phaedo-mcp 0.3.0 → 0.3.2

package/README.md

@@ -1,14 +1,98 @@
 # Phaedo MCP server (`phaedo-mcp`)
 
-A local [MCP](https://modelcontextprotocol.io) server that brings your Phaedo
-cognitive fingerprint to any MCP client (Claude Desktop, Claude Code, Cursor,
-agent frameworks) — no Chrome extension needed. It injects your fingerprint
-**projection** so the assistant responds in your style, and adds **consultation**
-(decision/risk signals), **real-time escalation** to your paired phone for a live
-approve / deny / modify on a blocking decision, and **act-as-me** learning from
-your outcome marks. One integration, every MCP client.
+Phaedo learns how you write, work and decide, and keeps that profile on your phone.
+This server lets your AI apps use it: Claude Desktop, Claude Code, Cursor, and any
+other app that supports [MCP](https://modelcontextprotocol.io). With it, they can:
 
-Implements `docs/protocol/mcp-binding.md` §3.1:
+- **Answer the way you like** — your preferred length, tone and format, without
+  you repeating it in every chat.
+- **Check with you before acting** — an AI agent asks Phaedo whether you'd want it
+  to go ahead. When it's unsure, your phone gets an approve / deny card.
+- **Learn from your answers** — each approve or deny teaches it how you want work
+  handled when you're not watching.
+- **Get your signature for purchases** — you sign a spending permission on your
+  phone with Face ID; the agent never holds the key.
+
+Your profile comes from your phone encrypted. The copy kept on this computer, for
+when your phone is offline, is encrypted too.
+
+## What you need
+
+1. **The Phaedo phone app.** Your profile lives there. The app isn't open to the
+   public yet — [phaedo.so](https://phaedo.so) has a link to hear when it is.
+2. **Node.js**, free from [nodejs.org](https://nodejs.org) (the LTS button).
+
+Without the phone app there is no profile, and the server says so plainly rather
+than guessing. You can still try Phaedo with a made-up example profile.
+
+## Try it with the example profile (no phone needed)
+
+This loads a made-up person's profile, so you can see what Phaedo adds before you
+have your own.
+
+**Claude Code** — run this in Terminal (it applies to all your projects):
+
+```bash
+claude mcp add -s user phaedo -e PHAEDO_FINGERPRINT=sample -- npx -y phaedo-mcp
+```
+
+**Claude Desktop** — open Settings → Developer → Edit Config, add the `phaedo`
+entry below inside `mcpServers`, save, then quit and reopen Claude Desktop:
+
+```json
+{
+  "mcpServers": {
+    "phaedo": {
+      "command": "npx",
+      "args": ["-y", "phaedo-mcp"],
+      "env": { "PHAEDO_FINGERPRINT": "sample" }
+    }
+  }
+}
+```
+
+If Claude Desktop reports that the server failed to start, it couldn't find
+`npx`. Replace `"npx"` with the full path that this prints:
+
+```bash
+which npx
+```
+
+Then start a new chat and ask: *"Load my Phaedo profile."* To stop using the
+example, delete the `env` line in Claude Desktop, or in Claude Code run
+`claude mcp remove -s user phaedo` and add it again without `-e …`. The server
+will then tell you there's no profile until you pair your phone.
+
+## Use your own profile (with the phone app)
+
+1. **Get this folder.** On [the GitHub page](https://github.com/phaedo-labs/phaedo-mcp),
+   click **Code → Download ZIP**, unzip it, and open the `mcp` folder inside.
+2. **Run the installer.**
+   - macOS: double-click **`installers/macos/Install Phaedo MCP.command`**. If macOS
+     says it can't be opened, right-click it and choose **Open**.
+   - Windows: double-click **`installers/windows/Install Phaedo MCP.bat`**.
+   - Linux: run `bash installers/linux/install-phaedo-mcp.sh`.
+
+   It adds Phaedo to Claude Desktop, Cursor and Claude Code — keeping your other
+   settings, and backing each file up first — then starts pairing.
+3. **Pair with your phone.** Open Phaedo on your phone. On the same Wi-Fi, approve
+   **"Phaedo MCP Server"** and check that the code matches the one in Terminal.
+   On a different network, tap **Pair with code** and type the code Terminal shows.
+4. **Quit and reopen your AI apps**, start a new chat, and ask: *"Load my Phaedo
+   profile."*
+
+You can disconnect this computer at any time from the **Agents** screen on your
+phone.
