Reward Hack Guard

RH Guard (rh-guard) sits in coding-agent hooks (Claude Code, Cursor, Codex, Grok Build, Pi, Amp, Prime Agent, DeepSeek Harness) and blocks reward-hacking tool use—tampering with graders, hidden tests, or the eval process—while steering toward checks the agent cannot game. Exo is support via ToolRuntime wrap, not drop-in hooks.

Left pane is a render of the recorded Exo session; right pane is a facts panel from that same session, not a second CLI (sed denied, assertion unchanged, harmless echo allowed). Click through for the mp4, or see docs/sessions/demo.md.

This repository is public on GitHub: 24601/rh-guard.

Companion, not a merge. Augustus is design-judgment for where typed System One judgment belongs. This repo is the live hazard gate on agent tools. Keep them separate.

Sibling, not a merge. JevLint is semantic convention Noul lint in a write → check → fix loop (quality vs gaming). Distinct from mizchi/jev-lint (name/comment/test truth-of-contract; findings are candidates, not verdicts). Not the same product.

Sibling, not a merge. jevgate is an allowlist that proves what may run; Jev judges only the rest. Hard envelope owns safety; soft judgment is never the sole veto (fail-open: it cannot block). Same complementary pattern as structural deny + System One sidecar. Do not merge the products.

Complementary, not a competitor. GLiGuard is an encoder-based LLM prompt/response safety guard; rh-guard is a coding-agent reward-hack / eval integrity gate.

Sibling, not a merge. Abide enforces soft project instructions (AGENTS.md / CLAUDE.md) via Jev on diffs. rh-guard is eval-integrity / reward-hacking on agent tool use. Same hook surface (Claude, Codex, OpenCode), different judgment class. Fail-open, banded confidence, and soft judgment never the sole hard veto — same envelope as jevgate. Do not merge the products; Abide does not catch reward hacking.

Eval integrity & measurement

Harbor is the preferred e2e substrate for reward-hack / eval-gaming scenarios: taskset (score first) + harness + runtime, an independent validator, and a HoH evidence loop. rh-guard hooks are structural / System One gates inside a harness — they do not replace a scored taskset.

jevals is the complementary decision-stage workbench for typed Noul / Choice / Score falsification when this sidecar or a policy uses Jev-class judgments. Practices: independent answer keys (never promote predictions to labels); correctness ≠ confidence; held-out discipline; compare only equivalent case sets. Distinct from openlayer-ai/jevals (in-loop gates; classifier is not the authorizer).

wellposed lints Choice / Score / Noul requests before runtime: a Choice with no "other" can be forced wrong at confidence 1.0, and broken state paths are unanswerable. Confidence gating cannot catch a forced wrong Choice — inspect request shape first.

openevals is adjacent online eval / observability: code graders first, then cheap parallel System One as a per-step/trace judge — not LLM-as-judge as the primary score.

jev-align verifies a plan or response against policy before act (including fabricated verification). Complementary to this tool gate, not a merge. Measure a live System One gate with shadow / confidence action evals (jev-harness; distinct from Astro-Han/jev-harness pre-model tool-result filter), not LLM-as-judge as the primary score.

pi-jev-approver is a Pi bash safety gate: code-computed state, then Jev; commandRules can hard-block; no key → fail-closed. Contrast jevgate allowlist + fail-open rest (it cannot block). agent-workflow-typesafe-ai emits advisory no_action receipts; the plugin never changes host routing/executor — hard fail-open evidence for soft sidecars. jevscan composes tree-sitter extract (hard envelope; no execute) with Jev questions (soft judgment). Measure collab with jev-testbench arms (llm_autonomous vs scripted_plus_jev vs llm_plus_jev); do not claim collab helps without arms.

semantic-firewall is LLM-proposes / Jev-5-noul control plane / code ALLOW/ASK_USER/REVISE/BLOCK (untrustedInstruction skip-when-absent). Contrast: this sidecar keeps a fail-open soft Jev overlay; the hard envelope stays structural. claude-code-jev is an additive Claude PreToolUse permission gate via OpenRouter typesafe/jev-1.13 (230.8ms p50 / 263.9ms mean / 459.2ms p95; 90 live decisions on their synthetic 18-case fixture); quoted 0 dangerous allowed on that fixture; low-confidence and network fail → human; quoted adds a 264 ms hop rather than removing one; default 0.85 uncalibrated; Anthropic auto-mode is not replaceable via a supported API. jev-agent-safety-arena is a small browser-agent Jev-vs-baseline eval on benign + injected pages (fixture, not a shipped claim). jev-model-router is adjacent model+effort routing, not a rh-guard peer.

gliner25-compaction is local GLiNER2.5 (fastino/gliner2.5-base-v1) Claude context compaction: extractive character-offset spans, not generated summaries; Choice keep_full / keep_evidence / keep_call_only / drop; uncertain or invalid evidence fail-closed to keep_full; hard shell/mutation policy overrides the soft model; shadowMode default true before rewriting history. Not reward-hack detection. Sibling envelope next to jevgate (fail-closed retention vs fail-open rest).

jev-compactor is framework-agnostic verbatim compaction plus safety gating: Jev judges relevance. Code decides structure. Destructive commands and thrashing loops are caught in the same pass; a regex floor in code flags rm -rf / DROP TABLE / curl | sh whatever Jev later says. Companion to the slo-router lesson: keep a deterministic floor under Jev. Not a rh-guard peer.

latch is a CI merge-gate: code clusters failures, Jev labels each cause, code owns Gate: PASS (infra) vs Gate: BLOCK (real). ignore_as_infra requires an explicit network fingerprint; Jev cannot ignore on its own. Eval-integrity cousin — treating real failures as noise is the gaming angle it counters. clear-head is a Claude Stop hook that checks claims against session evidence (CONTRADICTED / UNSUPPORTED); anti-done-without-reading.

jev-marshal is named PR policy rules enforced by Jev (empty public tree at capture). if-ai is plain-English PR condition checks (Jev Choice + min-confidence; Action fails on false/low-confidence/error; required-check is optional). Quoted README: A passing if-ai check is advisory. TypeSafe 67.8% is four workflows, not PR review. wakegate is a fail-open wake gate (skip only when Jev answers and p < 0.2; error/no-key/unsure wake). Contrast pi-jev-approver fail-closed. omp-auto-mode is an oh-my-pi safe/ask/unsafe classifier; classifier failure defers to omp approval (fail-open). Cousins, not runtime deps.

toolgate is a pre-execution tool-call gate (allow / block / review); guard error or timeout stops the call (fail-safe). Distinct from ndolinschi/toolgate. AI SDK + LangGraph adapters and a given → expected → actual eval CLI (only given reaches Jev). Cousin, not this sidecar.

jev-reviewer is a local PR overlay: Jev assigns P0/P1/P2 attention priorities (P0 expanded; P1/P2 collapsed). Attention is not a correctness verdict; never equate P0 with "blocked as unsafe". Anti-soundness-theater / soft-judgment UX for gates.

safe-sh is static shell analysis with Jev (tree-sitter bash chunks; never executes). README: replace sh/bash with safe-sh (curl … | safe-sh); --warn-on / --error-on own the hard exit. Scores include credential/exfil-shaped questions; high score plus --error-on confidence exits 1 — shell/secrets judgment before a hard deny, still not execution. Contrast yolo-shell (exec interceptor + local floor) and toolgate fail-safe pre-exec. Weakened-test review lives on typesafe_agent_gates, not here. Gate-adjacent; not a reward-hack detector.

interlock is a capability kernel for untrusted agents: Jev is a sensor; policy in code decides allow / ask / block. Canaries + closed action space; secrets never enter the agent. Critique of post-hoc "is this dangerous?" firewalls with real secrets still in scope. 38-case regression suite (not a blind paper). Positive pattern: hard envelope first. Anti-pattern: soundness theater / soft judgment hard-gated as safety.

port-cleanup is a gate UX exemplar: evidence-backed, human-confirmed irreversible actions; shields override Jev; identity re-check before SIGTERM; app-owned explanation text, not model prose. Never auto-kills.

