specpi 0.30.0 → 0.30.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## Unreleased
+
+## 0.30.1 - 2026-09-22
+
+- Repair Jev's task context: read the active contract structurally, fall back to the bounded current request, and clear stale context on task, branch and session changes.
+- Allocate the existing 1 KiB state budget by field. Preserve result samples and candidate/question correspondence; abstain locally when required evidence cannot fit. Record sample coverage and local refusals separately from classifier calls.
+- Renew transmission consent with an accurate disclosure of sampled file contents, command output and request text. Redact question text as well as state, replace outside-workspace absolute paths, and use opaque source/cluster IDs. Consent now binds the transport scheme as well as the host.
+- Rank delegation sources per `packet.jobs[]`, respecting the declared mode and preserving every selected source and ungated position. Store gap-triage opinions alongside the original observation, with a bounded existing-cluster shortlist. Opinions cannot change priority, canonical identity or human improvement authority.
+- Retain object-shaped Score distributions, reject malformed probabilities and require a Choice distribution before applying its margin gate. Separate warnings from real elisions and count delivered effects rather than undelivered advice. Shell results are no longer eligible for shortening because their commands may not be safe to repeat.
+- Close review findings at asynchronous boundaries: bind reports before consent and root lookup, recheck collection before sending and advisory authority inside locked writes, and abandon stale tool-result lookups. Reject transport redirects, redact quoted credentials and multiline keys before sampling, and retain committed-effect accounting when later notifications or report rendering fail.
+- Keep all advisor systems off by default, production thresholds unchanged, compaction guidance withdrawn and the command guard separate. These repairs do not establish a task-quality or cost benefit; new controlled evaluations are still required.
+- Isolate the base-package installer tests' home directory as well as their agent directory. The old fixtures could switch off the real command guard during validation; a regression now checks that a synthetic caller's enabled guard remains byte-for-byte unchanged.
+- Trim the evaluations page to results, a short method and chart notes, without changing the published data. Add expandable diagrams for the six Jev systems, with theme-aware colors and contained scrolling on narrow screens.
+
 ## 0.30.0 - 2026-09-21
 
 - Replace the evaluations page with Terminal-Bench 2.0. The suite that filled it was written in this repository, and it was retired for the reason it kept reporting: nearly every harness passed nearly every task, so the thing it was built to measure was the thing it could not see, and three rounds of harder tasks did not move it. A suite cannot mark its own homework. The page now carries somebody else's benchmark on tasks nobody here chose -- Pi with no harness, SpecPi + Jev, Oh My Pi and Claude Code, 334 scored attempts on one model through one endpoint.

package/NPM_RELEASE.md

@@ -6,7 +6,7 @@ Publishing, tags, deprecation, ownership changes and GitHub Releases require exp
 
 ## Prepare
 
-1. This candidate is SpecPi **0.30.0**, paired with the Chat **0.14.0** VSIX. Browser QA **0.3.0** is already independently published; do not republish or edit its source as part of this release. Choose an unused version; update `package.json`, the dated `CHANGELOG.md` entry, README, and the website. Check Chat's version and VSIX download links. Preserve historical changelog entries.
+1. This candidate is SpecPi **0.30.1**, paired with the Chat **0.14.0** VSIX. Browser QA **0.3.0** is already independently published; do not republish or edit its source as part of this release. Choose an unused version; update `package.json`, the dated `CHANGELOG.md` entry, README, and the website. Check Chat's version and VSIX download links. Preserve historical changelog entries.
 2. Validate:
 
     ```sh
@@ -20,7 +20,7 @@ Publishing, tags, deprecation, ownership changes and GitHub Releases require exp
     git diff --check
     ```
 