+
+---
+
+## Reference
+
+Everything below is for developers: the full tool list, how the profile is
+loaded, and the test suite.
+
+The server implements the MCP binding of the Anamnesis protocol
+(`docs/protocol/mcp-binding.md` §3.1):
 
 | Surface | Name | Returns |
 |---|---|---|
@@ -65,10 +149,14 @@ receipts-audit surfaces (the tools table above) shipped on top of these across t
   `../docs/roadmap/mcp-revocable-approval-plan.md`. Phone-gated unlock stays a
   deferred enterprise mode behind a config flag.
 
-**No conversation capture.** MCP never returns the conversation, so your
-fingerprint does not learn from MCP sessions (binding §5). (Consultation,
-escalation, and `phaedo_record_outcome` shape and record *decisions*, but none
-capture conversation text into the fingerprint.)
+**Conversation capture is opt-in.** The MCP protocol never hands a server the
+conversation, so the server itself learns nothing from your chats (binding §5).
+Consultation, escalation and `phaedo_record_outcome` record *decisions*, not
+conversation text. Capture happens only through things you turn on: the Claude
+Code hooks (`npm run setup:code-hook`; see *Capture from Claude Code / Cowork*
+below) and, on a Mac, the separately installed accessibility reader that feeds
+`capture-a11y.js`. Both read on this computer, keep only signal names and
+counts, and discard the text.
 Local **stdio** only; **standard** mode only (enhanced-privacy/Stained-Glass and
 remote HTTP/SSE are out of this cut).
 
@@ -129,9 +217,13 @@ foregrounded/reachable at the configured `endpoint`. *(You can still hand-copy
 `pairing.sample.json` → `pairing.json` from the extension's `phaedo_local_pairing`
 if you prefer.)*
 
-**Phase 1a — local JSON (fallback / demo).** With no pairing record, reads a
-**vault payload** from `PHAEDO_FINGERPRINT`, then `mcp/fingerprint.json`, then
-the shipped `mcp/sample-fingerprint.json` (so it runs out of the box):
+**Phase 1a — local JSON.** With no pairing record, reads a **vault payload**
+from `PHAEDO_FINGERPRINT` (a path, or the word `sample` for the shipped
+`mcp/sample-fingerprint.json`), then `mcp/fingerprint.json`. With neither, there
+is **no profile**: every tool returns a plain-language `decryption_failed` error
+saying so. The sample is never served unless asked for by name — until 0.3.1 it
+was the silent fallback, so a fresh `npx phaedo-mcp` injected a made-up person's
+style without saying so. The file looks like this:
 ```json
 {
   "phaedo_fingerprint": { "layers": { ... }, "fingerprint_id": "...", "persona_strength": 0.6 },
@@ -223,6 +315,35 @@ detectors, and a model call can never break or stall a session (30s budget, hook
 exits 0). Prefer the `setup:capture-model` config file over an env var — the file reaches
 Dock-launched Claude Desktop, a shell `export` does not.
 
+### Consult before shipping, from Claude Code (`hooks/pre-ship.mjs`)
+
+`npm run setup:code-hook` also installs a **ship hook** on Bash (PreToolUse,
+PermissionRequest, PostToolUse, PostToolUseFailure). Before an agent merges a PR
+(`gh pr merge`), deploys (`fly deploy`), builds or submits a phone app (`eas build` /
+`eas submit`) or pushes straight to `main`, the hook runs a full `phaedo_consult` on it
+(`ship-actions.js` names these; every other command is ignored in ~50 ms) and writes a
+§10.6 receipt, `agent_id: claude-code/ship-hook`.
+
+- **It only ever adds friction.** It never returns `allow`. A permissive answer leaves
+  Claude Code's own permission flow untouched; `escalate` / `clarify` / `decline` returns
+  `ask`, so the action comes to you with one plain line saying why.
+- **Outcomes are yours, never inferred.** The hook records `approved` only when it has
+  evidence you were asked: Claude Code fired PermissionRequest for that command, and the
+  command then ran. That holds in every mode except auto / dontAsk, where no person
+  answers. Decline and the agent records `rejected` (Claude Code fires no hook for a
+  decline). No prompt shown, nothing recorded; the agent is told so, and records your
+  reaction only if you give one.