jev-dspy-control-plane routes into a closed ontology; fraud/security force a human path even when the classifier predicts routine. After the control plane fixes the action, the LLM cannot add routes or tools.

jev-arena measures native Jev probabilities (Brier/ECE). A live run is overconfident in the low bins. Do not treat native probabilities as truth without Harbor-style measurement. Not a reward-hack ROC.

jev-capability-atlas is a jagged hold-vs-break map of Jev with real API receipts. type-safe ≠ correct: a typed answer space cannot go off-menu, but that is not a correctness guarantee (DAIR Emotion: mean confidence 0.819 vs 48% accuracy). Holds when the answer is in state; breaks — often confidently — when it needs unsupplied knowledge. Receipts first. Eval-integrity cousin, not a rh-guard peer.

jev-ood-calibration measures OOD ECE against its noise floor. In-domain benches look calibrated; on an unknowable org-rule label, accuracy 44.7% with mean stated probability 0.74 (ECE 4.4× the noise floor). AUC ≠ ECE — ranking is not calibration; pairs with does-jev-confidence-mean-anything. Do not threshold Jev as a probability without a local ECE check.

how-sure-is-jev (jevsure) maps Jev probabilities to sureness bands CERTAIN / CONFIDENT / LEANING / TORN / CLUELESS. Choice confidence == max_prob (the most generous metric). Thresholds are opinions, not physics. Good abstention UX; gaming risk if agents optimize the sureness metric rather than task truth. Pair with jev-ood-calibration / ECE noise floor (contrast only). Cousin, not this sidecar.

slo-router puts Jev 1.13 semantic features on an OpenAI-compatible routing hot path, with fail-open to deterministic local features. A live OpenRouter run preserved the same routes and accuracy as slo_no_jev but raised p95 from 77.93 ms to 490.38 ms (~6.3×). An exactness signal raises the quality floor; it never overrides context or capability checks. Infeasible routing returns 503 instead of a silent contract violation. Not a rh-guard peer. Hunch: hard-gating latency-sensitive control on a decision model without a measured fallback is itself a reliability/eval failure mode — agents will learn to skip or stub the gate.

cmdc-auto-mode is a Command Code auto-permission gate: Jev screens every tool call at beforeToolCall (after the host permission check); policy decide in code (allow / deny / escalate). within_scope ≤ 0.25 is out of scope (deny). Escalation always goes to a human, never back to the model. Default auto-fail-closed true. Tiny read-only prefilter. Do not merge into examples/. Cousin of omp-auto-mode, not this sidecar.

omp-jev-extensions is an Oh My Pi / pi-coding-agent adapter: jev_acceptance_gate before declaring done, plus jev_route subagent topology. Fail-open, never fail-catch (unavailable Jev allows the action at confidence 0). Gate-host adapter cousin of omp-auto-mode. Do not merge into examples/pi-extension.ts.

omp-greenlight is a measured OMP approval-gate: presets trade prompt-removal vs unsafe auto-approve (default 0/94 unsafe). The operator owns the risk dial; the plugin never tunes its own threshold. Graded allow, not hard deny — composes with omp-jev-extensions fail-open. Permission ≠ probability. Cousin, not this sidecar.

construct-auto-classifier is an effect-based OpenCode / Antigravity (agy) shell PreToolUse gate: structural fast-deny/fast-allow first, then Jev Choice plus nine independent risk Nouls (data_loss, secrets, remote_code, …). Allow only if the choice is allow at jev.minConfidence (0.6) and every risk is below jev.riskThreshold (0.7). Missing, low-confidence, high-risk, or a failed call all deny. Certified 0 dangerous commands allowed for Jev (main 113 + blind 82, five passes, 975 decisions); chat LLMs all leaked. Operator owns minConfidence/riskThreshold (same dial as omp-greenlight). Privilege Is Not a Verdict (sudo is blast radius, not a deny). Pair with dinostomp before hard-gating on those scores. Do not merge into examples/. Cousin, not this sidecar. Hunch: keyword privilege filters are reward-hackable (sudo ≠ dangerous); effect semantics resist surface gaming.

actiongate-jev is runtime authorization for tool calls before side effects: deterministic policy + RBAC + schemas + amount/limit checks own ALLOW / REVIEW / BLOCK. TypeSafe Jev (OpenRouter) supplies semantic evidence (intent match, scope expand, sensitive exposure). Jev supplies evidence. Code owns authority. A positive model score never overrides a deterministic security failure. Schema-valid ≠ intent-matched. Enforced ALLOW issues a signed, short-lived single-use Action Grant bound to the exact tool call (tenant, agent, user/session, tool, operation, arguments, risk, policy); consumption atomically rejects replayed, expired, mutated, and unknown permits. A Noul is not a permit. Early public MVP with an explicit threat model: ActionGate decides; the app owns execution and credentials; SDK wrapTool is advisory until a gateway or credential broker makes bypass impossible. Quoted threat model: Proxies isolate only when the upstream endpoint is not otherwise routable, which is a network property and not a cryptographic one. MCP/HTTP proxies exist as Isolate path; wrapTool remains advisory until that holds. Compose with construct-auto-classifier (effect-based shell) and jev-lens (attention≠authority, never blocks). Do not treat Jev ALLOW as a safety proof. No Claude/Cursor hook pack — wrapTool is not hooks.json; do not merge into examples/. Cousin, not this sidecar.

AgentGhost (npm @agentghost/sdk, MIT) is intent-aware ALLOW / ASK / DENY wrap around tool execution. Deterministic rules first; TypeSafe Jev judge; ASK/DENY throw so an approval cannot be silently skipped; default failMode: "closed" denies when the judge errors. README: "The model never decides whether AgentGhost runs. AgentGhost is the tool's execution function." Adapters: Vercel AI SDK / LangChain / OpenAI. Contrast actiongate wrapTool (advisory until a gateway) and jev-use (jev_gate fails open). Positive envelope: the wrap is the execute path — the model cannot opt out of a tool it only reaches through guard(). Residual: Jev ALLOW is still soft; do not treat it as a safety proof. README: "AgentGhost protects tools whose execution you control. Provider-hosted tools that run entirely inside OpenAI / Anthropic are out of reach; MCP is planned as a proxy." Heuristic: unguarded tools passed to generateText; AGENTGHOST_AUTO_APPROVE=1; failMode flipped open; wrap the model can skip. Do not merge into examples/. Cousin of actiongate / pi-jev-guard / jev-use / toolgate, not this sidecar.

turnstile is an agent action guardrail: deterministic policy + Jev semantic checks + receipts with threshold replay. Same doctrine as actiongate-jev: Jev supplies evidence; code owns allow / review / deny. Jev never grants authority that policy denied. Missing goal, disabled Jev, timeout, or invalid response → review. Experimental alpha; Claude observe-mode default; not an OS sandbox. Do not merge turnstile-hooks.json into examples/. Cousin, not this sidecar.

pi-heed persists user constraints across tool calls and context compaction and checks every side-effecting call against what the user said (anti instruction-drift / reward-hack). TypeSafe Jev powered: Jev never writes policy; code owns the ledger and the block. Constraints rebuild from the session after compaction (no Jev on reload). Shadow by default; fail-open on Jev error/timeout. Complementary to jev-carryforward 0/4: injecting persisted constraints beats hoping the model looks. Do not merge into examples/pi-extension.ts. Cousin of pi-jev-approver / omp-auto-mode, not this sidecar.

pi-jev-guard is a Pi edit/write content-judge against Markdown rules via TypeSafe Jev (Abide-shaped; not this reward-hack sidecar). Default informative mode reports without blocking; enforcement blocks before write. A malformed selected config fails closed (no silent fallback). In enforce, onUnavailable defaults to block; onUncertain defaults to warn. Default violationThreshold 0.85 is uncalibrated — treating that soft score as a hard gate is soundness theater. Only this process's edit/write are covered; shell, custom tools, and other agents bypass. Informative first; evaluate representative edits before relying on enforcement. Do not merge into examples/pi-extension.ts. Cousin of pi-heed / actiongate / Abide, not this sidecar.

