Phase C: limits/judge API, eval, regex gaps

[chiruu12]

Summary

• Expose LimitConfig / BYOLLM judge on the public path (unplug, unplug.api.limits, unplug.api.judge) with docs, example, and end-to-end tests (wiring already existed in Guard; this finishes the public surface and TOML story).
• Re-run built-in + neuralchemy/microsoft regex evals; record results and remaining gaps in sdk/docs/EVAL_PHASE_C.md (refresh download/reproduce commands).
• Close high-value neuralchemy FN phrases with focused injection patterns; strip bidi control chars in the normalizer (token smuggling).

Test plan

• make check / make test-cov (80%+) in sdk/
• uv run python examples/limits_and_judge_demo.py
• uv run python -m benchmarks.run benchmarks/data/neuralchemy.jsonl --isolated --format json (recall 0.405 / F1 0.575)
• CI green on this PR

---

Note

Medium Risk
Changes affect core injection scanning and text normalization (redaction span mapping), which can shift false positives/negatives; public API additions are additive but provisional.

Overview
Phase C promotes LimitConfig and BYOLLM judge types (CallableJudge, JudgeProvider, etc.) to the stable public surface via top-level unplug, new unplug.api.limits / unplug.api.judge, migration tier updates, LIMITS_AND_JUDGE.md, example config, and a demo script—backed by broader integration tests (TOML limits, judge band, fail-closed).

Regex detection gains ten neuralchemy-driven injection patterns and bidi / invisible control stripping in the normalizer (plus span mapping so redaction includes adjacent stripped chars). Benchmark README/docs reflect a small regex-only neuralchemy lift (recall ~0.41, F1 ~0.58); EVAL_PHASE_C.md records reproduce commands and remaining gaps.

^{Reviewed by Cursor Bugbot for commit 17d4675. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR completes the Phase C public API and detection updates. The main changes are:

• Public LimitConfig and judge imports through unplug and unplug.api.*.
• Limits and judge docs, demo code, TOML examples, and integration tests.
• Regex-only benchmark updates and Phase C evaluation notes.
• New injection regex gap patterns.
• Bidi control stripping and expanded redaction span mapping.

Confidence Score: 4/5

This is close, but the regex false positive should be fixed before merging.

• The public import and limits/judge facade changes appear sound.
• The bidi redaction fix covers the reported stripped-control span problem.
• The updated instructions regex can still flag ordinary documentation text.

sdk/src/unplug/data/patterns/injection.yaml

Important Files Changed

Filename	Overview
sdk/src/unplug/data/patterns/injection.yaml	Adds injection gap patterns, but the updated-instructions branch still matches benign documentation text.
sdk/src/unplug/core/normalize/normalize.py	Expands original spans over adjacent stripped bidi and zero-width controls.
sdk/src/unplug/init.py	Adds top-level exports for limits and judge types.
sdk/src/unplug/api/judge.py	Adds a public judge facade.
sdk/src/unplug/api/limits.py	Adds a public limits facade.

_{Reviews (2): Last reviewed commit: "Tighten supersede pattern; expand redact..." | Re-trigger Greptile}

[github-actions]

SDK Coverage •

File	Stmts	Miss	Cover	Missing
src/unplug
__init__.py	31	4	87%	80–81, 87, 89
src/unplug/core/normalize
normalize.py	316	5	98%	32, 151, 332, 441–442
TOTAL	7136	886	87%

Tests	Skipped	Failures	Errors	Time
1185	25 💤	0 ❌	0 🔥	39.440s ⏱️

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 17d4675. Configure here.}

[chiruu12]

Follow-up fixes merged in #81 → dev (18dee378). Injection regex FP + NORMALIZER_VERSION v13.