bare-agent 0.46.2 → 0.46.3

package/bareagent.context.md

@@ -256,7 +256,9 @@ const { answers, costUsd, raw } = await jev.classify('I was charged twice, pleas
 
 Three question types, kept verbatim from Jev's own contract: `noul` (binary probability `0..1`), `choice` (pick one of `criteria`'s keys, plus untrusted `probabilities`/`confidence`), `score` (a position `0..N-1` on `criteria`'s legend). Jev's reply is **untrusted model output** — `classify()` schema-checks the discriminator field against the question that asked it (`ValidationError`, stamped `lib:'bare-agent'`, on a type mismatch or an out-of-range value) before returning it; `probabilities`/`confidence` pass through unvalidated. A question's `instructions` can be a string, or the documented TypeSafe structured forms — an array or a plain object with named parts (e.g. `question`/`inspect`/`focus`/`ignore`) — for giving a question multiple named parts; empty `{}`/`[]`/non-plain values are rejected as missing instructions.
 
-**Injection hardening is on by default, and shape-aware.** `state` is untrusted and can carry an embedded attack (`"you are now…"`, `"ignore previous instructions"`); `classify()` wraps every question's `instructions` with a defensive preamble — prefixed onto a string, prepended as element 0 of an array, or added under a reserved `__hardening__` key on an object — so the classifier treats `state` as data, not commands (copy-on-write, never mutates your `questions` object; a caller-supplied `__hardening__` key is rejected so it can't overwrite the preamble). Opt out with `harden: false` on the constructor or per call.
+**Injection hardening is on by default, and shape-aware.** `state` is untrusted and can carry an embedded attack (`"you are now…"`, `"ignore previous instructions"`); `classify()` wraps every question's `instructions` with a defensive preamble — prefixed onto a string, prepended as element 0 of an array, or added under a reserved `__hardening__` key on an object — so the classifier treats `state` as data, not commands (copy-on-write, never mutates your `questions` object; a caller-supplied `__hardening__` key is rejected so it can't overwrite the preamble). Opt out with `harden: false` on the constructor or per call. **The preamble is part of the question, so hardened and unhardened calls can return different values for the same `state`** — the shift can be large enough to move a decision cutoff. Tune any decision threshold with hardening in the *same* state you ship it in — a threshold tuned against `harden:false` or the raw API silently moves once hardening is on.
+
+**Jev answers are calibrated, not deterministic.** Repeated identical `classify()` calls can differ slightly, and a value sitting on a threshold can cross it between runs — this is the model, not the provider. In tests and thresholds, assert on ranges or on which side of a cutoff a value falls, never on an exact value.
 
 **Calibrate a tier before you trust it.** `calibrateJev` (exported from `bare-agent`, mirrors `calibrate`/judge's harness) grades a Jev model against a frozen clear-case battery (`noul`/`choice`/`score` + a false-positive trap) **and** a multi-style injection battery, admitting only if the clear-case floor clears with zero reds **and** every injection style is resisted:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bare-agent",
-  "version": "0.46.2",
+  "version": "0.46.3",
   "files": [
     "index.js",
     "index.d.ts",

package/src/provider-jev.d.ts

@@ -21,7 +21,7 @@ export class JevProvider {
      * @param {number} [options.deadlineMs] - Total call-duration deadline (ms); 0 disables (default).
      * @param {{in: number, out: number, cacheReadMult?: number, cacheWriteMult?: number}} [options.rates] - Per-1K-token USD rates for authoritative pricing (Jev: `{ in: 0.042/1000, out: 0 }`).
      * @param {boolean} [options.exposeErrorBody=false] - Include the raw error body on a ProviderError (default off).
-     * @param {boolean} [options.harden=true] - Wrap each question's instructions with a defensive preamble (prefixed for a string, prepended as element 0 for an array, or added under a reserved key for an object), treating `state` as untrusted data and resisting embedded role/label-override attempts. Overridable per-call via `opts.harden`.
+     * @param {boolean} [options.harden=true] - Wrap each question's instructions with a defensive preamble (prefixed for a string, prepended as element 0 for an array, or added under a reserved key for an object), treating `state` as untrusted data and resisting embedded role/label-override attempts. Overridable per-call via `opts.harden`. NOTE: the preamble is part of the question, so hardened and unhardened calls can return DIFFERENT values for the same `state` — the shift can be large enough to move a decision cutoff. Tune any decision threshold with hardening in the SAME state you ship it in — a cutoff tuned against `harden:false` or the raw API will be off once hardening is on.
      */
     constructor(options?: {
         apiKey?: string | undefined;
@@ -53,6 +53,10 @@ export class JevProvider {
     harden: boolean;
     /**
      * Classify `state` against one or more typed `questions`. See the class doc for the primitive tags.
+     *
+     * Jev answers are CALIBRATED, not DETERMINISTIC — repeated identical calls can differ slightly,
+     * and a value sitting on a threshold can cross it between runs. Assert on RANGES or on the side of
+     * a threshold, never on an exact value (`toBe(0.62)` will flake).
      * @param {string|object|any[]} state - The shared input all questions judge (Jev's `state`).
      * @param {Record<string, {type: 'noul'|'choice'|'score', instructions: string|object|any[], criteria?: any}>} questions - Keyed questions; each judged independently against `state`.
      * @param {object} [opts]

package/src/provider-jev.js

@@ -77,7 +77,7 @@ class JevProvider {
    * @param {number} [options.deadlineMs] - Total call-duration deadline (ms); 0 disables (default).
    * @param {{in: number, out: number, cacheReadMult?: number, cacheWriteMult?: number}} [options.rates] - Per-1K-token USD rates for authoritative pricing (Jev: `{ in: 0.042/1000, out: 0 }`).
    * @param {boolean} [options.exposeErrorBody=false] - Include the raw error body on a ProviderError (default off).
-   * @param {boolean} [options.harden=true] - Wrap each question's instructions with a defensive preamble (prefixed for a string, prepended as element 0 for an array, or added under a reserved key for an object), treating `state` as untrusted data and resisting embedded role/label-override attempts. Overridable per-call via `opts.harden`.
+   * @param {boolean} [options.harden=true] - Wrap each question's instructions with a defensive preamble (prefixed for a string, prepended as element 0 for an array, or added under a reserved key for an object), treating `state` as untrusted data and resisting embedded role/label-override attempts. Overridable per-call via `opts.harden`. NOTE: the preamble is part of the question, so hardened and unhardened calls can return DIFFERENT values for the same `state` — the shift can be large enough to move a decision cutoff. Tune any decision threshold with hardening in the SAME state you ship it in — a cutoff tuned against `harden:false` or the raw API will be off once hardening is on.
    */
   constructor(options = {}) {
     this.apiKey = options.apiKey;
@@ -92,6 +92,10 @@ class JevProvider {
 
   /**
    * Classify `state` against one or more typed `questions`. See the class doc for the primitive tags.
+   *
+   * Jev answers are CALIBRATED, not DETERMINISTIC — repeated identical calls can differ slightly,
+   * and a value sitting on a threshold can cross it between runs. Assert on RANGES or on the side of
+   * a threshold, never on an exact value (`toBe(0.62)` will flake).
    * @param {string|object|any[]} state - The shared input all questions judge (Jev's `state`).
    * @param {Record<string, {type: 'noul'|'choice'|'score', instructions: string|object|any[], criteria?: any}>} questions - Keyed questions; each judged independently against `state`.
    * @param {object} [opts]