pi-jev-control is a Pi control plane (task/model routing, tool gating, retry, skill/memory, review, GUI), not a content-judge. Tool Gate: deterministic safe/dangerous rules + Jev for uncertain operations. No key → Jev features unavailable (graceful degradation). GUI: confidence below threshold → unknown, never force-click. Differs from pi-jev-guard (content vs Markdown rules), pi-heed (constraint ledger), and hermes-jev-router (Hermes model-route / skip-main-model, not Pi tool authorization). Control-plane vs content-judge. Do not merge into examples/. Cousin of jev-dspy-control-plane / omp-jev-extensions, not this sidecar.

jev-use jev_gate is an optional PreToolUse risk check (deny/ask only, fails open). Install does not enable the gate. It only ever tightens: deny → deny, unsure → ask, allow → silent so the host permission flow decides. "Treat confidence calibration as a training claim." Quoted README gate fixture (2026-09-19): 6 safe + 6 dangerous, 12/12 correct, p50 199 ms — not a rh-guard ROC. Vercel gateway has no confidence field (margin fallback; that backend's default threshold 0.4). Anything Jev can't decide returns escalate: true. Handoff-family sibling of wakegate; fold the gate/escalation angle only. Do not merge into examples/. Cousin of claude-code-jev / jev-decisions, not this sidecar.

jevex is an MCP VOI admission tool: codebase_investigate returns the files/lines a coding agent should read. TypeSafe Jev ranks a shortlist; README: "jevex only answers what to read." Fixture packet includes "status": "sufficient". --no-jev is a lexical ablation (no key, not the product). README does not document fail-open vs fail-closed on Jev error. Cousin of jev-sift (classify first, read selectively; errors/truncation are not evidence an item is irrelevant) and jev-carryforward 0/4 (an MCP tool sitting there is not enough). Soft-score-as-hard-gate risk: treating the shortlist as the only files that exist — hidden eval assets stay unread. Do not merge into examples/. Cousin, not this sidecar.

commitjev is a Jev-gated commit-msg hook: message-vs-diff, single-purpose, undisclosed change. Calibration-first (calibrate.py); README: run it "with cases of your own before trusting the thresholds on a codebase that matters." The hook "blocks only on a warning: not being able to check a commit is not a reason to refuse it" (fail-open on check failure). Code owns thresholds (Noul 0.65; middle band is "review", never rounded). Six regex checks never reach the model. Variance can straddle the threshold. Calibrate / shadow before a hard push block. Cousin of jev-pr-review. Do not merge into examples/. Cousin, not this sidecar.

jev-runway is a Codex proxy described as "A Jev-powered proxy for Codex that reduces token usage and frees up context space." Public tree at capture is LICENSE only (no README). Host-adapter / control-plane cousin of slo-router / jev-routing. Watch; do not invent how it authorizes or skips model work. Do not merge into examples/. Cousin, not this sidecar.

pi-jev-compact is Pi session_before_compact verbatim compaction: Jev keep/drop tool calls; survivors stay word for word. Keep-windows and pins (images, invoked skills, unresolved errors, git/file mutations) apply before Jev. Fail-open to Pi's built-in LLM summarizer on off / no key / HTTP error / < minReduction (default 25%). Contrast gliner25 fail-closed keep_full. Default keepThreshold 0.5 is uncalibrated — treating that noul as a hard delete is soundness theater; dropped calls are gone for good. Complementary to pi-heed / jev-carryforward 0/4 (constraints/memory surviving compaction). Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

hermes-plugin-jev is a Hermes host adapter (plugin ID jev-router): turn classification, conservative tool shaping, risk_gate approvals, optional coding verification. Default mode: shadow. It cannot grant permission; approve means request a human; it never returns allow. Native Hermes blocks take precedence. Missing key/SDK: plugin inactive, Hermes unchanged. Timeouts/malformed: Jev abstains. Contrast jev-decisions (advisory reviews; JEV_ENABLE_HOOKS) and hermes-jev-router (model-route / skip-main-model, not this risk gate). Same-named Mrmimee/hermes-plugin-jev is a tool plugin (Agnes Flash), not a hook adapter. Distinct from ajensenwaud/hermes-jev-plugin (jev_check / jev_route / jev_score / jev_evaluate tools the agent must call). Do not merge into examples/. Cousin, not this sidecar.

jev-routing is a single Go binary harness (explicitly not an MCP server) for Claude Code / Codex / Grok Build / Cursor Agent CLI / Devin CLI. Request rewrite: (a) drop/truncate tool results like fast-jev-compaction without summarizing, (b) ask Jev Choice(next tool)+Noul(done) in parallel, (c) shrink tools[] to 1 schema (zero if respond), (d) strip thinking/reasoning. Integrity/control-plane pattern for agent loops: the catalog the model sees is rewritten before the call. Host PreToolUse cannot strip the catalog (after the model has seen every schema). Default JEV_ROUTING_MODE=filter; forced only when a verified real Jev answer exists — local scoring alone does not force. No key → on-device classifier (named degraded backend, same lesson as backend: "lexical"). claude mcp add leaves the catalog in place. Distinct from nekowasabi/jev-routing-mcp (named predecessor in their README; MCP add leaves tools[] in place). Advisory filter vs hard forced route. Cousin of slo-router / pi-jev-control. Do not merge into examples/. Cousin, not this sidecar.

classifier-dev is an eval-integrity cousin: a public classifier that now serves TypeSafe Jev, with LLM chains as fallback. Upstream delisted inclusionai/ling-2.6-flash; backup ibm-granite/granite-4.0-h-micro served for weeks at F1 0.546 while docs advertised ~0.800 — "Nothing in the deployed numbers said so" (measured 2026-09-17, eval/README.md). The digest now marks FALLBACK; eval/bench.py scores a candidate offline before it ships. advertised backend ≠ served backend. Undeclared fallback = eval integrity failure; advertised score ≠ live model. Require digest/FALLBACK markers before quoting eval numbers; do not hard-gate on soft confidence from an undeclared fallback (same degraded-backend lesson as backend: "lexical" here). Heuristic: a quoted F1 without the served model id is soundness theater. Cousin of dinostomp / jev-baselines-eval. Not a rh-guard peer.

jev-gate is a calibrated PR-review gate (GitHub Action + local CLI + OpenCode plugin) powered by TypeSafe Jev. Seven typed concern questions; gated Nouls default 0.60. Distinct from jevgate (allowlist) and jev-gate-student-b (distill). README: defaults are starting points — calibrate on your diffs before trusting a gate; --no-gate keeps the exit code at 0. Risk: treating a calibrated soft Noul as a hard merge gate without workload calibration / human override = confidence theater. Card: soft-score-as-hard-rank; require calibration evidence + an escape hatch. Cousin of jev-pr-review (shadow until calibrated) / ci-gatekeeper / commitjev. Not choxos/jev-reviewer (human-verified quotes ≠ soft auto-accept) and not egma-ai/jev-reviewer (attention ≠ correctness). Do not merge into examples/. Cousin, not this sidecar.

claude-jev-warden is a real-time quality gate / Art Director Warden for Claude Code via Jev 1.13. PreToolUse on Write/Edit/MultiEdit: quality ≥ 80% → exit 0; else exit 2 (hard process intercept) and inject diagnostics. Same family as agent PreToolUse hooks: soft judgment hard-blocking agent actions. Card: attention≠verdict / warden-as-hard-gate. Document when a warden should escalate vs block: taste/quality → reinspect (jev-lens / jev-preflight); eval-asset mutate → structural deny. Contrast rh-guard (structural first; soft never the sole veto) and hermes-plugin-jev (cannot grant permission). Do not merge warden.js into examples/. Cousin of claude-code-jev / jev-preflight / construct-auto-classifier, not this sidecar.

