v0.9.0

0.9.0 (2026-10-07)

Features

• add jev_gate_range, which reads the gate's diff from git (47d27da)
• flag trimmed diffs and review-only failures in gate hints (f9a0ddb)

Bug Fixes

• code an upstream context overflow as input_too_large (1e875e3)
• gate what the push sends and read the hook command as the shell does (33cfe7d)
• key the response cache on the provider's endpoint (be05ead)
• let limits own the regex pool bounds (8d07eee)
• read the verified server's replies off a thread, not the pipe (0e7ce69)
• refuse non-HTTP connections at the bearer gate (d87a4ab)
• repair the defects found in the 2026-10-01 code audit (068872a)
• select the provider in the startup gate without building a client (734663c)

Documentation

• ask for the real diff in the gate and review descriptions (d6b6ea1)
• bring the module map up to date (167e7fb)

v0.8.0

0.8.0 (2026-10-01)

Features

• add jev_ask, the caller-written ask extension tool (ADR-0077) (ea475dd)
• add jev_file_judge, the server-read file judgment tool (ADR-0077) (4a5df4c)
• add jev_files_judge, the batched file judgment tool (ADR-0077) (5d19992)
• add the opt-in hook screen PostToolUse annotator (ffb2d90)
• cut the compaction summary at the live-work turn (ADR-0077) (6adb044)
• route hook gate through guard questions (99c3571)

Bug Fixes

• deny pattern-matched write content before any provider call (d2d5cca)
• judge only real user turns over a redacted transcript tail (6b3080d)
• keep credential redaction linear on long identifier runs (0df5b30)
• make jev_ask command execution opt-in, denylisted, scrubbed, and bounded (53eac60)
• reconcile jev_files_judge with the landed jev_ask (ADR-0077) (7e0486b)
• refuse every *.env dotenv as a secret store (e9be1e6)
• refuse secret stores and redact credential literals in file state (09e7f9e)
• refuse to work when a moved clone leaves core.hooksPath stale (794024b)
• scan write content with a strict credential-literal detector (5f9392c)
• stop at the caps and summarize the overflow (ADR-0077) (04e9c7f)
• target screen at injected instructions, not any instruction text (524cb3f)
• tighten the credential-literal detector against probed false positives (3dd75c0)

Documentation

• add composite, routing, and catalog-traversal recipes (774b7ed)
• correct the dogfood confinement record (f70e7cc)
• pass the S8 dogfood gate and scope the ask-command denylist (efd933b)
• record the ask and file-judgment extension family (ADR-0077) (afb6fed)
• record the hook guard-question design in ADR-0076 (d81d937)

v0.7.0

0.7.0 (2026-09-29)

Features

• grade confined agent runs inside the isolation adapter (2f1f22a)

Bug Fixes

• hash the tests file the CLI gate reads (d8e412d)
• return a typed tool outcome instead of re-parsing error text (c0f6688)
• type the outcome test reads so pyright stays clean (8e0626f)

v0.6.0

0.6.0 (2026-09-28)

Features

• a lowering-only JEV_AB_MAX_USD spend override for the A/B study (1b65b35)
• confine live agent evals behind a broker sidecar and a capability (ADR-0074) (f6453b8)
• grade added tests apart from weakened ones (67bc438)
• out-of-task exploration is recorded, not a study stop (ADR-0074) (1a92ded)
• package the owner's jev skill and keep Jev on demand (56ccb0f)
• ship the jev skill with the MCP server (19100ac)
• stop the study when a run leaves its boundary (5cfcaae)
• the cap persists in the ledger, and a paid pi model needs a ceiling (85bd171)
• the without-Jev arm runs a boundary with no TypeSafe channel (3ed1c09)