+- **What a merge changes.** Before `gh pr merge` the hook reads the PR from GitHub (read-only):
+  failing or unfinished checks, a large diff (> 1,000 code lines or > 20 files), or a sensitive
+  path (CI/deploy config, auth/crypto/secrets by name, or your repo's `.phaedo-sensitive` list,
+  read from the base branch) make it high-stakes. It can raise the stakes, never lower them.
+- **Stale profile.** It reads the at-rest profile cache (so it never pings your phone);
+  when that copy is over 14 days old the agent tells you once a day, with the refresh:
+  `npm run pull` and approve on the phone.
+- **See what it has done:** `npm run ship-readout` (`-- --days 90` to widen).
+- **Fail-safe:** any error, timeout (12 s) or unusable profile → no output, the command
+  runs as if the hook weren't there.
+
 ## Consult at decision points (`phaedo_consult`, §10)
 
 Beyond injecting style, an agent can **ask the fingerprint how the user's pattern
@@ -296,17 +417,21 @@ returns a §10.3 signal. Any failure/timeout/parse error **falls back to the rul
 engine**, so the model can only improve on, never break, the floor (and a missing
 model never breaks consultation). The §10.4 boundary is enforced on parse.
 
-The **installer turns this on automatically**: it probes local Ollama and writes
-`PHAEDO_CONSULT_MODEL` into each client's server entry (picking an installed general
-model, else defaulting to `llama3.1:8b`). Toggle it at install time:
+The judge is **off by default** — the rule engine answers. Measured 2026-10-18 against
+one cached profile, `llama3.1:8b` answered a $12k irreversible payment `clarify 0.9` on
+one run and `proceed_with_note 0.9` on the next, where the rules say `clarify` every
+time. Opt in at install time once a model has earned it:
 
 ```bash
-npm run setup                              # model judge ON (auto-detect Ollama)
-node install.mjs --consult-model qwen2.5:7b   # pin a specific model
+npm run setup                              # model judge OFF (rule engine) — the default
+node install.mjs --model-judge             # ON, auto-detect a local Ollama chat model
+node install.mjs --consult-model qwen2.5:7b   # ON, pinned
 node install.mjs --consult-url http://localhost:11434   # custom endpoint
-node install.mjs --no-model-judge          # rule engine only
 ```
 
+Auto-detect prefers `llama3.1:8b` when installed and never picks an extraction
+fine-tune or an embedding model (`nomic-embed-text` cannot answer a chat prompt).
+
 Use a **general** chat model (NOT the extraction fine-tune). To run it: `ollama
 pull llama3.1:8b`. Raw env (if configuring a client by hand):
 `PHAEDO_CONSULT_MODEL`, `PHAEDO_CONSULT_MODEL_URL`, `PHAEDO_CONSULT_API_KEY`

package/agreement.js

@@ -77,6 +77,38 @@ export function computeAgreement(receipts, { windowDays = DEFAULT_WINDOW_DAYS, n
   };
 }
 
+// ── Split by resolver revision (precedent track Phase 1b) ─────────────────────
+// Which engine answered a receipt: the `resolverRevision` driver the consult stamped (the
+// rules' RESOLVER_REVISION, or `judge:<model>`). A matched pre-flight is a standing rule
+// answering, not the inferred path. Anything else predates the stamp (2026-10-20) or carried
+// no inferred prediction (an abstain) — "not recorded", never guessed.
+export const NOT_RECORDED = 'not recorded';
+export function revisionOf(r) {
+  const d = Array.isArray(r?.drivers) ? r.drivers.find((x) => x?.cue === 'resolverRevision') : null;
+  if (d && typeof d.value === 'string' && d.value) return d.value;
+  if (r?.via === 'phaedo_check_authorization') return 'standing rule (pre-flight)';
+  return NOT_RECORDED;
+}
+
+/**
+ * (receipts, { windowDays, now }) -> { [revision]: overall-bucket }, so a behaviour change
+ * shows up as two rates instead of one blurred one. Same scoring as computeAgreement.
