phaedo-mcp 0.3.19 → 0.3.21

package/cache.js

@@ -58,6 +58,17 @@ export async function clearCache(stateDir) {
   try { await rm(join(stateDir, 'cache.enc'), { force: true }); } catch { /* nothing to clear */ }
 }
 
+// When the at-rest copy was made (ms), without decrypting it; null when there is none. The phone
+// shows this age (receipts digest `copy_at`), so the subject can see the copy keeping up.
+export async function readCacheTime(stateDir) {
+  try {
+    const { cached_at } = JSON.parse(await readFile(join(stateDir, 'cache.enc'), 'utf8'));
+    return Number.isFinite(cached_at) && cached_at > 0 ? cached_at : null;
+  } catch {
+    return null;
+  }
+}
+
 // Decrypt the cache → { vault, cachedAt } or null (absent/corrupt/undecryptable
 // → treated as no cache, since it's recoverable from the phone).
 export async function readCache(stateDir) {

package/fingerprint-source.js

@@ -15,6 +15,7 @@ import { resolve, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { hasPairingRecord, loadPairingRecord, loadFingerprintFromPhone, PhoneError } from './phone-source.js';
 import { defaultStateDir, writeCache, readCache, clearCache } from './cache.js';
+import { maybeDrainProfileCopy } from './profile-inbox.js';
 import { foldLocalCapture, isLocalCaptureOwner, localCaptureSessionCount } from './capture-local.js';
 import { Capabilities, AuthoredSource } from './lib/phaedo-crypto.js';
 import { PhaedoError } from './errors.js';
@@ -307,8 +308,11 @@ async function loadFingerprintUnfiltered(baseDir) {
         await clearCache(stateDir);
         throw err;
       }
+      // Phone unreachable → the copy the phone last pushed for us, if it is newer (profile-inbox.js),
+      // then the encrypted cache (may be stale).
+      await maybeDrainProfileCopy(async () => rec, stateDir);
       const cached = await readCache(stateDir);
-      if (cached) return stamp(foldConfigHome(normalizeIdentity(cached.vault)), cached); // phone unreachable → encrypted cache (may be stale)
+      if (cached) return stamp(foldConfigHome(normalizeIdentity(cached.vault)), cached);
       throw err;                        // no phone + no cache → cannot serve
     }
   }
@@ -371,6 +375,9 @@ async function loadFingerprintUnfiltered(baseDir) {
 // escalation in flight.
 export async function loadFingerprintPreferCache(baseDir, opts) {
   if (!process.env.PHAEDO_FINGERPRINT && hasPairingRecord(baseDir)) {
+    // The phone pushes a fresh copy whenever its app opens or the profile changes; take it first
+    // (throttled, fail-fast — this is the ship hook's path). See profile-inbox.js.
+    await maybeDrainProfileCopy(() => loadPairingRecord(baseDir), defaultStateDir());
     const cached = await readCache(defaultStateDir());
     if (cached) return forgetting(stamp(foldConfigHome(normalizeIdentity(cached.vault)), cached), opts);
   }

package/hooks/pre-ship.mjs

@@ -328,8 +328,8 @@ export function unpromptedContext(receiptId) {
 
 export function staleContext(days, mcpDir) {
   return `Also: Phaedo's copy of the user's profile is ${days} days old (their phone has not been ` +
-    `reached since). Mention once, in one line, that they can refresh it by running ` +
-    `\`cd ${mcpDir} && npm run pull\` and approving on their phone.`;
+    `reached since). Mention once, in one line, that opening the Phaedo app on their phone refreshes ` +
+    `it within minutes, or they can run \`cd ${mcpDir} && npm run pull\` and approve on their phone.`;
 }
 
