specpi 0.28.0 → 0.30.0

package/extensions/jev-advisor/config.mjs

@@ -5,6 +5,10 @@
 // name and never by value, because "how do I configure this" is a question asked before enabling
 // anything -- see key-source.mjs.
 //
+// The command guard is not here at all. It is a separate pinned package that keeps its own
+// configuration and its own switch, and nothing in this file tracks it -- see scripts/jev-guard.mjs
+// for the one place SpecPi touches it, which is install time.
+//
 // The file is SpecPi's own, hardened the same way as web-access and capability-policy: atomic
 // write, mode 0600, symlinks refused, and a missing or unreadable file read as off.
 
@@ -14,23 +18,7 @@ import path from "node:path";
 import { randomUUID } from "node:crypto";
 
 /** Systems that may run inside a session. Offline scripts are not gated here. */
-export const SYSTEM_NAMES = Object.freeze([
-    "retention",
-    "compaction",
-    "gap",
-    "sources",
-    "progress",
-    "untrusted",
-    "capability",
-    // The command guard, native since schema 3. It used to be a separate pinned package with its own
-    // global configuration file, which is why it used to carry its own switch here: a second switch,
-    // outside the master, with its own startup preference and its own persistence rules. Those rules
-    // disagreed with the layer's often enough to be their own source of defects -- a preference
-    // erased by a command that had decided nothing about the guard, a state written by one command
-    // and reverted by the next session. As a system it is gated, budgeted, reported and toggled by
-    // exactly the same code as the other seven.
-    "guard",
-]);
+export const SYSTEM_NAMES = Object.freeze(["retention", "gap", "sources", "progress", "untrusted", "capability"]);
 
 /**
  * What a confident stuck verdict is allowed to do. `notify` tells the person and cannot be wrong in
@@ -52,8 +40,8 @@ export const SYSTEM_NAMES = Object.freeze([
 export const NUDGE_MODES = Object.freeze(["notify", "message"]);
 
 const MAX_SETTINGS_BYTES = 4096;
-const MAX_CALL_BUDGET = 256;
-const MAX_TOTAL_BUDGET = 512;
+const MAX_CALL_BUDGET = 1024;
+const MAX_TOTAL_BUDGET = 2048;
 
