phaedo-mcp 0.3.16 → 0.3.19

package/consult-core.js

@@ -15,7 +15,7 @@
 // abstain. Signals out, never structure out (§10.4).
 
 import { PhaedoError } from './errors.js';
-import { loadPolicies, applyPolicies, matchAuthorization } from './consult-policy.js';
+import { loadPolicies, applyPolicies, matchAuthorization, relaxingRuleApplies } from './consult-policy.js';
 import { normalizeActionBinding, isBound } from './action-binding.js';
 import { normalizeDomain, canonicalDomain } from './lib/domain.js';
 
@@ -914,6 +914,17 @@ export function resolveConsultationCore(vd, request = {}, opts = {}) {
 // importers (tests, spec/test-schemas.mjs) are unchanged.
 export const buildConsultationResponse = resolveConsultationCore;
 
+/**
+ * Does one of the subject's own RELAXING rules (a §10.5 `autoproceed` grant or a `bias_bold`)
+ * apply to this request? The server's stale-authority guard withholds an expanding answer from a
+ * cached profile only when this is true: a grant is revocable, and the copy may predate the
+ * revocation. Phaedo's inferred judgment carries no such risk and is left alone.
+ */
+export function standingRuleRelaxes(vd, request = {}, opts = {}) {
+  const n = normalizeRequest(request);
+  return relaxingRuleApplies(n, loadPolicies(vd, opts), policyCtx(opts));
+}
+
 // ── Deterministic-only authorization check (brief M3) ─────────────────────────
 // (vd, request[, opts]) -> a small, fixed-shape result. Checks ONLY standing
 // authorizations (§10.5 force rules) — it does NOT run inferred evaluation, so it is

package/consult-policy.js

@@ -446,6 +446,15 @@ function agentScopeSatisfied(rule, clientId) {
   return scope.includes(clientId);                         // [] matches nobody, by design
 }
 
+// Does any RELAXING rule (autoproceed / bias_bold) apply to this request — active, in scope,
+// matched and bound? The stale-authority guard keys on this: an answer that rests on one of the
+// subject's own revocable grants must not be acted on from a copy that may predate a revocation.
+export function relaxingRuleApplies(n, policies, { now = Date.now(), clientId = null } = {}) {
+  if (!policies || !policies.length || !n || n.type === 'voice_draft') return false;
+  return policies.some((r) => RELAXING.has(r.effect) && ruleActive(r, now) && agentScopeSatisfied(r, clientId)
+    && ruleMatches(r, n) && bindingSatisfied(r, n));
+}
+
 // Did a rule match on its own terms and get held back ONLY by the binding gate?
 // Worth reporting: otherwise an agent whose standing auto-proceed rule silently
 // stops firing has no way to learn that it needs to send an action_binding.