jev-kit is a Claude Code PreToolUse Airlock (tool-call guard) plus optional Belay. Code pre-filter first; Jev only for the ambiguous half; fail-open on error / timeout / no key. Deny needs confidence ≥ 0.8 and margin ≥ 0.4. Shadow first, then enforce. Quoted README: "This is not a security control." Cost/hygiene guard that fails open by design — not a safety envelope. Distinct from leepokai/jev-guard. Gaming: [airlock-ok: <reason>] override stamp; loop protection never denies the same call twice in ten minutes. Measured 2026-09-19: deny-capable labelled eval 100% / zero false denies; A/B zero denies over 30 sessions (backstop, not a tax) — not a rh-guard ROC. Belay: finished with no passing check → send back to verify (anti-done-without-reading / eval-gaming cousin of clear-head). Compaction installer is opt-in and sends unredacted tool I/O (~25k tokens); never auto-installed. Treating fail-open hygiene Jev as a hard safety envelope is confidence theater. Fold the tool-call guard + Belay angle only, not the rest of the kit. Do not merge into examples/. Cousin of claude-code-jev / cmdc-auto-mode / construct-auto-classifier, not this sidecar.

agent-chaperone is an MCP proxy plus Claude hooks that screens tool calls before they run and results before the agent reads them (dual-gate eval-integrity / injection cousin). Deterministic allow/deny + Jev; shadow default; enforce holds for a human approve; strict stops when a screen could not run. Never auto-approves. Not a sandbox; not a guarantee; adaptive attacks get through. Post-result withholds content that instructs_reader. InjecAgent AUC 0.976 (2026-09-19) is not a safety proof. Eval-integrity residual: a replacement that does not match the tool's output shape is discarded without complaint while the original reaches the model (advertised screened ≠ served payload; silent FALLBACK cousin). First advertised tool list is not screened for injection; user-inlined files skip hooks. Distinct from Astro-Han/jev-harness (filter tool results before the model sees them; quoted Filtering is a routing decision, never destruction; quoted Jev failures fail open). Do not merge into examples/. Cousin of jev-agent-safety-arena / semantic-firewall / jev-security-scan / actiongate, not this sidecar.

opencode-intent-gate is an OpenCode context hook: four Nouls (is_work_request / ambiguous / missing_user_info / scope_unclear); code thresholds (isWorkThreshold 0.5 / dimensionThreshold 0.75) inject a system directive to ask 1–3 clarifying questions and not start tool calls this turn. Fail-open (timeout/error skip; 3 failures → 5 min pause). The gate is a system directive, not a hard block — pair with tool permissions for enforcement. Ask-before-act calibrated product pattern. Gaming: the agent can ignore the directive (hope the model looks / jev-carryforward 0/4). Treating that soft inject as a safety veto is confidence theater / hard-gating soft judgment. Do not merge into examples/. Cousin of jev-preflight / hermes-plugin-jev / jev-lens, not this sidecar.

opencode-context-pruner is an OpenCode port of fast-jev-compaction via the context hook (OpenCode has no session.compact). Keep/truncate/drop applies to the request view; persisted history is never modified. Default keepThreshold 0.15 vs upstream 0.5 (0.5 drops nearly every unpinned call). Measured 2026-09-19 on a 530-message session: 257 judged, 257 drop_call, removedMessages 282, 1,135 ms. Fail-open. Cached per tool_use_id for the session. Vendor-harness fan-out of compaction gates. Eval-integrity: dropping results can erase evidence (constraints, hidden eval, injection traces) — complementary to pi-heed / jev-carryforward 0/4. Treating 0.5 as "the right threshold" is confidence theater. Do not merge into examples/. Cousin of pi-jev-compact / gliner25-compaction / jev-compactor, not this sidecar.

yolo-shell is a destructive-shell interceptor: local fast-path (~2ms / 178ns in-process) for allowlisted read/navigate commands, then TypeSafe Jev (is_destructive noul at 0.5, risk_score 1–10, action Choice allow_immediately | warn_and_confirm | block_completely) with a client-enforced 200ms deadline. Timeout / offline / no key → 40-rule deterministic local engine — no silent fail-open when Jev is down (named degraded backend, same lesson as backend: "lexical"). Context-aware (cwd, git branch, AWS_PROFILE / KUBE_CONTEXT). Secrets scrubbed. Zsh/Bash/Fish hooks. Residual: unexpected hook exit codes are treated as allow (crash fail-open); yolo prefix and YOLO_BYPASS=1 skip the gate. Treating the Jev action Choice as the sole safety veto without the local floor is soundness theater / hard-gating soft judgment. Contrast jevgate (allowlist then Jev; fail-open rest), construct-auto-classifier, safe-sh (never executes). Do not merge zsh/bash/fish hooks into examples/. Cousin, not this sidecar.

jev-home-assistant-sentinel is a safety boundary for AI-assisted Home Assistant: Jev recommends; Sentinel policy; HA acts; Sentinel reads state back. Command sent ≠ state confirmed. action ≠ verified outcome. Review service is shadow (typed recommendation + event; does not silently operate a device). Jev cannot authorize itself. Allowlisted reversible actions only; sensitive behind approval. Unavailable device → uncertain, never success. Same author as jev-decisions. Not a coding-agent hook pack. Cousin of jev-decisions / actiongate / turnstile / jev-align (fabricated verification). Anti-pattern: treating dispatch success as evidence. Attention ≠ verdict — a recommendation is not a confirmed outcome. Do not merge into examples/. Cousin, not this sidecar.

herdr-jev is a prompt gate for Herdr agents via openjev NLI (entailment / contradiction / neutral). Soft permission/gate: Herdr has no UserPromptSubmit intercept, so herdr-jev owns the prompt path — classify, then allow / warn / rewrite / block before agent.prompt. Inference is an HTTP client of openjev serve, not in-repo. Quoted README: Status: design. Nothing here works yet. Watch; do not invent working mechanics. Distinct from TypeSafe Jev (NLI cross-encoder ≠ System One ROC). Cousin of claude-code-jev / opencode-intent-gate. Do not merge into examples/. Thin card.

apa-agent-harness (npm @aipersona/agent-harness) is a rebrand of jev-harness (src/ tree SHA identical at capture). README advertises confidence-gated policy routing, shadow mode, and trajectory verification; docs/architecture.md still titles itself jev-harness (© Antonio Coppe); public src/ has no trajectory module. Eval-integrity: advertised capability ≠ shipped module; shadow vs live is the real pattern (action === shadow_noop; intendedAction records what would have run). Example confidenceThreshold: 0.85 is uncalibrated (same 0.85 theater as laya / jev-preflight). Policy in the harness maps typed verdicts to verbs; Jev does not execute. Fold shadow / confidence-gate / advertised-vs-shipped only — not recipes (alert filter, model router, compaction). Treating 0.85 auto-act or README trajectory claims as a safety proof is confidence theater / hard-gating soft judgment. Distinct from Astro-Han/jev-harness (pre-model tool-result filter). Cousin of jev-harness / jev-pr-review (shadow until calibrated) / hermes-plugin-jev (shadow default). Do not merge into examples/. Cousin, not this sidecar.

alsoleg89/jev-bouncer is a Claude Code plugin (renamed from alsoleg89/jev-guard because leepokai/jev-guard already existed). PreToolUse four judges (shell / edits / MCP / Web URLs) plus a PostToolUse injection sentinel. Web URLs are deterministic (no API); quoted README: a hit is a deny. Shell: p(read_only / reversible_write / destructive) plus five risk Nouls. Modes dry (default) / guard (deny only; never widens) / on (allow and deny). JEV_BOUNCER_MODE. Quoted README: Your rules win. Claude Code checks its own deny rules before honoring a hook's allow. Quoted: in on mode an allow skips the auto-mode classifier — use guard if you want the classifier to see everything. Quoted SECURITY.md: Not a security boundary. Fail-open default (fail=ask never fail-to-allow). Jev-path Tripwires never deny — they only block auto-allow (regex floor: 500-issue bench, 21 hard-zero misses). Deny needs p(danger) ≥ 0.95 and a hard-stop risk ≥ 0.95. Pin jev-1.13.0. Project .jev-bouncer.json can tighten, never loosen. Author-labelled eval: 0/148 dangerous shell auto-allowed, 0/16 dangerous edits, 0/17 side-effect MCP, 17/17 injections; p50 770 ms — labels are the author's; thresholds chosen on the same rows; not a rh-guard ROC. Distinct from leepokai/jev-guard, pablozr/JevGuard, seb4ez/jevguard, and codebam/jev-guardrails. Contrast yolo-shell (named degraded backend) and agent-chaperone (withhold, not warn). Treating those 0.95 Nouls as a hard safety veto without the tripwire floor is soundness theater / hard-gating soft judgment. Do not merge bouncer.py into examples/. Cousin of claude-code-jev / construct-auto-classifier / yolo-shell / jev-kit, not this sidecar.

