🔮Augur v1.11.0

Added

• VisibleProvidersSecurity Programs that call Jev can point at http://127.0.0.1:8020 and leave the TypeSafe key out of their own config. The new Jev gateway, built with node scripts/build-gateway.mjs, holds the key and the jev-preview alias in ~/.augur/jev-gateway.json and refuses to send sensitive or regulated requests anywhere but Laya. Usage goes to ~/.augur/jev-gateway-usage.jsonl without the request text; see docs/jev-gateway.md.
• VisibleProvidersSecurity augur grade <rubric> --task ... --candidate ... scores an answer against a rubric in ~/.augur/rubrics. Grades start in shadow mode and only produce pass or fail verdicts after augur label <grade id> --grade agree|high|low has collected enough agreement, which for a low-stakes rubric means 30 labels at 85%. Text in the sensitive or regulated tier is graded on Laya only; docs/grading.md has the rubric format.
• VisibleProviders A pick weighs the task as routine, everyday, deep, or core, and a route can be capped. Routine work such as renames and boilerplate leans hard toward light models, and core work such as an engine or security-critical code leans hardest toward strong ones, through the new tilt.routine and tilt.core settings. --depth on augur pick and depth on augur_pick take all four values, and without one the decision backend judges the task description. caps.<route>.perDay and caps.<route>.perSession limit how often a route is picked, and a capped route still runs when a caller names it. No route is capped unless you set a cap.
• VisibleProviders Training mode asks you before a pick goes to a strong model. With training.enabled on, a pick on a strong route becomes a proposal, and no job runs on it until you answer with augur pick-answer <pick id> --model <route>. Once at least 10 of your answers for a kind of work exist and 90% of the last 20 agreed with the proposal, that kind of work stops asking, apart from core work and one pick in ten as a spot check. Your choices also lean later picks for that kind of work a little. Training mode is off by default.
• VisibleUIPlatform The service can serve the Augur app to a browser on any device that can reach this computer. The page shows the service’s own usage engine, the way the terminal app does, and reads no provider itself. The browser connects to your computer directly, with no relay in between, so the computer has to be on and reachable over your network, a VPN, or a tunnel you set up. It is off until augur config set web.enabled true and a service restart, and it listens on 127.0.0.1:7420 until web.host and web.port say otherwise. web.allowedHosts adds host names, and web.tlsCert and web.tlsKey turn on https; see docs/web.md.
• VisiblePlatformSecurity augur web prints the links that open the web app, and augur web rotate replaces its token. Each link ends in #token=, and the page keeps the token in that browser and clears it from the address bar. The web token has its own file, apart from the owner and agent tokens, and anyone with it can do everything the panel does. A rotated token cuts off open pages within about 20 seconds.
• VisibleProviders Augur can sign in to Codex itself. You open the sign-in link on any device, so a computer where the Codex CLI isn’t signed in, or that has no browser, can still be metered. Augur saves only the refresh token in your operating system’s key store and leaves the CLI’s login alone while it has its own, so the two stop signing each other out. The Codex card in Settings has a Sign-in block for it.
• VisibleProviders augur login codex, augur login status, and augur logout <provider> do that sign-in from a terminal. augur login codex prints a link and a short code and waits for you to approve it. Your ChatGPT account has to allow device-code sign-in in its security settings, and on a workspace account only the workspace admin can turn that on. augur login status lists every provider that has a sign-in, augur logout forgets only Augur’s own session, and an agent’s token can’t sign in or out.
• VisibleProvidersPlatform You can add a sign-in for a provider on one computer with a local-signin.mjs file in the Augur folder. The file exports signInFlows, which maps a provider id to a flow with begin, complete, and renew functions. Augur downloads never include it and updates never replace it, and the service logs at start which providers it added or why it couldn’t load the file.
• VisiblePlatformSecurity The macOS install script and augur update check a signature on the release’s checksum list. Each release carries SHA256SUMS.txt.sig, signed with the key the window app’s updater trusts, and a list whose signature does not verify is refused.
• VisibleProvidersSecurity Augur’s Jev classifier can ask a Jev gateway instead of calling TypeSafe with your own key. Set decision.gateway to the gateway’s address, such as http://127.0.0.1:8020, and the gateway’s key answers augur pick --task, with a token from JEV_GATEWAY_TOKEN when the gateway requires one. Sensitive and regulated task text still goes only to Laya.

Changed

• VisibleSecurity School and course names for the student-text check now come from private-terms.json in the Augur folder. The shipped list keeps only everyday words such as student, roster, and ferpa. Add your own terms as { "terms": ["..."] }, or set contentTerms in the gateway settings. A hyphen in a term matches with or without it.
• VisibleSecurity The MCP server now has its own agent token. With it an agent can run jobs, read their results, and add routes, but it cannot answer a pick, label a grade, change settings, or say that you named a model. The terminal app, the window app, and hooks still use your own token.
• VisibleSecurity On Windows, keys are stored for this computer only. They no longer travel with a roaming profile. A key saved by an older version keeps its old setting until it is saved again.
• InternalPlatform The release workflow pins the Tauri build action to a specific commit. That step receives the updater signing key, so it runs a fixed, known version.
• VisibleProvidersSecurity augur_route_add accepts fewer route options and leaves routes for models already in the rules to you. It refuses any option that names a program, arguments, a folder, an environment variable, or a header, keySource must be store, and a route for a model the rules already hold waits until you add it in the app.
• VisiblePlatformSecurity Laya judges a browser request by the adapter it resolves to and refuses a body over 1 MB. The adapters a browser may not use come from the registry’s browser_blocked_prefixes list or LAYA_BROWSER_BLOCKED_PREFIXES, and a registry that cannot be read blocks every pilot request from a browser.
• InternalPlatform Workflow actions and tools are pinned to exact commits, and checkout no longer keeps its credentials. Dependabot proposes updates to the pins each week.
• InternalProviders Jev gateway usage summaries keep caller-supplied labels such as __proto__ as plain keys.

