phaedo-mcp 0.3.16 → 0.3.21

package/cache.js

@@ -58,6 +58,17 @@ export async function clearCache(stateDir) {
   try { await rm(join(stateDir, 'cache.enc'), { force: true }); } catch { /* nothing to clear */ }
 }
 
+// When the at-rest copy was made (ms), without decrypting it; null when there is none. The phone
+// shows this age (receipts digest `copy_at`), so the subject can see the copy keeping up.
+export async function readCacheTime(stateDir) {
+  try {
+    const { cached_at } = JSON.parse(await readFile(join(stateDir, 'cache.enc'), 'utf8'));
+    return Number.isFinite(cached_at) && cached_at > 0 ? cached_at : null;
+  } catch {
+    return null;
+  }
+}
+
 // Decrypt the cache → { vault, cachedAt } or null (absent/corrupt/undecryptable
 // → treated as no cache, since it's recoverable from the phone).
 export async function readCache(stateDir) {

package/consult-core.js

@@ -15,7 +15,7 @@
 // abstain. Signals out, never structure out (§10.4).
 
 import { PhaedoError } from './errors.js';
-import { loadPolicies, applyPolicies, matchAuthorization } from './consult-policy.js';
+import { loadPolicies, applyPolicies, matchAuthorization, relaxingRuleApplies } from './consult-policy.js';
 import { normalizeActionBinding, isBound } from './action-binding.js';
 import { normalizeDomain, canonicalDomain } from './lib/domain.js';
 
@@ -914,6 +914,17 @@ export function resolveConsultationCore(vd, request = {}, opts = {}) {
 // importers (tests, spec/test-schemas.mjs) are unchanged.
 export const buildConsultationResponse = resolveConsultationCore;
 
+/**
+ * Does one of the subject's own RELAXING rules (a §10.5 `autoproceed` grant or a `bias_bold`)
+ * apply to this request? The server's stale-authority guard withholds an expanding answer from a
+ * cached profile only when this is true: a grant is revocable, and the copy may predate the
+ * revocation. Phaedo's inferred judgment carries no such risk and is left alone.
+ */
+export function standingRuleRelaxes(vd, request = {}, opts = {}) {
+  const n = normalizeRequest(request);
+  return relaxingRuleApplies(n, loadPolicies(vd, opts), policyCtx(opts));
+}
+
 // ── Deterministic-only authorization check (brief M3) ─────────────────────────
 // (vd, request[, opts]) -> a small, fixed-shape result. Checks ONLY standing
 // authorizations (§10.5 force rules) — it does NOT run inferred evaluation, so it is

package/consult-policy.js

@@ -446,6 +446,15 @@ function agentScopeSatisfied(rule, clientId) {
   return scope.includes(clientId);                         // [] matches nobody, by design
 }
 
+// Does any RELAXING rule (autoproceed / bias_bold) apply to this request — active, in scope,
+// matched and bound? The stale-authority guard keys on this: an answer that rests on one of the
+// subject's own revocable grants must not be acted on from a copy that may predate a revocation.
+export function relaxingRuleApplies(n, policies, { now = Date.now(), clientId = null } = {}) {
+  if (!policies || !policies.length || !n || n.type === 'voice_draft') return false;
+  return policies.some((r) => RELAXING.has(r.effect) && ruleActive(r, now) && agentScopeSatisfied(r, clientId)
+    && ruleMatches(r, n) && bindingSatisfied(r, n));
+}
+
 // Did a rule match on its own terms and get held back ONLY by the binding gate?
 // Worth reporting: otherwise an agent whose standing auto-proceed rule silently
 // stops firing has no way to learn that it needs to send an action_binding.

package/consult-runtime.js

@@ -9,7 +9,7 @@
 import { join } from 'path';
 import { configDir } from './lib/config-dir.js';
 import { readFileSync, existsSync } from 'fs';
-import { loadFingerprint, loadFingerprintPreferCache } from './fingerprint-source.js';
+import { loadFingerprint, loadFingerprintPreferCache, carrySource } from './fingerprint-source.js';
 import { readServingClientId } from './phone-source.js';
 import { consultOptsFromEnv, deriveDelegationSignals, withDelegationSignals, authoredDelegationSignals } from './consult.js';
 import { defaultStateDir } from './cache.js';
@@ -43,17 +43,26 @@ export function buildConsultOpts(baseDir, env = process.env, { warn = (m) => pro
 // origin-aware resolver then lets a `delegation` correction outrank a `self` signal on
 // the same dimension. Best-effort — if receipts are unreadable, the consult still
 // answers from the plain fingerprint (delegation learning never breaks a consultation).
-export async function loadConsultVd(baseDir, { preferCache = false, warn = (m) => process.stderr.write(m) } = {}) {
+//
+// `onRead(vd)` sees the plain read BEFORE the overlay. The overlay is a spread copy, and the
+// read's provenance (fingerprint-source.js SOURCE) is a non-enumerable marker a spread drops —
+// so `sourceOf()` on the RETURNED profile always says "live". A caller that needs the copy's
+// real age (the ship hook's standing-rule gate) must take it here.
+export async function loadConsultVd(baseDir, { preferCache = false, warn = (m) => process.stderr.write(m), onRead } = {}) {
   // preferCache (escalation, ship hook): read the at-rest cache instead of a live phone
   // pull, so the caller doesn't add a fingerprint-read AUTHORIZE prompt on the phone.
   const vd = preferCache ? await loadFingerprintPreferCache(baseDir) : await loadFingerprint(baseDir);
+  if (onRead) onRead(vd);
   try {
     // Two delegation sources, both origin-aware: live override history (every override)
     // + the subject's ENDORSED, portable delegation rules (authored_delegation). The
     // authored rule thus shapes consult too, not only the §9 injection it already renders in.
     const signals = deriveDelegationSignals(await readReceipts(defaultStateDir()))
       .concat(authoredDelegationSignals(vd && vd.phaedo_fingerprint));
-    return withDelegationSignals(vd, signals);
+    // The overlay is a spread COPY and the read's provenance is a non-enumerable marker, so it
+    // must be carried across — without it every cached read looked live and the server's
+    // stale-authority guard never engaged on phaedo_consult / phaedo_escalate (found 2026-10-31).
+    return carrySource(vd, withDelegationSignals(vd, signals));
   } catch (e) {
     warn(`[phaedo-mcp] delegation derive skipped (consult unaffected): ${e.message}\n`);
     return vd;

package/consult.js

@@ -13,7 +13,7 @@ import { buildInjectionResponse } from './projection.js';
 import { loadPolicies, applyPolicies } from './consult-policy.js';
 import { PhaedoError } from './errors.js';
 import {
-  resolveConsultationCore, buildConsultationResponse, checkAuthorization, normalizeRequest,
+  resolveConsultationCore, buildConsultationResponse, checkAuthorization, standingRuleRelaxes, normalizeRequest,
   shape, SIGNALS, CONSULTATION_TYPES, validateVaultShape, consultDrivers,
   deriveDelegationSignals, withDelegationSignals, buildDelegationPromotions, DELEGATION_PROMOTION_FLOOR,
   authoredDelegationSignals,
@@ -22,7 +22,7 @@ import {
 