 /**
  * One shared budget could not survive a turn-level system. A system that fires once per turn would
@@ -61,16 +49,19 @@ const MAX_TOTAL_BUDGET = 512;
  * session, and which one won would be decided by event ordering rather than by anyone's policy.
  *
  * So the ceiling is two-level: each system gets its own, and the total is a real constraint because
- * it is deliberately less than their sum. Running out of one system's budget stops that system and
- * nothing else.
+ * it is deliberately less than their sum -- 2048 against 2274. That relationship is the invariant,
+ * not either number: raising the total without raising the per-system ceilings would leave a total
+ * no combination of systems could ever reach, which is a limit that reads as a limit and is not
+ * one. `tests/jev-advisor.test.mjs` pins the inequality so a future change to one has to consider
+ * the other. Running out of one system's budget stops that system and nothing else.
  *
  * The per-system numbers follow how often each one can fire: retention on every large read-only
- * result, compaction once or twice in a long session, gap per report, sources per delegation batch.
+ * result, gap per report, sources per delegation batch.
  */
 export const DEFAULT_BUDGETS = Object.freeze({
     // A backstop, not a working limit, and the number says which. Measured, a full tier-3 task -- a
     // 120-step repair chain over about 25 model requests -- spends 4 to 7 calls, and the busiest
-    // attempt ever recorded spent 12. A session would have to run for days before 512 bound
+    // attempt ever recorded spent 12. A session would have to run for days before 2048 bound
     // anything a person was actually doing, which is the point: the ceiling should only ever be hit
     // by a loop, and hitting it should therefore be information rather than an inconvenience.
     //
@@ -78,35 +69,36 @@ export const DEFAULT_BUDGETS = Object.freeze({
     // runs for two minutes; an interactive session runs for a day, and a turn-level system at one
     // call every four turns reaches 120 somewhere in the afternoon and then goes quiet without
     // having found anything wrong. A ceiling that a normal long session reaches is not protecting
-    // anyone, it is just failing later than it looks.
+    // anyone, it is just failing later than it looks. 512 was the same mistake one order of
+    // magnitude further out, and the long-session evals are what showed it: a session long enough
+    // to compact several times spends in the hundreds, so the backstop sat close enough to real
+    // use to be reachable by a session that was working correctly.
     //
-    // Cost is not what these are for. A call is about $0.00003, so the whole total is about a cent
-    // and a half. They bound two things that do not get cheaper with scale: how much digest leaves
-    // the machine for a third party, at up to 1 KB a call, and how much awaited latency a runaway
-    // loop can add before something stops it. Half a megabyte of digest and an announced stop is
-    // the shape of the trade.
-    total: 512,
-    retention: 208,
-    compaction: 12,
-    gap: 48,
-    sources: 32,
+    // Cost is not what these are for. A call is about $0.00003, so the whole total is about six
+    // cents. They bound two things that do not get cheaper with scale: how much digest leaves the
+    // machine for a third party, at up to 1 KB a call, and how much awaited latency a runaway loop
+    // can add before something stops it. Two megabytes of digest and an announced stop is the shape
+    // of the trade.
+    total: 2048,
+    // The per-system numbers move with the total, because a total the per-system ceilings can never
+    // add up to is not a constraint at all -- see below. They are scaled rather than re-derived:
+    // each one's rationale is a firing frequency, and none of those frequencies changed.
+    retention: 832,
+    gap: 192,
+    sources: 128,
     // Turn-level, but gated behind local signals and a four-turn cooldown, so it only spends on
     // sessions that already look wrong. The ceiling is what stops a genuinely thrashing session
     // from spending the total on being told it is thrashing.
-    progress: 176,
+    progress: 704,
     // Usually free: when retention is on, system 7's question rides the call retention was already
     // making against the same state. This ceiling only binds when retention is off, or when the
     // fetched result is too small for retention to be interested in it.
-    untrusted: 104,
+    untrusted: 416,
     // Once per session by construction, and only when local signals already suggest it. Two rather
-    // than one so a retried first turn is not silently un-served.
+    // than one so a retried first turn is not silently un-served. The one number here that does not
+    // scale with the total, because it is not sized by a frequency: the system asks once and then
+    // never again, so a larger ceiling would buy nothing and would only misdescribe what it does.
     capability: 2,
-    // Per gated tool call that local rules could not settle, so its frequency is retention's rather
-    // than compaction's -- and like retention, most calls never reach it: read-only commands and
-    // ordinary project writes are answered locally for nothing. Running out means the guard defers
-    // to the permission system for the rest of the session, which is what it does for every other
-    // kind of unavailability.
-    guard: 208,
 });
 
 /** 0 is a real budget meaning no calls. Switching a system off is what `systems[name] = false` is for. */
@@ -143,7 +135,7 @@ export function regularFile(file, label) {
 /** Every unknown shape collapses to the same all-off default rather than a partial enable. */
 export function defaultSettings() {
     return {
-        schema: 3,
+        schema: 5,
         master: false,
         startup: false,
         systems: Object.fromEntries(SYSTEM_NAMES.map((name) => [name, false])),
@@ -187,36 +179,73 @@ function migrate(raw) {
 }
 