Fixed

• VisibleProvidersSecurity An API route no longer follows an http redirect. A redirect would carry the route’s key to another host, so the job fails with a message saying the endpoint redirected. Set the route’s base URL to the address the redirect points to.
• VisibleProvidersSecurity When a provider request that carries a key is redirected, Augur follows it only to an https or home-network address. If the redirect goes to a different site, the headers and body stay behind. The home-network check now takes only a real private IPv4 address, so a host name that merely starts like one, such as 192.168.1.5.example.com, no longer counts.
• VisibleProvidersSecurity A job’s working folder, prompt file, and attachments are checked at the place they really point to. A symbolic link inside an allowed folder can no longer reach a file outside it, and a prompt file or attachment that sits in the service’s data folder is refused.
• VisiblePlatformSecurity Only your account can open the service’s token file and socket. On Windows the token file gets an access list that names only you, and on macOS and Linux the socket and its folder are created with no access for other accounts.
• VisibleUISecurity The terminal app opens a web link without going through a shell. A link with characters a shell would treat as commands is not opened.
• VisiblePlatformSecurity augur update and the macOS install script install a release only when its version is a plain dotted number. The version becomes part of file and folder names, so anything else is refused and nothing is installed.
• VisibleProvidersSecurity Grading text that mentions students is always graded at the regulated tier. A lower tier declared by the caller no longer overrides it.
• VisibleProvidersSecurity A provider added by augur profile import starts from the cautious starter rules. Its models see public data only and must be named before use, unless the file sets other values.
• VisibleProvidersSecurity A balance edit whose path names __proto__, constructor, or prototype is refused. The answer says the name is not a balance setting.
• VisibleProvidersSecurity The Jev gateway keeps requiring tokens when host is edited after it starts, and its health check no longer runs the key command. With tokens off it also answers only connections from this computer, whatever the Host header says.
• VisibleSyncSecurity The phone ignores a sync update older than the last one it applied, and each update is tied to its pairing. A relay can no longer roll the phone back to an old reading or hand it another pairing’s data. A desktop whose clock moves backwards sends updates the phone ignores until the clock passes the time of the last one.
• VisibleSyncSecurity A pairing link opened in the phone’s browser asks before it sets the phone’s relay. A scanned code asks only when it would replace a working pairing, and a relay has to use https or sit on your home network.
• VisibleSyncSecurity Unpairing a phone also deletes the desktop’s push notification key. A push subscription the phone still holds stops working, and a new pairing makes a new key.
• VisibleSecurity Login files the service renews for Claude Code, Codex, and Grok are written readable by your account only. On macOS and Linux the file gets owner-only permissions, in a folder only you can open when the service creates it.
• VisiblePlatformSecurity Cancelling a job on macOS, or on Linux without systemd, also ends processes that left the job’s process group. The service follows the job’s descendants about once a second, so a process that starts and detaches between two looks can still be missed.
• VisibleUISecurity A balance shows its currency only when the provider sends a plain currency code. Any other text in that field is left off.
• VisibleProviders The Claude card now says when the saved Claude Code login can no longer be renewed. Once another Claude Code sign-in replaces the refresh token in ~/.claude/.credentials.json, the card reads “The saved Claude login was refused, so Augur cannot renew it. Sign in to Claude Code again.” in place of “Provider returned HTTP 400” beside numbers that had stopped updating.
• VisibleSecurity Fit scores for student-related task text come only from a decision backend on this network. When no local backend is available, those scores stay neutral at 0.5.
• VisibleSecurity The control endpoint answers a request that is not a JSON object with an error. The service keeps running and handles the next request normally.
• VisibleSecurity Rule sync skips a policy stamp that names a field the rule does not have. The remaining stamps from the other device still merge.
• VisibleSecurity The phone and browser app opens provider links only when they use http or https. Links with any other scheme do nothing.
• VisibleSecurity Desktop commands that read or write files, run the dispatch CLI, set the hotkey, or talk to the service now answer only the app’s own popup window. A provider page open in a sign-in window cannot call them.
• VisibleProviders Codex, Copilot, and API jobs no longer count their reasoning tokens twice. Those harnesses already include reasoning in the output count, so their output totals, characters-per-token calibration, and derived costs drop to the true figure. Costs a provider reports itself stay the same.
• VisibleProviders The Jev gateway now notices when you break its settings while it runs. If an edit leaves the settings file broken or sets a bad value, the gateway writes it to its log when it rereads the file, instead of saying nothing until the next restart.