 // Re-export the core surface so existing importers (server.js, tests,
 // spec/test-schemas.mjs) keep their `from './consult.js'` paths.
-export { CONSULTATION_TYPES, buildConsultationResponse, resolveConsultationCore, checkAuthorization, validateVaultShape, consultDrivers, deriveDelegationSignals, withDelegationSignals, buildDelegationPromotions, DELEGATION_PROMOTION_FLOOR, authoredDelegationSignals };
+export { CONSULTATION_TYPES, buildConsultationResponse, resolveConsultationCore, checkAuthorization, standingRuleRelaxes, validateVaultShape, consultDrivers, deriveDelegationSignals, withDelegationSignals, buildDelegationPromotions, DELEGATION_PROMOTION_FLOOR, authoredDelegationSignals };
 
 // ── Model resolver (richest fingerprint, LOCAL compute — opt-in) ──────────────
 // When a local model is configured (PHAEDO_CONSULT_MODEL + an Ollama/OpenAI-

package/fingerprint-source.js

@@ -15,6 +15,7 @@ import { resolve, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { hasPairingRecord, loadPairingRecord, loadFingerprintFromPhone, PhoneError } from './phone-source.js';
 import { defaultStateDir, writeCache, readCache, clearCache } from './cache.js';
+import { maybeDrainProfileCopy } from './profile-inbox.js';
 import { foldLocalCapture, isLocalCaptureOwner, localCaptureSessionCount } from './capture-local.js';
 import { Capabilities, AuthoredSource } from './lib/phaedo-crypto.js';
 import { PhaedoError } from './errors.js';
@@ -256,6 +257,20 @@ export function sourceOf(vd) {
   return s || { live: true, cachedAt: null, ageMs: 0 };
 }
 
+/**
+ * Copy `from`'s provenance onto `to` (a derived copy of it) and return `to`. Any overlay that
+ * spreads the fingerprint MUST pass its result through this: an absent marker reads as LIVE,
+ * so a lost one makes a stale cached read look fresh to the stale-authority guard.
+ */
+export function carrySource(from, to) {
+  const s = from && from[SOURCE];
+  if (!s || !to || typeof to !== 'object' || to === from) return to;
+  try {
+    Object.defineProperty(to, SOURCE, { value: s, enumerable: false, configurable: true, writable: true });
+  } catch { /* frozen object — provenance is best-effort, never fatal */ }
+  return to;
+}
+
 // What the subject removed in `npm run learned` is taken out on EVERY read, so injection,
 // consult and the rules files all stop using it — even when the sessions keep showing it.
 // `unfiltered` is for that review screen alone, which has to list what was removed.
@@ -293,8 +308,11 @@ async function loadFingerprintUnfiltered(baseDir) {
         await clearCache(stateDir);
         throw err;
       }
+      // Phone unreachable → the copy the phone last pushed for us, if it is newer (profile-inbox.js),
+      // then the encrypted cache (may be stale).
+      await maybeDrainProfileCopy(async () => rec, stateDir);
       const cached = await readCache(stateDir);
-      if (cached) return stamp(foldConfigHome(normalizeIdentity(cached.vault)), cached); // phone unreachable → encrypted cache (may be stale)
+      if (cached) return stamp(foldConfigHome(normalizeIdentity(cached.vault)), cached);
       throw err;                        // no phone + no cache → cannot serve
     }
   }
@@ -357,6 +375,9 @@ async function loadFingerprintUnfiltered(baseDir) {
 // escalation in flight.
 export async function loadFingerprintPreferCache(baseDir, opts) {
   if (!process.env.PHAEDO_FINGERPRINT && hasPairingRecord(baseDir)) {
+    // The phone pushes a fresh copy whenever its app opens or the profile changes; take it first
+    // (throttled, fail-fast — this is the ship hook's path). See profile-inbox.js.
+    await maybeDrainProfileCopy(() => loadPairingRecord(baseDir), defaultStateDir());
     const cached = await readCache(defaultStateDir());
     if (cached) return forgetting(stamp(foldConfigHome(normalizeIdentity(cached.vault)), cached), opts);
   }

package/hooks/pre-ship.mjs

@@ -9,13 +9,24 @@
 // Phaedo before those run (ship-actions.js names them) and writes a §10.6 receipt, so the
 // receipts accumulate in normal use instead of waiting for an agent to remember a tool.
 //
-// WHAT IT MAY DO — ONE RULE. The hook only ever ADDS friction; it never removes it. It
-// never returns `allow`, so it cannot pre-approve anything Claude Code would otherwise
-// have asked about. On a permissive answer it returns no decision at all (Claude Code's
-// own permission flow applies unchanged); on a cautious one it returns `ask`, which puts
-// the action in front of the subject. That is why it reads the at-rest profile cache and
-// skips the server's stale-authority guard: the guard exists to stop a stale read from
-// EXPANDING autonomy, and nothing here can.
+// WHAT IT MAY DO. On a cautious answer it returns `ask`, which puts the action in front of
+// the subject. On a permissive answer it returns no decision (Claude Code's own permission
+// flow applies unchanged) — with ONE exception, since 0.3.17: it returns `allow` when the
+// subject's own standing rule decided the action (a §10.5 `autoproceed` authorization they
+// accepted on the phone — usually staged by §10.7 promotion). Every gate must hold
+// (standingGrantHeld): the authorization matched (unexpired, scoped to this client, bound
+// to this call); the action is reversible and not high; GitHub raised nothing; the profile
+// copy is at most GRANT_FRESH_DAYS old; and no "no" in that domain within GRANT_PUSHBACK_DAYS
+// (lib/rule-leeway.js — shared with the server).
+// Claude Code only — other agents' hooks never get the dependency.
+//
+// Why a cached read may apply a rule at all: the hook cannot read live (a live pull needs the
+// subject to approve on the phone, which would trade one prompt for another), and the
+// alternative is a rule that never fires. Bounded instead, by the same leeway the server's
+// stale-authority guard uses (lib/rule-leeway.js): the copy's age caps how long a rule withdrawn
+// on the phone can still act, and the pushback gate is a brake on THIS machine — one "no" stops
+// it at once. Outside that one case the hook reads the at-rest cache and skips the guard
+// because nothing it does can EXPAND autonomy.
 //
 // WHERE OUTCOMES COME FROM — SUBJECT-AUTHORED ONLY (§10.6 honesty rail). The one thing the
 // hook records itself is a yes the subject gave on a prompt, and it records that only on
@@ -50,6 +61,7 @@ import { execFile } from 'child_process';
 import { classifyShipCommand, classifyToolCall } from '../ship-actions.js';
 import { isMainModule } from '../lib/is-main.js';
 import { isDirectoryEdition } from '../lib/config-dir.js';
+import { ruleLeeway, RULE_FRESH_DAYS, RULE_PUSHBACK_DAYS } from '../lib/rule-leeway.js';
 
 const MCP_DIR = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -82,6 +94,31 @@ export const STALE_PROFILE_DAYS = 14;
 const DAY_MS = 24 * 60 * 60 * 1000;
 const PENDING_TTL_MS = DAY_MS;
 
