Rules engine v2: per-action policy + agent send over MCP + starter presets

[hellno]

Why

Today the agent's "Rules" are a single flat Policy struct: a bespoke top-level key per capability
(auto_shield_min_wei, allow_swap_tokens, …), one global approval mode, and default-allow on
recipients (allow_to: [] = any). It cannot scale to the wallet-action roadmap without per-feature
policy-plumbing churn, and it default-allows the most dangerous axis.

This issue replaces it with a small, default-deny, per-action typed rule list — the user-facing
"Rules" — kept as a single pure evaluate() with native U256 caps, and teaches the agent to
actually send money (within the Rules). Decision + rationale, standards survey, and the corrected
spec: docs/adr/0005-policy-and-authorization-model.md.

Grounded by a primary-source deep-research pass (the uint256-vs-64-bit finding) and two codex
adversarial reviews. User-facing term is "Rules"; the internal deckard-contract type stays
Policy and the file stays policy.json (cosmetic rename optional, not v1).

In scope — delivered as ordered PRs inside this one issue

PR1 — schema (deckard-contract)

• Replace flat Policy with a versioned per-action Rule list: Rule enum (Send/Shield/Unshield/Swap/ContractCall variants carrying their own constraints), Allowlist { DenyAll, Any, Only(Vec<Address>) } with #[serde(default)] = DenyAll, Effect { Deny } (default: "allow" forbidden), one global daily_cap_wei, advisory auto_shield_min_wei.
• Rewrite evaluate (default-deny; per-rule per-tx cap + global daily cap in U256; Allowlist lattice) preserving Decision / deny_reasons / RequestId::ZERO and the mock⇄daemon parity contract. evaluate_order reads the Swap rule's tokens (replaces allow_swap_tokens); still always NeedsApproval, no cap fields.
• Loader (policy_store.rs): strict typed deser; reject duplicate actions (loud); v0 file (absent version) → loud reject ("rewrite to v1"); malformed → deny-all + loud log.
• Rewrite the JSON+CBOR round-trip tests for the new shape (keep the byte-stable charter — this is an intentional versioned break of Policy only; Intent/Decision/RPC enums stay frozen).
• Update by-name readers: mock.rs / MockSigner::new, tests/harness_slice.rs, deckard-mcp/src/sidecar.rs::policy_json() (+ fixtures), deckard-app/src/welcome.rs::agent_policy_rows.

PR2 — agent send over MCP

• deckard_send MCP tool → existing Intent{ kind: Send } → evaluate.
• ⌘K palette command (palette_commands.rs + Shell::run_palette_command) — palette-reachability rule.
• Verify (do not rebuild) that the existing single-mutex serialization + execute-time re-evaluate (daemon.rs:1131) + signerd: reserve daily-cap before signing + durable rollback-resistant accounting (C3) #108 reserve-before-sign (daemon.rs:1164) correctly cover a value-bearing auto-allowed Send (today's only auto-allow is value == 0 shield); add a regression test.

PR3 — the send approval screen

• The send card (recipient + amount + token + any resolution), per DESIGN.md two-signal model.
• Before/after screenshots attached (GUI visual-verification rule).

PR4 — starter presets + demo

• Ship three named Rules presets on the v2 schema, all default-deny: shield-only (one shield rule, everything else denied — the safest useful agent); ask-me-everything (send/shield/swap all approval: always); locked (panic — rules: [], everything denied; a switchable frozen rulebook, distinct from the runtime revoked STOP).
• Selection (CLI flag / ⌘K). Default shipped Rules: shield auto-allow, send approval: always (recipients any; every send human-approved), swap always-cards.
• Rewrite policy.demo.json → v1; just demo upgrade-not-skip a v0 file (today installs-if-absent); fix just demo-check jq paths + intended-values; CHANGELOG the schema break + demo-machine upgrade step.

Not in scope

• In-app authoring / SetPolicy RPC — deferred (→ Scenario recipes: policy variants with transcripts, each backed by an acceptance test #29, narrowed to authoring/PAP).
• Per-action daily budgets (a SpendStore-schema change).
• The #33 / #48 grant/attenuation model — they adopt this vocabulary but stay distinct enforcers.
• #31 wire-kind discovery (reframed, deferred).
• New actions beyond what exists: Unshield / ContractCall rules are defined forward-compat but not yet reachable (the daemon denies non-Send/Shield with unsupported_v1 before evaluate; the shaped relayer-approve skips evaluate).

Definition of done

• cargo fmt --all --check clean.
• just check green (default and --features tray).
• cargo test --workspace green; evaluate / evaluate_order mock⇄daemon parity green; round-trip tests rewritten + green.
• Send approval card before/after screenshots attached.
• No new or changed dependencies.
• ADR-0005 promoted to Accepted.

[hellno]

Parallel-prep findings (2026-06-24) — cap verification, gas model, send card

Two read-only prep agents + maintainer decisions, captured here so the implementing agent inherits them. Grounded in DESIGN.md, crates/deckard-signerd/src/daemon.rs, crates/deckard-app/src/{commit_view,activity_view}.rs.

1. Cap-reservation — VERIFIED sufficient (verify, don't rebuild)

A value-bearing auto-allowed Send cannot exceed the daily cap: the daemon holds one mutex across the whole handle() incl. the broadcast await (server.rs:169), so propose/execute never interleave; the second auto-allow's execute-time re-evaluate (daemon.rs:1131) sees the first's committed spent_today; reserve-before-sign (:1164) + commit/release/timeout paths are correct; no "reservation released on expiry then re-spent" hole (expire_stale never touches spend). PR2 needs NO new reservation machinery — only:

• Test auto_allow_value_sends_cannot_exceed_daily_cap — policy ApprovalMode::Never, per-tx 0.04 / daily 0.05; propose(0.04)→Allow, propose(0.03)→Allow (stale snapshot), execute(0.04)→ok (spent_today==0.04), execute(0.03)→Denied{CAP_EXCEEDED}, spent_today still 0.04. → tests/durable_cap_e2e.rs.
• Test reservation_released_on_broadcast_failure — clean pre-broadcast RPC reject → Denied{broadcast_failed..}, reservation released, spent_today back to pre-execute, headroom intact.
• Keep the existing anvil-gated, real-broadcast pattern (prove the arithmetic end-to-end).

2. Gas / fees — SEPARATE fee budget (deferred axis) — decision 2026-06-24

The daily cap bounds intent.value, not gas. Gas is a distinct authority axis (fees go to validators, not a recipient), so it gets its own budget — a daily gas allowance and/or a max-tx-count in the Rules vocabulary — not folded into the value cap. It only bites auto-allow send policies (a human-gated send shows each fee on the card); v1 ships always-ask sends, so the gas-drain vector is latent, not live.

• PR2: one-line THREAT-MODEL.md note — "the daily cap is a value-cap, not a balance-cap; gas is unbounded; auto-allow value-send policies are deferred until a fee budget / tx-count limit exists."
• Deferred (alongside per-action daily budgets): add fee_budget / max_tx_per_day to the Rules when auto-allow sends are actually built. Do not ship a policy that auto-allows value sends before that exists.

3. Send approval card (PR3) — converge onto the on-spec hero (shared-helper extraction)

Two send-confirm surfaces exist today: app-Send (commit_view.rs::render_commit_review) is the correct transaction-as-hero clear-signing card; the agent-proposed approval (activity_view.rs::render_activity_review) is a flat key/value card that under-renders the recipient (short_address, not identicon + ENS + full address). The recipient is the #1 security-load-bearing field (attacker-influenceable via the agent LLM), so this is a security fix, not just polish.

Decision: shared-helper extraction — pull tx_hero + recipient_block out of commit_view.rs (:288-337), call from both render_commit_review and render_activity_review; reuse the armed ⌘↵ key-cap (hold_to_confirm, commit_view.rs:496); preserve the no-blind-approve approve_target path (activity_view.rs:212).

• Recipient rendered full + identicon + ENS in fg (fixes the regression).
• Agent two-actor band (cyan squircle, "Atlas proposed → you approve") for origin=Agent; neutral for App.
• Truthful breached-fence cite from the record's reason (never hardcoded).
• Danger-first red honesty lines; fresh / off-allowlist recipient → red, not just amber.

Open questions for PR3:

• Fiat/USD: no price source wired → omit (don't fabricate $).
• ENS: resolve intent.to app-side via EthProvider::resolve_name (no ActivityRecord change).
• Chain row: add the network name from the chain.rs registry; trust-tier tag on a write (vs a read) = open.
• Naming debt: hold_to_confirm / *_hold render a key-cap, not a hold — cosmetic rename pass.

[hellno]

PR1 merged — #160 (squash 52ba8c2). The schema foundation is in main.

Done (all 5 PR1 boxes checked above): flat Policy → versioned per-action Rule list + Allowlist lattice (DenyAll/Any/Only, no more "empty Vec = any"); evaluate/evaluate_order rewritten (default-deny ⇒ Deny{no_rule}, per-rule per-tx cap + one global daily cap in U256, Swap rule's tokens); strict loader with duplicate-action + v0 (no version) loud reject and a most-restrictive deny-all fallback; JSON+CBOR round-trip tests rewritten; all by-name readers ported (mock.rs, harness_slice.rs, sidecar.rs::policy_json, welcome.rs::agent_policy_rows).

Pulled forward from PR4 (the breaking schema change had to keep CI green, so I did the demo/justfile/CHANGELOG item now — box 38 checked): policy.demo.json → v1 (comment keys dropped, now deny_unknown_fields), just demo v0 upgrade-not-skip (backs up to policy.json.v0.bak), demo-check kept working via top-level back-compat keys in policy_json, CHANGELOG documents the break + upgrade step. The actual PR4 presets (shield-only / ask-me-everything / locked + selection) are not done — still open.

Two trust-relevant implementation notes for the next PRs:

• Policy is BOTH the policy.json file shape AND the PolicyGet RPC payload. revoked/spent_today_wei are #[serde(default)] (not skip) — force-reset on load so a file can't inject a spend, but kept on the wire so the app gauge + agent's spent_today read the daemon's live values.
• Rule uses hand-rolled serde (not #[serde(tag="action")]): the derived internally-tagged enum fails CBOR round-trip via ciborium (self-describing Content buffering vs alloy's hex/bytes). Same {"action":…} shape, strictness preserved by hand. Allowlist::DenyAll serializes by omitting the field so every variant round-trips byte-stably.

Review: codex adversarial pass = ACHIEVED-WITH-CAVEATS, zero P1 (verified default-deny end to end, mock⇄daemon parity, U256 caps, JSON+CBOR serde, fail-safe). Its 3 P2s are fixed in #160's 2nd commit.

Carried into PR3: agent_view shows a "Reading the signer's policy…" placeholder when a Send rule has no per-tx cap (the friendly default, approval: always). The autonomy copy is hardcoded/demo-shaped and should be derived from the per-action rules as part of the send-card work — codex agreed it's UI debt, not a trust hole. The demo path (Send per-tx 0.1 ETH) renders fine.

DoD section left unchecked: it's the whole-issue gate (PR3 screenshots + ADR→Accepted are the final steps). Next: PR2 — deckard_send MCP tool + ⌘K command + the value-bearing auto-allow reservation verification.