Message Trust Sidecar: proposal

Byron's goal (2026-10-03): for each incoming text, decide spam or not, give it a confidence score, and only ring the phone for texts that are legitimate, without calling a real stranger "spam".

Status: proposal only. Nothing is built. Your PRD paste cut off partway through §7, and the six reviewers it mentions never came through, so the six reviewers below were chosen by Claude.

---

1. The answer in one screen

Yes, this can be built, and it can score real texts. It runs as a small Android app beside Google Messages:

1. It reads each Google Messages notification. It has no inbox access, does not send texts, and does not become the default texting app.
2. It runs a fixed set of rules that only add or remove points.
3. It decides whether your phone should ring.

There's evidence it works. The scoring reviewer built a reference scorer, and it scores 42 realistic test texts exactly as expected. Those texts include toll scams, fake FedEx messages, a real Chase alert, "Are you working today?", and "Hey it's Jake, new number". The results are in §4.

---

2. How the score works

Every text gets two separate ledgers, which are never merged into one number:

• Who is this? (identity and context). Evidence: a saved contact, a sender you trust, a known short code with a link on the brand's real domain, a match to your expected-senders list, or the fact that you replied in this thread before.
• Is this a scam move? (risk). Evidence: a link on a domain that isn't the brand's, a lookalike or punycode domain, a small fee plus a threat, a request to share a code, gift cards or crypto, an urgent "fraud alert" with a call-back number, an email-gateway sender, a "reply Y to activate the link" trick, and so on. The catalog has about 60 codes, each with a rule, a weight and false-positive notes.

What each score means:

Verdict comes from a fixed table, not a single cut-off:

1. A tripwire makes the verdict at least Suspicious. Tripwires: a brand that doesn't match the link's domain, a lookalike domain, a request to share a code, or a gift-card or crypto payment. Tripwires are checked before visibility, so even a cut-off preview still catches them.
2. Risk ≥ 70 → Likely scam. Risk 40–69 → Suspicious.
3. A saved or trusted contact with low risk → Recognized.
4. Low risk plus at least one piece of evidence a scammer can't fake → Likely legitimate. A scammer can't fake: a saved contact, your own earlier reply, a known short code, a link on the brand's real domain, or a specific match to your expected-senders list. The message text alone can never earn "legitimate".
5. If none of the above apply → Unrecognized / not enough context. This is the honest "we don't know" bucket, and it is never labeled spam.
6. If the app can't see the text → Cannot assess.

Two safety rules learned from the threat review:

• Your context can raise trust, but it can never lower risk. If you're expecting FedEx and a "FedEx" text links to fedex-track.info, it is still a scam. The explanation says so: "You're expecting FedEx, but this link isn't fedex.com."
• A sender's self-introduction only counts as a claim. If it comes with a request (call, pay, reply or click), the match to your expected-senders list stops counting toward trust.

Example: "Are you working today?" from an unknown number gets scam risk 18 and legitimacy 12. Verdict: Unrecognized / not enough context. Why: no self-introduction, no link, no request. The app also notes that real people and wrong-number scams both open this way, so it watches the next message for a pivot to "sorry, wrong number, I'm Amy…".

---

3. "Only ring for legit": let Android do the silencing

This design came out of the Fable critique (§9) and replaces the earlier plan, which silenced Google Messages and had the sidecar ring instead.

The flaw in the earlier plan: a sidecar that is the only thing that rings has to be alive for any text to ring. Samsung routinely kills background apps, and a dead app can't sound an alarm about being dead.

The fix: reverse the direction.

1. Android Do Not Disturb, set to "Messages: from contacts only".

• This is a built-in setting with no code: your contacts and starred people ring, and texts from everyone else arrive silently in the notification shade.
• Google Messages keeps working normally, including Android Auto read-aloud, your watch, inline reply and bubbles.

2. The sidecar only adds rings. Its alert channel is allowed through Do Not Disturb, and it rings in two cases:

• An **unknown sender that scored *Likely legitimate***: a match to your expected-senders list, a known short code with a link on the brand's real domain, a one-time code from a known short code, or a sender you replied to earlier.
• A hidden one-time code that it can't read, because you might be waiting for it.

3. Everything else stays silent but labeled. Each silent text gets a small verdict note: grey Unrecognized or orange ⚠ Likely scam, with a one-line reason. Nothing is ever hidden, deleted, blocked or reported.

Failure modes, by design:

Safeguard: the Mac Mini checks a heartbeat from the phone (over adb or Tailscale) and warns you through Signal if the sidecar has been silent for an hour. The phone app itself still has no internet permission.

Test-build checks for this design:

• Does the sidecar's channel ring through Do Not Disturb on your Samsung? (In Do Not Disturb → Apps, add the sidecar as an exception.)
• Does "Messages from contacts" cover Google Messages RCS texts?