package/consult-runtime.js

@@ -9,7 +9,7 @@
 import { join } from 'path';
 import { configDir } from './lib/config-dir.js';
 import { readFileSync, existsSync } from 'fs';
-import { loadFingerprint, loadFingerprintPreferCache } from './fingerprint-source.js';
+import { loadFingerprint, loadFingerprintPreferCache, carrySource } from './fingerprint-source.js';
 import { readServingClientId } from './phone-source.js';
 import { consultOptsFromEnv, deriveDelegationSignals, withDelegationSignals, authoredDelegationSignals } from './consult.js';
 import { defaultStateDir } from './cache.js';
@@ -43,17 +43,26 @@ export function buildConsultOpts(baseDir, env = process.env, { warn = (m) => pro
 // origin-aware resolver then lets a `delegation` correction outrank a `self` signal on
 // the same dimension. Best-effort — if receipts are unreadable, the consult still
 // answers from the plain fingerprint (delegation learning never breaks a consultation).
-export async function loadConsultVd(baseDir, { preferCache = false, warn = (m) => process.stderr.write(m) } = {}) {
+//
+// `onRead(vd)` sees the plain read BEFORE the overlay. The overlay is a spread copy, and the
+// read's provenance (fingerprint-source.js SOURCE) is a non-enumerable marker a spread drops —
+// so `sourceOf()` on the RETURNED profile always says "live". A caller that needs the copy's
+// real age (the ship hook's standing-rule gate) must take it here.
+export async function loadConsultVd(baseDir, { preferCache = false, warn = (m) => process.stderr.write(m), onRead } = {}) {
   // preferCache (escalation, ship hook): read the at-rest cache instead of a live phone
   // pull, so the caller doesn't add a fingerprint-read AUTHORIZE prompt on the phone.
   const vd = preferCache ? await loadFingerprintPreferCache(baseDir) : await loadFingerprint(baseDir);
+  if (onRead) onRead(vd);
   try {
     // Two delegation sources, both origin-aware: live override history (every override)
     // + the subject's ENDORSED, portable delegation rules (authored_delegation). The
     // authored rule thus shapes consult too, not only the §9 injection it already renders in.
     const signals = deriveDelegationSignals(await readReceipts(defaultStateDir()))
       .concat(authoredDelegationSignals(vd && vd.phaedo_fingerprint));
-    return withDelegationSignals(vd, signals);
+    // The overlay is a spread COPY and the read's provenance is a non-enumerable marker, so it
+    // must be carried across — without it every cached read looked live and the server's
+    // stale-authority guard never engaged on phaedo_consult / phaedo_escalate (found 2026-10-31).
+    return carrySource(vd, withDelegationSignals(vd, signals));
   } catch (e) {
     warn(`[phaedo-mcp] delegation derive skipped (consult unaffected): ${e.message}\n`);
     return vd;

package/consult.js

@@ -13,7 +13,7 @@ import { buildInjectionResponse } from './projection.js';
 import { loadPolicies, applyPolicies } from './consult-policy.js';
 import { PhaedoError } from './errors.js';
 import {
-  resolveConsultationCore, buildConsultationResponse, checkAuthorization, normalizeRequest,
+  resolveConsultationCore, buildConsultationResponse, checkAuthorization, standingRuleRelaxes, normalizeRequest,
   shape, SIGNALS, CONSULTATION_TYPES, validateVaultShape, consultDrivers,
   deriveDelegationSignals, withDelegationSignals, buildDelegationPromotions, DELEGATION_PROMOTION_FLOOR,
   authoredDelegationSignals,
@@ -22,7 +22,7 @@ import {
 
 // Re-export the core surface so existing importers (server.js, tests,
 // spec/test-schemas.mjs) keep their `from './consult.js'` paths.
-export { CONSULTATION_TYPES, buildConsultationResponse, resolveConsultationCore, checkAuthorization, validateVaultShape, consultDrivers, deriveDelegationSignals, withDelegationSignals, buildDelegationPromotions, DELEGATION_PROMOTION_FLOOR, authoredDelegationSignals };
+export { CONSULTATION_TYPES, buildConsultationResponse, resolveConsultationCore, checkAuthorization, standingRuleRelaxes, validateVaultShape, consultDrivers, deriveDelegationSignals, withDelegationSignals, buildDelegationPromotions, DELEGATION_PROMOTION_FLOOR, authoredDelegationSignals };
 
 // ── Model resolver (richest fingerprint, LOCAL compute — opt-in) ──────────────
 // When a local model is configured (PHAEDO_CONSULT_MODEL + an Ollama/OpenAI-

package/fingerprint-source.js

@@ -256,6 +256,20 @@ export function sourceOf(vd) {
   return s || { live: true, cachedAt: null, ageMs: 0 };
 }
 