-    Installer/Pi lifecycle tests must use disposable state, never a live profile. `check:base` requires network access and verifies the real six-package base with isolated home/configuration paths. The base check now invokes the installed Browser QA Node bin for Chromium setup and offline doctor checks; scope `PLAYWRIGHT_BROWSERS_PATH` to a disposable test cache. Verify setup skip, core-only behavior, failure rollback, and BetterWright ownership migration in the installer regressions. Browser-cache/package bytes are outside managed rollback and uninstall. Review all default version changes, upstream lifecycle scripts, compatibility, and notices in `THIRD_PARTY.md`. Local dry runs disable provenance because they lack GitHub OIDC.
+    Installer/Pi lifecycle tests must use disposable state, never a live profile. `check:base` requires network access and verifies the real eight-package base with isolated home/configuration paths. The base check now invokes the installed Browser QA Node bin for Chromium setup and offline doctor checks; scope `PLAYWRIGHT_BROWSERS_PATH` to a disposable test cache. Verify setup skip, core-only behavior, failure rollback, and BetterWright ownership migration in the installer regressions. Browser-cache/package bytes are outside managed rollback and uninstall. Review all default version changes, upstream lifecycle scripts, compatibility, and notices in `THIRD_PARTY.md`. Local dry runs disable provenance because they lack GitHub OIDC.
 
 3. Review the diff, exact package manifest and artifact; obtain fresh read-only review for lifecycle, permissions and packaging changes.
 4. After approval and passing PR checks, merge to `main`, then create the matching `v<version>` tag at the merge commit. Build Chat's VSIX with `npm --prefix vscode run package` and attach it to the GitHub Release. Publish the release to start the npm workflow and approve the protected `npm` environment if it requests review. Verify the website deployment and download links. If publication cannot complete, revert the release merge and use a new version for the next attempt.

package/README.md

@@ -28,7 +28,7 @@
 
 ---
 
-SpecPi is a small starting point for the [Pi coding agent](https://pi.dev/). It is one opinionated setup for how the agent should work, not a marketplace of plugins.
+SpecPi 0.30.1 is a small starting point for the [Pi coding agent](https://pi.dev/). It is one opinionated setup for how the agent should work, not a marketplace of plugins.
 
 At the center are two built-in extensions. **Scope control** keeps each task to the files it said it would touch. The **improvement loop** turns repeated friction into small, tested changes to the setup, instead of letting prompts and workarounds pile up. Around those are eight hand-picked packages, each locked to an exact version and checked before anything installs, plus **SpecPi Chat**, a VS Code panel for working alongside the agent.
 
@@ -97,9 +97,8 @@ this run, so its cost is an upper bound.
 
 <!-- /eval-summary -->
 
-This run is still in progress. Read the method, the charts and the caveats on the
-[evaluations page](https://tannermidd.github.io/SpecPi/evaluations/), which lists
-what is missing and what is known to be wrong. The table above is regenerated
+This run is still in progress. See the results and brief method on the
+[evaluations page](https://tannermidd.github.io/SpecPi/evaluations/). The table above is regenerated
 from the run data by `node scripts/tb2-site.mjs`, so it cannot drift from the
 published figures.
 
@@ -122,7 +121,7 @@ Full setup options, package details, and requirements: [website](https://tannerm
 
 | | |
 | --- | --- |
-| [Packages](https://tannermidd.github.io/SpecPi/#packages) | The seven pinned packages and what each provides |
+| [Packages](https://tannermidd.github.io/SpecPi/#packages) | The eight pinned packages and what each provides |
 | [Scope control](https://tannermidd.github.io/SpecPi/wiki/#scope) | `/scope` commands and drift monitoring |
 | [Improvement loop](https://tannermidd.github.io/SpecPi/#loop) | Local wishlist, `/harness-improvement`, and retirement with evidence |
 | [SpecPi Chat](https://tannermidd.github.io/SpecPi/#vscode-chat) | VS Code frontend and VSIX install · [Chat guide](https://github.com/TannerMidd/SpecPi/blob/main/vscode/README.md) |

package/SECURITY_MODEL.md

@@ -18,19 +18,23 @@ Optional tool groups ship withdrawn. The `request_capability` tool lets the mode
 
 The advisor is the only part of SpecPi that sends anything off this machine, and it ships off. With the master switch off there is no network call, no key read, no consent read and no prompt injection: the harness behaves exactly as it did before the extension existed.
 
-What is sent: a summary object of at most 1 KB per call to `openrouter.ai`, which is where Jev is published and the default route, or to `api.typesafe.ai` when `JEV_BACKEND=typesafe` selects the direct API. Either way, over HTTPS. It carries tool names, byte counts, relative paths, entry counts, short descriptions and a bounded sample of lines from the material being judged. `sanitize.mjs` is the only module permitted to build one, so the rule is enforced in one place rather than promised in several: credentials, tokens, JWTs, emails and URLs are redacted, absolute paths are relativized, and anything still over budget is truncated rather than sent. Redaction reduces exposure; it does not guarantee that a model-authored string carries nothing sensitive.
+What is sent: a summary object of at most 1 KB per call to `openrouter.ai`, which is where Jev is published and the default route, or to `api.typesafe.ai` when `JEV_BACKEND=typesafe` selects the direct API. Either way, over HTTPS. It carries tool names, byte counts, relative paths, entry counts, short descriptions and a bounded sample of lines from the material being judged. `sanitize.mjs` builds the wire state and sanitizes question text. Known credential, token, JWT, email and URL patterns are redacted, including quoted credential values and multiline private-key blocks before sampling; workspace paths become relative and other absolute paths are replaced. Source and cluster questions use opaque IDs, with their descriptions inside the state budget. Required fields have explicit allocations: samples may be shortened, but missing objectives, missing samples or candidate lists that cannot fit cause local abstention, not an evidence-free classifier call. Redaction reduces exposure; it does not guarantee that a model-authored string carries nothing sensitive.
 
-Earlier versions of this document said file contents and command output were "refused outright". That was never accurate and is corrected here. Deciding whether a tool result is spent, or whether a fetched page is addressing the agent, cannot be done from byte counts alone, so `outline()` has always sent a sample of the result's own lines: up to six from the head and two from the tail, each collapsed to at most 80 characters and passed through the same redaction as everything else. As of 0.27.0 it also samples up to four lines evenly spaced through the middle, because an instruction planted in a fetched page is rarely in its first six lines and a digest that could never contain one would ask system 7 a question its own state made unanswerable. So the accurate statement is: **a bounded, redacted sample of at most twelve short lines per result, inside a 1 KB total budget** — not the whole content, and not none of it. What the sample cannot include is anything beyond that budget, which is enforced by truncation rather than by intention.
+Earlier versions of this document said file contents and command output were "refused outright". That was never accurate and is corrected here. Deciding whether a tool result is spent, or whether a fetched page is addressing the agent, cannot be done from byte counts alone, so `outline()` has always sent a sample of the result's own lines: up to six from the head and two from the tail, each collapsed to at most 80 characters and passed through the same redaction as everything else. As of 0.27.0 it also samples up to four lines evenly spaced through the middle, because an instruction planted in a fetched page is rarely in its first six lines and a digest that could never contain one would ask system 7 a question its own state made unanswerable. So the accurate statement is: **a bounded, redacted sample of at most twelve short lines per result, inside a 1 KB total budget** — not the whole content, and not none of it. What the sample cannot include is anything beyond that budget. The ledger records offered and retained sample counts and whether required evidence was present; that does not establish that the sample contains every relevant fact.
 
-Consent is separate from the switch. The first time any system would transmit, an interactive dialog names the endpoint, the shape of the data and the byte budget. Without an interactive human nothing is sent, so an unattended run cannot be the thing that starts transmitting. The grant lives in `<agent-dir>/specpi/jev/consent.json` and is bound to the host it was given for, so switching backends asks again rather than carrying an old answer to a new destination. `/jev forget` revokes it.
+Consent is separate from the switch. The first time any system would transmit, an interactive dialog names the endpoint, the shape of the data and the byte budget. Without an existing valid grant, a noninteractive run cannot start transmitting. A previously granted consent may be reused without a UI. The grant lives in `<agent-dir>/specpi/jev/consent.json` and is bound to the destination origin, including its transport scheme. Transport rejects redirects rather than forwarding evidence to an unapproved destination. Schema 2 requires renewed consent because the earlier dialog incorrectly promised never to send file contents or command output. It now explicitly discloses sampled content, the current request/objective, best-effort redaction and any non-HTTPS endpoint override. `/jev forget` revokes it.
 
-Every call appends one line to `<agent-dir>/specpi/jev/transmissions.jsonl`: timestamp, system, question keys, state byte count, a SHA-256 of the exact payload, latency and the gated outcome. The payload itself is never written. `/jev ledger` reads it back, so "only digests are sent" is checkable rather than asserted. The ledger is user data and survives uninstall.
+Every advisor request attempt appends one line to `<agent-dir>/specpi/jev/transmissions.jsonl`: timestamp, system, question keys, state byte count, a SHA-256 of the sanitized state and questions, latency and the gated outcome. Local evidence refusals are marked `sent: false`, consume no call budget, and are counted separately from calls. Effect tags distinguish shortening, warnings, recorded assessments, notifications, capability proposals and queued steering; queueing does not prove the model consumed a message. The payload itself is never written. `/jev ledger` reads it back, so "only digests are sent" is checkable rather than asserted. The ledger is user data and survives uninstall.
 
 The advisor also keeps `<agent-dir>/specpi/jev/usage.json`, the running call count for the current session, written atomically with owner-only permissions. It exists because the ledger has no session boundary in it, so nothing outside the advisor's own process could say what *this* session had spent, and the count is what SpecPi Chat shows beside each budget. It is the one file in this layer meant to be read by another process, and it is deliberately the least interesting one: counts per system, the budgets they are counted against, a session identifier and two timestamps. No state, no questions, no answers, not even the ledger's digests. It is written only while the master switch is on, so a layer nobody has enabled leaves no trace of having been installed, and the last session's counts are kept rather than deleted at shutdown, because "this has never run" and "the session that just ended spent its whole budget" are different facts and a reader should be able to tell them apart. One file serves the directory, as the settings file does, so where several Pi sessions share an agent directory it describes whichever wrote to it last; it carries a session identifier, two timestamps and an active flag so a reader can say which rather than having to assume.
 
-The advisor holds no authority. It never grants a capability, never calls a tool and never allows one. Its only blocking action is to refuse a capability-gap report that looks like it carries a credential, which asks the model to rewrite its own text and discards nothing. Failure is silent, not closed: a timeout, HTTP error, missing key, missing consent, an exhausted per-system or session budget, or ungated confidence produces no advice, and the existing code path runs unchanged. Tool-result retention can shorten a large read-only result before it is appended; it never alters a write, edit or error result, and the replacement says the output is recoverable by re-running.
+The advisor holds no authority. It never grants a capability, never calls a tool and never allows one. Its only blocking action is to refuse a capability-gap report that looks like it carries a credential, which asks the model to rewrite its own text and discards nothing. Failure is silent, not closed: a timeout, HTTP error, missing key, missing consent, an exhausted per-system or session budget, or ungated confidence produces no advice, and the existing code path runs unchanged. Tool-result retention can shorten a large observational result before it is appended; it never shortens a write, edit, shell or error result. Shell success does not establish that a command is read-only or safe to repeat. Other replacements still suggest re-reading; preserving an immutable original result is not implemented.
 
-Two of the seven systems do something the other five do not, and both are off by default like everything else here.
+Task context comes from the workflow owner's validated active contract, not a rendered heading or a search through stored conversations. A bounded current-request fallback is refreshed when the task changes and cleared on branch/session changes. Delegation ranking adapts `packet.jobs[]` independently, uses each declared mode, and preserves the exact source multiset and ungated positions.
+
+Gap triage runs only after local collection is enabled. Reports bind their task and session before any awaited consent or root lookup; collection is rechecked before transmission. Locked writes recheck task authority and strip the advisory assessment if Jev was disabled while waiting, without preventing otherwise authorized local collection. A bounded shortlist comes from sanitized wishlist observations, never from Pi state. A persisted `assessment` is a Jev opinion based on the reporting model's account, **not independent evidence**. It cannot change the original impact or suggested fix, canonical identity, priority, qualification, selection or retirement. Suggested cluster matches require a human merge decision. Model-authored report arguments cannot inject these assessments.
+
+Two of the six systems can add fixed advice to model context, and both are off by default like everything else here.
 
 **System 5, progress detection**, is the only one that can change what the model does. On a confident verdict that a session has stopped making progress it adds one fixed, code-written line at a turn boundary. It ships set to `notify`, which tells the person and cannot change the session; `message`, which appends the line for the model to read, is a deliberate opt-in. It is written once per session and never retracted, it never aborts or blocks, and it is suppressed entirely when the same call reports that a person would have to answer something first. Nothing the model produced ever enters the transcript: the line is chosen from a fixed table by failure mode.
 

package/extensions/jev-advisor/broker.mjs

@@ -15,7 +15,7 @@
 import { randomUUID } from "node:crypto";
 import { SYSTEM_NAMES, loadSettings } from "./config.mjs";
 import { ensureConsent } from "./consent.mjs";
-import { buildState } from "./sanitize.mjs";
+import { buildQuestions, buildState } from "./sanitize.mjs";
 import { ask } from "./client.mjs";
 import { payloadDigest, record } from "./ledger.mjs";
 import { writeUsage } from "./usage.mjs";
@@ -164,8 +164,27 @@ export function createBroker(options = {}) {
      * is the only point where the answers and the audit line exist together; its `decision` is
      * handed back so the caller does not gate the same answers twice.
      */
-    const request = async ({ system, state, questions, ctx, root, maxBytes, timeoutMs, signal, decide }) => {
+    const request = async ({
+        system,
+        state,
+        questions,
+        ctx,
+        root,
+        profile,
+        maxBytes,
+        timeoutMs,
+        signal = ctx?.signal,
+        decide,
+        apply,
+        isCurrent = () => true,
+    }) => {
+        const startedGeneration = generation;
+        const currentRequest = () => startedGeneration === generation && !signal?.aborted && isCurrent();
         const settings = readSettings();
+        if (!currentRequest()) {
+            return { ok: false, reason: "context-changed", answers: {} };
+        }
+
         if (!settings.master) {
             return { ok: false, reason: "master-off", answers: {} };
         }
@@ -188,6 +207,25 @@ export function createBroker(options = {}) {
             return { ok: false, reason: "budget-exhausted", answers: {} };
         }
 
+        const built = buildState(state, { root, maxBytes, profile });
+        const wireQuestions = buildQuestions(questions, root);
+        if (!built.ok || !wireQuestions) {
+            const reason = !built.ok ? built.reason : "invalid-questions";
+            // A local abstention is not a transmission and consumes no call budget. Counts and
+            // coverage only: never record the material that could not safely be sent.
+            write({
+                system,
+                sent: false,
+                ok: false,
+                reason,
+                outcome: reason,
+                applied: false,
+                coverage: built.coverage,
+            });
+
+            return { ok: false, reason, answers: {} };
+        }
+
         const consented = await resolveConsent(ctx, SYSTEM_LABELS[system] ?? system);
         if (!consented) {
             return { ok: false, reason: "no-consent", answers: {} };
@@ -195,22 +233,41 @@ export function createBroker(options = {}) {
 
         // Settings can change while the dialog is open, and a session can end under it.
         const current = readSettings();
+        if (!currentRequest()) {
+            return { ok: false, reason: "context-changed", answers: {} };
+        }
+
         if (!current.master || current.systems[system] !== true) {
             return { ok: false, reason: "master-off", answers: {} };
         }
 
-        const built = buildState(state, { root, maxBytes });
-        const questionKeys = Object.keys(questions);
+        // Parallel result hooks can wait on the same consent prompt. Reserve only after rechecking.
+        if ((usedBySystem.get(system) ?? 0) >= current.budgets[system]) {
+            return { ok: false, reason: "system-budget-exhausted", answers: {} };
+        }
+
+        if (callsUsed >= current.budgets.total) {
+            return { ok: false, reason: "budget-exhausted", answers: {} };
+        }
+
+        const questionKeys = Object.keys(wireQuestions);
         callsUsed += 1;
         usedBySystem.set(system, (usedBySystem.get(system) ?? 0) + 1);
-        const startedGeneration = generation;
-        const result = await transport(built.state, questions, { timeoutMs, signal });
+        let result;
+        try {
+            result = await transport(built.state, wireQuestions, { timeoutMs, signal });
+        } catch {
+            result = { ok: false, reason: "transport-error", answers: {} };
+        }
+
         // The session can end under a call that was never awaited, which is the normal shape of a
         // turn-level system: the payload has already left the machine, and the answer now belongs
         // to a session that no longer exists. It must not be acted on. It must still be recorded --
         // the ledger's whole claim is that every transmission appears in it, and a run that sent 44
         // and logged 43 is how this was found. So the line is written either way and says which.
-        const stale = startedGeneration !== generation;
+        const mayApply = () => currentRequest() && readSettings().master && readSettings().systems[system] === true;
+        let stale = !mayApply();
+        const committedEffects = new Set();
 
         // A gate that throws must not turn into a failed call: the caller's own catch would have
         // swallowed it anyway, and recording it as unapplied is the truthful line.
@@ -218,17 +275,38 @@ export function createBroker(options = {}) {
         if (!stale && result.ok && typeof decide === "function") {
             try {
                 outcome = decide(result.answers) ?? { applied: false };
+                if (typeof apply === "function") {
+                    const delivered = await apply(outcome.decision, {
+                        isCurrent: mayApply,
+                        recordEffect: (effect) => committedEffects.add(effect),
+                    });
+                    outcome = { ...outcome, applied: false, ...delivered };
+                }
             } catch {
                 outcome = { applied: false, gateThrew: true };
             }
         }
 
+        // A later notification or report-rendering failure cannot undo an already committed effect.
+        if (committedEffects.size > 0) {
+            outcome = {
+                ...outcome,
+                applied: true,
+                effects: [...new Set([...(outcome.effects ?? []), ...committedEffects])],
+            };
+        }
+
+        // An application may await a dialog or a locked wishlist write. Do not attribute its
+        // delivered effects to a different session if that session changed while awaiting it.
+        stale ||= !currentRequest() || !readSettings().master || readSettings().systems[system] !== true;
         write({
             system,
+            sent: true,
             questionKeys,
+            coverage: built.coverage,
             stateBytes: built.bytes,
             stateTruncated: built.truncated,
-            payloadSha256: payloadDigest({ state: built.state, questions }),
+            payloadSha256: payloadDigest({ state: built.state, questions: wireQuestions }),
             ok: result.ok,
             reason: result.ok ? undefined : result.reason,
             // A sent payload whose answer arrived too late to use. Distinguished from a refusal,
@@ -237,6 +315,7 @@ export function createBroker(options = {}) {
             // Whether the advice changed anything, and what it saved when the change was a
             // shortening. Zero is a real answer here and means "asked, and kept the result whole".
             applied: outcome.applied === true,
+            effects: Array.isArray(outcome.effects) ? outcome.effects : [],
             // And why not, when nothing changed. Without this a system that asks and never acts is
             // indistinguishable from one whose gate can never be satisfied, which is the exact
             // failure the calibration pass had to go looking for by hand.

package/extensions/jev-advisor/client.mjs

@@ -74,30 +74,51 @@ function unavailable(reason) {
  * A Noul has no confidence, and inventing one would let a caller gate on a number the model never
  * reported, so it stays undefined.
  */
-function normalizeAnswer(raw) {
-    if (!raw || typeof raw !== "object") {
+function normalizeAnswer(raw, question) {
+    if (!raw || typeof raw !== "object" || !question) {
         return undefined;
     }
 
-    if (typeof raw.noul === "number") {
+    const probability = (value) => Number.isFinite(value) && value >= 0 && value <= 1;
+    const confidence = probability(raw.confidence) ? raw.confidence : undefined;
+    const distribution = raw.probabilities;
+    const validDistribution =
+        distribution &&
+        typeof distribution === "object" &&
+        Object.keys(distribution).length > 0 &&
+        Object.values(distribution).every(probability);
+
+    if (question.type === "noul" && probability(raw.noul)) {
         return { kind: "noul", value: raw.noul, probabilities: undefined, confidence: undefined };
     }
 
-    if (typeof raw.choice === "string") {
+    if (question.type === "choice" && typeof raw.choice === "string" && Object.hasOwn(question.criteria, raw.choice)) {
         return {
             kind: "choice",
             value: raw.choice,
-            probabilities: raw.probabilities && typeof raw.probabilities === "object" ? raw.probabilities : undefined,
-            confidence: typeof raw.confidence === "number" ? raw.confidence : undefined,
+            probabilities:
+                validDistribution &&
+                !Array.isArray(distribution) &&
+                Object.keys(distribution).length === Object.keys(question.criteria).length &&
+                Object.keys(distribution).every((key) => Object.hasOwn(question.criteria, key))
+                    ? distribution
+                    : undefined,
+            confidence,
         };
     }
 
-    if (typeof raw.score === "number") {
+    if (
+        question.type === "score" &&
+        Number.isFinite(raw.score) &&
+        raw.score >= 0 &&
+        raw.score <= question.criteria.length - 1
+    ) {
         return {
             kind: "score",
             value: raw.score,
-            probabilities: Array.isArray(raw.probabilities) ? raw.probabilities : undefined,
-            confidence: typeof raw.confidence === "number" ? raw.confidence : undefined,
+            // The documented Score distribution is an object; older routes also return arrays.
+            probabilities: validDistribution ? distribution : undefined,
+            confidence,
         };
     }
 
@@ -126,6 +147,8 @@ export async function ask(state, questions, options = {}) {
     try {
         const response = await fetch(endpoint(), {
             method: "POST",
+            // Consent covers this origin, not a redirect target that could receive the same body.
+            redirect: "error",
             headers: {
                 "content-type": "application/json",
                 authorization: `Bearer ${key}`,
@@ -143,7 +166,7 @@ export async function ask(state, questions, options = {}) {
         const body = await response.json();
         const answers = {};
         for (const [name, raw] of Object.entries(body?.answers ?? {})) {
-            const normalized = normalizeAnswer(raw);
+            const normalized = normalizeAnswer(raw, Object.hasOwn(questions, name) ? questions[name] : undefined);
             if (normalized) {
                 answers[name] = normalized;
             }

package/extensions/jev-advisor/consent.mjs

@@ -20,6 +20,12 @@ import { MAX_STATE_BYTES } from "./sanitize.mjs";
  * and a TYPESAFE_BASE_URL override) names itself, and so the rule below is true rather than
  * aspirational: a grant is keyed on this string, so repointing the client really does ask again.
  */
+export const CONSENT_SCHEMA = 2;
+
+export function endpointOrigin() {
+    return new URL(baseUrl()).origin;
+}
+
 export function endpointLabel() {
     const base = baseUrl();
     try {
@@ -43,12 +49,12 @@ export function loadConsent() {
         }
 
         const stored = JSON.parse(fs.readFileSync(file, "utf8"));
-        if (stored?.schema !== 1 || stored.granted !== true || typeof stored.endpoint !== "string") {
+        if (stored?.schema !== CONSENT_SCHEMA || stored.granted !== true || typeof stored.endpoint !== "string") {
             return undefined;
         }
 
         // A grant is for the endpoint it was given for. Repointing the client asks again.
-        return stored.endpoint === endpointLabel() ? stored : undefined;
+        return stored.endpoint === endpointLabel() && stored.origin === endpointOrigin() ? stored : undefined;
     } catch {
         return undefined;
     }
@@ -65,9 +71,11 @@ export function saveConsent() {
     }
 
     const stored = {
-        schema: 1,
+        // Earlier consent incorrectly excluded file/command samples. It cannot authorize them.
+        schema: CONSENT_SCHEMA,
         granted: true,
         endpoint: endpointLabel(),
+        origin: endpointOrigin(),
         maxStateBytes: MAX_STATE_BYTES,
         grantedAt: new Date().toISOString(),
     };
@@ -89,15 +97,19 @@ export function consentPath() {
     return consentFile();
 }
 
-export const CONSENT_TITLE = "Allow SpecPi to send task summaries to Jev?";
+export const CONSENT_TITLE = "Allow SpecPi to send task summaries and text samples to Jev?";
 
 export function consentBody(systemLabel) {
     return [
         `${systemLabel} wants to ask TypeSafe's Jev classifier a question about this session.`,
         "",
-        `What is sent: a summary object of at most ${MAX_STATE_BYTES} bytes to ${endpointLabel()}, over HTTPS.`,
-        "It carries tool names, byte counts, relative paths and short descriptions.",
-        "It never carries file contents, command output, credentials, URLs or session history.",
+        `What is sent: a state object of at most ${MAX_STATE_BYTES} bytes to ${endpointLabel()}, with classifier questions.`,
+        `Transport: ${new URL(baseUrl()).protocol === "https:" ? "HTTPS" : "not HTTPS (configured endpoint override)"}.`,
+        "It may include the current request or objective, relative paths, capability-gap summaries,",
+        "and short sampled lines from file contents, command output and fetched content.",
+        "Known credential, email, URL and outside-workspace path patterns are redacted before sending.",
+        "Redaction is best effort, not a guarantee that every sensitive detail is removed. No session history is read.",
+        "Collection stays local unless you separately allow this advisor transmission.",
         "",
         "Every call is recorded locally in transmissions.jsonl with a hash of exactly what was sent,",
         "which you can read with /jev ledger. Turn this off at any time with /jev off.",

package/extensions/jev-advisor/gate.mjs

@@ -167,14 +167,14 @@ export function thresholdsFor(system) {
 export function nounTrue(answer, system) {
     const limits = thresholdsFor(system);
 
-    return answer?.kind === "noul" && answer.value >= limits.high;
+    return answer?.kind === "noul" && Number.isFinite(answer.value) && answer.value >= limits.high && answer.value <= 1;
 }
 
 /** True when the Noul is confidently no. Not the negation of nounTrue: the middle band is silence. */
 export function nounFalse(answer, system) {
     const limits = thresholdsFor(system);
 
-    return answer?.kind === "noul" && answer.value <= limits.low;
+    return answer?.kind === "noul" && Number.isFinite(answer.value) && answer.value >= 0 && answer.value <= limits.low;
 }
 
 function topTwo(probabilities) {
@@ -193,7 +193,15 @@ function topTwo(probabilities) {
  * the margin is a live test rather than a branch that silently never runs.
  */
 export function choiceValue(answer, system) {
-    if (answer?.kind !== "choice" || typeof answer.confidence !== "number") {
+    if (
+        answer?.kind !== "choice" ||
+        !Number.isFinite(answer.confidence) ||
+        answer.confidence > 1 ||
+        !answer.probabilities ||
+        Array.isArray(answer.probabilities) ||
+        !Object.hasOwn(answer.probabilities, answer.value) ||
+        !Object.values(answer.probabilities).every((value) => Number.isFinite(value) && value >= 0 && value <= 1)
+    ) {
         return undefined;
     }
 
@@ -203,7 +211,7 @@ export function choiceValue(answer, system) {
     }
 
     const { first, second } = topTwo(answer.probabilities);
-    if (answer.probabilities && first - second < limits.margin) {
+    if (answer.probabilities[answer.value] !== first || first - second < limits.margin) {
         return undefined;
     }
 
@@ -215,7 +223,14 @@ export function choiceValue(answer, system) {
  * returned level is the rounded band; callers compare against their own rubric.
  */
 export function scoreLevel(answer, system) {
-    if (answer?.kind !== "score" || typeof answer.confidence !== "number") {
+    if (
+        answer?.kind !== "score" ||
+        !Number.isFinite(answer.confidence) ||
+        answer.confidence > 1 ||
+        !Number.isFinite(answer.value) ||
+        answer.value < 0 ||
+        answer.value > 9
+    ) {
         return undefined;
     }