Bug Fixes

• allow the README hero in the hidden-character guard (62827ca)
• an irrelevant added test fails the run (8eacae7)
• answer every question the load stub is asked (525b7c9)
• assert the load stub's derived source names the caller's evidence (33631a1)
• attribute the repo to elkaix and reject hidden characters (337fd52)
• close the j6, j7, and j8 acceptance defects (30099f8)
• close the review findings on the hidden-character guard and adapter path (98124e5)
• correct the bench D3 telemetry (cbf6c36)
• do not count an unasked source question as fail-closed (925c53b)
• do not reflow the packaged jev skill (f9078b8)
• doctor --help prints a real argparse page and exits 0 (edee34b)
• doctor reports whether the typesafe SDK is importable (3c381e9)
• evals: keep Claude login working and refuse dead batches (a829584)
• evals: scope the keychain link and refuse a dead preflight (f19c02b)
• exploration and the failure category part ways, derived at render (f58f3da)
• fail the build when a wheel file has no uv cache key (5c27bc1)
• grade added tests the way the agent ran them (30d9a05)
• inspect exactly one built artifact and name the check for what it does (383593e)
• install the pinned actionlint in hosted CI so the workflow lint runs there (77e9309)
• keep host paths out of the agent-visible MCP config (d995026)
• keep the ci stage list on the ci line and sync as a prerequisite (cf009bb)
• keep the escape category on every record path (b9c69ab)
• keep the study key out of the harness process environment (7f942a3)
• keep treehouse checkouts from shipping ignored sdist files (a1f252d)
• launch the study servers from a wheel-built venv outside the repo (8cbb522)
• let make ci-linux check a linked worktree (eb1b13b)
• make j4 through j9 hinge on their judgment (d1a6c0e)
• make restraint on a control measurable (7083023)
• make sdk_importable's docstring true and its probe cover RetryPolicy (92cd660)
• make the outcome charts readable in the README (f908726)
• map an upstream 401 to auth (7b863e5)
• match the diagram to the server and free the replay route (81f725c)
• name elkaix as the only author and maintainer (94e8ffb)
• name every file that carries the reference tool text (a58e17f)
• name the skills, the instructions, and the CLI surface in the README (e8feb0c)
• name the uv 0.10.10 cache-key boundary and cover LICENSE (b339b1f)
• narrow the notice-test walk for strict pyright (f317365)
• notice the copied tool text and the Archify diagram (8c888b3)
• one AST rule for pre-existing test content (9ef905e)
• one shell tokenizer for the canary (heredocs, quotes, redirections) (dc55d5d)
• patch the probe seam in the gate tests, never sys.modules (6df8a73)
• pin uv to 0.12.19 across local, Linux, and GitHub CI (91a5702)
• reach the Jev server's key by sandbox keyfile, not the config env (84b17b5)
• read Jev's answer from the one field that carries it (c823c0c)
• rebuild the escape canary on a run boundary (295aa2f)
• rebuild uvx from current sources instead of a stale cache (8138719)
• refuse at startup when the selected typesafe provider cannot run (dae5ffe)
• refuse checkout installs on uvx older than 0.10.10 (853a231)
• render the diagram without an embedded font (193113d)
• replace the release workflow's ls count with find; lint workflows with actionlint (c14296f)
• rerender the architecture diagram on Archify 7c3ae9a (6dc23f8)
• restore owner labelers and cited sources (8f22070)
• resync the packaged jev skill to a596996 (164b44f)
• satisfy the fake-secret guard on the new test cred...

v0.5.0

0.5.0 (2026-09-26)

Features

• adapt public JevBench items to the eval harness (A8 preparation) (d4a78a2)
• add advisory calibrate subcommand fitting thresholds on caller-labeled rows (3f3051b)
• add order-sensitivity probe to the eval harness (A2) (e4276ac)
• cache: off-loop IO, a TTL, and oldest-first eviction (ADR-0047 amendment) (8e93953)
• file lists name each reviewed file's action (file_actions) (5a02bf1)
• gate file list verifies claims once, per file review stays per file (25016dd)
• providers: opt-in JEV_MCP_MAX_INFLIGHT cap on concurrent requests (fd26573)
• telemetry: log the metrics snapshot at INFO every 100 tool spans (0c2972b)

Bug Fixes

• address every critique finding on fm/jev-eval-calibrate (P2-1..4, P3-1..6, E1..3) (0f2cdbe)
• cli: code isError envelopes with the one parity mapping (422c17f)
• critique follow-ups H1-H4 (hook gates, cache leftovers, serve wiring test, off-path hops) (14c2569)
• delta-critique-a follow-ups — sweep before no-evict, scaffold guard, worst-last pin (C1, C2, F1) (0c35884)
• delta-critique-b nits — one source_commit call, required control (F3, F4) (831fab4)
• example collects every confidence across the real payload shapes (f2d3c86)
• gate file list keeps isError, sums usage, shares file plumbing (0cf8928)
• hook: match completion commands on tokens, not a string prefix (c6641f7)
• qualify file_actions' worst-entry claim and pin the clamp shapes (D1, G-A, G-B) (38b7b34)
• responses: code every frozen budget refusal input_too_large (dc06e0e)
• review-critique follow-ups on the gate file list (F1-F3, G1-G3) (d33c98e)
• server: configure redacting logging before the judge/gate/hook subcommands (6630fc8)
• server: hand the HTTP listen sockets to uvicorn, closing the probe gap (6862536)