+// The copy's age and the "one no pauses it" window — the SAME leeway the server's stale guard
+// gives a rule (lib/rule-leeway.js), so a merge and a direct consult can't disagree.
+export const GRANT_FRESH_DAYS = RULE_FRESH_DAYS;
+export const GRANT_PUSHBACK_DAYS = RULE_PUSHBACK_DAYS;
+
+/**
+ * May the subject's standing rule answer this prompt? PURE. Returns { ok: true } or
+ * { ok: false, why } where `why` is one of: no_rule | raised | not_reversible | high |
+ * magnitude_unstated | priced | stale | pushback.
+ * `auth` is checkAuthorization's result; `source` is the profile read's provenance (sourceOf).
+ */
+export function standingGrantHeld({ auth, descriptor, raised, source, receipts, now }) {
+  if (!auth?.authorization_matched || auth.signal !== 'proceed') return { ok: false, why: 'no_rule' };
+  if (raised) return { ok: false, why: 'raised' };
+  return ruleLeeway({ source, descriptor, receipts, now });
+}
+
+// What the agent is told when the subject's rule answered the prompt.
+export function grantContext(receiptId) {
+  return `This ran without a confirmation prompt: the user's own standing rule in Phaedo covers it ` +
+    `(routine, reversible). Tell them in one line that it went ahead under their rule. If they object, ` +
+    `call phaedo_record_outcome with receipt_id ${receiptId} and "rejected" (or "modified") — one ` +
+    `"no" pauses the rule on this computer.`;
+}
+
 // The caller label on the receipt. `via` stays `phaedo_consult` — the hook runs a full
 // consultation through the same path, and the receipt schema's `via` enum is closed — so
 // the free-text, self-asserted `agent_id` is where "this came from the ship hook" lives.
@@ -291,8 +328,8 @@ export function unpromptedContext(receiptId) {
 
 export function staleContext(days, mcpDir) {
   return `Also: Phaedo's copy of the user's profile is ${days} days old (their phone has not been ` +
-    `reached since). Mention once, in one line, that they can refresh it by running ` +
-    `\`cd ${mcpDir} && npm run pull\` and approving on their phone.`;
+    `reached since). Mention once, in one line, that opening the Phaedo app on their phone refreshes ` +
+    `it within minutes, or they can run \`cd ${mcpDir} && npm run pull\` and approve on their phone.`;
 }
 
 /**
@@ -373,29 +410,42 @@ export async function runShipHook(input, deps) {
     };
     const { response, drivers, source } = await deps.consult(request);
     const signal = String(response?.signal || '');
+    const asked = ASKING_SIGNALS.has(signal);
+    // The one way this hook removes a prompt: the subject's own standing rule (see header).
+    let grant = null;
+    if (!asked && signal === 'proceed' && deps.standingGrant) {
+      try { grant = await deps.standingGrant(request, { raised, now }); } catch { grant = null; }
+    }
+    const granted = grant?.ok === true;
     // Provenance: what the hook saw, beside what drove the answer. Local receipt only.
     const extra = [];
     if (ci) extra.push({ cue: 'ciState', value: ci, confidence: null, basis: ci === 'unknown' ? null : 'observed' });
     if (ci && deps.prFacts) extra.push({ cue: 'diffStakes', value: stakesValue(stakes), confidence: null, basis: stakes ? 'observed' : null });
-    const allDrivers = extra.length ? [...(drivers || []), ...extra] : drivers;
+    // First, not last: buildReceipt keeps only the first 16 drivers, and the weekly summary on the
+    // phone counts this one ("your standing rule decided N of them", weekly.js).
+    const lead = grant ? [{ cue: 'standingGrant', value: granted ? 'answered' : `held:${grant.why}`, confidence: null, basis: 'observed' }] : [];
+    const allDrivers = (extra.length || lead.length) ? [...lead, ...(drivers || []), ...extra] : drivers;
     const receiptId = await deps.writeReceipt({ request, response, drivers: allDrivers });
     if (!receiptId) return null;     // no receipt = nothing to learn from; stay out of the way
-    const asked = ASKING_SIGNALS.has(signal);
 
