v2.3.5
The deep tier stops hedging on the one thing it sees most often, and stops rolling dice.
A fake verification gate is the payload. Seven of eighteen medium-confidence scam verdicts were hand-drawn "Security Check / I'm not a robot" cards on days-old throwaway domains. The model described them accurately, named ClickFix in its own reasoning, and said medium, so the auto-block policy did nothing. The prompt's only confidence rule was "high means you would stake the block on it", and every high example showed the model seeing the payload directly; nothing said the gate on a young spoofing domain is the payload. It does now, with two conditions together: a rendered gate that loads no real challenge provider, plus at least two of a young certificate, a numeric or random hostname, brand imitation, no mail records, or nothing legitimate at the root. A dead page is never a gate. A real provider challenge on an established domain stays missing evidence.
Side by side on the same 17 hosts with the real tools and model: the one live gate went medium to high, a dead page that the first draft had wrongly pushed to high dropped back to uncertain, and nothing benign was condemned in any run.
The tool stops contradicting the rule. The challenge-page note from v2.3.4 fired on wording alone, so a kit that copies Cloudflare's text verbatim was told "missing evidence" by the tool while the rule said judge it. The renderer now records whether a real challenge provider script loaded. With one, the note stands. Without one, it says the opposite: a real challenge always loads its provider, so this is a fake gate and positive evidence.
Sampling at temperature 0. The runner was passing only a timeout, so every investigation sampled at the provider default of 1.0, and the same evidence could land on different verdicts run to run. Judgment tasks now sample at 0 by default, configurable with LLM_TEMPERATURE.
What's Changed
Full Changelog: v2.3.4...v2.3.5