 /**
@@ -421,8 +421,10 @@ export async function runShipHook(input, deps) {
     const extra = [];
     if (ci) extra.push({ cue: 'ciState', value: ci, confidence: null, basis: ci === 'unknown' ? null : 'observed' });
     if (ci && deps.prFacts) extra.push({ cue: 'diffStakes', value: stakesValue(stakes), confidence: null, basis: stakes ? 'observed' : null });
-    if (grant) extra.push({ cue: 'standingGrant', value: granted ? 'answered' : `held:${grant.why}`, confidence: null, basis: 'observed' });
-    const allDrivers = extra.length ? [...(drivers || []), ...extra] : drivers;
+    // First, not last: buildReceipt keeps only the first 16 drivers, and the weekly summary on the
+    // phone counts this one ("your standing rule decided N of them", weekly.js).
+    const lead = grant ? [{ cue: 'standingGrant', value: granted ? 'answered' : `held:${grant.why}`, confidence: null, basis: 'observed' }] : [];
+    const allDrivers = (extra.length || lead.length) ? [...lead, ...(drivers || []), ...extra] : drivers;
     const receiptId = await deps.writeReceipt({ request, response, drivers: allDrivers });
     if (!receiptId) return null;     // no receipt = nothing to learn from; stay out of the way
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phaedo-mcp",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "private": false,
   "license": "Apache-2.0",
   "type": "module",
@@ -36,6 +36,7 @@
     "server.js",
     "server.json",
     "fingerprint-source.js",
+    "profile-inbox.js",
     "projection.js",
     "errors.js",
     "consult.js",
@@ -100,7 +101,7 @@
     "unsetup": "node install.mjs --uninstall",
     "pair": "node pair.js",
     "pull": "node pull.js",
-    "test": "node test-smoke.mjs && node test-no-profile.mjs && node test-phone-boundary.mjs && node test-cache.mjs && node test-pairing.mjs && node test-revoke.mjs && node test-install.mjs && node test-consult.mjs && node test-consult-policy.mjs && node test-amount-bands.mjs && node test-resolver-revision.mjs && node test-ship-actions.mjs && node test-ship-hook.mjs && node test-ship-readout.mjs && node test-action-binding.mjs && node test-autonomy-promotion.mjs && node test-ap2.mjs && node test-delegation-sync.mjs && node test-delegation-relay.mjs && node test-capture-sync.mjs && node test-capture-hook.mjs && node test-stop-capture.mjs && node test-capture-local.mjs && node test-capture-a11y.mjs && node test-vendored-capture.mjs && node test-escalation.mjs && node test-domain.mjs && node test-receipts.mjs && node test-receipts-sync.mjs && node test-agreement.mjs && node test-weekly.mjs && node test-asks.mjs && node test-precedent.mjs && node test-rules-files.mjs && node test-agent-hook.mjs && node test-learned.mjs && node test-history-import.mjs && node test-calibration.mjs && node test-identity.mjs && node test-signing.mjs && node test-sign-request.mjs && node test-signing-audit.mjs && node test-delegation-domain-fragmentation.mjs && node test-stale-authority.mjs && node test-config-home-fold.mjs && node test-precedence-and-ceiling.mjs && node test-package-closure.mjs && node test-plugin.mjs",
+    "test": "node test-smoke.mjs && node test-no-profile.mjs && node test-phone-boundary.mjs && node test-cache.mjs && node test-profile-inbox.mjs && node test-pairing.mjs && node test-revoke.mjs && node test-install.mjs && node test-consult.mjs && node test-consult-policy.mjs && node test-amount-bands.mjs && node test-resolver-revision.mjs && node test-ship-actions.mjs && node test-ship-hook.mjs && node test-ship-readout.mjs && node test-action-binding.mjs && node test-autonomy-promotion.mjs && node test-ap2.mjs && node test-delegation-sync.mjs && node test-delegation-relay.mjs && node test-capture-sync.mjs && node test-capture-hook.mjs && node test-stop-capture.mjs && node test-capture-local.mjs && node test-capture-a11y.mjs && node test-vendored-capture.mjs && node test-escalation.mjs && node test-domain.mjs && node test-receipts.mjs && node test-receipts-sync.mjs && node test-agreement.mjs && node test-weekly.mjs && node test-asks.mjs && node test-precedent.mjs && node test-rules-files.mjs && node test-agent-hook.mjs && node test-learned.mjs && node test-history-import.mjs && node test-calibration.mjs && node test-identity.mjs && node test-signing.mjs && node test-sign-request.mjs && node test-signing-audit.mjs && node test-delegation-domain-fragmentation.mjs && node test-stale-authority.mjs && node test-config-home-fold.mjs && node test-precedence-and-ceiling.mjs && node test-package-closure.mjs && node test-plugin.mjs",
     "receipts": "node receipts.js list",
     "agreement": "node agreement.js",
     "ship-readout": "node ship-readout.js",

package/profile-inbox.js

@@ -0,0 +1,114 @@
+// The phone's pushed profile copy (relay lane `profile_to_agent/<client_id>`, 2026-11-02).
+//
+// The live read (phone-source.js) needs the phone's LAN server up and a Face ID tap, so on the
+// reference Mac it almost never completed and the at-rest copy went days stale — past the 7 days
+// a standing rule may run on (lib/rule-leeway.js). The phone now leaves a fresh copy for this
+// agent whenever its app comes to the foreground or the profile changes (mobile
+// agentProfile.js / agentProfilePush.ts), sealed under this agent's own fp_sync_key. Here we pick
+// it up and make it the at-rest copy.
+//
+// What keeps this safe:
+//   - It refreshes the CACHE only. A pushed copy is never "live" (sourceOf stays live:false), so
+//     the stale-authority guard and the rule leeway treat it exactly as they treat any cache.
+//   - Its age is the PHONE's `generated_at`, not when we drained it, so a copy that sat on the
+//     relay for days is days old here too. A time in the future is clamped to now.
+//   - Newest wins: a copy no newer than the one we hold is ignored, so the relay cannot roll the
+//     profile back to before a rule was removed by replaying an older deposit.
+//   - Sealed + tagged: only this agent's pair key opens it, and `kind: 'agent_profile'` stops
+//     anything else sealed under that key (our own receipts digest) being read as a profile.
+//
+// Best-effort and throttled (CHECK_GAP_MS, shared across processes through a small state file,
+// since the ship hook runs as a fresh process per tool call): a relay failure leaves the copy we
+// have and never fails the read that asked.
+
+import { readFile, writeFile, mkdir } from 'fs/promises';
+import { join } from 'path';
+import { Phaedo, b64uDec } from './lib/phaedo-crypto.js';
+import { readCache, writeCache } from './cache.js';
+import { toVaultPayload } from './phone-source.js';
+import { relayBaseFromEnv } from './receipts-sync.js';
+
+const { Kdf, Envelope } = Phaedo;
+export const AGENT_PROFILE_KIND = 'agent_profile';
+export const CHECK_GAP_MS = 10 * 60 * 1000;
+const SEGMENT_RE = /^[A-Za-z0-9_.-]{1,128}$/;   // relay/mailbox.js LANE_SUB_RE
+const STATE_FILE = 'profile-inbox.json';
+const TIMEOUT_MS = 3000;                         // on the ship hook's path: fail fast
+
+/** Open a pushed copy → { vault, generatedAt } or null (wrong key, wrong kind, malformed). */
+export async function parseAgentProfileDeposit(pairKeyB64u, envelope) {
+  if (!envelope || !pairKeyB64u) return null;
+  const pairKey = b64uDec(pairKeyB64u);
+  let key;
+  try { key = await Kdf.deriveFpSyncKey(pairKey); } finally { pairKey.fill(0); }
+  try {
+    const plaintext = await Envelope.unwrap(envelope, key);
+    let inner;
+    try { inner = JSON.parse(new TextDecoder().decode(plaintext)); } finally { if (plaintext.fill) plaintext.fill(0); }
+    if (!inner || inner.kind !== AGENT_PROFILE_KIND || !inner.data || typeof inner.data !== 'object') return null;
+    const generatedAt = Date.parse(inner.generated_at);
+    if (!Number.isFinite(generatedAt)) return null;
+    return { vault: toVaultPayload(inner), generatedAt };
+  } catch {
+    return null;
+  } finally {
+    if (key && key.fill) key.fill(0);
+  }
+}
+
+/** Should a pushed copy replace the cache? Only a strictly newer one. Returns the time to stamp. */
+export function acceptCopy(generatedAt, cachedAt, now = Date.now()) {
+  if (!Number.isFinite(generatedAt)) return null;
+  const at = Math.min(generatedAt, now);         // a phone clock ahead of ours cannot buy freshness
+  if (Number.isFinite(cachedAt) && at <= cachedAt) return null;
+  return at;
+}
+
+/**
+ * Fetch this agent's pushed copy and, when it is newer than the cache, make it the cache.
+ * → { updated: true, generatedAt } | { updated: false, reason }.
+ */
+export async function drainProfileCopy(pairing, stateDir, deps = {}) {
+  const fetchFn = deps.fetch || globalThis.fetch;
+  const now = deps.now ? deps.now() : Date.now();
+  if (!pairing || !pairing.pair_key) return { updated: false, reason: 'unpaired' };
+  if (!pairing.relay_device_id) return { updated: false, reason: 'no-relay-device-id' };
+  if (typeof pairing.client_id !== 'string' || !SEGMENT_RE.test(pairing.client_id)) return { updated: false, reason: 'no-client-id' };
+  try {
+    const url = `${deps.relayBase || relayBaseFromEnv()}/fp-mailbox/${encodeURIComponent(pairing.relay_device_id)}/profile_to_agent/${pairing.client_id}`;
+    const authHeader = pairing.relay_device_secret
+      ? { Authorization: `Bearer ${pairing.relay_device_id}:${pairing.relay_device_secret}` }
+      : {};
+    const res = await fetchFn(url, { method: 'GET', headers: authHeader, signal: AbortSignal.timeout(deps.timeoutMs || TIMEOUT_MS) });
+    // 404 = nothing pushed yet; 400 = a relay that predates the lane.
+    if (!res || !res.ok) return { updated: false, reason: `http-${res && res.status}` };
+    const body = await res.json().catch(() => null);
+    const copy = await parseAgentProfileDeposit(pairing.pair_key, body && body.envelope);
+    if (!copy) return { updated: false, reason: 'unreadable' };
+    const cached = await readCache(stateDir);
+    const at = acceptCopy(copy.generatedAt, cached ? Number(cached.cachedAt) : NaN, now);
+    if (at == null) return { updated: false, reason: 'not-newer' };
+    await writeCache(stateDir, copy.vault, at);
+    return { updated: true, generatedAt: at };
+  } catch (e) {
+    return { updated: false, reason: String(e && e.message || e) };
+  }
+}
+
+/** Throttled `drainProfileCopy`: at most once per CHECK_GAP_MS across every process on this Mac. */
+export async function maybeDrainProfileCopy(loadPairing, stateDir, deps = {}) {
+  const now = deps.now ? deps.now() : Date.now();
+  const path = join(stateDir, STATE_FILE);
+  try {
+    const last = Number(JSON.parse(await readFile(path, 'utf8'))?.checked_at);
+    if (Number.isFinite(last) && now >= last && now - last < CHECK_GAP_MS) return { updated: false, reason: 'recent' };
+  } catch { /* first check, or an unreadable file: check now */ }
+  try {
+    await mkdir(stateDir, { recursive: true, mode: 0o700 });
+    // Claimed BEFORE the request, so the processes that start together do not all ask.
+    await writeFile(path, JSON.stringify({ checked_at: now }), { mode: 0o600 });
+  } catch { /* a read-only state dir still gets its check */ }
+  let pairing = null;
+  try { pairing = await loadPairing(); } catch { return { updated: false, reason: 'unpaired' }; }
+  return drainProfileCopy(pairing, stateDir, deps);
+}