     const state = readState(deps.statePath);
     if (input.tool_use_id) {
       state.pending[input.tool_use_id] = {
         receipt_id: receiptId, cmd_hash: callHash(input), session_id: input.session_id || null,
-        asked, prompt_shown: false, at: new Date(now).toISOString(),
+        asked, granted, prompt_shown: false, at: new Date(now).toISOString(),
       };
     }
-    let context = preContext({
-      summary: ship.summary, signal, receiptId, asked, recordsNo: Boolean(deps.readTranscript),
-      hint: typeof response?.rationale_hint === 'string' ? response.rationale_hint : '',
-    });
+    let context = granted
+      ? `Phaedo was consulted before this action (${ship.summary}) and answered "${signal}". receipt_id: ${receiptId}. ${grantContext(receiptId)}`
+      : preContext({
+        summary: ship.summary, signal, receiptId, asked, recordsNo: Boolean(deps.readTranscript),
+        hint: typeof response?.rationale_hint === 'string' ? response.rationale_hint : '',
+      });
     if (raised) context += ` GitHub shows ${why}, so Phaedo treated this merge as high-stakes.`;
     const ageDays = source && source.live === false && Number.isFinite(source.ageMs) ? Math.floor(source.ageMs / DAY_MS) : 0;
-    if (ageDays >= STALE_PROFILE_DAYS && !(now - Date.parse(state.stale_noted_at) < DAY_MS)) {
+    // A rule held back only by the copy's age is worth a refresh nudge before the general one.
+    const staleNudge = ageDays >= STALE_PROFILE_DAYS || grant?.why === 'stale';
+    if (staleNudge && !(now - Date.parse(state.stale_noted_at) < DAY_MS)) {
       context += ' ' + staleContext(ageDays, deps.mcpDir || MCP_DIR);
       state.stale_noted_at = new Date(now).toISOString();
     }
@@ -404,6 +454,7 @@ export async function runShipHook(input, deps) {
       hookSpecificOutput: {
         hookEventName: 'PreToolUse',
         ...(asked ? { permissionDecision: 'ask', permissionDecisionReason: promptReason(signal, ship.summary, why, personalWhy(request.action_descriptor, response)) } : {}),
+        ...(granted ? { permissionDecision: 'allow', permissionDecisionReason: `Phaedo: your standing rule covers this (${ship.summary}).` } : {}),
         additionalContext: context,
       },
     };
@@ -452,24 +503,40 @@ export async function runShipHook(input, deps) {
 // `agentId` names the agent on the receipt; other agents' hooks (agent-hook.mjs) pass their own.
 export async function realDeps({ agentId = AGENT_ID, statePath } = {}) {
   const { loadConsultVd, buildConsultOpts } = await import('../consult-runtime.js');
-  const { resolveConsultation, consultDrivers, withRevision } = await import('../consult.js');
-  const { buildReceipt, appendReceipt, receiptsCapFromEnv } = await import('../receipts.js');
+  const { resolveConsultation, consultDrivers, withRevision, checkAuthorization } = await import('../consult.js');
+  const { buildReceipt, appendReceipt, receiptsCapFromEnv, readReceipts } = await import('../receipts.js');
   const { sourceOf } = await import('../fingerprint-source.js');
   const { defaultStateDir } = await import('../cache.js');
   const stateDir = defaultStateDir();
   const quiet = () => {};
   const opts = buildConsultOpts(MCP_DIR, process.env, { warn: quiet });
+  let consultedVd = null;            // the profile the consult read — the grant is checked against the same copy
+  let readSource = null;             // ...and how old that copy really is (taken before the overlay drops it)
   return {
     statePath: statePath || join(stateDir, 'ship-hook.json'),
     agentId,
     mcpDir: MCP_DIR,
     prFacts: (ship, cwd) => lookupPrFacts(ship, cwd),
+    // Only Claude Code's hook may answer a prompt; other agents' hooks never get this.
+    ...(agentId === AGENT_ID ? {
+      async standingGrant(request, { raised, now }) {
+        if (!consultedVd || !readSource) return { ok: false, why: 'no_rule' };
+        return standingGrantHeld({
+          auth: checkAuthorization(consultedVd, request, opts),
+          descriptor: request.action_descriptor, raised, source: readSource,
+          receipts: await readReceipts(stateDir), now,
+        });
+      },
+    } : {}),
     async consult(request) {
-      const vd = await loadConsultVd(MCP_DIR, { preferCache: true, warn: quiet });
+      const vd = await loadConsultVd(MCP_DIR, { preferCache: true, warn: quiet, onRead: (plain) => { readSource = sourceOf(plain); } });
+      consultedVd = vd;
       const response = await resolveConsultation(vd, request, opts);
       let drivers = [];
       try { drivers = withRevision(consultDrivers(vd, request, opts), response); } catch { /* provenance is non-critical */ }
-      return { response, drivers, source: sourceOf(vd) };
+      // The plain read's provenance — `sourceOf(vd)` on the overlay always says "live", which is
+      // also why the 14-day refresh nudge below never fired before 0.3.17.
+      return { response, drivers, source: readSource };
     },
     async writeReceipt({ request, response, drivers }) {
       const r = buildReceipt({ via: 'phaedo_consult', agentId, clientId: opts.clientId, request, response, drivers });

package/lib/rule-leeway.js

@@ -0,0 +1,56 @@
+// Phaedo — how far a CACHED profile copy may be trusted to apply one of the subject's own
+// relaxing rules (a §10.5 `autoproceed` grant or a `bias_bold`). One definition, shared by the
+// Claude Code ship hook (hooks/pre-ship.mjs) and the server's stale-authority guard (server.js),
+// so the two paths cannot drift apart again.
+//
+// THE RISK. A rule is revocable on the phone, and a revocation reaches this computer only with
+// the next live read. A cached copy may predate it — the 2026-07-25 incident, where a withdrawn
+// $500 payment permission kept working from a 22-hour-old copy. So by default a cached copy may
+// NOT apply a rule.
+//
+// THE LEEWAY (Randy, 2026-10-31: "align them"). A live read needs the subject to approve on the
+// phone, so "live only" means a rule almost never fires. For the cheap end of the risk, a cached
+// copy may apply the rule when ALL hold:
+//   - the action is reversible (stated `true`);
+//   - its magnitude is stated `low` or `medium` (never high, never unstated);
+//   - it moves no money (no `amount`) — every priced action stays live-only;
+//   - the copy is at most RULE_FRESH_DAYS old, which caps how long a withdrawn rule can act;
+//   - no rejected / modified outcome in that domain within RULE_PUSHBACK_DAYS — one "no" on
+//     this computer stops it at once, before the phone's revocation has arrived.
+// Anything else keeps the strict rule. PURE: no I/O, `now` injected.
+
+import { canonicalDomain, normalizeDomain } from './domain.js';
+
+export const RULE_FRESH_DAYS = 7;
+export const RULE_PUSHBACK_DAYS = 30;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const LEEWAY_MAGNITUDES = new Set(['low', 'medium']);
+// Receipts store the canonical domain; a request may carry an alias or other casing. Compare
+// canonical forms, so "code" and "engineering" are one class here as they are on the receipt.
+const domainKey = (x) => (typeof x === 'string' && x.trim() ? (canonicalDomain(x) || normalizeDomain(x) || '') : '');
+
+/**
+ * May a cached copy apply the subject's relaxing rule to this action?
+ * (source: sourceOf(read), descriptor: the request's action_descriptor, receipts, now)
+ * → { ok: true } | { ok: false, why } where why ∈ not_reversible | high | magnitude_unstated | priced
+ *   | stale | pushback.
+ * The age gate applies only to a cached read; every other gate applies to any read.
+ */
+export function ruleLeeway({ source, descriptor, receipts, now = Date.now() } = {}) {
+  const d = descriptor && typeof descriptor === 'object' ? descriptor : {};
+  if (d.reversible !== true) return { ok: false, why: 'not_reversible' };
+  const mag = typeof d.magnitude === 'string' ? d.magnitude.toLowerCase() : null;
+  if (!LEEWAY_MAGNITUDES.has(mag)) return { ok: false, why: mag === 'high' ? 'high' : 'magnitude_unstated' };
+  if (d.amount != null) return { ok: false, why: 'priced' };
+  if (source && source.live === false && !(Number.isFinite(source.ageMs) && source.ageMs <= RULE_FRESH_DAYS * DAY_MS)) {
+    return { ok: false, why: 'stale' };
+  }
+  const domain = domainKey(d.domain);
+  const since = now - RULE_PUSHBACK_DAYS * DAY_MS;
+  const pushback = (Array.isArray(receipts) ? receipts : []).some((r) =>
+    (r?.user_action === 'rejected' || r?.user_action === 'modified')
+    && domainKey(r?.request?.action_descriptor?.domain) === domain
+    && Date.parse(r?.user_action_at || r?.created_at) >= since);
+  if (pushback) return { ok: false, why: 'pushback' };
+  return { ok: true };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phaedo-mcp",
-  "version": "0.3.16",
+  "version": "0.3.21",
   "private": false,
   "license": "Apache-2.0",
   "type": "module",
@@ -36,6 +36,7 @@
     "server.js",
     "server.json",
     "fingerprint-source.js",
+    "profile-inbox.js",
     "projection.js",
     "errors.js",
     "consult.js",
@@ -100,7 +101,7 @@
     "unsetup": "node install.mjs --uninstall",
     "pair": "node pair.js",
     "pull": "node pull.js",
-    "test": "node test-smoke.mjs && node test-no-profile.mjs && node test-phone-boundary.mjs && node test-cache.mjs && node test-pairing.mjs && node test-revoke.mjs && node test-install.mjs && node test-consult.mjs && node test-consult-policy.mjs && node test-amount-bands.mjs && node test-resolver-revision.mjs && node test-ship-actions.mjs && node test-ship-hook.mjs && node test-ship-readout.mjs && node test-action-binding.mjs && node test-autonomy-promotion.mjs && node test-ap2.mjs && node test-delegation-sync.mjs && node test-delegation-relay.mjs && node test-capture-sync.mjs && node test-capture-hook.mjs && node test-stop-capture.mjs && node test-capture-local.mjs && node test-capture-a11y.mjs && node test-vendored-capture.mjs && node test-escalation.mjs && node test-domain.mjs && node test-receipts.mjs && node test-receipts-sync.mjs && node test-agreement.mjs && node test-weekly.mjs && node test-asks.mjs && node test-precedent.mjs && node test-rules-files.mjs && node test-agent-hook.mjs && node test-learned.mjs && node test-history-import.mjs && node test-calibration.mjs && node test-identity.mjs && node test-signing.mjs && node test-sign-request.mjs && node test-signing-audit.mjs && node test-delegation-domain-fragmentation.mjs && node test-stale-authority.mjs && node test-config-home-fold.mjs && node test-precedence-and-ceiling.mjs && node test-package-closure.mjs && node test-plugin.mjs",
+    "test": "node test-smoke.mjs && node test-no-profile.mjs && node test-phone-boundary.mjs && node test-cache.mjs && node test-profile-inbox.mjs && node test-pairing.mjs && node test-revoke.mjs && node test-install.mjs && node test-consult.mjs && node test-consult-policy.mjs && node test-amount-bands.mjs && node test-resolver-revision.mjs && node test-ship-actions.mjs && node test-ship-hook.mjs && node test-ship-readout.mjs && node test-action-binding.mjs && node test-autonomy-promotion.mjs && node test-ap2.mjs && node test-delegation-sync.mjs && node test-delegation-relay.mjs && node test-capture-sync.mjs && node test-capture-hook.mjs && node test-stop-capture.mjs && node test-capture-local.mjs && node test-capture-a11y.mjs && node test-vendored-capture.mjs && node test-escalation.mjs && node test-domain.mjs && node test-receipts.mjs && node test-receipts-sync.mjs && node test-agreement.mjs && node test-weekly.mjs && node test-asks.mjs && node test-precedent.mjs && node test-rules-files.mjs && node test-agent-hook.mjs && node test-learned.mjs && node test-history-import.mjs && node test-calibration.mjs && node test-identity.mjs && node test-signing.mjs && node test-sign-request.mjs && node test-signing-audit.mjs && node test-delegation-domain-fragmentation.mjs && node test-stale-authority.mjs && node test-config-home-fold.mjs && node test-precedence-and-ceiling.mjs && node test-package-closure.mjs && node test-plugin.mjs",
     "receipts": "node receipts.js list",
     "agreement": "node agreement.js",
     "ship-readout": "node ship-readout.js",