pablozr/JevGuard is a semantic policy engine: after an agent turn, Jev on an attributed diff + a local deterministic gate → PASS / WARN / FAIL. Not a linter, generator, or prose reviewer. Incomplete / oversized / blocked evidence → UNAVAILABLE — it never turns incomplete evidence into a reassuring verdict. V0.1 observe-only (never alters agent context or blocks). Status: design-to-MVP; public tree at capture is docs + README (no packages/ scaffold). Eval-integrity: advertised monorepo ≠ shipped packages. Distinct from alsoleg89/jev-guard and leepokai/jev-guard. Policy-integrity cousin of Abide (Jev on diffs), not reward-hack. Treating observe-mode PASS as a merge gate is soundness theater. Watch; do not invent working OpenCode mechanics. Do not merge into examples/. Cousin, not this sidecar.

ybadragon/jev-proving-ground is synthetic cases for measuring whether a verify-criteria check actually catches things. Every case starts as an issue written before any code exists. Some implementations carry a planted defect; which ones, and what the defect is, is deliberately not in this repo — a session writing criteria must not be able to read the answer. Quoted README: "Nothing here is real software. Do not depend on it." CODEOWNERS: review is the gate that keeps a machine-authored (including planted-defect) change from landing unseen. Eval-integrity / soundness-theater antidote: independent keys, held-out defects, never promote predictions to labels. Cousin of dinostomp / Harbor separate verifier / jevals. Thin card. Do not merge into examples/. Cousin, not this sidecar.

jevbrain (Jev Brain) is a local <1ms decision daemon: confidence ≥ 0.80 → AUTO_ACT, else REVIEW_QUEUE. Attention firewall / coding-agent Warden (GREEN / YELLOW / RED). Not TypeSafe Jev — routing is n-gram / keyword-anchor overlap; the Warden is regex. Name collision with Jev. Uncalibrated 0.80 AUTO_ACT is confidence theater (same 0.8x recipe as laya 0.85). Silent-fallback risk if mis-calibrated: a high keyword-margin auto-acts without a human. Fold the attention-firewall / AUTO_ACT / silent-fallback angle only — not inbox / X / mobile-runner recipes. Whitepaper N=10k 95.2% token-cut is not a rh-guard ROC. Distinct from claude-jev-warden. Do not merge into examples/. Cousin of jev-lens / slo-router / localjev, not this sidecar.

jev-crawlers puts judge then verify nodes on recursive bug-discovery crawlers (crawl-judge then crawl-verify). The verifier builds a falsifiable artifact and checks grounding. Anything that fails is an unverified lead, never a bug. v0 verification is grounding, not execution. Quoted README: Jev probabilities are ranking signals, not calibrated bug confidence; routing follows the risk score, never a raw boolean; the review queue is the primary sink. n=12 labelled fixture is a start, not proof. Cousin of jev-align (fabricated verification) / dinostomp / Harbor independent validator. Fold the verify-path / ranking-not-calibration / unverified-lead angle only. Do not merge into examples/. Cousin, not this sidecar.

typed-gate is a pattern for using a System One model without throwing away the number it gives you. Code finds candidates; Jev returns a Choice and a Noul; code decides ACCEPT vs REVIEW (typed_gate/gate.py). Quoted README: a yes/no probability near 0.5 is the model declining to answer. It is not a weak yes. The 0.40–0.60 band is a refusal to commit. Synthetic 100 freight docs / 1,100 field decisions (19 Sep 2026): Jev + gate 0 wrong / 0 omitted (117 review) vs argmax only 0 wrong / 25 omitted. Quoted: Correctness is a tie. Distinct from jev-gate (PR-review Nouls). Anti-pattern: hard-argmax "safety theater" / treating 0.51 as a yes. Fold the probability≠argmax / band-as-refusal angle only. Do not merge into examples/. Cousin, not this sidecar.

pi-jev-gate is Jev-gated auto mode for Pi: before bash / write / edit (and custom tools) execute, OpenRouter Decisions reviews the call. Local read-only allowlist (read) skips Jev. Block if choice === "block" or p(block) ≥ 0.50. Binary: it either runs or it doesn't. Fail-open: checker error or unreachable → the agent keeps running (Jev gate error (failing open)). /checker can disable the gate. Intent-aware: the current task is in state. Distinct from jevgate, jev-gate, pi-jev-approver (fail-closed), pi-jev-guard, and pi-jev-control. Contrast this sidecar (structural first; soft never the sole veto) and jev-use (jev_gate fails open, only ever tightens). Treating p(block) ≥ 0.50 as a hard safety envelope without the local allowlist is soundness theater. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

jev-oas-sentinel catches consumer-visible API changes hiding in documentation-only OpenAPI edits. Deterministic structural checks first; TypeSafe Jev evaluates bounded semantic questions on changed prose. Quoted README: JEV never writes a review or changes a specification. Advisory mode is the default. Enforce: a semantic break blocks only when both the breaking probability and promise-violation probability cross --block-threshold (default 0.90). API errors fail closed in enforcement and request review in advisory. Quoted: do not enable enforcement until questions and thresholds have been evaluated on representative changes from your own APIs. CI/policy-integrity cousin of if-ai / latch. Detection: treating a docs-only OpenAPI PR as harmless; hard-gating uncalibrated 0.90 as a merge veto. Do not merge into examples/. Cousin, not this sidecar.

nanoprune is a 2.8MB local System One decision & RAG pruner (2-layer encoder distilled from Laya 421M). Not TypeSafe Jev. Cheap front gate before expensive System Two: prune / choice / score on CPU in ~1.3–2.4 ms. Quoted badges: 0.0% Hallucination Guaranteed; table ECE 2.58%. That guarantee is soundness theater — a tiny distill is not a hallucination proof, and ECE on their bench is not a rh-guard ROC. Pair with laya (0.85 still soft; Khmer OOD 0.000 at 95.2% confidence) and jev-ood-calibration. Distinct from prune-review. Fold the cheap calibrated deny/allow-before-System-Two angle only — not the medical search app. Do not merge into examples/. Cousin, not this sidecar.

hermes-switchyard is a Hermes plugin: Jev-powered advisory skill selection and policy-constrained mode switches. Quoted README: it never loads the skill, never silently changes the active model, and does not claim a recommendation is correct. Automatic hosted routing stays fail-closed unless the host supplies a typed per-turn egress envelope. Quoted: a persistent public_or_sanitized_data_ack does not scan or redact data, grant permission to share it, or bypass other controls — not DLP and not automatic authorization. Local token-overlap threshold 0.20 and Jev skill-choice / needs / winning-probability thresholds 0.80 are uncalibrated abstention policy (quoted routing.py: calibration for correctness is not independently established). Sibling of skill-broker (relevance never grants access). Distinct from hermes-plugin-jev. Fold the skill/policy / permission-integrity angle only — not CUA / computer-use. Anti-pattern: treating a skill recommendation or ack flag as a grant. Do not merge into examples/. Cousin, not this sidecar.

