Silence ad noise on Android, failing open

01 · Role in the system

What Jev does here

The message pipeline asks the model one question - is this noise - and everything the model does not explicitly flag passes through. Fail-open is enforced in one place, the DecisionMapper, so no call path can bypass it: network failure, missing credentials, timeout, or an unexpected answer category all resolve to allow. Two mechanisms deliberately never reach the model: a local gate matches verification-code shapes and allows the message with no request made at all - not a stripped field, no request, and the diagnostics screen shows an upload counter so the claim is observable - and the SMS sender blacklist blocks by exact identifier without a network call. The model is reserved for the one judgment rules cannot make: is this an ad.

02 · Control boundary

Where Jev sits

Local OTP and blacklist gates short-circuit first; only the remainder reaches one classification call, and a single fail-open mapper owns every uncertain outcome.

Code owns the loop, permissions, thresholds, validation, and side effects. Jev owns only the bounded judgments described above.

03 · Known limits

What this evidence does not prove

• Message text for non-OTP, non-blacklisted items does leave the device to the API; the design doc makes that scope explicit rather than eliminating it.
• Not verified here on a device or emulator; the record cites the repository's design and diagnostics-counter mechanism.
• Fail-open means novel ad phrasings will be shown rather than hidden - the stated price of never swallowing a verification code.

04 · Attribution

Public sources

This is a Community record: the project was published by a third-party community author.

• ufec ↗Community · github · public · checked 2026-09-23