package/profile-inbox.js

@@ -0,0 +1,114 @@
+// The phone's pushed profile copy (relay lane `profile_to_agent/<client_id>`, 2026-11-02).
+//
+// The live read (phone-source.js) needs the phone's LAN server up and a Face ID tap, so on the
+// reference Mac it almost never completed and the at-rest copy went days stale — past the 7 days
+// a standing rule may run on (lib/rule-leeway.js). The phone now leaves a fresh copy for this
+// agent whenever its app comes to the foreground or the profile changes (mobile
+// agentProfile.js / agentProfilePush.ts), sealed under this agent's own fp_sync_key. Here we pick
+// it up and make it the at-rest copy.
+//
+// What keeps this safe:
+//   - It refreshes the CACHE only. A pushed copy is never "live" (sourceOf stays live:false), so
+//     the stale-authority guard and the rule leeway treat it exactly as they treat any cache.
+//   - Its age is the PHONE's `generated_at`, not when we drained it, so a copy that sat on the
+//     relay for days is days old here too. A time in the future is clamped to now.
+//   - Newest wins: a copy no newer than the one we hold is ignored, so the relay cannot roll the
+//     profile back to before a rule was removed by replaying an older deposit.
+//   - Sealed + tagged: only this agent's pair key opens it, and `kind: 'agent_profile'` stops
+//     anything else sealed under that key (our own receipts digest) being read as a profile.
+//
+// Best-effort and throttled (CHECK_GAP_MS, shared across processes through a small state file,
+// since the ship hook runs as a fresh process per tool call): a relay failure leaves the copy we
+// have and never fails the read that asked.
+
+import { readFile, writeFile, mkdir } from 'fs/promises';
+import { join } from 'path';
+import { Phaedo, b64uDec } from './lib/phaedo-crypto.js';
+import { readCache, writeCache } from './cache.js';
+import { toVaultPayload } from './phone-source.js';
+import { relayBaseFromEnv } from './receipts-sync.js';
+
+const { Kdf, Envelope } = Phaedo;
+export const AGENT_PROFILE_KIND = 'agent_profile';
+export const CHECK_GAP_MS = 10 * 60 * 1000;
+const SEGMENT_RE = /^[A-Za-z0-9_.-]{1,128}$/;   // relay/mailbox.js LANE_SUB_RE
+const STATE_FILE = 'profile-inbox.json';
+const TIMEOUT_MS = 3000;                         // on the ship hook's path: fail fast
+
+/** Open a pushed copy → { vault, generatedAt } or null (wrong key, wrong kind, malformed). */
+export async function parseAgentProfileDeposit(pairKeyB64u, envelope) {
+  if (!envelope || !pairKeyB64u) return null;
+  const pairKey = b64uDec(pairKeyB64u);
+  let key;
+  try { key = await Kdf.deriveFpSyncKey(pairKey); } finally { pairKey.fill(0); }
+  try {
+    const plaintext = await Envelope.unwrap(envelope, key);
+    let inner;
+    try { inner = JSON.parse(new TextDecoder().decode(plaintext)); } finally { if (plaintext.fill) plaintext.fill(0); }
+    if (!inner || inner.kind !== AGENT_PROFILE_KIND || !inner.data || typeof inner.data !== 'object') return null;
+    const generatedAt = Date.parse(inner.generated_at);
+    if (!Number.isFinite(generatedAt)) return null;
+    return { vault: toVaultPayload(inner), generatedAt };
+  } catch {
+    return null;
+  } finally {
+    if (key && key.fill) key.fill(0);
+  }
+}
+
+/** Should a pushed copy replace the cache? Only a strictly newer one. Returns the time to stamp. */
+export function acceptCopy(generatedAt, cachedAt, now = Date.now()) {
+  if (!Number.isFinite(generatedAt)) return null;
+  const at = Math.min(generatedAt, now);         // a phone clock ahead of ours cannot buy freshness
+  if (Number.isFinite(cachedAt) && at <= cachedAt) return null;
+  return at;
+}
+
+/**
+ * Fetch this agent's pushed copy and, when it is newer than the cache, make it the cache.
+ * → { updated: true, generatedAt } | { updated: false, reason }.
+ */
+export async function drainProfileCopy(pairing, stateDir, deps = {}) {
+  const fetchFn = deps.fetch || globalThis.fetch;
+  const now = deps.now ? deps.now() : Date.now();
+  if (!pairing || !pairing.pair_key) return { updated: false, reason: 'unpaired' };
+  if (!pairing.relay_device_id) return { updated: false, reason: 'no-relay-device-id' };
+  if (typeof pairing.client_id !== 'string' || !SEGMENT_RE.test(pairing.client_id)) return { updated: false, reason: 'no-client-id' };
+  try {
+    const url = `${deps.relayBase || relayBaseFromEnv()}/fp-mailbox/${encodeURIComponent(pairing.relay_device_id)}/profile_to_agent/${pairing.client_id}`;
+    const authHeader = pairing.relay_device_secret
+      ? { Authorization: `Bearer ${pairing.relay_device_id}:${pairing.relay_device_secret}` }
+      : {};
+    const res = await fetchFn(url, { method: 'GET', headers: authHeader, signal: AbortSignal.timeout(deps.timeoutMs || TIMEOUT_MS) });
+    // 404 = nothing pushed yet; 400 = a relay that predates the lane.
+    if (!res || !res.ok) return { updated: false, reason: `http-${res && res.status}` };
+    const body = await res.json().catch(() => null);
+    const copy = await parseAgentProfileDeposit(pairing.pair_key, body && body.envelope);
+    if (!copy) return { updated: false, reason: 'unreadable' };
+    const cached = await readCache(stateDir);
+    const at = acceptCopy(copy.generatedAt, cached ? Number(cached.cachedAt) : NaN, now);
+    if (at == null) return { updated: false, reason: 'not-newer' };
+    await writeCache(stateDir, copy.vault, at);
+    return { updated: true, generatedAt: at };
+  } catch (e) {
+    return { updated: false, reason: String(e && e.message || e) };
+  }
+}
+
+/** Throttled `drainProfileCopy`: at most once per CHECK_GAP_MS across every process on this Mac. */
+export async function maybeDrainProfileCopy(loadPairing, stateDir, deps = {}) {
+  const now = deps.now ? deps.now() : Date.now();
+  const path = join(stateDir, STATE_FILE);
+  try {
+    const last = Number(JSON.parse(await readFile(path, 'utf8'))?.checked_at);
+    if (Number.isFinite(last) && now >= last && now - last < CHECK_GAP_MS) return { updated: false, reason: 'recent' };
+  } catch { /* first check, or an unreadable file: check now */ }
+  try {
+    await mkdir(stateDir, { recursive: true, mode: 0o700 });
+    // Claimed BEFORE the request, so the processes that start together do not all ask.
+    await writeFile(path, JSON.stringify({ checked_at: now }), { mode: 0o600 });
+  } catch { /* a read-only state dir still gets its check */ }
+  let pairing = null;
+  try { pairing = await loadPairing(); } catch { return { updated: false, reason: 'unpaired' }; }
+  return drainProfileCopy(pairing, stateDir, deps);
+}

package/pull.js

@@ -58,7 +58,8 @@ loadFingerprint(BASE_DIR)
       `⚠ Could NOT reach your phone — served a CACHED copy${hours != null ? ` about ${hours}h old` : ''} ` +
       `(fingerprint ${fp.fingerprint_id || '(no id)'}, ${layers} layer(s)).\n` +
       `  Anything you changed since then — including a revoked authorization — is NOT reflected.\n` +
-      `  Open Phaedo on your phone and approve the card, then run this again.\n`
+      `  Opening Phaedo on your phone sends this computer a fresh copy (picked up within 10 minutes);\n` +
+      `  to read it live instead, keep the app open, approve the card, and run this again.\n`
     );
     process.stdout.write(await week() + review(vd));
     process.exit(2);                       // distinct from 1 (hard failure) — stale, not broken

package/receipts-sync.js

@@ -78,7 +78,7 @@ function digestFields(r) {
 // Pure-crypto: take the local receipts list, build a §10.4-safe digest of the most
 // recent `cap` entries, and seal it under fp_sync_key. Returns `{ envelope }` — the
 // same shape `agent_to_ext` (delegation-sync) uses, so the relay's mailbox accepts it.
-export async function buildReceiptsDeposit(pairKeyB64u, receipts, { cap = DIGEST_CAP, now = () => new Date().toISOString() } = {}) {
+export async function buildReceiptsDeposit(pairKeyB64u, receipts, { cap = DIGEST_CAP, now = () => new Date().toISOString(), copyAt = null } = {}) {
   const list = Array.isArray(receipts) ? receipts : [];
   // Most-recent N (receipts are append-only, ordered by creation in the store).
   const head = list.slice(-cap).map(digestFields).filter(Boolean);
@@ -100,7 +100,12 @@ export async function buildReceiptsDeposit(pairKeyB64u, receipts, { cap = DIGEST
     // plus the sentence the MCP already shows in /phaedo:status, so both surfaces say the same.
     const w = weeklyHandled(list, { now: Number.isFinite(agreementAt) ? agreementAt : Date.now() });
     const week = { ...w, summary: formatWeekly(w) };
-    const inner = { kind: 'receipts_digest', data: { receipts: head, agreement, week, generated_at: generatedAt } };
+    // How fresh this computer's profile copy is (cache.js readCacheTime), so the phone can show it.
+    // Omitted when there is no copy; never later than this digest.
+    const copy = Number.isFinite(copyAt) && copyAt > 0
+      ? { copy_at: new Date(Math.min(copyAt, Number.isFinite(agreementAt) ? agreementAt : Date.now())).toISOString() }
+      : {};
+    const inner = { kind: 'receipts_digest', data: { receipts: head, agreement, week, generated_at: generatedAt, ...copy } };
     const plaintext = new TextEncoder().encode(JSON.stringify(inner));
     const envelope = await Envelope.wrap(plaintext, fpSyncKey, { artifact_kind: 'receipts_digest', created_at: now() });
     plaintext.fill(0);