+/**
+ * Copy `from`'s provenance onto `to` (a derived copy of it) and return `to`. Any overlay that
+ * spreads the fingerprint MUST pass its result through this: an absent marker reads as LIVE,
+ * so a lost one makes a stale cached read look fresh to the stale-authority guard.
+ */
+export function carrySource(from, to) {
+  const s = from && from[SOURCE];
+  if (!s || !to || typeof to !== 'object' || to === from) return to;
+  try {
+    Object.defineProperty(to, SOURCE, { value: s, enumerable: false, configurable: true, writable: true });
+  } catch { /* frozen object — provenance is best-effort, never fatal */ }
+  return to;
+}
+
 // What the subject removed in `npm run learned` is taken out on EVERY read, so injection,
 // consult and the rules files all stop using it — even when the sessions keep showing it.
 // `unfiltered` is for that review screen alone, which has to list what was removed.

package/hooks/pre-ship.mjs

@@ -9,13 +9,24 @@
 // Phaedo before those run (ship-actions.js names them) and writes a §10.6 receipt, so the
 // receipts accumulate in normal use instead of waiting for an agent to remember a tool.
 //
-// WHAT IT MAY DO — ONE RULE. The hook only ever ADDS friction; it never removes it. It
-// never returns `allow`, so it cannot pre-approve anything Claude Code would otherwise
-// have asked about. On a permissive answer it returns no decision at all (Claude Code's
-// own permission flow applies unchanged); on a cautious one it returns `ask`, which puts
-// the action in front of the subject. That is why it reads the at-rest profile cache and
-// skips the server's stale-authority guard: the guard exists to stop a stale read from
-// EXPANDING autonomy, and nothing here can.
+// WHAT IT MAY DO. On a cautious answer it returns `ask`, which puts the action in front of
+// the subject. On a permissive answer it returns no decision (Claude Code's own permission
+// flow applies unchanged) — with ONE exception, since 0.3.17: it returns `allow` when the
+// subject's own standing rule decided the action (a §10.5 `autoproceed` authorization they
+// accepted on the phone — usually staged by §10.7 promotion). Every gate must hold
+// (standingGrantHeld): the authorization matched (unexpired, scoped to this client, bound
+// to this call); the action is reversible and not high; GitHub raised nothing; the profile
+// copy is at most GRANT_FRESH_DAYS old; and no "no" in that domain within GRANT_PUSHBACK_DAYS
+// (lib/rule-leeway.js — shared with the server).
+// Claude Code only — other agents' hooks never get the dependency.
+//
+// Why a cached read may apply a rule at all: the hook cannot read live (a live pull needs the
+// subject to approve on the phone, which would trade one prompt for another), and the
+// alternative is a rule that never fires. Bounded instead, by the same leeway the server's
+// stale-authority guard uses (lib/rule-leeway.js): the copy's age caps how long a rule withdrawn
+// on the phone can still act, and the pushback gate is a brake on THIS machine — one "no" stops
+// it at once. Outside that one case the hook reads the at-rest cache and skips the guard
+// because nothing it does can EXPAND autonomy.
 //
 // WHERE OUTCOMES COME FROM — SUBJECT-AUTHORED ONLY (§10.6 honesty rail). The one thing the
 // hook records itself is a yes the subject gave on a prompt, and it records that only on
@@ -50,6 +61,7 @@ import { execFile } from 'child_process';
 import { classifyShipCommand, classifyToolCall } from '../ship-actions.js';
 import { isMainModule } from '../lib/is-main.js';
 import { isDirectoryEdition } from '../lib/config-dir.js';
+import { ruleLeeway, RULE_FRESH_DAYS, RULE_PUSHBACK_DAYS } from '../lib/rule-leeway.js';
 
 const MCP_DIR = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -82,6 +94,31 @@ export const STALE_PROFILE_DAYS = 14;
 const DAY_MS = 24 * 60 * 60 * 1000;
 const PENDING_TTL_MS = DAY_MS;
 
