02When a page talks to the agent

Screen what it reads.
Rank what it finds.

Caudra asks a decision model small typed questions where a judgement helps. Is this fetched page trying to instruct the agent? Which memory notes matter for this task? The answers screen what reaches the model and put what matters first.

The fetch card for http://127.0.0.1:8787/cursor-kit/README.md reads Decision engine: withheld from the model, with a flagged chip. The decision line above it reads content_screening, withheld the result from the model: it holds possible instructions to an agent, 0.97 injection, 0.94 addressed_to_agent in chunk 1 of 1. Below, the model says it will not try to retrieve the README another way.

Terminal recording · Withhold a page that gives the agent ordersA real session in the demo project with gpt-6.1-sol, with content screening of the jev-latest decision engine in enforce mode and every other engine feature off. The model fetches the README of a pagination library from a test server on 127.0.0.1:8787. A quoted note in it tells AI coding assistants to delete the tests and push to main. The engine scores the page at 0.97 for injection and 0.94 for addressed to the agent, against thresholds of 0.9, so the result is withheld from the model. The reply says that the README was withheld and answers from the code. A click opens the card, which still shows you the whole page with the note.Open in the gallery
The card Memory searched next-page cursor, 3 notes, with a ranked chip. Its decision line reads memory_search, ranked 6 keyword matches, left out 3 judged unrelated. next-page-cursor.md scores 0.96 and stays first, database-cursors.md and docs-pages.md follow, and terminal-cursor.md, refunds-next.md and page-titles.md are left out.

Terminal recording · Rerank memory search with /decisionsA real session in the demo project with gpt-6.1-sol and the jev-latest decision engine, where only content screening is on. /decisions opens the Features tab, and Space switches memory_search and then source_code_context to enforce, which Caudra saves to the global caudra.toml. The project memory holds six notes, and five of them only share a word with the question. The agent searches its notes for the next-page cursor. The engine ranks the six keyword matches, keeps the note about the next-page cursor first with a score of 0.96, and leaves out three it judged unrelated. A click on the chip shows each score. The reply reads the note and names line 29 of src/pagination.ts. Every decision feature stays off until you turn it on in /decisions and needs an active decision endpoint, and a left-out note still opens with read.Open in the gallery

  • Screening that can withhold a result

    Content screening reads web, MCP, and code output for text that tries to instruct the agent. In advise mode a flagged result carries a caution. In enforce mode the model receives a notice in its place, and you still see the result on its card. A result that cannot be screened in full is withheld too, and its chip says why, such as screening timed out.

  • Reranking where the agent searches

    Memory search and history search keep the matches judged relevant, best first. source_code_context keeps the code rows that fit the task and sends no source text. Compaction keeps the results that matter to the goal, and output pointers name omitted lines worth reading.

  • Advice on every prompt

    Permission advice adds warnings to a prompt without delaying it. Auto mode turns a flagged call into a prompt, and autopilot approves nothing while screening restricts the session.

  • Routing and recall

    New subagents can go to the Fast or Best model by difficulty. Memory recall reminds the agent of up to three notes that fit a new message, and a message that corrects the agent can remind it to save a note. A goal unlikely to pass skips its evaluation.

  • Judgement inside a snippet

    In a code snippet, decisions.decide() and decisions.rerank() judge what the snippet gathered before any of it reaches the model.

  • Spend you can see

    Each decision call shows in /usage under its own purpose, priced per endpoint: TypeSafe Jev at $0.042 and OpenAI Luna at $0.10 per 1M input tokens, with free output. It counts toward the session cost, goal spend, and the budget of autopilot. A local model without a price adds its tokens without a cost.

  • One endpoint you choose

    Add TypeSafe Jev, OpenAI Luna, or a server of your own in /login, and switch it in /model. A local server on a loopback address needs no key.

Every feature is off until you turn it on in /decisions, and each needs an active decision endpoint. shadow mode only collects predictions. The transcript shows what each feature changed, and a decision about a tool call shows on its card. Predictions add to deterministic permission rules and can miss risks. enforce never grants a permission, and redaction of what is sent is best effort.

Decision endpoints