package/server.js

@@ -28,8 +28,10 @@ import { buildIntentMandatePayload } from './ap2.js';
 import { depositSignRequest, pollSignOnce } from './signing-request.js';
 import { buildSigningAuditRecord, appendSigningAudit } from './signing-audit.js';
 import { buildInjectionResponse, errorResponse, PhaedoError } from './projection.js';
-import { resolveConsultation, checkAuthorization, CONSULTATION_TYPES, consultDrivers, withRevision } from './consult.js';
-import { defaultStateDir } from './cache.js';
+import { resolveConsultation, checkAuthorization, standingRuleRelaxes, CONSULTATION_TYPES, consultDrivers, withRevision } from './consult.js';
+import { defaultStateDir, readCacheTime } from './cache.js';
+import { ruleLeeway, RULE_FRESH_DAYS } from './lib/rule-leeway.js';
+import { standingRuleDriver } from './weekly.js';
 import { buildConsultOpts, loadConsultVd } from './consult-runtime.js';
 import { buildReceipt, appendReceipt, receiptsCapFromEnv, readReceipts, markOutcome, USER_ACTIONS } from './receipts.js';
 
@@ -65,12 +67,50 @@ async function emitReceipt(via, args, response, drivers) {
 const EXPANDING_SIGNALS = new Set(['proceed', 'autoproceed', 'bias_bold']);
 
 /**
- * Downgrade an authority-EXPANDING answer that was computed from a stale (cached) read.
- * Returns the response unchanged for a live read, or for any answer that already defers.
+ * Downgrade an authority-EXPANDING answer that was computed from a stale (cached) read AND rests
+ * on one of the subject's own relaxing rules (`ruleDecided`). Returns the response unchanged for a
+ * live read, for any answer that already defers, and for Phaedo's inferred judgment.
  * Always annotates provenance so the caller can SAY where the answer came from — the
  * silence is what let a stale "you're authorized" go unnoticed for a day.
+ *
+ * RULES ONLY (Randy's decision, 2026-10-31). The danger a cached copy carries is a REVOKED GRANT
+ * (the 2026-07-25 $500 payment). An inferred "proceed" is a reading of the subject's disposition,
+ * not a revocable permission. Guarding it too would turn nearly every consult into an ask, since
+ * the phone is rarely reachable. The question only arose because this guard had never engaged on
+ * consult/escalate: the overlay dropped the provenance marker (carrySource fixes that).
+ *
+ * THE LEEWAY (Randy, 2026-10-31: "align them"). `leeway` = lib/rule-leeway.js said the cached copy
+ * may still apply the rule: reversible, stated low/medium, no money, copy ≤ RULE_FRESH_DAYS old,
+ * no recent "no" in the domain — the same test the Claude Code ship hook applies before it
+ * answers a prompt, so a merge and a direct consult give the same answer. Anything outside it
+ * (a payment, an irreversible or high-stakes action, an older copy) is withheld as before.
  */
-function withStaleAuthorityGuard(response, vd) {
+// Can't tell → treat it as rule-decided, so the guard applies (fail closed).
+function ruleRelaxes(vd, req) {
+  try { return standingRuleRelaxes(vd, req, CONSULT_OPTS); } catch { return true; }
+}
+
+// What the guard needs to know about this request, in one place for all three tools. The leeway
+// is only worked out for a cached copy (a live read is never withheld); can't tell → no leeway.
+async function guardFacts(vd, req, ruleDecided = ruleRelaxes(vd, req)) {
+  const src = sourceOf(vd);
+  if (src.live || !ruleDecided) return { ruleDecided };
+  try {
+    const receipts = await readReceipts(defaultStateDir());
+    return { ruleDecided, leeway: ruleLeeway({ source: src, descriptor: req?.action_descriptor, receipts, now: Date.now() }).ok };
+  } catch {
+    return { ruleDecided, leeway: false };
+  }
+}
+
+// The receipt's note that one of the subject's standing rules let this go ahead (weekly.js counts
+// it for the phone). First in the list, since buildReceipt keeps only the first 16 drivers.
+function ruleAnsweredDriver(vd, req, response) {
+  if (response?.signal !== 'proceed') return [];
+  try { return standingRuleDriver(checkAuthorization(vd, req, CONSULT_OPTS), response); } catch { return []; }
+}
+
+function withStaleAuthorityGuard(response, vd, { ruleDecided = true, leeway = false } = {}) {
   const src = sourceOf(vd);
   const out = { ...response };
   const hours = src.ageMs != null ? Math.round(src.ageMs / 3600000) : null;
@@ -79,6 +119,12 @@ function withStaleAuthorityGuard(response, vd) {
     : { live: false, cached_age_hours: hours, note: 'Answered from a cached profile — the subject\'s device could not be reached.' };
   if (src.live) return out;
   if (!EXPANDING_SIGNALS.has(String(response?.signal))) return out;
+  if (!ruleDecided) return out;
+  if (leeway) {
+    out.profile_source.note = `Answered from a cached profile${hours != null ? ` about ${hours}h old` : ''}: the subject's standing ` +
+      `rule still applies to a reversible, lower-stakes action from a copy up to ${RULE_FRESH_DAYS} days old.`;
+    return out;
+  }
 