+// The copy's age and the "one no pauses it" window — the SAME leeway the server's stale guard
+// gives a rule (lib/rule-leeway.js), so a merge and a direct consult can't disagree.
+export const GRANT_FRESH_DAYS = RULE_FRESH_DAYS;
+export const GRANT_PUSHBACK_DAYS = RULE_PUSHBACK_DAYS;
+
+/**
+ * May the subject's standing rule answer this prompt? PURE. Returns { ok: true } or
+ * { ok: false, why } where `why` is one of: no_rule | raised | not_reversible | high |
+ * magnitude_unstated | priced | stale | pushback.
+ * `auth` is checkAuthorization's result; `source` is the profile read's provenance (sourceOf).
+ */
+export function standingGrantHeld({ auth, descriptor, raised, source, receipts, now }) {
+  if (!auth?.authorization_matched || auth.signal !== 'proceed') return { ok: false, why: 'no_rule' };
+  if (raised) return { ok: false, why: 'raised' };
+  return ruleLeeway({ source, descriptor, receipts, now });
+}
+
+// What the agent is told when the subject's rule answered the prompt.
+export function grantContext(receiptId) {
+  return `This ran without a confirmation prompt: the user's own standing rule in Phaedo covers it ` +
+    `(routine, reversible). Tell them in one line that it went ahead under their rule. If they object, ` +
+    `call phaedo_record_outcome with receipt_id ${receiptId} and "rejected" (or "modified") — one ` +
+    `"no" pauses the rule on this computer.`;
+}
+
 // The caller label on the receipt. `via` stays `phaedo_consult` — the hook runs a full
 // consultation through the same path, and the receipt schema's `via` enum is closed — so
 // the free-text, self-asserted `agent_id` is where "this came from the ship hook" lives.
@@ -373,29 +410,40 @@ export async function runShipHook(input, deps) {
     };
     const { response, drivers, source } = await deps.consult(request);
     const signal = String(response?.signal || '');
+    const asked = ASKING_SIGNALS.has(signal);
+    // The one way this hook removes a prompt: the subject's own standing rule (see header).
+    let grant = null;
+    if (!asked && signal === 'proceed' && deps.standingGrant) {
+      try { grant = await deps.standingGrant(request, { raised, now }); } catch { grant = null; }
+    }
+    const granted = grant?.ok === true;
     // Provenance: what the hook saw, beside what drove the answer. Local receipt only.
     const extra = [];
     if (ci) extra.push({ cue: 'ciState', value: ci, confidence: null, basis: ci === 'unknown' ? null : 'observed' });
     if (ci && deps.prFacts) extra.push({ cue: 'diffStakes', value: stakesValue(stakes), confidence: null, basis: stakes ? 'observed' : null });
+    if (grant) extra.push({ cue: 'standingGrant', value: granted ? 'answered' : `held:${grant.why}`, confidence: null, basis: 'observed' });
     const allDrivers = extra.length ? [...(drivers || []), ...extra] : drivers;
     const receiptId = await deps.writeReceipt({ request, response, drivers: allDrivers });
     if (!receiptId) return null;     // no receipt = nothing to learn from; stay out of the way
-    const asked = ASKING_SIGNALS.has(signal);
 