 /**
- * Schema 2 carried the command guard as a separate `guard: { enabled, startup }` pair, because it
- * was a separate package with its own global configuration file. Schema 3 makes it the eighth
- * system, so the stored preference becomes `systems.guard`.
+ * Schema 4 removes every trace of the command guard from this file, from either shape it took.
+ *
+ * Schema 2 kept a `guard: { enabled, startup }` pair, from when SpecPi re-asserted the package's
+ * switch at every session start; schema 3 made the guard the layer's eighth system under
+ * `systems.guard`. Both keys go, because neither answer is SpecPi's to hold any more: the package
+ * owns its switch in its own file, and a stale copy here could only ever disagree with it.
+ *
+ * Dropping them changes nothing about whether anyone's guard is on. A schema-2 file's preference
+ * had already been written through to the package's own configuration by the last session that
+ * read it, and schema 3 shipped with no guard package installed at all.
+ */
+function migrateToFour(raw) {
+    const { guard: _pair, ...rest } = raw ?? {};
+    const { guard: _system, ...systems } = rest.systems ?? {};
+
+    return { ...rest, schema: 4, systems };
+}
+
+/**
+ * Schema 5 removes compaction guidance, which was withdrawn rather than fixed.
+ *
+ * Two tier-6 runs, on SpecPi 0.28.0 and 0.29.0, both measured the arm carrying it solving fewer
+ * long-session tasks than plain SpecPi: 14/16 against 8/16 pooled, Fisher exact p = 0.054. Over the
+ * same attempts compaction was 55 of 56 applied verdicts, so the arm's behaviour was almost entirely
+ * this system's, and no other system in the layer applied enough to be a candidate.
  *
- * `guard.startup` is what migrates, not `guard.enabled`: the former is what the user chose for new
- * sessions, and the latter was a session flag that happened to be written to disk. A file where the
- * guard was wanted at startup but the layer itself was not produces a system that is on inside a
- * layer that is off, which is inactive -- the guard used to sit outside the master switch and now
- * does not. That direction is deliberate: a gate quietly becoming inactive is recoverable in one
- * command, and a gate quietly becoming active is how a session stops being able to run anything.
+ * The evidence never reached significance and the mechanism was never isolated. The system was
+ * removed anyway, because a system that steers a summary has to earn the risk it takes, and one
+ * whose only measurement says it costs solve rate has not.
+ *
+ * Both the `systems.compaction` switch and the per-system `budgets.compaction` ceiling go. Dropping
+ * them turns nothing off that a user had on in any meaningful sense: the hooks they gated no longer
+ * exist, so a retained preference could only describe a system that cannot run.
  */
-function migrateToThree(raw) {
-    const systems = { ...(raw?.systems ?? {}), guard: raw?.guard?.startup === true };
+function migrateToFive(raw) {
+    const { compaction: _system, ...systems } = raw?.systems ?? {};
+    const { compaction: _budget, ...budgets } = raw?.budgets ?? {};
 
-    const { guard: _guard, ...rest } = raw ?? {};
+    return { ...raw, schema: 5, systems, budgets };
+}
 
-    return { ...rest, schema: 3, systems };
+/**
+ * What the advisor will read, given a settings object, without writing it anywhere.
+ *
+ * Exported for callers that compose a settings file for somewhere other than this process's own
+ * agent directory -- the eval harness writes one into a disposable home -- and need to check what
+ * they composed. Building a literal and trusting it is how the harness came to run every published
+ * tier with a system it believed it had enabled switched off: it hardcoded a schema number, the
+ * migration for that number read a preference from a key that shape does not have, and nothing ever
+ * compared the result to the ask. Compose, then normalize, then assert -- not compose and trust.
+ */
+export function normalizeSettings(raw) {
+    return normalize(raw);
 }
 
 function normalize(raw) {
     const one = raw?.schema === 1 ? migrate(raw) : raw;
-    const source = one?.schema === 2 ? migrateToThree(one) : one;
-    if (source?.schema !== 3) {
+    const four = one?.schema === 2 || one?.schema === 3 ? migrateToFour(one) : one;
+    const source = four?.schema === 4 ? migrateToFive(four) : four;
+    if (source?.schema !== 5) {
         return defaultSettings();
     }
 
     const systems = Object.fromEntries(SYSTEM_NAMES.map((name) => [name, source.systems?.[name] === true]));
 
     return {
-        schema: 3,
+        schema: 5,
         master: source.master === true,
         startup: source.startup === true,
         systems,
@@ -252,9 +281,9 @@ export function writeFileAtomic(file, contents) {
 }
 
 export function saveSettings(settings) {
-    // A caller handing back a schema-1 shape is migrated rather than reset, so a round trip through
+    // A caller handing back an older shape is migrated rather than reset, so a round trip through
     // an old reader cannot quietly disable the layer.
-    const next = normalize(settings?.schema === 1 || settings?.schema === 2 ? settings : { ...settings, schema: 3 });
+    const next = normalize([1, 2, 3, 4].includes(settings?.schema) ? settings : { ...settings, schema: 5 });
     const file = settingsFile();
     if (fs.existsSync(file)) {
         regularFile(file, "Jev settings");

package/extensions/jev-advisor/gate.mjs

@@ -50,12 +50,11 @@
 //    was unreachable, and running the layer could never have revealed it, because a system that
 //    never fires looks exactly like a system whose advice was always to do nothing.
 //
-//    compaction's `unresolved_thread` had the same problem at high 0.85: the clearest open
-//    investigation the fixture can express scores 0.63-0.65. It is lowered to 0.60, which is
-//    defensible only because of what that branch does -- add one sentence to a summariser prompt
-//    that is being rebuilt from scratch anyway. It is the cheapest action in the layer, so it can
-//    afford the loosest gate. gap keeps 0.85 because its Noul reaches 0.96 on the case that matters
-//    and because a firing there blocks a write.
+//    Compaction guidance had the same problem and was lowered to 0.60 to clear it. That system has
+//    since been withdrawn -- two tier-6 runs measured the arm carrying it solving fewer long-session
+//    tasks than plain SpecPi -- so the loosest gate in the layer is gone with it. gap keeps 0.85
+//    because its Noul reaches 0.96 on the case that matters and because a firing there blocks a
+//    write.
 