   out.signal = 'escalate';
   out.authorization_matched = false;
@@ -113,9 +159,11 @@ async function maybeDepositReceiptsDigest() {
     // AND "an existing receipt got marked" (so the next phone drain reflects the mark).
     const latest = receipts[receipts.length - 1];
     const tally = receipts.reduce((acc, r) => { acc[r.user_action ?? 'null'] = (acc[r.user_action ?? 'null'] || 0) + 1; return acc; }, {});
-    const sig = `${latest.receipt_id}|${JSON.stringify(tally)}`;
+    // The copy's time rides along, so a fresher copy alone is worth a new digest.
+    const copyAt = await readCacheTime(defaultStateDir());
+    const sig = `${latest.receipt_id}|${JSON.stringify(tally)}|${copyAt}`;
     if (sig === _lastReceiptsSig) return;
-    const res = await depositReceiptsDigest(await loadPairingRecord(BASE_DIR), receipts);
+    const res = await depositReceiptsDigest(await loadPairingRecord(BASE_DIR), receipts, { copyAt });
     if (res && res.deposited) _lastReceiptsSig = sig;
     else if (res && !res.deposited && res.reason !== 'no-receipts')
       process.stderr.write(`[phaedo-mcp] receipts digest deposit skipped: ${res.reason || 'http ' + res.status}\n`);
@@ -334,11 +382,12 @@ server.registerTool(
       // profile with no downgrade and no provenance. That is the 2026-07-25 device defect (a
       // revoked $500 grant honoured from a 22h cache) still live on the paths that matter most.
       const raw = await resolveConsultation(vd, args || {}, CONSULT_OPTS);
-      const response = withStaleAuthorityGuard(raw, vd);
+      const response = withStaleAuthorityGuard(raw, vd, await guardFacts(vd, args || {}));
       // Provenance for the local audit receipt only — the cues that drove this
       // (never in `response`; §10.4). Best-effort: a failure must not block the answer.
       let drivers = [];
       try { drivers = withRevision(consultDrivers(vd, args || {}, CONSULT_OPTS), raw); } catch { /* provenance is non-critical */ }
+      drivers = [...ruleAnsweredDriver(vd, args || {}, response), ...drivers];
       const receiptId = await emitReceipt('phaedo_consult', args, response, drivers); // every resolution, abstains included
       if (receiptId) response.receipt_id = receiptId;   // the handle for phaedo_record_outcome
       await maybeDepositDelegationPromotions(vd);                    // act-as-me promotion (best-effort)
@@ -411,12 +460,13 @@ server.registerTool(
       // deterministic pre-flight is a resolution and produces a receipt."
       const preGuard = checkAuthorization(vd, req, CONSULT_OPTS);
       const matchedPreGuard = preGuard.authorization_matched === true;
-      const response = withStaleAuthorityGuard(preGuard, vd);
+      const response = withStaleAuthorityGuard(preGuard, vd, await guardFacts(vd, req, matchedPreGuard));
       // A matched pre-flight IS a resolved decision (the authorization fired) →
       // receipt. A no-match is not a decision — no receipt (keeps the store from
       // filling with probes; the follow-up phaedo_consult writes its own).
       if (matchedPreGuard) {
-        const rid = await emitReceipt('phaedo_check_authorization', req, { signal: response.signal, confidence: 1.0, deference_level: 'high' });
+        const rid = await emitReceipt('phaedo_check_authorization', req, { signal: response.signal, confidence: 1.0, deference_level: 'high' },
+          ruleAnsweredDriver(vd, req, response));
         if (rid) response.receipt_id = rid;
         await maybeDepositReceiptsDigest();                          // G1+G2 audit channel — only on a matched preflight (no-match writes no receipt)
       }
@@ -550,9 +600,10 @@ server.registerTool(
       // and then told the agent the signal was not blocking — i.e. "just proceed", and never
       // wake the subject, on authority that may have been revoked hours earlier.
       const raw = await resolveConsultation(vd, req, CONSULT_OPTS);
-      const response = withStaleAuthorityGuard(raw, vd);
+      const response = withStaleAuthorityGuard(raw, vd, await guardFacts(vd, req));
       let drivers = [];
       try { drivers = withRevision(consultDrivers(vd, req, CONSULT_OPTS), raw); } catch { /* non-critical */ }
+      drivers = [...ruleAnsweredDriver(vd, req, response), ...drivers];
       const escReceiptId = await emitReceipt('phaedo_escalate', req, response, drivers);   // the decision being escalated
       await maybeDepositReceiptsDigest();                              // G1+G2 audit channel
 

package/server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.phaedo-labs/phaedo-mcp",
   "description": "Make AI apps answer your way, check with you before acting, and get approvals on your phone.",
-  "version": "0.3.16",
+  "version": "0.3.21",
   "repository": {
     "url": "https://github.com/phaedo-labs/phaedo-mcp",
     "source": "github",
@@ -13,7 +13,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "phaedo-mcp",
-      "version": "0.3.16",
+      "version": "0.3.21",
       "transport": {
         "type": "stdio"
       }

package/weekly.js

@@ -10,7 +10,10 @@
 //   came_to_you — Phaedo said check with you (escalate / clarify)
 //   unsure      — Phaedo didn't know (insufficient_signal); the agent fell back to its own default
 //
-// "Handled" is went_ahead + stopped. Pure over the receipts list; the CLI reads the local store.
+// "Handled" is went_ahead + stopped. `by_rule` is the part of went_ahead that one of the subject's
+// standing rules decided — the receipt carries a `standingRule` (server) or `standingGrant` (ship
+// hook) driver saying so — which is how they see a rule they accepted actually being used.
+// Pure over the receipts list; the CLI reads the local store.
 //
 //   npm run week
 
@@ -27,14 +30,30 @@ const BUCKET = {
   insufficient_signal: 'unsure',
 };
 
+// The driver cues that mean "a standing rule answered this" (server.js ruleAnsweredDriver,
+// hooks/pre-ship.mjs). A held grant is recorded as `held:<why>`, so only 'answered' counts.
+export const RULE_CUES = new Set(['standingRule', 'standingGrant']);
+export function answeredByRule(r) {
+  return Array.isArray(r?.drivers) && r.drivers.some((d) => RULE_CUES.has(d?.cue) && d?.value === 'answered');
+}
+
+/** The server's driver for a receipt a standing rule decided: an authorization that matched and
+ *  said go ahead, AND an answer that still says go ahead after the stale-authority guard — one the
+ *  guard withheld went to the subject instead, so the rule did not decide it. */
+export function standingRuleDriver(auth, response) {
+  return auth?.authorization_matched === true && auth.signal === 'proceed' && response?.signal === 'proceed'
+    ? [{ cue: 'standingRule', value: 'answered', confidence: 1, basis: 'authored' }] : [];
+}
+
 export function weeklyHandled(receipts, { now = Date.now(), days = WEEK_DAYS } = {}) {
   const since = now - days * DAY_MS;
-  const out = { days, went_ahead: 0, stopped: 0, came_to_you: 0, unsure: 0 };
+  const out = { days, went_ahead: 0, by_rule: 0, stopped: 0, came_to_you: 0, unsure: 0 };
   for (const r of Array.isArray(receipts) ? receipts : []) {
     const t = Date.parse(r?.created_at);
     if (!Number.isFinite(t) || t < since || t > now) continue;
     const b = BUCKET[r?.response?.signal];
     if (b) out[b]++;
+    if (b === 'went_ahead' && answeredByRule(r)) out.by_rule++;
   }
   out.handled = out.went_ahead + out.stopped;
   out.total = out.handled + out.came_to_you + out.unsure;
@@ -53,8 +72,9 @@ export function formatWeekly(w) {
     ? `This week Phaedo handled ${plural(w.handled, 'decision')} without interrupting you (${parts.join(', ')})`
     : 'This week Phaedo handled no decisions on its own';
   const asked = w.came_to_you ? ` and brought ${w.came_to_you} to you` : '';
+  const rule = w.by_rule ? ` Your standing rule decided ${w.handled === 1 ? 'it' : `${w.by_rule === 1 ? 'one' : w.by_rule} of them`}.` : '';
   const unsure = w.unsure ? ` ${w.unsure === 1 ? 'One more was' : `${w.unsure} more were`} too unclear to call.` : '';
-  return `${handled}${asked}.${unsure}`;
+  return `${handled}${asked}.${rule}${unsure}`;
 }
 
 if (isMainModule(import.meta.url)) {