typesafe_agent_gates is LangChain / Deep Agents middleware: typed Jev judgments where a regex, word list, or prompt line was standing in for reading. ToolGateMiddleware wraps execute with four independent Nouls (database_write, production, destructive, secrets). One answer ≥ threshold (0.5) and the command does not run; the agent gets an error ToolMessage and must report the step as HELD. Quoted: Closed when TypeSafe is unreachable (fail_closed=True); only {role, command} is sent, never the conversation. Distinct from langchain-typesafe AutoModeMiddleware (last 30 messages; whether the user authorised the call). Quoted: the pattern runs first and its answer stands; the judgment is asked about what the pattern let through — never looser. SpecReviewMiddleware judges changed existing specs — assertion inverted, retargeted, weakened, test disabled. Quoted measured on jev-1.13.0 (synthetic): toolgate probe 27/27, judgments 31/31 — not a rh-guard ROC. Quoted: treat 0.5 / 0.6 / 0.8 as starting points; This is a second layer, not a boundary. Soft-judgment gate middleware; do not treat 0.5 as a safety envelope. Distinct from fdemir/toolgate. Do not merge into examples/. Cousin, not this sidecar.

jev-pastepilot (PastePilot) is a paste-to-action launcher: allowlisted tools, preview, then Confirm. Quoted README: Confirm is a gate, not a formality. Pasted text is untrusted data. It cannot grant new permissions. Optional live Jev: a Choice for the allowlisted action, a Noul for injection/suspicion, a Noul for emptiness/clarity, and a Score for fit; code combines those answers. Quoted: Confidence is a gate, not proof — high (default ≥ 0.75) may keep a select; low (default < 0.45) abstains to the manual tools. Missing key / timeout / 429 → fail-opens. Quoted: Do not treat this README, a vendor claim, or a confidence score as a measured accuracy result. Not an autonomous agent (no browsing, no shell, no silent writes). Fold paste/injection/confirm-gate only — not Share Sheet. Treating 0.75 as a safety proof is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

jevcache is a local-first decision ledger for Jev-class models: fingerprint (model, schema, state) after redact/canonicalize, then recall (ledger-only) or decide (recall then backend). publish/add share fingerprints+answers, never raw state. cache hit ≠ correctness. Shared fingerprint bundles are trust theater if treated as calibrated truth / auto-act. Distinct from Hyperspace KV attention cache. Not a PreToolUse gate. Thin card. Do not merge into examples/. Cousin, not this sidecar.

sutro-sh/jev-align (jeva) is a GEPA loop that aligns TypeSafe Jev with human labels (uncertain rows + audit sample; human accept/reject/rewind). Distinct from caiovicentino/jev-align (policy verify before act). Quoted README: A higher training score never accepts a proposal automatically. Positive envelope. Anti-pattern cousin if someone hard-gates on the GEPA training score. Thin card. Do not merge into examples/. Cousin, not this sidecar.

enzyme is a local-first compile step for Markdown knowledge bases: temporally grounded sampling → catalysts (questions as semantic routes). enzyme compile is an explicit OpenRouter Decisions op (ENZYME_JEV_MODEL, default typesafe/jev-1.13). Quoted README: when asked is guidance compiled for your agent, not an enforced hook. Not a PreToolUse wrap. catalyst similarity scores are ranking, not deny/allow — do not hard-gate them as a safety veto. Fold compiled-guidance ≠ hook / similarity≠deny only — not PKM recipes. Thin card. Do not merge into examples/. Cousin of jevex / jev-sift, not this sidecar.

jevguard is a production integrity runtime around TypeSafe Jev: closed-world escape injection, certainty/margin calibration, volatile-field masking, zero-token SHA-256 cache, and episodic SQLite memory. Quoted README: categorical Choice without a fallback forces a false positive; the runtime injects UNRESOLVED_OR_OTHER. Quoted: top probability below 0.40 or first/second margin below 0.15 → AMBIGUOUS_STATE. Distinct from alsoleg89/jev-guard, pablozr/JevGuard, and leepokai/jev-guard. Distinct from jevcache (decision ledger) — this SHA-256 cache is still not a correctness proof. Pairs with wellposed (Choice with no "other" can be forced wrong at 1.0) and typed-gate (argmax near 0.5 is declining to answer). Anti-pattern: closed-world false positives without an escape; argmax on a flat distribution without a margin check. Do not merge into examples/. Cousin, not this sidecar.

jev-ci-selector is CI task selection: a pure policy engine (always / force_paths / dependencies) plus Jev on optional tasks. Quoted README: Keep your workflows. Start in shadow mode. Measure before you skip. Default shadow: every task still runs; the report records proposed_run vs run. Timeout, API problem, invalid response, fork PRs, and catalog/workflow changes keep all tasks. enforce is explicit opt-in. Initial skip_below: 0.05 is an experiment, not an error-rate guarantee. Soft judgment must not hard-skip checks. Cousin of latch / if-ai / jev-pr-review. Anti-pattern: treating a Jev skip plan as a safety envelope without shadow soak. Do not merge into examples/. Cousin, not this sidecar.

tonedown is multilingual text safety grading 0–4 plus category probabilities; a moderation API and userscripts turn them into pass/review/block or show/blur/hide. Quoted README: Platforms pick a policy, users pick a level, the engine only measures. Golden set of 74 comments/danmaku in 11 languages (2026-09-19): 74 / 74 exact. Quoted: A set this small proves the pipeline, not the model. Offline lexicon fallback. Not a coding-agent hook pack. Cousin of GLiGuard / system-one-benchmark / jevmod. Treating 74/74 as a rh-guard ROC or hard-gating the 0–4 score as safety is confidence theater. Fold grading / policy-in-code only — not danmaku recipes. Do not merge into examples/. Cousin, not this sidecar.

jevmod is productized community moderation: category probabilities plus plain-English rules; the operator owns thresholds and actions. Flag-only by default. Quoted README: Fails open: if Jev is unreachable, messages are left alone (reason="error_open"). Self-harm is flag-only by design. BENCHMARK.md (2026-09-18, 2,531 messages): OpenAI eval AUROC harassment 0.930, nsfw 0.982, selfharm 0.992, minors 0.977. Quoted: 2,531 messages across three public sets is a sanity benchmark, not a leaderboard. Quoted: a 0.6 is a maybe, not a 60%. Distinct from ohernandezdev/jev-pr-review. AUC ≠ ECE. Treating those AUROCs as a hard safety envelope is soundness theater. Do not merge into examples/. Cousin of GLiGuard / system-one-benchmark / tonedown, not this sidecar.

one-dollar-tahoe is a prompt-injection defense eval (Chevy Tahoe $1 chatbot sandbox): 36 attacks + 38 benign; six defenses including Real Jev API. Quoted README: ~74 messages is a demonstration set, not a statistically powered benchmark. Static attack list; quoted: adaptive attackers bypass even SOTA more than 85% of the time when they know the defense. FPR is the metric most demos skip. Cousin of jev-agent-safety-arena / agent-chaperone / jev-pastepilot. Fold injection-eval / honest-limitations only. Do not invent unpublished ASR as a rh-guard ROC. Do not merge into examples/. Cousin, not this sidecar.