package/pull.js

@@ -58,7 +58,8 @@ loadFingerprint(BASE_DIR)
       `⚠ Could NOT reach your phone — served a CACHED copy${hours != null ? ` about ${hours}h old` : ''} ` +
       `(fingerprint ${fp.fingerprint_id || '(no id)'}, ${layers} layer(s)).\n` +
       `  Anything you changed since then — including a revoked authorization — is NOT reflected.\n` +
-      `  Open Phaedo on your phone and approve the card, then run this again.\n`
+      `  Opening Phaedo on your phone sends this computer a fresh copy (picked up within 10 minutes);\n` +
+      `  to read it live instead, keep the app open, approve the card, and run this again.\n`
     );
     process.stdout.write(await week() + review(vd));
     process.exit(2);                       // distinct from 1 (hard failure) — stale, not broken

package/receipts-sync.js

@@ -78,7 +78,7 @@ function digestFields(r) {
 // Pure-crypto: take the local receipts list, build a §10.4-safe digest of the most
 // recent `cap` entries, and seal it under fp_sync_key. Returns `{ envelope }` — the
 // same shape `agent_to_ext` (delegation-sync) uses, so the relay's mailbox accepts it.
-export async function buildReceiptsDeposit(pairKeyB64u, receipts, { cap = DIGEST_CAP, now = () => new Date().toISOString() } = {}) {
+export async function buildReceiptsDeposit(pairKeyB64u, receipts, { cap = DIGEST_CAP, now = () => new Date().toISOString(), copyAt = null } = {}) {
   const list = Array.isArray(receipts) ? receipts : [];
   // Most-recent N (receipts are append-only, ordered by creation in the store).
   const head = list.slice(-cap).map(digestFields).filter(Boolean);
@@ -100,7 +100,12 @@ export async function buildReceiptsDeposit(pairKeyB64u, receipts, { cap = DIGEST
     // plus the sentence the MCP already shows in /phaedo:status, so both surfaces say the same.
     const w = weeklyHandled(list, { now: Number.isFinite(agreementAt) ? agreementAt : Date.now() });
     const week = { ...w, summary: formatWeekly(w) };
-    const inner = { kind: 'receipts_digest', data: { receipts: head, agreement, week, generated_at: generatedAt } };
+    // How fresh this computer's profile copy is (cache.js readCacheTime), so the phone can show it.
+    // Omitted when there is no copy; never later than this digest.
+    const copy = Number.isFinite(copyAt) && copyAt > 0
+      ? { copy_at: new Date(Math.min(copyAt, Number.isFinite(agreementAt) ? agreementAt : Date.now())).toISOString() }
+      : {};
+    const inner = { kind: 'receipts_digest', data: { receipts: head, agreement, week, generated_at: generatedAt, ...copy } };
     const plaintext = new TextEncoder().encode(JSON.stringify(inner));
     const envelope = await Envelope.wrap(plaintext, fpSyncKey, { artifact_kind: 'receipts_digest', created_at: now() });
     plaintext.fill(0);

package/server.js

@@ -29,8 +29,9 @@ import { depositSignRequest, pollSignOnce } from './signing-request.js';
 import { buildSigningAuditRecord, appendSigningAudit } from './signing-audit.js';
 import { buildInjectionResponse, errorResponse, PhaedoError } from './projection.js';
 import { resolveConsultation, checkAuthorization, standingRuleRelaxes, CONSULTATION_TYPES, consultDrivers, withRevision } from './consult.js';
-import { defaultStateDir } from './cache.js';
+import { defaultStateDir, readCacheTime } from './cache.js';
 import { ruleLeeway, RULE_FRESH_DAYS } from './lib/rule-leeway.js';
+import { standingRuleDriver } from './weekly.js';
 import { buildConsultOpts, loadConsultVd } from './consult-runtime.js';
 import { buildReceipt, appendReceipt, receiptsCapFromEnv, readReceipts, markOutcome, USER_ACTIONS } from './receipts.js';
 