+ */
+export function computeAgreementByRevision(receipts, { windowDays = DEFAULT_WINDOW_DAYS, now = Date.now() } = {}) {
+  const groups = new Map();
+  for (const r of Array.isArray(receipts) ? receipts : []) {
+    const k = revisionOf(r);
+    if (!groups.has(k)) groups.set(k, []);
+    groups.get(k).push(r);
+  }
+  const out = {};
+  for (const [k, rs] of groups) {
+    const rep = computeAgreement(rs, { windowDays, now });
+    if (rep.window.in_window > 0) out[k] = rep.overall;
+  }
+  return out;
+}
+
 // ── The transportable summary (receipts digest → phone) ───────────────────────
 // `computeAgreement` is the full local report; this is the bounded slice that rides
 // the `agent_to_phone` receipts digest so the subject can see how well their oracle
@@ -119,9 +151,23 @@ export function agreementDigest(receipts, { windowDays = DEFAULT_WINDOW_DAYS, no
 // Decrypts the local receipt store with the local key; nothing leaves the device.
 // NOT product UX and NOT fed back into deference (see header).
 if (process.argv[1] && process.argv[1].endsWith('agreement.js')) {
-  const days = Number(process.argv[2]) || DEFAULT_WINDOW_DAYS;
+  const args = process.argv.slice(2);
+  const byRevision = args.includes('--by-revision');
+  const days = Number(args.find((a) => /^\d+$/.test(a))) || DEFAULT_WINDOW_DAYS;
   Promise.all([import('./receipts.js'), import('./cache.js')]).then(async ([{ readReceipts }, { defaultStateDir }]) => {
-    const report = computeAgreement(await readReceipts(defaultStateDir()), { windowDays: days });
+    const receipts = await readReceipts(defaultStateDir());
+    if (byRevision) {
+      const split = computeAgreementByRevision(receipts, { windowDays: days });
+      console.log(`Agreement by rule-engine version — last ${days}d\n`);
+      const names = Object.keys(split).sort((a, b) => (a === NOT_RECORDED) - (b === NOT_RECORDED) || a.localeCompare(b));
+      if (!names.length) console.log('No receipts in the window.');
+      for (const k of names) {
+        const b = split[k];
+        console.log(`${k.padEnd(34)} rate ${b.rate === null ? '  —  ' : (b.rate * 100).toFixed(1) + '%'}  (${b.agreements}✓ ${b.disagreements}✗ of ${b.scored} scored · ${b.non_directional} non-directional · ${b.awaiting_user_action} awaiting)`);
+      }
+      return;
+    }
+    const report = computeAgreement(receipts, { windowDays: days });
     const { overall: o, window: w } = report;
     console.log(`Agreement over the last ${w.days}d — ${w.in_window}/${w.total_receipts} receipts in window\n`);
     const line = (label, b) =>

package/consult-core.js

@@ -356,6 +356,68 @@ function calibrate(vd, coverage, signalConfidence = 0) {
 
 const magnitudeRank = (m) => ({ low: 0, medium: 1, high: 2 }[m] ?? 1);
 
+// ── Amount bands (precedent track G8 B1) ──────────────────────────────────────
+// Until this, the inferred path never read `amount`: $12 and $12,000 answered alike
+// unless the agent ALSO labelled the magnitude, and only authored §10.5 rules saw money.
+// Now an amount sets a FLOOR under the magnitude the inferred path reasons about.
+//
+// Band edges are the subject's own numbers wherever they exist: every amount bound on an
+// authored rule (amount_gt / amount_lt / amount_lte — a grant's ceiling says what is small
+// to them as surely as a prohibition's floor says what is large). Rules scoped to the
+// action's domain (or unscoped) win; failing those, any authored amount anywhere; failing
+// that, DEFAULT_AMOUNT_EDGES — a stated default, recorded as such on the receipt, replaced
+// by the subject's first money rule.
+//
+// CAUTION-ONLY, by construction: the floor is max()'d with the declared magnitude, so it
+// can raise the stakes and never lower them. And it feeds the INFERRED path only — §10.5
+// matching keeps reading the declared magnitude, so an authored grant's `magnitude_max`
+// means exactly what the subject wrote.
+export const DEFAULT_AMOUNT_EDGES = [100, 1000];
+
+// ── Resolver revision (precedent track Phase 1b) ──────────────────────────────
+// Which version of the inferred path answered. Stamped on every inferred receipt (as a
+// `resolverRevision` driver — local provenance, never in the response) so agreement can be
+// split before/after a behaviour change instead of blurring into one number.
+//
+// BUMP THIS WHENEVER THE INFERRED PATH'S ANSWERS CHANGE. You will not be able to forget:
+// test-resolver-revision.mjs fingerprints the answers over a fixed grid and fails, naming
+// this constant, when they move under an unchanged revision. Format: <date>.<what changed>.