 /**
  * The figures the comment above cites, in a form a test can check against the artifact. A citation
@@ -91,16 +90,6 @@ export const THRESHOLDS = Object.freeze({
         // Measured 0.06-0.07 on the spent case, so this clears with room.
         low: 0.1,
     }),
-    compaction: Object.freeze({
-        scoreConfidence: 0.6,
-        boundary: 0.3,
-        choiceConfidence: 0.75,
-        margin: 0.25,
-        // Lowered from 0.85: the clearest open investigation scores 0.63-0.65, and the action is
-        // one sentence added to a prompt that is being rebuilt regardless.
-        high: 0.6,
-        low: 0.15,
-    }),
     gap: Object.freeze({
         scoreConfidence: 0.6,
         boundary: 0.3,
@@ -156,20 +145,6 @@ export const THRESHOLDS = Object.freeze({
         high: 0.85,
         low: 0.15,
     }),
-    guard: Object.freeze({
-        // The same measured Score operating point as every other system, written out rather than
-        // inherited by falling through `thresholdsFor`'s default. The guard asked under the name
-        // "gap" for exactly as long as it took to notice that adding a `guard` entry would then have
-        // changed nothing -- a silent no-op on the one system whose action takes a tool call away.
-        scoreConfidence: 0.6,
-        boundary: 0.3,
-        choiceConfidence: 0.75,
-        margin: 0.2,
-        // Unused: this system reads only the Score side. Kept so every system has a full set, and
-        // so the calibration tests cover this entry like any other.
-        high: 0.85,
-        low: 0.15,
-    }),
     sources: Object.freeze({
         scoreConfidence: 0.6,
         boundary: 0.3,

package/extensions/jev-advisor/index.ts

@@ -2,55 +2,24 @@ import fs from "node:fs";
 import { type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { SYSTEM_NAMES, loadSettings, saveSettings, settingsPath } from "./config.mjs";
 import { keySources } from "./key-source.mjs";
-import { applyLayer, guardWarning, layerScopeLine, layerToPersist, startupToPersist } from "./layer.mjs";
+import { applyLayer, layerScopeLine, layerToPersist, startupToPersist } from "./layer.mjs";
 import { consentPath, granted, revokeConsent } from "./consent.mjs";
 import { createBroker } from "./broker.mjs";
 import { ledgerPath, read as readLedger } from "./ledger.mjs";
 import { usagePath } from "./usage.mjs";
-import { GATED_TOOLS, SHELL_TOOLS, callTargets, classifyCall, commandText } from "./risk.mjs";
 import * as retention from "./questions/retention.mjs";
-import * as compaction from "./questions/compaction.mjs";
 import * as gap from "./questions/gap.mjs";
 import * as sources from "./questions/sources.mjs";
 import * as progress from "./questions/progress.mjs";
 import * as untrusted from "./questions/untrusted.mjs";
 import * as capabilities from "./questions/capabilities.mjs";
-import * as guard from "./questions/guard.mjs";
 
 const MAX_RECENT = 8;
 
-/** One line of a call, for a notification or a block reason. Never a digest; never sent anywhere. */
-function short(value: string, limit: number) {
-    const text = String(value ?? "")
-        .replace(/\s+/gu, " ")
-        .trim();
-
-    return text.length > limit ? `${text.slice(0, limit - 1)}…` : text;
-}
-
 function safeMessage(error: unknown) {
     return String((error as any)?.message ?? error ?? "unknown error").slice(0, 200);
 }
 
