Three things this repo had shipped but never checked. Each was measured first, and in every case the measurement was worse than the claim.
The plan cache was hitting 5% of the time
jev plan caches a planned command so a repeat costs nothing. It was keyed byte-for-byte — and these commands arrive by dictation. Measured on 22 repeats of six spoken commands, re-transcribed the ways a dictation engine really varies them (a capital on the first word, a capital on an app name, the full stop it adds, a doubled space), it hit 1 time in 22.
A second normalised key beside the exact one takes that to 64%. The eight pairs that must never share a plan still miss, and every cached step still goes through clean_step and the never-send filter when it is read back. The misses that remain are listed in docs/response-caches.md: they carry dictated content, where sharing a plan would change what gets typed.
Also: an expired entry was never actually removed. The 7-day TTL refused to serve it and left it on disk, so a dictated note sat there until 256 newer plans pushed it out.
The mailbox sorter's dollar figure was invented
It priced a batch at a flat 450 tokens per message. Measured against the live endpoint, a full-length message is 1,402 — the constant was a third of reality. The summary now reports what the provider counted, or what the module measured itself sending, says which of the two it used, and reports usd: None when nothing could be counted rather than a confident zero.
Two more from the same pass:
automatedno longer libels a colleague. It meant "this address looks like a robot's", which put a person writing fromsupport@on the path to a disposal lane. It now means only what can be read off an address — a mailbox that cannot receive a reply. Shared mailboxes a team reads get a fourth class,role.- A mail body is screened for text aimed at an agent, using the same screen the memory filter uses. A hit is flagged and never filed away: if a screened message disappeared, one sentence in a body would be the most useful thing an attacker could reach here.
jev triage now refuses bad input like its siblings
A missing file, a directory, non-UTF-8 bytes, invalid JSON, a bare scalar, entries that are not objects — each printed a Python traceback. They now return {"error": "invalid_request", "detail": ...} and exit 2, and entries that are not messages are counted rather than silently dropped.
On how this was built
Each change was made by one agent and then attacked by a second, and the second found real defects in every one: a sender-class fix that read every Name <noreply@…> header as a person, a classify() that raised OverflowError on a non-finite token count in a reply, a measurement claimed in a report but not true of the shipped code, and an injection screen that flagged 2 of 30 ordinary developer mails. All fixed before this was tagged.
839 tests on macOS, 769 on Linux, Python 3.9 and 3.13. MIT.