![\"GrantTap](\"docs/images/iphone-command-center.png\")
\n ![\"GrantTap](\"docs/images/iphone-chat.png\")
\n ![\"GrantTap](\"docs/images/iphone-mcp-usage.png\")
\n\n \n \n \n
\n ![\"GrantTap](\"docs/images/apple-watch-inbox.png\")
\n ![\"GrantTap](\"docs/images/apple-watch-approval.png\")
\n
\n ![\"Projects:](\"docs/images/iphone-projects-shared.png\")
\n ![\"Two](\"docs/images/iphone-linked-projects.png\")
\n ![\"A](\"docs/images/iphone-project-mesh.png\")
\n ![\"A](\"docs/images/iphone-task-route.png\")
\n ![\"Task](\"docs/images/iphone-handoff.png\")
\n
Shared Projects · linked repository bindings with separate Project access · Project management · Task execution history · handoff readiness
\n\n\n ![\"Full-screen](\"docs/images/iphone-weavatrix-graph.png\")
\n ![\"Full-screen](\"docs/images/iphone-health-code-towers.png\")
\n
These are deterministic simulator fixtures, not reports from a live customer repository.
\n\nAn authenticated controller can request a separate, one-time device credential\nfor another iPhone or iPad from each Live linked computer. The phone packages\nthe resulting links in an encrypted, single-use QR. This adds the new phone to\nthe same device network; it does not grant Project membership. Explicit human\ndecisions for a bound Project Task can be recorded through Engine Memory, and\na same-scope correction supersedes an earlier decision while retaining history.\nThe computer returns `recorded` only after the Engine confirms storage.\n\nThe capability catalog distinguishes local observations from installed and\ninitialized state. It does not yet transfer and apply complete MCP or skill\nbundles to every host. Usage figures do not enforce spending caps. Project\nEnvironment secrets injected into an agent process remain readable by that\nprocess; a use-only credential broker is not part of this runtime yet.\n\nFor Claude Code, Codex, and Cursor, the provider hook runs inside the agent's\nown session and sees the exact call. GrantTap attributes every `notify` to the\nsession that really made it and publishes the event only for that execution —\na model that learned another session's id cannot act in its name.\n`granttap://mesh/current` therefore carries no Project data: an attributed call returns this execution's opaque\n`granttap://mesh/\n ![\"Members](\"docs/images/iphone-members.png\")
\n ![\"Invite](\"docs/images/iphone-invite.png\")
\n ![\"Join](\"docs/images/iphone-join-project.png\")
\n ![\"A](\"docs/images/iphone-members-shared.png\")
\n
The owner's members and computers · an invite with its role · joining from another phone · the shared Project as the member sees it, with a computer of their own to add
\n\nA member works in the Project with computers of their own. Adding one hands\nit the Project's mesh key over the pairing the member's phone already trusts,\nand from then on that computer takes part in the mesh like any other: its\nchats are the Project's, its claims are seen by every other computer, and a\nTask can be handed to it.\n\nA Project can pin new tasks to one confirmed computer. The endpoint id is\nthe stored computer identity, not the display name. Models offered on the\nphone come from that host's catalog. If the pinned host is offline, the\nProject either refuses the create or queues it until a deadline — it does\nnot silently start the task elsewhere. A command issued for a previous\ninstance of the computer (a restore or clone that kept pairing keys) is\nrejected. A pin is not a secure VM.\n\n### A claim released by the person\n\nA claim outlives an agent that crashed or was closed, and the files it names\nstay fenced off until it expires. Touch and hold a claim on the Task screen\nto release it yourself. The phone tells the computer that holds the claim,\nand the computer answers with a result of its own: released, or refused with\nthe reason — no such claim on this computer, a claim that belongs to another\nProject, a role that does not allow it, or no computer to ask. A refusal puts\nthe claim back on the phone with that reason beside it, so what the phone\nshows is what the mesh holds. A release is written to the store as a\ntombstone, so a snapshot or a late event from a computer that was away cannot\nbring the claim back.\n\n### Task reports\n\n\n ![\"A](\"docs/images/iphone-report.png\")
\n
\n ![\"Project](\"docs/images/iphone-governance.png\")
\n ![\"A](\"docs/images/iphone-member-detail.png\")
\n
Governance for the whole Project · a member's answers, changed at once