-/**
- * Tell the person something, and never let the telling change what happens.
- *
- * `ctx.ui.notify` reaches the host over RPC and can throw -- a disconnected client, a torn-down UI,
- * a host without the method. Called inline inside the guard's fail-open catch, one such throw
- * unwound a decided refusal into an allow, so the announcement is isolated from the decision here.
- */
-function announce(ctx: ExtensionContext, message: string) {
-    if (!ctx.hasUI) {
-        return;
-    }
-
-    try {
-        ctx.ui.notify(message, "error");
-    } catch {
-        // A failed notification is not a reason to run a command, or not to.
-    }
-}
-
 export default function jevAdvisor(pi: ExtensionAPI) {
     // Session switches live in memory. A session toggle must never write the startup preference,
     // so the saved file is read once per session and only /jev startup ever writes it.
@@ -254,111 +223,6 @@ export default function jevAdvisor(pi: ExtensionAPI) {
         }
     });
 
-    // System 8: the command guard, before a shell or file call runs.
-    //
-    // Fail open at every step. Local triage settles most calls for nothing; anything else is asked
-    // about, and a call is blocked only on a confident verdict that the request does not account
-    // for. Every other outcome -- no key, no budget, a timeout, an unconfident answer, no human to
-    // ask -- returns the call to @gotgenes/pi-permission-system, which decides it exactly as it did
-    // before this layer existed. The package this replaced was fail-closed, so an outage or a
-    // missing key stopped work; that is the single behaviour most worth not reproducing.
-    pi.on("tool_call", async (event: any, ctx: ExtensionContext) => {
-        if (!enabled("guard") || !GATED_TOOLS.includes(event?.toolName)) {
-            return undefined;
-        }
-
-        const shell = SHELL_TOOLS.includes(event.toolName);
-        // Not `input.command`: `write_stdin` types into a live shell under another name, so reading
-        // one key classified every such call as the empty string -- spending a guard call on nothing
-        // while the text actually being run went unexamined.
-        const command = shell ? commandText(event?.input) : "";
-        // Every file the call names, because `multi_edit` and `apply_patch` do not carry one `path`
-        // and a target the guard cannot see is a target it never asks the credential question about.
-        const targets = callTargets(event?.input);
-        const local = classifyCall({ tool: event.toolName, command, targets, cwd: ctx.cwd });
-        const subject = shell
-            ? command || "(command unknown)"
-            : `${event.toolName} ${targets.join(", ") || "(target unknown)"}`;
-
-        // Built once, and nothing inside it may throw. A refusal that has already been decided must
-        // reach the harness: an exception raised while announcing it would unwind into the fail-open
-        // catch below and turn the layer's only blocking action into an allow.
-        const refuse = (reason: string) => {
-            announce(ctx, `Jev guard blocked ${event.toolName}: ${reason}.`);
-
-            return { block: true, reason: `Jev guard: ${reason}. Call: ${short(subject, 160)}` };
-        };
-
-        if (local.decision === "safe") {
-            return undefined;
-        }
-
-        if (local.decision === "dangerous") {
-            // Catastrophic and unambiguous, so it needs neither a network call nor a human. This is
-            // the one path that blocks without asking Jev, which is why its rule list is tiny.
-            return refuse(local.reason);
-        }
-
-        let verdict;
-        try {
-            const result = await broker.request({
-                system: "guard",
-                state: guard.buildInput({
-                    tool: event.toolName,
-                    subject,
-                    protectedTarget: local.reason === "writes to a protected path",
-                    objective,
-                    recent,
-                    cwd: ctx.cwd,
-                }),
-                questions: guard.questions({ protected: local.reason === "writes to a protected path" }),
-                ctx,
-                root: ctx.cwd,
-                decide: (answers: any) => {
-                    const verdict = guard.decide(answers, { hasUI: ctx.hasUI });
-
-                    return { applied: verdict.action !== "defer", decision: verdict };
-                },
-            });
-            if (!result.ok) {
-                return undefined;
-            }
-
-            verdict = result.decision;
-        } catch {
-            // An advisor must never be the reason a tool call fails. Anything unexpected while
-            // asking hands the call back to the permission system unchanged. The catch ends here, so
-            // that everything the verdict then decides is outside it.
-            return undefined;
-        }
-
-        if (verdict.action === "block") {
-            return refuse(verdict.reason);
-        }
-
-        if (verdict.action === "ask" && ctx.hasUI) {
-            let choice;
-            try {
-                choice = await ctx.ui.select({
-                    title: "Jev guard",
-                    message: `This looks ${verdict.reason}: ${short(subject, 300)}`,
-                    options: [guard.CHOICES.run, guard.CHOICES.block],
-                });
-            } catch {
-                // The one failure in this file that does not fail open, and deliberately. Reaching
-                // here means the verdict already said this call needs a person's approval; a host
-                // that cannot ask has not obtained it, and an unanswerable question resolved as yes
-                // is the failure mode a confirmation dialog exists to rule out.
-                return refuse("this needs your approval and you could not be asked");
-            }
-
-            // `guard.approved` owns the rule; see it for why every non-answer is a refusal.
-            return guard.approved(choice) ? undefined : refuse("not approved by you");
-        }
-
-        return undefined;
-    });
-
     // System 1: condense a spent tool result before it is appended. Doing this after the fact would
     // rewrite a cached prefix; on arrival it never touches one.
     pi.on("tool_result", async (event: any, ctx: ExtensionContext) => {
@@ -379,11 +243,10 @@ export default function jevAdvisor(pi: ExtensionAPI) {
             }
         }
 