Documentation

• caller guide for writing states and questions (86bdcfb)
• claims are positional strings, not id records (87b65b6)
• fix every critique finding on fm/jev-readme-bench (P1-A..P3-8) (fc70ce6)
• fold caller-docs' EVIDENCE.md pointer into the reworked Measured results; depth now points at guidance.md (89c5369)
• lead with measured speed, cost, and decision quality; add agent setup rules (e386694)
• limits page for caps, defaults, and error codes (66cecf3)
• name the pin behind every budget refusal's error code (47d5f4e)
• per-tool cards with measured evidence and weak spots (0c04ad8)
• pin or source every restated frozen number (1215d47)
• pin the install command's -y exactly; state the public_tasks id join (F1, F2) (a95c097)
• release evidence page and a release step that fills it (ee28b62)
• state the per-file diff review rule on the limits page and tool cards (5d579f0)
• track the JevBench run's machine evidence; point the adapter at the recorded run (F1, F2) (e807384)

v0.4.1

0.4.1 (2026-09-26)

Bug Fixes

• score rubric window, caller-input error codes, config log, --help (4697a02)

v0.4.0

0.4.0 (2026-09-26)

Features

• state item shapes plainly in array argument descriptions (f91cb5e)

Bug Fixes

• judge envelope reads each tool's own decision field (27eec8c)

Documentation

• document renamed_ids duplicate-id semantics (0ff8cc7)

v0.3.0

0.3.0 (2026-09-26)

Features

• cli: add judge and gate commands and an opt-in completion hook (76dd45a)
• doctor: print policy_version beside the policy defaults (8cdba50)
• hook: split decision rendering and add JEV_HOOK_REQUIRED (50febb1)
• mcp: build initialize instructions from the tool registry (2d708f1)
• tools: add response fields, implicit evidence, and file diffs (a8d6af5)

Bug Fixes

• close the Claude dogfood release blockers (b05d646)
• close the stage-8 findings on the CLI, hook, and file list (cc70abd)
• harness: match Bash so the completion hook can fire (b06caec)
• keep the live typesafe request id header (6b52f8f)
• map sanitized ids back to the caller with renamed_ids (8422a3e)

Documentation

• describe the CLI, completion hook, and response fields (0a1681e)

v0.2.2

0.2.2 (2026-09-25)

Documentation

• changelog: list the fixes that shipped in 0.2.1 (5490f1c)
• use compact rounded README badges (7037cf5)

v0.2.1

0.2.1 (2026-09-25)

Bug Fixes

• evals: carry the partial evidence on the readers-never-stopped path too (825c8fb)
• evals: never return a silently partial agent transcript (b72c53a)
• install: build the verify error tail after the drain has finished (637c996)
• server: the served regex pool starts warm (ADR-0058) (99ac61e)

Documentation

• add a PyPI download count badge to the README (39b1544)
• the passing-case evidence moves to the branch head (fee5188)
• the pre-push gate in contributing and ADR-0056 (0ba2cfb)

Continuous Integration

• base the linux leg on the slim uv image with a checksum-verified node (fe32b0d)
• block pushes on the full ci workflow, native and linux (ADR-0056) (060880e)
• emulate security-one-cpu with the job's own docker run contract (9b73bd0)
• guard the watchdog's pkill against the not-yet-started race (0de3ee7)
• make the gate hermetic, bounded, checkout-agnostic, and pushed-commit-faithful (2e19b66)
• mirror ci.yml's security-one-cpu job in the linux leg (71a17b0)
• reap orphans in the linux leg with --init (53cb5e7)
• run the linux leg as a non-root runner with the tools the tests shell out to (b842154)
• run the ReDoS storm contract on a one-CPU quota (81e8022)
• stop the one-cpu image lookup dying on a flaky sigpipe (eb41999)