+//   (receipts before 2026-10-20 carry none — the pre-B1 rules and the first days of B1)
+export const RESOLVER_REVISION = '2026-10-19.amount-bands';
+
+function ruleAmounts(r) {
+  return [r?.amountGt, r?.amountLt, r?.amountLte].filter((x) => typeof x === 'number' && Number.isFinite(x) && x > 0);
+}
+function ruleCoversDomain(r, domain) {
+  const ds = Array.isArray(r?.domains) ? r.domains : [];
+  if (!ds.length) return true;                       // unscoped → speaks for every domain
+  if (!domain) return false;
+  const canon = canonicalDomain(domain);
+  return ds.some((d) => domain.includes(d) || (canon && canonicalDomain(d) === canon));
+}
+
+/** The band edges for this action: { edges: [low, high] (ascending, low may equal high), basis }. */
+export function amountEdges(policies, domain) {
+  const list = Array.isArray(policies) ? policies : [];
+  const scoped = list.filter((r) => ruleCoversDomain(r, domain)).flatMap(ruleAmounts);
+  const any = scoped.length ? scoped : list.flatMap(ruleAmounts);
+  if (!any.length) return { edges: DEFAULT_AMOUNT_EDGES.slice(), basis: null };
+  return { edges: [Math.min(...any), Math.max(...any)], basis: 'self_reported' };
+}
+
+/**
+ * The magnitude floor an amount implies, or null when it implies none.
+ * Above the high edge → `high`; above the low edge → `medium`. With a single authored
+ * number ("escalate above $1,000") both edges are that number: above it is `high`.
+ */
+export function amountFloor(n, policies) {
+  const a = n?.amount;
+  if (typeof a !== 'number' || !Number.isFinite(a) || a <= 0) return null;
+  const { edges: [lo, hi], basis } = amountEdges(policies, n.domain);
+  const band = a > hi ? 'high' : a > lo ? 'medium' : null;
+  return band ? { band, rank: magnitudeRank(band), basis } : null;
+}
+
 // ── Request validation/normalization (§10.2) ──────────────────────────────────
 export function normalizeRequest(request) {
   const type = request.consultation_type;
@@ -411,7 +473,8 @@ const USES_AMBIGUITY = new Set(['action_approval', 'escalation_default']);
 function resolveActionApproval(vd, n, suppressed) {
   const p = profile(vd, RELEVANT_CUES.action_approval, true, n.domain, suppressed);
   const irreversible = n.reversible === false;
-  const mag = magnitudeRank(n.magnitude);
+  // Declared stakes, raised (never lowered) by what the amount means to this subject.
+  const mag = Math.max(magnitudeRank(n.magnitude), n.amountBand ? n.amountBand.rank : 0);
   const thinEvidence = n.evidenceProvided.length === 0;
 
   let signal;
@@ -481,7 +544,7 @@ function resolveVoiceDraft() {
 // sees (§10.4 holds: provenance is for the subject's audit/calibration, not the agent).
 // Pure + defensive: bad/redirect/abstain inputs → []. Takes the raw request; normalizes
 // internally so callers pass exactly what they passed to the consult.
-export function consultDrivers(vd, request) {
+export function consultDrivers(vd, request, opts = {}) {
   let n;
   try { n = normalizeRequest(request || {}); } catch { return []; }
   const keys = RELEVANT_CUES[n.type];
@@ -499,6 +562,13 @@ export function consultDrivers(vd, request) {
     const a = readAmbiguity(vd, n.domain, suppressed);
     if (a.found) drivers.push(withOrigin({ cue: 'ambiguityPosture', value: a.value, confidence: a.confidence, basis: a.basis }, a.origin));
   }
+  // The amount band, when it raised the stakes. basis `self_reported` = the subject's own
+  // thresholds; null = the stated default (no subject evidence behind it).