-        // Every result, not only the ones retention asked about. This history is what lets the
-        // command guard tell a cleanup step from a first move, and it was written in one place --
-        // inside retention's success path -- so a session running the guard with retention off, or
-        // with retention's budget spent, evaluated the block rule against an empty history for its
-        // whole length while the question set said history was what the intent answer weighed.
+        // Every result, not only the ones retention asked about. It was written in one place --
+        // inside retention's success path -- so a session with retention off, or with retention's
+        // budget spent, handed every other system an empty history for its whole length while
+        // their question sets said history was what they weighed.
         recent.push({ tool: String(event?.toolName ?? ""), outcome: event?.isError === true ? "error" : "ok" });
         if (recent.length > MAX_RECENT) {
             recent.shift();
@@ -470,115 +333,6 @@ export default function jevAdvisor(pi: ExtensionAPI) {
         }
     });
 
-    // System 1b: steer the summary at the one boundary where the prompt cache is discarded anyway.
-    // Only customInstructions is supplied; the preparation's own cut and budget are left alone.
-    pi.on("session_before_compact", async (event: any, ctx: ExtensionContext) => {
-        if (!enabled("compaction")) {
-            return;
-        }
-
-        try {
-            const result = await broker.request({
-                system: "compaction",
-                state: compaction.buildInput({ preparation: event.preparation, objective }),
-                questions: compaction.questions(),
-                ctx,
-                root: ctx.cwd,
-                signal: event.signal,
-                decide: (answers: any) => {
-                    const built = compaction.decide(answers);
-
-                    // Nothing is shortened here, so savedBytes stays 0 and `applied` is the whole
-                    // record: either a sentence reached the summariser or Pi's own prompt ran.
-                    return { applied: Boolean(built.customInstructions), decision: built };
-                },
-            });
-            if (!result.ok) {
-                return;
-            }
-
-            const advice = result.decision;
-            if (!advice.customInstructions) {
-                return;
-            }
-
-            const existing = typeof event.customInstructions === "string" ? event.customInstructions.trim() : "";
-
-            return {
-                customInstructions: existing
-                    ? `${existing}\n\n${advice.customInstructions}`
-                    : advice.customInstructions,
-            };
-        } catch {
-            return;
-        }
-    });
-
-    // System 1b, second hook. Branch summarisation is the same problem at the same boundary --
-    // something is about to be reduced to a summary and the prefix is being rebuilt regardless --
-    // and it was simply unserved. It shares the compaction switch rather than adding a fifth
-    // system, because a user who has decided the advisor may steer a summary has decided that once.
-    //
-    // `label` is the part worth having. Pi's `/tree` can filter to labelled entries, so a branch
-    // that says what it was is the difference between a navigable tree and a list of timestamps,
-    // and the enum is fixed so no model-written text reaches the session file.
-    pi.on("session_before_tree", async (event: any, ctx: ExtensionContext) => {
-        if (!enabled("compaction")) {
-            return;
-        }
-
-        try {
-            const entries = event?.preparation?.entriesToSummarize ?? [];
-            if (entries.length === 0) {
-                return;
-            }
-
-            const result = await broker.request({
-                system: "compaction",
-                state: compaction.buildBranchInput({ preparation: event.preparation, objective }),
-                questions: compaction.questions({ branch: true }),
-                ctx,
-                root: ctx.cwd,
-                signal: event.signal,
-                decide: (answers: any) => {
-                    const built = compaction.decide(answers);
-                    const branchLabel = compaction.label(answers);
-
-                    return {
-                        applied: Boolean(branchLabel || built.customInstructions),
-                        decision: { ...built, label: branchLabel },
-                    };
-                },
-            });
-            if (!result.ok) {
-                return;
-            }
-
-            const advice = result.decision;