4. Real scores on 42 test texts

The scores come from the reference scorer: docs/reviews/tools/score.py, run against golden-corpus.json, with 0 wrong verdicts and 0 wrong reason codes out of 42. Brand short-code numbers in these test cases are made up, and links are defanged as hxxps:// so they can't be tapped.

Totals under the §3 design: 🔔 11 ring. That's 1 contact through Android, 8 unknown-but-legitimate senders rung by the sidecar, and 2 hidden one-time codes. 🔕 12 are silent and unflagged, and 🔕 19 are silent and flagged ⚠.

Honesty note, from the Fable critique: these 42 cases and the rules were written by the same author, so "42/42" only proves the rules do what they were written to do. Known gaps the rules don't handle yet:

• Brands' real short-link domains are missing from the list. Examples are PayPal's py.pl, Amazon's a.co and Verizon's vzw.com, so a genuine text from any of them would wrongly trip the brand-vs-link tripwire.
• The "risky domain ending" list is too broad. It includes endings like .info, .shop and .live that plenty of real small businesses use.
• The brand short codes are made up.

Phase 1 fixes these, freezes the expected answers by hand, and adds a held-out test set: your real last 90 days of texts, labeled blind.

---

5. Plan

Cut from v1:

• The on-device AI model. It duplicates Google's own, sends telemetry, and could be manipulated by text in a message.
• Weights that learn from your feedback. A "Trust this sender" button is enough.
• The calendar permission and work-profile support.
• The earlier plan to silence Google Messages and have the sidecar ring instead. Replaced by §3.

Confidence shown on the card: a band, Low / Medium / High risk, until about 200 of your texts are labeled. The exact number is a tap away. The scoring reviewer warned that two-digit percentages imply a precision we don't have yet.

Built in from day 1:

• No internet permission. A build check fails if any library sneaks it in.
• No message bodies stored.
• Phone numbers are never written to logs or exports.
• The app's notes never quote the message, so scam text can't impersonate a verdict.
• Backups are off.

6. What it cannot do (without becoming your default texting app)

• See texts Google already filed as spam. They post no notification. Partial fix: the "expected sender didn't show up → check Spam" nudge.
• See what you've sent, apart from the last few messages Google includes in a notification. So "I texted this number first" is weak evidence.
• Block, report or delete. No public way to do it exists, so you do those in Google Messages.
• Read one-time codes on a Pixel. Android 15 hides the code and the sender from apps like this. These score as Cannot assess and ring, which is also the private outcome. Whether Samsung does the same is unverified.
• Read pictures or attachments.
• Install from a browser. Play Protect blocks apps with notification access that are installed that way, so it installs over a cable with adb install.

Becoming the default texting app would lose RCS and Google's own scam protection, so it isn't recommended.

---

7. What the six reviews changed (decision log)

Separately: the old sms-spambot-gateway (Harold) writes messages from real people to public Vercel Blob storage (access: 'public' in api/webhook.js and api/inbox.js). Those should be switched to private. That fix is independent of this project.

---

8. Full reviews

• Android feasibility
• Threat model & prompt injection
• Privacy & data minimization
• Scoring & calibration
• UX & interruptions
• Skeptical product critic

---

9. Self-critique: Fable adversarial pass

Run by Claude Fable 5 as an adversarial critic on the first draft of this proposal (2026-10-03). Its main findings, and what changed:

1. "Only ring for legit" would have lost real texts by design. The first draft sent unknown-but-real senders to a twice-a-day Quiet list. That included the Amazon driver at your gate and Sophie proposing Saturday climbing. The go-live check only counted texts wrongly hidden, so it never measured this.

• The draft's safeguards were weak. A watchdog inside a Samsung-killed app can't report its own death, and 14 days at ~5 unknown texts a week is too few to prove safety.
• Silencing Google Messages also disables Android Auto read-aloud, your watch and inline reply.
• Changed: §3 now uses the reversed design (Do Not Disturb silences, the sidecar adds rings), the heartbeat is checked from the Mac Mini, and there's a "generous" setting for time-sensitive strangers.

2. The 42/42 result is circular. The test harness copies the detector's own output back in as the expected answer, and some rules were patched to fit specific cases. Real brand link domains (py.pl, a.co, vzw.com) would trip a tripwire.

• Changed: the scorecard dropped to 6/10, the gaps are disclosed in §4, and Phase 1 freezes the expected answers by hand and tests on your real 90 days of texts.

3. The scam-catching half mostly repeats Google's protection. The real product is notification triage: the expected-senders list, plain explanations, and the "real but unfamiliar" tier.

• Changed: the framing in §1 and §3, and the Phase 0 go/no-go is now binding.

4. Fable's bold idea, adopted: reverse the design. Never silence Google Messages; let Android do it, and make the scorer able only to add attention, never remove it.

Fable's call on the open question was "do not silence Google Messages in v1". This proposal follows that call, and still delivers "only ring for legit" through Do Not Disturb.