+  if (n.type === 'action_approval') {
+    let band = null;
+    try { band = amountFloor(n, loadPolicies(vd, opts)); } catch { /* provenance is non-critical */ }
+    if (band) drivers.push({ cue: 'amountBand', value: band.band, confidence: 1, basis: band.basis });
+  }
   return drivers;
 }
 
@@ -796,7 +866,11 @@ const policyCtx = (opts = {}) => ({ now: opts.now, clientId: opts.clientId ?? nu
 export function resolveConsultationCore(vd, request = {}, opts = {}) {
   assertVaultUsable(vd);
   const n = normalizeRequest(request);
-  return applyPolicies(ruleResponse(vd, n), n, loadPolicies(vd, opts), policyCtx(opts));
+  const policies = loadPolicies(vd, opts);
+  // G8 B1: the amount's band, read against the subject's own thresholds. On `n` so the
+  // resolver sees it; applyPolicies does not read it (§10.5 matches the declared magnitude).
+  n.amountBand = amountFloor(n, policies);
+  return applyPolicies(ruleResponse(vd, n), n, policies, policyCtx(opts));
 }
 
 // Back-compat alias: the prior public name of the sync rule entry. Kept so existing

package/consult-runtime.js

@@ -0,0 +1,60 @@
+// Consult runtime — the I/O half of a consultation, shared by every caller that resolves
+// one: the MCP server (server.js) and the Claude Code ship hook (hooks/pre-ship.mjs).
+//
+// One copy, on purpose. This repo has paid twice for two consult paths that drifted — the
+// stale-authority guard once lived on phaedo_check_authorization alone, and the tools an
+// agent actually used answered from a revoked cache with no downgrade. A hook that loaded
+// policies or delegation signals its own way would be the third time.
+
+import { join } from 'path';
+import { readFileSync, existsSync } from 'fs';
+import { loadFingerprint, loadFingerprintPreferCache } from './fingerprint-source.js';
+import { readServingClientId } from './phone-source.js';
+import { consultOptsFromEnv, deriveDelegationSignals, withDelegationSignals, authoredDelegationSignals } from './consult.js';
+import { defaultStateDir } from './cache.js';
+import { readReceipts } from './receipts.js';
+
+/**
+ * The consult options for a process rooted at `baseDir` (the mcp/ directory): env config,
+ * the subject's deference policies, and this install's own paired-client id.
+ */
+export function buildConsultOpts(baseDir, env = process.env, { warn = (m) => process.stderr.write(m) } = {}) {
+  const opts = consultOptsFromEnv(env);
+  // Deference policies: PHAEDO_CONSULT_POLICIES if set, else the default file beside
+  // the server (mcp/consult-policies.json — what policy-editor.html produces). Zero
+  // config: drop the file in and restart the client. (Portable vault policies in
+  // phaedo_consult_policies always apply too, regardless of this file.)
+  const policiesPath = env.PHAEDO_CONSULT_POLICIES || join(baseDir, 'consult-policies.json');
+  if (existsSync(policiesPath)) {
+    try { opts.policies = JSON.parse(readFileSync(policiesPath, 'utf8')); }
+    catch (e) { warn(`[phaedo-mcp] ignoring malformed consult policies (${policiesPath}): ${e.message}\n`); }
+  }
+  // §10.5 `agents`: this process's OWN paired-client identity, resolved once at startup.
+  // One server serves one paired client, so it never asks a caller who is calling — it
+  // reads who it IS. Null (unpaired / unreadable) makes `agents`-scoped RELAXING rules
+  // inert, which is the fail-safe direction; the server still answers everything else.
+  opts.clientId = readServingClientId(baseDir);
+  return opts;
+}
+
+// Load the fingerprint for a consult and fold in the act-as-me channel: delegation
+// signals derived from this subject's own override history (§10.6 receipts). The
+// origin-aware resolver then lets a `delegation` correction outrank a `self` signal on
+// the same dimension. Best-effort — if receipts are unreadable, the consult still
+// answers from the plain fingerprint (delegation learning never breaks a consultation).
+export async function loadConsultVd(baseDir, { preferCache = false, warn = (m) => process.stderr.write(m) } = {}) {
+  // preferCache (escalation, ship hook): read the at-rest cache instead of a live phone
+  // pull, so the caller doesn't add a fingerprint-read AUTHORIZE prompt on the phone.
+  const vd = preferCache ? await loadFingerprintPreferCache(baseDir) : await loadFingerprint(baseDir);
+  try {
+    // Two delegation sources, both origin-aware: live override history (every override)
+    // + the subject's ENDORSED, portable delegation rules (authored_delegation). The
+    // authored rule thus shapes consult too, not only the §9 injection it already renders in.