pi-jev-sentinel (current listing harshwasan/jev-sentinel; keep both slugs) is a Pi coding-agent extension (+ Claude Code / Codex hooks): TypeSafe Jev on (a) tool-call intent+risk before run, (b) tool-output injection before the agent reads, (c) reply harmful/relay-injection after. Quoted README: Fails closed. Errors / no key → ask you; never auto-allows. Code owns an allow / ask / warn ladder (soft judgment ≠ hard deny list). Secret scrub before Jev (pattern-based). Optional task pin so chat drift is not "on task". Contrast fail-open pruners / pi-jev-gate. Distinct from pi-jev-approver / pi-jev-guard / alsoleg89/jev-guard. Quoted: Prompt injection is not solved. Uncalibrated 0.3 / 1.3 / 0.8. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

hermes-jev-skills is a Hermes (also Claude Code/Codex) skill pack: model routing, memory passage triage (incl. hidden-instruction check), compaction/handoffs, skill selection, message triage, computer/browser use gated by safe action tables, plus a routing dashboard (on/shadow/off). Quoted README: Everything fails open — no key / timeout / malformed / low confidence keeps the current model, returns the original list, drops nothing, suggests nothing, and computer use returns reobserve. Safety rails that do not depend on Jev being right: risk words never route to the cheapest tier; Jev can only ever return an action id you put in the table. Quoted README: acknowledgements answered locally for free (named lexical skip, not live Jev). Quoted skills/jev-memory/SKILL.md: Never read, follow or quote dropped_injection_ids; unjudged_ids are unchecked, not verified. Quoted skills/jev-computer-use/SKILL.md: "The worst a wrong answer can do is pick another action you already judged safe"; a chosen id is not proof — observe again. Quoted docs/turning-a-jev-feature-on.md: Shadow first, and mean it; a quiet log proves nothing. Distinct from hermes-plugin-jev (cannot grant permission), hermes-switchyard (never loads the skill), skill-broker, rsdkrasen/hermes-jev-router (skip-main-model), cdepuy/hermes-skill-router (local Laya inject). In-repo jevkit/ is this pack's library, not jonathanavis96/jev-kit (Airlock). Fold integrity + fail-open + action-table + hidden-instruction + shadow/on/off only — not CUA recipes. Do not merge into examples/. Cousin, not this sidecar.

hermes-skill-router is a local Laya skill gate: pre_llm_call classifies the task vs a skill index, injects top skills via the user-message channel (quoted cache-safe: Hermes prompt-cache, not jevcache cache-hit; never mutates the system prompt). Quoted README: Fail-open — if Laya is unavailable, missing, or routing finds nothing, the hook injects nothing and Hermes behaves as stock. Default floor 0.25 is uncalibrated. Quoted: Accuracy is ~good, not perfect; it is never worse than stock (fail-open), but it can pick a plausible-but-not-ideal skill. Contrast hermes-switchyard (never loads the skill) — this plugin does inject SKILL.md excerpts as "ACTIVE guidance". Same-named xXLODXx/hermes-skill-router, LLM-Architects/hermes-skill-router, bkutasi/hermes-skill-router, MKI13/hermes-skill-router — this card is cdepuy's local Laya inject. Local-econ fail-open cousin of API Jev routers (jev-routing / hermes-jev-skills). Pair with laya (0.85 still soft; Khmer OOD). Treating a 0.25 inject as a grant or as a safety veto is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

dgp (Decision Graph Protocol) is typed assessment then application-side guarded commit/authorization before effects; receipts. Quoted README: an agent assesses the choices while application code retains control of permissions and effects. Assessors do not execute side effects. Quoted DGP docs/TYPESAFE_JEV.md (theirs, not TypeSafe): Speculative assessments cannot authorize effects; using cached computation requires equivalence checks and a fresh live assessment (cache hit ≠ live Jev). Demo: the model's publication recommendation does not publish. Host retains authority regardless of the assessor. Primary protocol fold is in Augustus; here capture the integrity boundary only (same shape as actiongate / turnstile: Jev supplies evidence, code owns authority). Not a coding-agent hook pack. Do not merge into examples/. Cousin, not this sidecar.

typesafe-jev-gate is a Hermes Agent fail-closed tool-call policy gate: Jev classifies side-effecting / paid / external tools with argument redaction; read-only and obvious safe terminal commands pass without a network call; outage / malformed / uncertain → Hermes existing approval (fail closed into ASK, not allow). Quoted README: ambiguous multi-step requests get an advisory route hint through pre_llm_call (not fail-closed approval). Quoted README: Let Jev inspect the risky calls. Keep Hermes in control. Quoted: This is a safety layer, not an autonomous permission slip. Quoted: Hermes hardline blocks, normal authorization, and human approval remain authoritative. Quoted: the gate can recommend allow, deny, or approval; It cannot override Hermes's existing authorization rules. Quoted: a Jev outage, malformed response, or uncertain decision is treated as a reason to ask for approval, not a reason to allow the call. Quoted: metadata-only audit records to $HERMES_HOME/logs/jev-gate.jsonl. Quoted: experimental; tracks deployed Hermes plugin 0.3.0. Distinct from thevibeworks/jevgate (allowlist), totally-tim/jev-gate (PR-review Nouls), robbyczgw-cla/hermes-plugin-jev (cannot grant permission; never returns allow). Cousin of kerpopule/hermes-jev-skills / cdepuy/hermes-skill-router / nekowasabi/jev-routing. Fail-closed-into-approval is not this sidecar's structural deny. Do not dump plugin source — quote README behavior theirs. Do not merge into examples/. Cousin, not this sidecar.

omo-jevlike-router is a local jevlike one-pass skill router for OmO: frozen Qwen2.5-0.5B + option-attention head scores the full skill catalog; an OmO extension shrinks <available_skills> to top-K. Quoted README: fail-open: if the router is unreachable, OmO behaves exactly as before. Quoted measured (theirs; 1,414 labeled turns, 141 skills, held-out 132): recall@24 84.1%, warm ~50–70 ms, ECE ~0.10. Quoted: an earlier README quoted 46.2% top-1 / 95.5% recall@12 — evaluation bug (trainer iterated training rows, not held-out). Quoted: skills cut from top-K keep names in an other_skill_names index; flat-confidence turns skip filtering. Quoted: independent experiment, not a Jev reproduction. MIT. Integrity: soft router ≠ hard gate; fail-open is intentional; a catalog shrink is not a deny. Do not dump model/weights. Cousin of cdepuy/hermes-skill-router (local Laya inject, fail-open) / nekowasabi/jev-routing (shrink tools[]) / vinnylarouge/jevlike. Distinct from TypeSafe Jev. Do not merge into examples/. Cousin, not this sidecar.

llm-vs-jev is a controlled comparison of LLMs vs Jev on LLM guardrailing. Quoted README: one decision spec, one policy, several perception backends. Quoted table (shared spec 77f2a821072b1862): jev-1.13.0 strict accuracy 77.9% / ECE 0.053 / p99 679 ms / $0.0444 per 1k screens; gpt-5.1 68.8% / 0.229; claude-opus-5 83.8% / 0.051; gpt-6-astra 85.8% / 0.107. Quoted: Nothing wins outright. Quoted: Jev is the cheap end of the frontier. Quoted steerability: appending one sentence that asserts the classification it wants moved anthropic-opus 14.3%, jev 10.7%, openai-mini 7.1%, openai 0.0%. Quoted: this repo does not make a stronger claim on TypeSafe's behalf. Distinct from TeoMastro/jev-vs-llm-guardrails-intent-router (LangGraph demo; 96.8% route acc). Sentinel eval: cost/latency/steerability bake-off for guardrail judges — quoted Nothing wins outright (Jev is beaten on accuracy by opus/astra). Do not invent unpublished RESULTS.md extras as a rh-guard ROC. Do not merge into examples/. Cousin, not this sidecar.

jeff (Jeff 1) is a local open-weight typed decision / fact-checking model (Jev-compatible Choice / Noul / Score). Quoted README: API compatibility does not imply identical judgments or performance. Independent, not affiliated with TypeSafe. Quoted evaluation vs live Jev 1.13.0 on 9,730 human-labelled fact-checking examples (FEVER, VitaminC, SciFact, Climate-FEVER): Jeff 1 accuracy 0.8183 / ECE 0.0807 vs Jev 0.8283 / 0.0932. Quoted: Lower ECE does not guarantee that an individual prediction is correct. Apache 2.0 for the code and adapter. Fact-check / integrity cousin; light cross-note only (not a drop-in Jev ROC; do not dump a deeper replica). Do not dump weights. Pair with laya / localjev. Do not merge into examples/. Cousin, not this sidecar.