\n\nCapabilities are decided per Project, not per task. A policy names an effect —\n`allow`, `ask`, or `deny` — for each kind (skills, MCP servers, shell and\nscripts, file writes, deploy, network), and may name one capability alone: one\nMCP server can be forbidden without forbidding every server. A named rule wins\nover its kind, and a global deny always wins over a Project.\n\nThe phone authors the policy and hands it to every Project computer through the\nrelay, which holds the encrypted packet until each computer reads its mailbox;\na computer that was asleep receives it when it returns. Each computer applies\nthe policy through the GrantTap Engine, acknowledges the revision it enforces,\nand reports coverage — enforced, observed only, unsupported, or unknown — per\ncapability kind, so the phone shows what is actually in force rather than what\nwas sent. Revision zero is a Project with no policy yet, and it is reported so\nthe first policy can be written.\n\nA refused edit is answered, not swallowed. When a computer cannot apply a\npolicy — the phone built it on a revision the computer no longer holds, the\nengine is not running, the policy is invalid — it sends\n`project.policy.rejected` with the reason and the revision it actually holds,\nthen the policy it holds, so the phone can say what happened, keep the edit,\nand offer it again on top of the current revision. The helper log carries the\nsame line. What the engine leaves null is sent as absent: the phone reads a\nstatus strictly, and a `null` where a field was optional was read as a wrong\nvalue and the whole status dropped.\n\nA shell call is fingerprinted by the command it runs (`git`, `rm`), a deploy or\nnetwork call by the phrase that made it one (`git push`, `curl`), so a named\nrule can forbid pushing or deleting while the rest of the shell stays allowed.\nA commit or pull request whose command carries a co-author or \"generated with\"\ntrailer is fingerprinted as `co-authorship`, its own row in the phone's Shell\ntable, so a Project whose history is authored by people can deny the trailer\nand leave git alone.\n\nEvaluation happens in the provider hook before the action runs, with a deadline\nlong enough for a busy machine to answer. A missed answer falls back to the\nlegacy GrantTap gate rather than to a silent allow, and content never crosses\nto the engine: it receives a capability fingerprint, not the command or file.\n\nA refusal is said where the action was. Each one is written down for its chat,\nand the timeline carries it as a status row naming the rule and the reason,\nbeside the call it stopped. On the phone a rule is written where the need for\nit appears: touch and hold a tool on the Project page, or use the Governance\nmenu on a tool's call history, to allow, ask, or deny it for the Project.\n\n## Relay boundary\n\nPairing and task keys are generated locally. The relay receives opaque routing\nmetadata and ciphertext, not provider credentials or task plaintext. Pairing\nhandoff uses a relay-visible random mailbox ID plus an independent transfer key\nthat stays in the QR.\n\nAPNs carries a content-neutral wake only. It contains no prompt, task title,\ncommand, path, request ID, or ciphertext. See [SECURITY.md](SECURITY.md) for the\ncomplete boundary and reporting instructions.\n\n## Development\n\n```bash\nnpm install\nnpm run typecheck\nnpm test\nnpm run package:allowlist\nnpm run test:coverage # macOS only — see below\n```\n\n`npm test` runs everywhere. Both suites run with an isolated `HOME`, so a\ndeveloper's own Claude/Codex/Cursor data can never inflate a local result: the\nnumbers on this machine and in CI are the same. The coverage contract is\nmeasured on macOS because the background helper, the Cursor OAuth service, and\nthe installer only execute there, so a Linux percentage understates real\nruntime coverage. CI runs the cross-platform suite on Linux and the coverage\ngate on macOS, and `npm publish` enforces the same gate through\n`prepublishOnly`.\n\nDo not publish from a dirty checkout or before the package allowlist, tests,\ntypecheck, and release checks pass.\n\n## License\n\nGrantTap MCP, its CLI, and bundled plugins are distributed under the\n[MIT License](LICENSE). The iPhone and Apple Watch app is licensed separately.\nThird-party dependencies retain their own terms; see\n[THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).\n\nGrantTap is not affiliated with Anthropic, OpenAI, Apple, Anysphere, or xAI.\n","readmeFilename":"README.md"}