+    const signals = deriveDelegationSignals(await readReceipts(defaultStateDir()))
+      .concat(authoredDelegationSignals(vd && vd.phaedo_fingerprint));
+    return withDelegationSignals(vd, signals);
+  } catch (e) {
+    warn(`[phaedo-mcp] delegation derive skipped (consult unaffected): ${e.message}\n`);
+    return vd;
+  }
+}

package/consult.js

@@ -17,6 +17,7 @@ import {
   shape, SIGNALS, CONSULTATION_TYPES, validateVaultShape, consultDrivers,
   deriveDelegationSignals, withDelegationSignals, buildDelegationPromotions, DELEGATION_PROMOTION_FLOOR,
   authoredDelegationSignals,
+  RESOLVER_REVISION,
 } from './consult-core.js';
 
 // Re-export the core surface so existing importers (server.js, tests,
@@ -110,6 +111,24 @@ export function consultOptsFromEnv(env = process.env) {
   };
 }
 
+// Which engine answered a response this module returned: the opt-in model judge, or the
+// deterministic rules. A WeakMap rather than a field because the §10.3 response shape is
+// closed (additionalProperties:false) and this is local provenance, never for the agent.
+const JUDGED_BY = new WeakMap();
+
+/**
+ * Append the `resolverRevision` provenance driver to a consult's drivers: the rules'
+ * RESOLVER_REVISION, or `judge:<model>` when the model judge answered. Only when there are
+ * drivers already — the receipt schema documents drivers as absent for deterministic
+ * pre-flights and abstains, which carry no inferred prediction to attribute.
+ * Pass the response EXACTLY as resolveConsultation returned it (before any copy).
+ */
+export function withRevision(drivers, response) {
+  if (!Array.isArray(drivers) || !drivers.length) return Array.isArray(drivers) ? drivers : [];
+  const judge = response && typeof response === 'object' ? JUDGED_BY.get(response) : undefined;
+  return [...drivers, { cue: 'resolverRevision', value: judge ? `judge:${judge}` : RESOLVER_REVISION, confidence: null, basis: null }];
+}
+
 // Public async entry: model judge when configured, else the deterministic core.
 // voice_draft always takes the (redirect) core path. Authored policies (§10.5)
 // override either result, so a standing guardrail always wins. Never throws except
@@ -132,7 +151,9 @@ export async function resolveConsultation(vd, request = {}, opts = {}) {
       // Authored guardrails override the model judge too (applied last so they win).
       // Same §10.5 context as the deterministic path — including the serving
       // `client_id`, so `agents` scoping is not bypassed by configuring a model.
-      return applyPolicies(judged, n, loadPolicies(vd, opts), { now: opts.now, clientId: opts.clientId ?? null });
+      const out = applyPolicies(judged, n, loadPolicies(vd, opts), { now: opts.now, clientId: opts.clientId ?? null });
+      if (out && typeof out === 'object') JUDGED_BY.set(out, String(opts.model));
+      return out;
     } catch (err) {
       process.stderr.write?.(`[phaedo-consult] model judge fell back to rules: ${err.message}\n`);
     }

package/delegation-sync.js

@@ -15,6 +15,12 @@
 // principal for §10.5 `agents` scoping, so these two properties are in tension until
 // the extension's drain gains the phone's try-each-verified-client loop.
 //
+// RESOLVED BY THE COURIER (verified 2026-09-24): the extension still cannot open an
+// independently-paired MCP's deposit, but it no longer has to. The PHONE drains this lane
+// with every verified client's key (mobile/src/lib/fpSync.ts drainAgentSuggestions) and
+// forwards the suggestions inside its to_ext deposit, which since spec v0.1.70 reaches EVERY
+// paired browser under that browser's own key. Independent pairing is the supported setup.
+//
 // The extension union-merges
 // the suggestions (sync-merge.js mergeAgentSuggestions) into suggested_rules, where the
 // existing popup review card surfaces them for endorsement.

package/fingerprint-source.js

@@ -5,15 +5,17 @@
 //   Phase 1b (phone): if a pairing record is configured (PHAEDO_PAIRING or
 //     mcp/pairing.json), authorize → pull /v1/profile → unwrap the §7.2 envelope
 //     from the paired phone (phone-source.js). Spec-faithful; no plaintext at rest.
-//   Phase 1a (local): otherwise read a local vault-payload JSON (or the shipped
-//     sample) — the decoupled stand-in that runs out of the box.