     const state = readState(deps.statePath);
     if (input.tool_use_id) {
       state.pending[input.tool_use_id] = {
         receipt_id: receiptId, cmd_hash: callHash(input), session_id: input.session_id || null,
-        asked, prompt_shown: false, at: new Date(now).toISOString(),
+        asked, granted, prompt_shown: false, at: new Date(now).toISOString(),
       };
     }
-    let context = preContext({
-      summary: ship.summary, signal, receiptId, asked, recordsNo: Boolean(deps.readTranscript),
-      hint: typeof response?.rationale_hint === 'string' ? response.rationale_hint : '',
-    });
+    let context = granted
+      ? `Phaedo was consulted before this action (${ship.summary}) and answered "${signal}". receipt_id: ${receiptId}. ${grantContext(receiptId)}`
+      : preContext({
+        summary: ship.summary, signal, receiptId, asked, recordsNo: Boolean(deps.readTranscript),
+        hint: typeof response?.rationale_hint === 'string' ? response.rationale_hint : '',
+      });
     if (raised) context += ` GitHub shows ${why}, so Phaedo treated this merge as high-stakes.`;
     const ageDays = source && source.live === false && Number.isFinite(source.ageMs) ? Math.floor(source.ageMs / DAY_MS) : 0;
-    if (ageDays >= STALE_PROFILE_DAYS && !(now - Date.parse(state.stale_noted_at) < DAY_MS)) {
+    // A rule held back only by the copy's age is worth a refresh nudge before the general one.
+    const staleNudge = ageDays >= STALE_PROFILE_DAYS || grant?.why === 'stale';
+    if (staleNudge && !(now - Date.parse(state.stale_noted_at) < DAY_MS)) {
       context += ' ' + staleContext(ageDays, deps.mcpDir || MCP_DIR);
       state.stale_noted_at = new Date(now).toISOString();
     }
@@ -404,6 +452,7 @@ export async function runShipHook(input, deps) {
       hookSpecificOutput: {
         hookEventName: 'PreToolUse',
         ...(asked ? { permissionDecision: 'ask', permissionDecisionReason: promptReason(signal, ship.summary, why, personalWhy(request.action_descriptor, response)) } : {}),
+        ...(granted ? { permissionDecision: 'allow', permissionDecisionReason: `Phaedo: your standing rule covers this (${ship.summary}).` } : {}),
         additionalContext: context,
       },
     };
@@ -452,24 +501,40 @@ export async function runShipHook(input, deps) {
 // `agentId` names the agent on the receipt; other agents' hooks (agent-hook.mjs) pass their own.
 export async function realDeps({ agentId = AGENT_ID, statePath } = {}) {
   const { loadConsultVd, buildConsultOpts } = await import('../consult-runtime.js');
-  const { resolveConsultation, consultDrivers, withRevision } = await import('../consult.js');
-  const { buildReceipt, appendReceipt, receiptsCapFromEnv } = await import('../receipts.js');
+  const { resolveConsultation, consultDrivers, withRevision, checkAuthorization } = await import('../consult.js');
+  const { buildReceipt, appendReceipt, receiptsCapFromEnv, readReceipts } = await import('../receipts.js');
   const { sourceOf } = await import('../fingerprint-source.js');
   const { defaultStateDir } = await import('../cache.js');
   const stateDir = defaultStateDir();
   const quiet = () => {};
   const opts = buildConsultOpts(MCP_DIR, process.env, { warn: quiet });
+  let consultedVd = null;            // the profile the consult read — the grant is checked against the same copy
+  let readSource = null;             // ...and how old that copy really is (taken before the overlay drops it)
   return {
     statePath: statePath || join(stateDir, 'ship-hook.json'),
     agentId,
     mcpDir: MCP_DIR,
     prFacts: (ship, cwd) => lookupPrFacts(ship, cwd),
+    // Only Claude Code's hook may answer a prompt; other agents' hooks never get this.
+    ...(agentId === AGENT_ID ? {
+      async standingGrant(request, { raised, now }) {
+        if (!consultedVd || !readSource) return { ok: false, why: 'no_rule' };
+        return standingGrantHeld({
+          auth: checkAuthorization(consultedVd, request, opts),
+          descriptor: request.action_descriptor, raised, source: readSource,
+          receipts: await readReceipts(stateDir), now,
+        });
+      },
+    } : {}),
     async consult(request) {
-      const vd = await loadConsultVd(MCP_DIR, { preferCache: true, warn: quiet });
+      const vd = await loadConsultVd(MCP_DIR, { preferCache: true, warn: quiet, onRead: (plain) => { readSource = sourceOf(plain); } });
+      consultedVd = vd;
       const response = await resolveConsultation(vd, request, opts);
       let drivers = [];
       try { drivers = withRevision(consultDrivers(vd, request, opts), response); } catch { /* provenance is non-critical */ }
-      return { response, drivers, source: sourceOf(vd) };
+      // The plain read's provenance — `sourceOf(vd)` on the overlay always says "live", which is
+      // also why the 14-day refresh nudge below never fired before 0.3.17.
+      return { response, drivers, source: readSource };
     },
     async writeReceipt({ request, response, drivers }) {
       const r = buildReceipt({ via: 'phaedo_consult', agentId, clientId: opts.clientId, request, response, drivers });