@@ -102,6 +103,13 @@ async function guardFacts(vd, req, ruleDecided = ruleRelaxes(vd, req)) {
   }
 }
 
+// The receipt's note that one of the subject's standing rules let this go ahead (weekly.js counts
+// it for the phone). First in the list, since buildReceipt keeps only the first 16 drivers.
+function ruleAnsweredDriver(vd, req, response) {
+  if (response?.signal !== 'proceed') return [];
+  try { return standingRuleDriver(checkAuthorization(vd, req, CONSULT_OPTS), response); } catch { return []; }
+}
+
 function withStaleAuthorityGuard(response, vd, { ruleDecided = true, leeway = false } = {}) {
   const src = sourceOf(vd);
   const out = { ...response };
@@ -151,9 +159,11 @@ async function maybeDepositReceiptsDigest() {
     // AND "an existing receipt got marked" (so the next phone drain reflects the mark).
     const latest = receipts[receipts.length - 1];
     const tally = receipts.reduce((acc, r) => { acc[r.user_action ?? 'null'] = (acc[r.user_action ?? 'null'] || 0) + 1; return acc; }, {});
-    const sig = `${latest.receipt_id}|${JSON.stringify(tally)}`;
+    // The copy's time rides along, so a fresher copy alone is worth a new digest.
+    const copyAt = await readCacheTime(defaultStateDir());
+    const sig = `${latest.receipt_id}|${JSON.stringify(tally)}|${copyAt}`;
     if (sig === _lastReceiptsSig) return;
-    const res = await depositReceiptsDigest(await loadPairingRecord(BASE_DIR), receipts);
+    const res = await depositReceiptsDigest(await loadPairingRecord(BASE_DIR), receipts, { copyAt });
     if (res && res.deposited) _lastReceiptsSig = sig;
     else if (res && !res.deposited && res.reason !== 'no-receipts')
       process.stderr.write(`[phaedo-mcp] receipts digest deposit skipped: ${res.reason || 'http ' + res.status}\n`);
@@ -377,6 +387,7 @@ server.registerTool(
       // (never in `response`; §10.4). Best-effort: a failure must not block the answer.
       let drivers = [];
       try { drivers = withRevision(consultDrivers(vd, args || {}, CONSULT_OPTS), raw); } catch { /* provenance is non-critical */ }
+      drivers = [...ruleAnsweredDriver(vd, args || {}, response), ...drivers];
       const receiptId = await emitReceipt('phaedo_consult', args, response, drivers); // every resolution, abstains included
       if (receiptId) response.receipt_id = receiptId;   // the handle for phaedo_record_outcome
       await maybeDepositDelegationPromotions(vd);                    // act-as-me promotion (best-effort)
@@ -454,7 +465,8 @@ server.registerTool(
       // receipt. A no-match is not a decision — no receipt (keeps the store from
       // filling with probes; the follow-up phaedo_consult writes its own).
       if (matchedPreGuard) {
-        const rid = await emitReceipt('phaedo_check_authorization', req, { signal: response.signal, confidence: 1.0, deference_level: 'high' });
+        const rid = await emitReceipt('phaedo_check_authorization', req, { signal: response.signal, confidence: 1.0, deference_level: 'high' },
+          ruleAnsweredDriver(vd, req, response));
         if (rid) response.receipt_id = rid;
         await maybeDepositReceiptsDigest();                          // G1+G2 audit channel — only on a matched preflight (no-match writes no receipt)
       }
@@ -591,6 +603,7 @@ server.registerTool(
       const response = withStaleAuthorityGuard(raw, vd, await guardFacts(vd, req));
       let drivers = [];
       try { drivers = withRevision(consultDrivers(vd, req, CONSULT_OPTS), raw); } catch { /* non-critical */ }
+      drivers = [...ruleAnsweredDriver(vd, req, response), ...drivers];
       const escReceiptId = await emitReceipt('phaedo_escalate', req, response, drivers);   // the decision being escalated
       await maybeDepositReceiptsDigest();                              // G1+G2 audit channel
 

