[liby]

preallow 0.0.9 judges every call on haiku at high and has a second judge on opus at medium judge again, from the start, every call the first did not allow, including one it gave no verdict on; the second judge's verdict is final. The new escalation_model and escalation_effort settings choose the second judge, and the defaults apply as a pair: setting model without escalation_model leaves no second judge. A judged log line keeps the first judge's fields and gives the second's in escalation.

The defaults and the new policy text were chosen on real calls auto mode had sent to the classifier, labeled by hand and kept outside this repository, on a development split and a held-out split. On both, neither the previous default (opus at medium alone) nor the pair allowed a call the policy rules out, counting a read-only call whose output happened to hold a secret as the output scan's job; the README now lists that among the known gaps. On the held-out split the pair sent one more call it should allow to the classifier than the previous default, a weighted 0.26% against 0.15%, which misses the 0.25% limit set before the evaluation by that one call; on the development split it sent fewer, 0.40% against 0.63%. I accepted that for the cost: $2.10 per 1,000 calls against $15.69, with 8.4% of calls reaching the second judge.

The policy is rewritten as decisions taken in order: leaks, whether the call serves the task and keeps to what the user ruled out, the own-repository allowance, whether each effect can be undone, and the authorization the irreversible ones need. It describes each field the judge reads and each fact a check returns, with what the fact does not establish.

A judge model call that comes back without a reply, or with an API error the engine says may clear on its own (rate_limit, overloaded, server_error), is made once more two seconds later; each judge's 90 seconds now cover all its model calls for one tool call. The judged line says in isAnswered whether the judge's model answered, in failure why not, and in retried which failures were retried, so the provider's failure rate stays visible after the retry hides it.

A call auto mode denied, made again unchanged before the user writes again, goes to the classifier instead of the judge, which could allow it on a second sample with nothing new from the user; it is logged as repeated. The plugin keeps a SHA-256 digest of the judge's first prompt for each denied call, so "unchanged" covers the input, the directory, a subagent's brief, and the user's words.

The judge now reads the user's whole kept conversation, which the store already bounds at 64,000 characters, instead of up to 24,000 characters selected per call by wording, which could leave out a prohibition phrased without the words selection looked for. The conversation opens the prompt as its own block marked for the prompt cache, so calls until the user writes again read it, and on Bedrock, Vertex, Foundry, or a gateway the policy too, from the cache.

For a ref with commits no other ref holds, the ref facts now count how many of them git cherry finds with an equivalent patch in the ref's upstream or a remote's default branch, so deleting a branch merged by rebase need not go to the classifier. Path and ref facts move out of facts.ts into paths.ts and refs.ts.

The withholding scan no longer withholds text that names a private key's format without a key, such as a PEM header, a key file's markers around placeholder text, an age key's prefix, or the fixed start of a short-lived Amazon Bedrock key; reading the plugin's own source was withheld for this, and bun run test:sources, now part of bun run check, scans the plugin's tracked files. gitleaks' private-key rule is left out of the generated rules for the same reason; the PEM shape takes its header characters and counts 40 characters of a body across lines of any width and line ending, so a key wrapped at any width or with any line ending is still withheld. Armor around a placeholder of 40 or more letters and digits split over lines is withheld too, and a key after more than about 200 characters of headers, or a narrow body with indented or blank lines, is not; the README lists both among the known gaps. The generated Slack webhook and Sidekiq rules escape the dots in their hostnames, which fixes CodeQL alert #1 (js/incomplete-hostname-regexp).

Each change is its own commit, and each commit passes the plugin tests, lint, formatting, and the core type check on its own. Every new safeguard has a test that fails when it is removed.