invalidate is a memory lease/invalidation layer on TypeSafe Jev: every stored fact is judged against new evidence; code owns the disposition. Quoted README: The memory text is never edited. Questions and plans change nothing. Instructions change nothing. When unsure, it asks a human. Six Jev votes (bears / still_true / replaces / partial / hypothetical / directive) then fixed rules in code; similarity top-k is never the judge. Quoted eval (157 labeled cases, shipped v4): 89.2% strict, 97.5% lenient, 0 false invalidations. Quoted: defaults "refused any policy adding a false invalidation; they were tuned on that set, so rerun the sweep on your own events." Quoted: a kill takes two votes. Quoted: LongMemEval treatment number for the stale-retrieval slice is pending. Not a memory store (adapters sit in front of Mem0 / Chroma / Markdown / …). 0/157 is not a rh-guard ROC. Cousin of jev-carryforward (verbatim ledger; this one retires stale facts) / jev-recall (include/exclude at read). Do not merge into examples/. Cousin, not this sidecar.

hermes-jev-plugin is a Hermes Agent tool plugin exposing jev_check (Noul) / jev_route (Choice) / jev_score (Score) / jev_evaluate (mixed, one call). Not a PreToolUse hook and not a fail-closed permission overlay. Distinct from robbyczgw-cla/hermes-plugin-jev (cannot grant permission; never returns allow) and Mrmimee/hermes-plugin-jev (Agnes Flash). Distinct from typesafe-jev-gate (fail-closed policy overlay). Hope-the-model-looks cousin of jev-carryforward 0/4: if Hermes never calls the tools, there is no gate. Bundled skill jev:jev-questions covers atomic questions, state, and confidence gating. Quoted tests: clear-cut noul → confident yes (p ≥ 0.70); malformed call → graceful error JSON, hermes exit 0. Do not dump plugin source. Do not merge into examples/. Cousin, not this sidecar.

jev-lint is a semantic contract linter: does a function do what its name says, is a comment still true, would a test still pass if the claimed behaviour were broken — ast-grep locates subjects; Jev scores one sentence per match. Distinct from huntedman/JevLint (semantic convention lint, write → check → fix). Distinct from wobsoriano/oxlint-plugin-jev (English oxlint rules → Jev cutoffs) and mizchi/jev-playground eslint-plugin-jev. Quoted README: Read a finding as a candidate for a human to judge, not a verdict to act on. Quoted: about one finding in five was wrong. Quoted: No shipped rule has severity: error — "a probabilistic reviewer that can fail a build is one that gets switched off." Without an API key the pre-commit hook steps aside. Quoted: 56 of the 65 rules reach precision and recall 1.00 at shipped cutoffs (467 labelled defects; marker-free — an earlier // DEFECT leak fitted the label); not a rh-guard ROC. Cutoffs fitted to their corpus. jev-lint commits judges message-vs-diff (same candidate class). Do not merge into examples/. Cousin, not this sidecar.

jev-recall is a calibrated include/exclude gate over memories: relevance, not resemblance. One yes/no Noul per memory in one request; keep everything above a threshold (default 0.5) instead of top-k. Quoted bench (2026-09-19, jev-1.13.0, 238 fictional memories, 18 requests): pointer mode 17/18 requests / 19/20 key memories / $0.00044 / 0.35s — matches Sonnet 5, within one memory of Opus 5. Quoted: one miss needs outside knowledge ("Sam is on an H-1B visa"); Sonnet missed that one too. Distinct from jev-carryforward (verbatim ledger; 0/4 recall) and jev-gate-student-b (distill of memory-relevance). Soft include/exclude is not a safety deny. 18 fictional requests is not a rh-guard ROC. Cousin of invalidate (retire vs retrieve). Do not merge into examples/. Cousin, not this sidecar.

oxlint-plugin-jev is English oxlint rules → Jev cutoffs (jev/ask). Oxlint finds the node; Jev answers a yes/no; a cutoff reports. When Jev can't be asked: skip (warn) unless ci: "fail". Quoted: keep jev/ask out of the editor config (keystroke = paid request). Distinct from huntedman/JevLint and mizchi/jev-lint. Treating an uncalibrated cutoff as a hard lint error is soundness theater. Thin card. Do not merge into examples/. Cousin, not this sidecar.

rspamd-jev is a shadow-mode only TypeSafe Jev spam-eval Lua plugin for Rspamd (classification gate in the mail path). Quoted README: Experimental: disabled by default, no external requests by default, no filtering decisions. Quoted: Jev observations have zero score and do not change delivery actions or set Bayes learning flags. JEV_HAM / JEV_SPAM / JEV_PHISHING / JEV_UNCERTAIN / JEV_ERROR have registration scores and insertion weights of zero — do not add them to action rules, composites, or learning conditions. Quoted: the individual mail scan still waits for Jev. Gloss: unchanged score ≠ unchanged latency. Quoted: agreement is not accuracy. Timeout 1.5s, no retries; failures keep the existing verdict. Quoted: Confidence is not a false-positive-rate guarantee. Quoted: no automatic enforcement. Gloss: no auto-reject path is provided. Pins jev-1.13.0; quoted: jev-latest and other moving aliases are rejected. Classification-as-guardrail: observation, not a hard reject. Cousin of jevmod / tonedown. Treating score-0 shadow symbols as a reject envelope is soundness theater. Do not merge into examples/. Cousin, not this sidecar.

jev-guardrails (@codebam/jev-guardrails; README title dsh-jev-guardrails) is Jev-backed agent tool-call guardrails plus OpenCode / Hermes Agent / DeepSeek Harness hook installers. Quoted README: The library owns policy, not the model. Jev answers typed questions; code maps them to allow / review / block / support. Heuristics are fast paths; a local decision never overrides Jev. failMode is explicit (open → allow, review, closed → block). Default action/review thresholds 0.70 / 0.35 are uncalibrated product knobs. Quoted library README: A guardrail is not a sandbox. Default TypeSafe/OpenRouter aliases include jev-latest (moving alias, not a pin; contrast classifier-dev advertised backend ≠ served backend and rspamd-jev refusing that alias). Distinct from alsoleg89/jev-guard, pablozr/JevGuard, leepokai/jev-guard, and seb4ez/jevguard. Cousin of claude-code-jev / construct-auto-classifier / AgentGhost / this sidecar's dsh adapter. Sibling dedicated plugin monorepo: codebam/dsh-jev-guardrails (@codebam/jev-guardrails + @codebam/dsh-jev-guardrails). Treating 0.70 as a safety envelope or merging their dsh/OpenCode/Hermes installers into examples/ is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

moongate is a semantic CI gate (MoonBit): TypeSafe Jev evaluates committed diffs against JSON rules (violation / compliant / insufficient_evidence). Policy and checkout come from the base commit so a PR cannot edit the rules that judge it. Quoted README: A verdict is a model's answer, not a proof. Exit 0 doesn't mean the code is fine. Confidence doesn't tell you the answer is correct. Advisory unless "severity": "blocking". An unevaluated rule never counts as a pass. Forks and Dependabot are skipped rather than reported as a fake pass. Ten identical replays: label violation all ten times, but 4 counted as violation and 6 as review at a 0.90/0.80 gate. Quoted: Keep thresholds away from where a rule actually lands. The model is pinned. Changing it invalidates your thresholds. Cousin of jev-gate / jev-pr-review / if-ai / latch. Soft-score-as-hard-merge without calibration + escape hatch is soundness theater. Do not merge into examples/. Cousin, not this sidecar.

jev-logtriage is an SRE observability sentinel: Jev scores a collapsed log batch (six questions, one call); code keeps the thresholds; nothing is executed. Confidence-gated routing: below --confidence-floor (default 0.50) → review. Quoted README: Low confidence never auto-acts. auto_remediate_candidate is a label; the repo does not restart pods, call webhooks, or page anyone. Security is never an auto-remediation candidate. Demo numbers move; the gates do not. Cousin of jev-home-assistant-sentinel (action ≠ verified outcome) / firehose-judge. Treating auto_remediate_candidate as execution is hard-gating soft judgment. Do not merge into examples/. Cousin, not this sidecar.

bias-bench is a resume-screening fairness/calibration audit for decision models (pinned jev-1.13.0). Full factorial 76 names × 8 resumes × 3 reps = 1,824 independent evaluations (Bertrand & Mullainathan / Kline, