[hexuria]

Summary

• JevEscalation in gpui-agent-policy behind new optional jev feature — port of aui-cli/src/typesafe.rs onto our ActionSpace. One blocking::Client::system_one call per abstain: an operation choice head plus one <kind>_target head per element-bearing kind, keyed by id region so composed replies are valid offered ActionIds.
• Still behind EscalatingPolicy: local Instinct decides first; Jev runs only on Abstain — abstain never becomes "top candidate wins". The text tier stays command-escalation-only.
• CLI --escalate jev (conflicts with --escalate-cmd). Missing TYPESAFE_API_KEY is a clear config error; a binary built without jev names the missing feature. TYPESAFE_MODEL / TYPESAFE_BASE_URL / TYPESAFE_DEFAULT_MODEL handled by the SDK.
• Strict validation, all fail-closed → escalation: → Blocked: off-menu choice, uncovered/extra probability keys, sum ≠ 1, out-of-range/non-finite probabilities, non-argmax choice, transport errors, empty operation menu.
• typesafe-sdk 0.3 optional — cargo tree shows no typesafe in default or instinct builds (extends the M1.7 guard).
• Requests sent Compression::None so scripted endpoints stay std-only.
• bench/arms.toml gains arm a4 (--escalate jev). A4 ran live (jev-latest): 75/80 → ambiguity guard → a4+guard wrong=0; recorded in RESULTS.md.
• §8 docs sweep: PROTOCOL.md (since/compact/fingerprints/revision/expect_fingerprint/features), INTEGRATING.md (host fingerprint-gate contract), PERF.md (M2–M8 numbers), RECIPES.md (instinct resolve), README.md (run/locate/act + flags).

Test plan

• 11 new jev.rs unit tests — build_questions coverage (heads, id-region keys, criterion label text, controls-only space), validate_choice (off-menu, uncovered, extra keys, bad sums, out-of-range incl. boundary matrix + NaN, non-argmax, argmax accept), keys_for, element_kind_of, model_non_empty, plus a std-only in-crate mock System One server asserting request model/state/questions
• 7 run_jev.rs integration tests over a std-only mock — menu pick dispatches, Instinct choice never calls Jev, non-argmax/bad-sum/uncovered/off-menu → blocked, missing key → clear error; request asserts model from TYPESAFE_MODEL
• cargo test --workspace green in default, instinct, and jev configs (25 suites under jev)
• cargo clippy --workspace --all-targets --features jev -- -D warnings clean; also default + instinct configs; cargo doc clean under -D warnings
• cargo tree under default/instinct has no typesafe
• Mutation gate: cargo mutants -p gpui-agent-policy --features jev -f jev.rs → 40 caught / 0 missed / 8 unviable
• A4 live run (jev-latest, n=5 × 16): 75/80 — Jev coin-flipped T08's identical-row menu (5 wrong) → ambiguity guard (7cdfa37): identical (kind,label) contenders short-circuit before any endpoint → a4+guard 5/5, wrong=0. RESULTS.md §M8 + §Final summary.

Generated with Devin

[hexuria]

A4 live + bonus fix (2026-10-19) — --escalate jev against real System One (jev-latest): 75/80, all 5 wrong on T08 (Jev coin-flipping identical-row menus). New ambiguity guard (commit 7cdfa37): identical (kind,label) contenders short-circuit before any endpoint — a model sees the same identical options, so a pick is a coin flip, not evidence. Rerun: a4+guard 5/5, wrong=0. Mutation gate now also covers escalate.rs: 38 mutants, 28 caught, 0 missed.

[hexuria]

Two-axis review remediation — all findings addressed in 64c43f9

A Standards + Spec review of origin/main...HEAD (the combined M2–M8 stack) found contract bugs now fixed:

Spec conformance

• choose/jev request actions now carry state ({value,checked,states} from UiNode) per M7.2 — OfferedAction::state() + NodeState::to_json(), covered by choose_request_actions_carry_state.
• act replies conform to the M4.5 envelope: {"done":{op,id,text?},"rev":N,"diff":{…}} via post-dispatch snapshot since=<pre-rev>; abstains and blocked/wait controls emit {"abstain":{reason,candidates}}.
• DeterministicTextResolver is spec-strict: multiple quoted literals without label disambiguation → TextError::Ambiguous (dropped the untyped[0] fallback).
• Runner stale bound aligned to two re-decides (M5.3 "at most twice"), matching act.
• M2.5 proptest added (tests/props.rs): a Choice always names an offered action and never a dangerous one — abstain can never produce a dispatchable op. Committed regression seed guards the duplicate-id shrink.
• k declared in the act tool schema.

Standards

• CI now compiles the feature surface: cargo test under instinct and jev + jev clippy; bench job runs r1 (instinct resolver) and a2 (local policy) arms — previously every mcp_instinct/run_* test file compiled to nothing in CI.
• bench/run.py no longer sends a raw token when the host issues no challenge.
• INSTINCT_VERSION_REQ const + manifest pin-test replaces the "0.1" literal in receipts.
• SECURITY.md documents --escalate-cmd env inheritance (GPUI_AGENT_TOKEN, TYPESAFE_API_KEY reach the child).
• lib.rs contract wording carves jev out of "no floats, no network, no model" explicitly.
• PRD gains §11 "Deviations" addendum recording every deliberate divergence (opt-in defaults, ambiguity guard, spec-strict text resolver, jev f64 carve-out, stale-bound interpretation).

Verified: fmt + clippy -D warnings ×3 configs; workspace tests ×3 (0 failures); escalate.rs mutation gate 38 mutants / 0 missed; A2 re-run at the specced n=20 (320/320, wrong=0, p50 ≈49 ms — RESULTS.md updated); live spot-checks a3 10/10 + a4 6/6 (incl. T08), wrong=0.

Still gated on M0.4 (human crates.io publish) before [patch.crates-io] can drop — unchanged per #69.