package/server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.phaedo-labs/phaedo-mcp",
   "description": "Make AI apps answer your way, check with you before acting, and get approvals on your phone.",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "repository": {
     "url": "https://github.com/phaedo-labs/phaedo-mcp",
     "source": "github",
@@ -13,7 +13,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "phaedo-mcp",
-      "version": "0.3.19",
+      "version": "0.3.21",
       "transport": {
         "type": "stdio"
       }

package/weekly.js

@@ -10,7 +10,10 @@
 //   came_to_you — Phaedo said check with you (escalate / clarify)
 //   unsure      — Phaedo didn't know (insufficient_signal); the agent fell back to its own default
 //
-// "Handled" is went_ahead + stopped. Pure over the receipts list; the CLI reads the local store.
+// "Handled" is went_ahead + stopped. `by_rule` is the part of went_ahead that one of the subject's
+// standing rules decided — the receipt carries a `standingRule` (server) or `standingGrant` (ship
+// hook) driver saying so — which is how they see a rule they accepted actually being used.
+// Pure over the receipts list; the CLI reads the local store.
 //
 //   npm run week
 
@@ -27,14 +30,30 @@ const BUCKET = {
   insufficient_signal: 'unsure',
 };
 
+// The driver cues that mean "a standing rule answered this" (server.js ruleAnsweredDriver,
+// hooks/pre-ship.mjs). A held grant is recorded as `held:<why>`, so only 'answered' counts.
+export const RULE_CUES = new Set(['standingRule', 'standingGrant']);
+export function answeredByRule(r) {
+  return Array.isArray(r?.drivers) && r.drivers.some((d) => RULE_CUES.has(d?.cue) && d?.value === 'answered');
+}
+
+/** The server's driver for a receipt a standing rule decided: an authorization that matched and
+ *  said go ahead, AND an answer that still says go ahead after the stale-authority guard — one the
+ *  guard withheld went to the subject instead, so the rule did not decide it. */
+export function standingRuleDriver(auth, response) {
+  return auth?.authorization_matched === true && auth.signal === 'proceed' && response?.signal === 'proceed'
+    ? [{ cue: 'standingRule', value: 'answered', confidence: 1, basis: 'authored' }] : [];
+}
+
 export function weeklyHandled(receipts, { now = Date.now(), days = WEEK_DAYS } = {}) {
   const since = now - days * DAY_MS;
-  const out = { days, went_ahead: 0, stopped: 0, came_to_you: 0, unsure: 0 };
+  const out = { days, went_ahead: 0, by_rule: 0, stopped: 0, came_to_you: 0, unsure: 0 };
   for (const r of Array.isArray(receipts) ? receipts : []) {
     const t = Date.parse(r?.created_at);
     if (!Number.isFinite(t) || t < since || t > now) continue;
     const b = BUCKET[r?.response?.signal];
     if (b) out[b]++;
+    if (b === 'went_ahead' && answeredByRule(r)) out.by_rule++;
   }
   out.handled = out.went_ahead + out.stopped;
   out.total = out.handled + out.came_to_you + out.unsure;
@@ -53,8 +72,9 @@ export function formatWeekly(w) {
     ? `This week Phaedo handled ${plural(w.handled, 'decision')} without interrupting you (${parts.join(', ')})`
     : 'This week Phaedo handled no decisions on its own';
   const asked = w.came_to_you ? ` and brought ${w.came_to_you} to you` : '';
+  const rule = w.by_rule ? ` Your standing rule decided ${w.handled === 1 ? 'it' : `${w.by_rule === 1 ? 'one' : w.by_rule} of them`}.` : '';
   const unsure = w.unsure ? ` ${w.unsure === 1 ? 'One more was' : `${w.unsure} more were`} too unclear to call.` : '';
-  return `${handled}${asked}.${unsure}`;
+  return `${handled}${asked}.${rule}${unsure}`;
 }
 
 if (isMainModule(import.meta.url)) {