package/lib/rule-leeway.js

@@ -0,0 +1,56 @@
+// Phaedo — how far a CACHED profile copy may be trusted to apply one of the subject's own
+// relaxing rules (a §10.5 `autoproceed` grant or a `bias_bold`). One definition, shared by the
+// Claude Code ship hook (hooks/pre-ship.mjs) and the server's stale-authority guard (server.js),
+// so the two paths cannot drift apart again.
+//
+// THE RISK. A rule is revocable on the phone, and a revocation reaches this computer only with
+// the next live read. A cached copy may predate it — the 2026-07-25 incident, where a withdrawn
+// $500 payment permission kept working from a 22-hour-old copy. So by default a cached copy may
+// NOT apply a rule.
+//
+// THE LEEWAY (Randy, 2026-10-31: "align them"). A live read needs the subject to approve on the
+// phone, so "live only" means a rule almost never fires. For the cheap end of the risk, a cached
+// copy may apply the rule when ALL hold:
+//   - the action is reversible (stated `true`);
+//   - its magnitude is stated `low` or `medium` (never high, never unstated);
+//   - it moves no money (no `amount`) — every priced action stays live-only;
+//   - the copy is at most RULE_FRESH_DAYS old, which caps how long a withdrawn rule can act;
+//   - no rejected / modified outcome in that domain within RULE_PUSHBACK_DAYS — one "no" on
+//     this computer stops it at once, before the phone's revocation has arrived.
+// Anything else keeps the strict rule. PURE: no I/O, `now` injected.
+
+import { canonicalDomain, normalizeDomain } from './domain.js';
+
+export const RULE_FRESH_DAYS = 7;
+export const RULE_PUSHBACK_DAYS = 30;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const LEEWAY_MAGNITUDES = new Set(['low', 'medium']);
+// Receipts store the canonical domain; a request may carry an alias or other casing. Compare
+// canonical forms, so "code" and "engineering" are one class here as they are on the receipt.
+const domainKey = (x) => (typeof x === 'string' && x.trim() ? (canonicalDomain(x) || normalizeDomain(x) || '') : '');
+
+/**
+ * May a cached copy apply the subject's relaxing rule to this action?
+ * (source: sourceOf(read), descriptor: the request's action_descriptor, receipts, now)
+ * → { ok: true } | { ok: false, why } where why ∈ not_reversible | high | magnitude_unstated | priced
+ *   | stale | pushback.
+ * The age gate applies only to a cached read; every other gate applies to any read.
+ */
+export function ruleLeeway({ source, descriptor, receipts, now = Date.now() } = {}) {
+  const d = descriptor && typeof descriptor === 'object' ? descriptor : {};
+  if (d.reversible !== true) return { ok: false, why: 'not_reversible' };
+  const mag = typeof d.magnitude === 'string' ? d.magnitude.toLowerCase() : null;
+  if (!LEEWAY_MAGNITUDES.has(mag)) return { ok: false, why: mag === 'high' ? 'high' : 'magnitude_unstated' };
+  if (d.amount != null) return { ok: false, why: 'priced' };
+  if (source && source.live === false && !(Number.isFinite(source.ageMs) && source.ageMs <= RULE_FRESH_DAYS * DAY_MS)) {
+    return { ok: false, why: 'stale' };
+  }
+  const domain = domainKey(d.domain);
+  const since = now - RULE_PUSHBACK_DAYS * DAY_MS;
+  const pushback = (Array.isArray(receipts) ? receipts : []).some((r) =>
+    (r?.user_action === 'rejected' || r?.user_action === 'modified')
+    && domainKey(r?.request?.action_descriptor?.domain) === domain
+    && Date.parse(r?.user_action_at || r?.created_at) >= since);
+  if (pushback) return { ok: false, why: 'pushback' };
+  return { ok: true };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phaedo-mcp",
-  "version": "0.3.16",
+  "version": "0.3.19",
   "private": false,
   "license": "Apache-2.0",
   "type": "module",

package/server.js

@@ -28,8 +28,9 @@ import { buildIntentMandatePayload } from './ap2.js';
 import { depositSignRequest, pollSignOnce } from './signing-request.js';
 import { buildSigningAuditRecord, appendSigningAudit } from './signing-audit.js';
 import { buildInjectionResponse, errorResponse, PhaedoError } from './projection.js';
-import { resolveConsultation, checkAuthorization, CONSULTATION_TYPES, consultDrivers, withRevision } from './consult.js';
+import { resolveConsultation, checkAuthorization, standingRuleRelaxes, CONSULTATION_TYPES, consultDrivers, withRevision } from './consult.js';
 import { defaultStateDir } from './cache.js';
+import { ruleLeeway, RULE_FRESH_DAYS } from './lib/rule-leeway.js';
 import { buildConsultOpts, loadConsultVd } from './consult-runtime.js';
 import { buildReceipt, appendReceipt, receiptsCapFromEnv, readReceipts, markOutcome, USER_ACTIONS } from './receipts.js';
 
@@ -65,12 +66,43 @@ async function emitReceipt(via, args, response, drivers) {
 const EXPANDING_SIGNALS = new Set(['proceed', 'autoproceed', 'bias_bold']);
 
 /**
- * Downgrade an authority-EXPANDING answer that was computed from a stale (cached) read.
- * Returns the response unchanged for a live read, or for any answer that already defers.
+ * Downgrade an authority-EXPANDING answer that was computed from a stale (cached) read AND rests
+ * on one of the subject's own relaxing rules (`ruleDecided`). Returns the response unchanged for a
+ * live read, for any answer that already defers, and for Phaedo's inferred judgment.
  * Always annotates provenance so the caller can SAY where the answer came from — the
  * silence is what let a stale "you're authorized" go unnoticed for a day.
+ *
+ * RULES ONLY (Randy's decision, 2026-10-31). The danger a cached copy carries is a REVOKED GRANT
+ * (the 2026-07-25 $500 payment). An inferred "proceed" is a reading of the subject's disposition,
+ * not a revocable permission. Guarding it too would turn nearly every consult into an ask, since
+ * the phone is rarely reachable. The question only arose because this guard had never engaged on
+ * consult/escalate: the overlay dropped the provenance marker (carrySource fixes that).
+ *
+ * THE LEEWAY (Randy, 2026-10-31: "align them"). `leeway` = lib/rule-leeway.js said the cached copy
+ * may still apply the rule: reversible, stated low/medium, no money, copy ≤ RULE_FRESH_DAYS old,
+ * no recent "no" in the domain — the same test the Claude Code ship hook applies before it
+ * answers a prompt, so a merge and a direct consult give the same answer. Anything outside it
+ * (a payment, an irreversible or high-stakes action, an older copy) is withheld as before.
  */
-function withStaleAuthorityGuard(response, vd) {
+// Can't tell → treat it as rule-decided, so the guard applies (fail closed).
+function ruleRelaxes(vd, req) {
+  try { return standingRuleRelaxes(vd, req, CONSULT_OPTS); } catch { return true; }
+}
+
+// What the guard needs to know about this request, in one place for all three tools. The leeway
+// is only worked out for a cached copy (a live read is never withheld); can't tell → no leeway.
+async function guardFacts(vd, req, ruleDecided = ruleRelaxes(vd, req)) {
+  const src = sourceOf(vd);
+  if (src.live || !ruleDecided) return { ruleDecided };
+  try {
+    const receipts = await readReceipts(defaultStateDir());
+    return { ruleDecided, leeway: ruleLeeway({ source: src, descriptor: req?.action_descriptor, receipts, now: Date.now() }).ok };
+  } catch {
+    return { ruleDecided, leeway: false };
+  }
+}
+
+function withStaleAuthorityGuard(response, vd, { ruleDecided = true, leeway = false } = {}) {
   const src = sourceOf(vd);
   const out = { ...response };
   const hours = src.ageMs != null ? Math.round(src.ageMs / 3600000) : null;
@@ -79,6 +111,12 @@ function withStaleAuthorityGuard(response, vd) {
     : { live: false, cached_age_hours: hours, note: 'Answered from a cached profile — the subject\'s device could not be reached.' };
   if (src.live) return out;
   if (!EXPANDING_SIGNALS.has(String(response?.signal))) return out;
+  if (!ruleDecided) return out;
+  if (leeway) {
+    out.profile_source.note = `Answered from a cached profile${hours != null ? ` about ${hours}h old` : ''}: the subject's standing ` +
+      `rule still applies to a reversible, lower-stakes action from a copy up to ${RULE_FRESH_DAYS} days old.`;
+    return out;
+  }
 