-            const patch: Record<string, unknown> = {};
-            if (advice.label) {
-                patch.label = advice.label;
-            }
-
-            // Only when a summary is actually going to be generated. Instructions for a summariser
-            // that will not run are bytes nobody reads, and `replaceInstructions` is left alone so
-            // Pi's own branch prompt still frames the result.
-            if (advice.customInstructions && event.preparation?.userWantsSummary === true) {
-                const existing =
-                    typeof event.preparation?.customInstructions === "string"
-                        ? event.preparation.customInstructions.trim()
-                        : "";
-                patch.customInstructions = existing
-                    ? `${existing}\n\n${advice.customInstructions}`
-                    : advice.customInstructions;
-            }
-
-            return Object.keys(patch).length > 0 ? patch : undefined;
-        } catch {
-            return;
-        }
-    });
-
     pi.on("tool_call", async (event: any, ctx: ExtensionContext) => {
         history.signatures.push(progress.signature(event.toolName, event.input));
         history.tools.push(event.toolName);
@@ -704,7 +458,7 @@ export default function jevAdvisor(pi: ExtensionAPI) {
     // System 5: notice a session that has stopped making progress, while it can still be helped.
     //
     // THE ONE HANDLER THAT IS NOT AWAITED. Everything else in this file mutates what it inspects --
-    // a tool result, a compaction patch, a tool's input -- so the session has to wait for the
+    // a tool result, a tool's input -- so the session has to wait for the
     // answer. This one acts on the next turn, and at roughly 300ms a call, awaiting it on a
     // thrashing session would add seconds to an attempt to deliver advice that could not have
     // changed the turn it was asked during.
@@ -868,16 +622,11 @@ export default function jevAdvisor(pi: ExtensionAPI) {
                               }
                           })()
                         : undefined;
-                    // The same disclosure `/jev on` makes, on the path that arms the guard by name.
-                    // Learning from a blocked call that calls can be blocked is the outcome that
-                    // rule exists to prevent, and which command did the arming does not change it.
-                    const armedGuard = action === "enable" && names.includes("guard") && settings.master;
                     ctx.ui.notify(
                         `${action === "enable" ? "Enabled" : "Disabled"}: ${names.join(", ")}.` +
                             `${kept ? " Remembered for new sessions." : " This session only."}` +
                             `${emptied ? " That was the last system, so the layer was switched off; it would otherwise run and do nothing." : ""}` +
-                            `${!emptied && !settings.master ? " The layer is still off; run /jev on." : ""}` +
-                            `${armedGuard ? `\n${guardWarning()}` : ""}`,
+                            `${!emptied && !settings.master ? " The layer is still off; run /jev on." : ""}`,
                         "info",
                     );
 
@@ -916,8 +665,7 @@ export default function jevAdvisor(pi: ExtensionAPI) {
                     const enabled = SYSTEM_NAMES.filter((name) => saved.systems[name]);
                     ctx.ui.notify(
                         saved.startup && saved.master
-                            ? `New Pi sessions will start with the Jev layer on, with ${enabled.length} of ${SYSTEM_NAMES.length} systems: ${enabled.join(", ")}. This session is unchanged; run /jev on to switch it on now.` +
-                                  `${saved.systems.guard ? `\n${guardWarning()}` : ""}`
+                            ? `New Pi sessions will start with the Jev layer on, with ${enabled.length} of ${SYSTEM_NAMES.length} systems: ${enabled.join(", ")}. This session is unchanged; run /jev on to switch it on now.`
                             : "New Pi sessions will start with the Jev layer off. This session is unchanged.",
                         "info",
                     );

package/extensions/jev-advisor/key-source.mjs

@@ -162,7 +162,7 @@ function environmentOnly() {
 
 /**
  * Jev is reached through OpenRouter by default: that is where it is published, it is what
- * the command guard uses, and an OpenRouter key (`sk-or-...`) is rejected by the direct
+ * specpi-jev-guard uses, and an OpenRouter key (`sk-or-...`) is rejected by the direct
  * TypeSafe API with a bare 401. `JEV_BACKEND=typesafe` selects the direct API for a TypeSafe key.
  *
  * It lives here rather than in client.mjs because everything below has to bind it. A parameter