // disposition heuristic, not a grant, and it is unchanged.
+    magnitude,
     amount: typeof ad.amount === 'number' && isFinite(ad.amount) ? ad.amount : undefined,
     summary: typeof ad.summary === 'string' ? ad.summary : undefined,
     evidenceProvided: Array.isArray(ev) ? ev : (ev != null ? [ev] : []),
+    binding,
+    bound: isBound(binding),
   };
 }
 
@@ -392,7 +473,8 @@ const USES_AMBIGUITY = new Set(['action_approval', 'escalation_default']);
 function resolveActionApproval(vd, n, suppressed) {
   const p = profile(vd, RELEVANT_CUES.action_approval, true, n.domain, suppressed);
   const irreversible = n.reversible === false;
-  const mag = magnitudeRank(n.magnitude);
+  // Declared stakes, raised (never lowered) by what the amount means to this subject.
+  const mag = Math.max(magnitudeRank(n.magnitude), n.amountBand ? n.amountBand.rank : 0);
   const thinEvidence = n.evidenceProvided.length === 0;
 
   let signal;
@@ -462,7 +544,7 @@ function resolveVoiceDraft() {
 // sees (§10.4 holds: provenance is for the subject's audit/calibration, not the agent).
 // Pure + defensive: bad/redirect/abstain inputs → []. Takes the raw request; normalizes
 // internally so callers pass exactly what they passed to the consult.
-export function consultDrivers(vd, request) {
+export function consultDrivers(vd, request, opts = {}) {
   let n;
   try { n = normalizeRequest(request || {}); } catch { return []; }
   const keys = RELEVANT_CUES[n.type];
@@ -480,6 +562,13 @@ export function consultDrivers(vd, request) {
     const a = readAmbiguity(vd, n.domain, suppressed);
     if (a.found) drivers.push(withOrigin({ cue: 'ambiguityPosture', value: a.value, confidence: a.confidence, basis: a.basis }, a.origin));
   }
+  // The amount band, when it raised the stakes. basis `self_reported` = the subject's own
+  // thresholds; null = the stated default (no subject evidence behind it).
+  if (n.type === 'action_approval') {
+    let band = null;
+    try { band = amountFloor(n, loadPolicies(vd, opts)); } catch { /* provenance is non-critical */ }
+    if (band) drivers.push({ cue: 'amountBand', value: band.band, confidence: 1, basis: band.basis });
+  }
   return drivers;
 }
 
@@ -530,7 +619,15 @@ export function deriveDelegationSignals(receipts, { now = new Date().toISOString
     const sig = r?.response?.signal;
     const contribution = delegationCorrection(sig, r && r.user_action); // signed; 0 = agreement/no lesson
     if (!contribution) continue;
-    const domain = (typeof r?.request?.action_descriptor?.domain === 'string') ? r.request.action_descriptor.domain : '';
+    // Canonicalize the domain BEFORE bucketing, or one concept spelled several ways
+    // (finance / financial / Finance) fragments into several near-identical buckets — the
+    // drift §10.2's published vocabulary exists to end. Both the live overlay
+    // (deriveDelegationSignals) and the promotion cards (buildDelegationPromotions) key on
+    // this, so both must canonicalize or a card floods / an overlay splits. Free text still
+    // survives — an unrecognized domain canonicalizes to itself — so only known synonyms
+    // merge, never distinct classes.
+    const domain = canonicalDomain(
+      (typeof r?.request?.action_descriptor?.domain === 'string') ? r.request.action_descriptor.domain : '');
     for (const d of (Array.isArray(r.drivers) ? r.drivers : [])) {
       if (!CUES[d && d.cue]) continue;                             // scalar caution cues only (ambiguity later)
       const k = `${d.cue}|${domain}`;
@@ -627,7 +724,15 @@ export function buildDelegationPromotions(receipts, fp, { now = new Date().toISO
     const sig = r?.response?.signal;
     const contribution = delegationCorrection(sig, r && r.user_action);
     if (!contribution) continue;
-    const domain = (typeof r?.request?.action_descriptor?.domain === 'string') ? r.request.action_descriptor.domain : '';
+    // Canonicalize the domain BEFORE bucketing, or one concept spelled several ways
+    // (finance / financial / Finance) fragments into several near-identical buckets — the
+    // drift §10.2's published vocabulary exists to end. Both the live overlay
+    // (deriveDelegationSignals) and the promotion cards (buildDelegationPromotions) key on
+    // this, so both must canonicalize or a card floods / an overlay splits. Free text still
+    // survives — an unrecognized domain canonicalizes to itself — so only known synonyms
+    // merge, never distinct classes.
+    const domain = canonicalDomain(
+      (typeof r?.request?.action_descriptor?.domain === 'string') ? r.request.action_descriptor.domain : '');
     for (const d of (Array.isArray(r.drivers) ? r.drivers : [])) {
       const dim = CUE_DIMENSION[d && d.cue];
       if (!dim) continue;
@@ -744,6 +849,15 @@ export function ruleResponse(vd, n) {
   return shape(n.type, resolved.signal, cal.confidence, resolved.hint, cal.deference_level);
 }
 
+// The §10.5 evaluation context, lifted out of `opts` once so both public entries
+// gate identically. `clientId` is the SERVING paired client's own `client_id` (from
+// the server's `pairing.json`, supplied by the transport layer) — the identity
+// `agents` scoping matches on; never anything the caller asserted. Absent here means
+// unpaired, which makes every `agents`-scoped relaxing rule inert. Passing `now`
+// through as well keeps rule expiry on the same clock `loadPolicies` already gives
+// §5.7 commitments; both fall back to `Date.now()` when a caller omits them.
+const policyCtx = (opts = {}) => ({ now: opts.now, clientId: opts.clientId ?? null });
+
 // ── Public pure entry ─────────────────────────────────────────────────────────
 // (vd, request[, opts]) -> §10.3 response. Deterministic; applies authored §10.5
 // policies last so a standing guardrail wins (even over an abstain). `opts.policies`
@@ -752,7 +866,11 @@ export function ruleResponse(vd, n) {
 export function resolveConsultationCore(vd, request = {}, opts = {}) {
   assertVaultUsable(vd);
   const n = normalizeRequest(request);
-  return applyPolicies(ruleResponse(vd, n), n, loadPolicies(vd, opts));
+  const policies = loadPolicies(vd, opts);
+  // G8 B1: the amount's band, read against the subject's own thresholds. On `n` so the
+  // resolver sees it; applyPolicies does not read it (§10.5 matches the declared magnitude).
+  n.amountBand = amountFloor(n, policies);
+  return applyPolicies(ruleResponse(vd, n), n, policies, policyCtx(opts));
 }
 
 // Back-compat alias: the prior public name of the sync rule entry. Kept so existing
@@ -769,7 +887,7 @@ export const buildConsultationResponse = resolveConsultationCore;
 export function checkAuthorization(vd, request = {}, opts = {}) {
   assertVaultUsable(vd);
   const n = normalizeRequest(request);
-  const auth = matchAuthorization(n, loadPolicies(vd, opts));
+  const auth = matchAuthorization(n, loadPolicies(vd, opts), policyCtx(opts));
   return {
     phaedo_response_version: '0.1',
     request_type: 'authorization_check',