   out.signal = 'escalate';
   out.authorization_matched = false;
@@ -334,7 +372,7 @@ server.registerTool(
       // profile with no downgrade and no provenance. That is the 2026-07-25 device defect (a
       // revoked $500 grant honoured from a 22h cache) still live on the paths that matter most.
       const raw = await resolveConsultation(vd, args || {}, CONSULT_OPTS);
-      const response = withStaleAuthorityGuard(raw, vd);
+      const response = withStaleAuthorityGuard(raw, vd, await guardFacts(vd, args || {}));
       // Provenance for the local audit receipt only — the cues that drove this
       // (never in `response`; §10.4). Best-effort: a failure must not block the answer.
       let drivers = [];
@@ -411,7 +449,7 @@ server.registerTool(
       // deterministic pre-flight is a resolution and produces a receipt."
       const preGuard = checkAuthorization(vd, req, CONSULT_OPTS);
       const matchedPreGuard = preGuard.authorization_matched === true;
-      const response = withStaleAuthorityGuard(preGuard, vd);
+      const response = withStaleAuthorityGuard(preGuard, vd, await guardFacts(vd, req, matchedPreGuard));
       // A matched pre-flight IS a resolved decision (the authorization fired) →
       // receipt. A no-match is not a decision — no receipt (keeps the store from
       // filling with probes; the follow-up phaedo_consult writes its own).
@@ -550,7 +588,7 @@ server.registerTool(
       // and then told the agent the signal was not blocking — i.e. "just proceed", and never
       // wake the subject, on authority that may have been revoked hours earlier.
       const raw = await resolveConsultation(vd, req, CONSULT_OPTS);
-      const response = withStaleAuthorityGuard(raw, vd);
+      const response = withStaleAuthorityGuard(raw, vd, await guardFacts(vd, req));
       let drivers = [];
       try { drivers = withRevision(consultDrivers(vd, req, CONSULT_OPTS), raw); } catch { /* non-critical */ }
       const escReceiptId = await emitReceipt('phaedo_escalate', req, response, drivers);   // the decision being escalated

package/server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.phaedo-labs/phaedo-mcp",
   "description": "Make AI apps answer your way, check with you before acting, and get approvals on your phone.",
-  "version": "0.3.16",
+  "version": "0.3.19",
   "repository": {
     "url": "https://github.com/phaedo-labs/phaedo-mcp",
     "source": "github",
@@ -13,7 +13,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "phaedo-mcp",
-      "version": "0.3.16",
+      "version": "0.3.19",
       "transport": {
         "type": "stdio"
       }