+//   Phase 1a (local): otherwise read a local vault-payload JSON. With neither, there is
+//     no profile — tools say so (NO_PROFILE_MESSAGE); the shipped sample is opt-in only.
 
 import { readFile } from 'fs/promises';
-import { resolve } from 'path';
+import { resolve, dirname } from 'path';
+import { fileURLToPath } from 'url';
 import { hasPairingRecord, loadPairingRecord, loadFingerprintFromPhone, PhoneError } from './phone-source.js';
 import { defaultStateDir, writeCache, readCache, clearCache } from './cache.js';
 import { foldLocalCapture, isLocalCaptureOwner } from './capture-local.js';
 import { Capabilities, AuthoredSource } from './lib/phaedo-crypto.js';
+import { PhaedoError } from './errors.js';
 
 // §4.1 protocol-identity normalization (consumer defense-in-depth, 2026-06-16).
 // A stored fingerprint from a producer that predates identity stamping (or whose
@@ -74,14 +76,33 @@ export function foldConfigHome(vd) {
 }
 
 // Resolution order for the local fixture (1a):
-//   1. PHAEDO_FINGERPRINT env var (absolute or cwd-relative path)
+//   1. PHAEDO_FINGERPRINT env var (absolute or cwd-relative path, or `sample`)
 //   2. ./fingerprint.json next to the server
-//   3. ./sample-fingerprint.json (shipped demo fixture)
+//   — nothing else. There is deliberately NO silent fallback to the shipped sample.
+//
+// NO PROFILE IS AN ANSWER, NOT A DEMO. Until 2026-10-20 an unpaired install with no file fell
+// back to sample-fingerprint.json — so a stranger who ran `npx phaedo-mcp` had a made-up
+// person's style injected into their assistant, with nothing anywhere saying so (the response
+// carried `fingerprint_id: sample-0000…`, which no human reads). The sample is still one word
+// away for anyone who wants to try it — PHAEDO_FINGERPRINT=sample — but it has to be asked for.
+const SAMPLE_KEYWORD = 'sample';
+// The sample ships beside this module, whatever base dir the caller serves from.
+const SAMPLE_PATH = resolve(dirname(fileURLToPath(import.meta.url)), 'sample-fingerprint.json');
 function resolveSourcePath(baseDir) {
-  if (process.env.PHAEDO_FINGERPRINT) return resolve(process.cwd(), process.env.PHAEDO_FINGERPRINT);
+  const env = process.env.PHAEDO_FINGERPRINT;
+  if (env === SAMPLE_KEYWORD) return SAMPLE_PATH;
+  if (env) return resolve(process.cwd(), env);
   return resolve(baseDir, 'fingerprint.json');
 }
 
+// Read by the assistant (a tool error) and, through it, by the person — so plain words, and
+// it says what did NOT happen as well as what to do.
+export const NO_PROFILE_MESSAGE =
+  'No Phaedo profile is set up on this computer, so there is nothing to load and Phaedo has ' +
+  'not changed how the assistant responds. A profile comes from the Phaedo phone app, which is ' +
+  'not open to the public yet (https://phaedo.so to hear when it is). To try Phaedo with a made-up example profile ' +
+  'instead, set PHAEDO_FINGERPRINT=sample in this server\'s settings.';
+
 // Returns the vault payload:
 //   { phaedo_fingerprint, phaedo_behavioral_signals, phaedo_linguistic_profile,
 //     phaedo_session_metrics }
@@ -154,9 +175,13 @@ export async function loadFingerprint(baseDir) {
   let raw;
   try {
     raw = await readFile(path, 'utf8');
-  } catch {
-    // Fall back to the shipped sample so a fresh checkout runs out of the box.
-    raw = await readFile(resolve(baseDir, 'sample-fingerprint.json'), 'utf8');
+  } catch (err) {
+    // Only the default location may be absent quietly. A path the user NAMED that doesn't
+    // read is their mistake to see, not "no profile".
+    if (!process.env.PHAEDO_FINGERPRINT && err?.code === 'ENOENT') {
+      throw new PhaedoError('decryption_failed', NO_PROFILE_MESSAGE);
+    }
+    throw new PhaedoError('decryption_failed', `Could not read the Phaedo profile at ${path} (${err?.code || err?.message || err}).`);
   }
   const vd = JSON.parse(raw);
   if (!vd || typeof vd !== 'object' || !vd.phaedo_fingerprint) {