# 0035 — Fatigue control derived from the log and enforced on the phone; grants bound to the requesting session

- Status: accepted (amends 0017 §5; amends 0016 §1 and 0023 §1 on the role of the session capability); §2 scope sentence and §3 overlap block amended by 0047; §3 number formula and banner semantics amended by 0050 (six digits, no trust styling, never coalesced)
- Date: 2026-10-22
- Area: protocol | product

## Context

Spec review round 1 (HUMAN-FACTORS-R1-1, -R1-6, -R1-7, AGENT-HOST-R1-9, -R1-10, -R1-11):

- Every fatigue control lived in daemon memory and was keyed on a session the attacker mints (`session.open` or no token). Restarting the daemon wiped it. Unanswered requests expire without counting as denials, so the natural reaction to a storm — ignoring it — never throttled anything. The PWA storm banner fired only above the daemon's own cap. This is the Uber 2022 push-bombing pattern.
- ADR 0016 §1 / 0023 §1 require a per-session capability; v2 made it optional and grants were per host, so a lease approved for "claude in ~/proj-a" was usable by any program on the host, while the approval screen suggested otherwise.
- Number matching was requester-chosen and pick-1-of-3.

## Decision

1. **Fatigue state is a function of the verified log**, computed identically by the daemon (to refuse) and by the PWA (to collapse and silence), so neither restart nor new sessions reset it. Per **host and handle**:
   - an **outcome** is a denial entry, or a request whose `expires` passed without grant or denial ("expired unanswered", a soft denial);
   - back-off after an outcome: the host may not request that handle for 60 s, doubling per further outcome within 1 h, capped at 30 min;
   - **quarantine:** 3 outcomes for a host within 10 min ⇒ the daemon refuses new requests from that host for 30 min (`quarantined`); the PWA shows one collapsed **storm card** for the host, auto-hides further requests from it during the window (they expire unanswered) and offers "Mute this host for N h" (local PWA setting in the PoC);
   - the PWA storm banner fires at ≥ 3 requests from one host in 10 min, counting expired ones (below the daemon cap of 3 pending);
   - times come from entry time fields bounded by the relay's ±300 s hygiene check and the device's own clock; the rule is a throttle, not a security boundary.
2. **Sessions.** `session.open` stays a socket method (any client uid may call it; this is attribution, not authentication). Each request records `H(session token)` (or 32 zero bytes for "no session") and the session label in its sealed RequestDetails. A grant is usable only by callers presenting the **same** session token (or no token, if the request had none). The approval screen states the scope in plain words: "Usable by session '<label>' on <host> until 07:00 — a label reported by the host; any program running as <user> that obtains the token could use it" or, for no session, "Usable by any program on <host> that runs without a Custos session".
3. **Number matching** is typed, not picked: the phone asks the user to type the 2-digit number shown on the terminal. If two pending requests from the same host overlap in time and either has `number_match`, the phone blocks approval of both and shows "two requests at once — deny both or check your terminal". The CLI writes the number and fingerprint to the controlling TTY (`/dev/tty`), never to stdout. The spec states the scope: number matching proves the person approving looks at the terminal that started *a* request; it does not prove a human started it, and the fingerprint defends against relay substitution (A1), not against the agent.

## Alternatives considered

| Option | Why not |
| --- | --- |
| Persist daemon limiter state to disk | Survives restart but not a host compromise or dev-mode tampering; the log already holds the facts, so a second state store is redundant |
| New `host.mute` log kind | A shared, signed mute is cleaner for multi-approver accounts, but log-derived quarantine already stops the storm at the source; one more kind and rule for the PoC is not needed |
| Require a session token for every request | The human's own `custos request` / `custos http` in a plain terminal would need extra steps; "no session" is an explicit, labelled bucket instead |
| Keep pick-1-of-3 | A user who does not look picks right 1 in 3 times |

## Evidence

1. [Uber security update, 2022-09](https://www.uber.com/newsroom/security-update/) — repeated MFA pushes plus a pretext until the victim accepted — via research/10 I-21, accessed 2026-10-22.
2. [Microsoft Entra number matching](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-number-match) — the user types the number shown at sign-in — via research/10 CHANGE-01, accessed 2026-10-22.
3. CISA "Implementing Number Matching in MFA Applications" fact sheet — cited in ADR 0017.
4. Habituation magnitude of repeated prompts: **unverified** in this repository (no measured source on file); the decision rests on the incident pattern in [1].

## Consequences

- New core module `core::fatigue` (pure function of `LogState` + now), used by daemon and wasm; tests `fatigue_survives_daemon_restart`, `new_session_does_not_reset_backoff`, `expired_unanswered_counts`.
- RequestDetails gains the session hash; the daemon's grant lookup gains a session-equality check; `daemon::grant_unusable_from_other_session`.
- PWA: typed number entry, overlap block, storm card, mute.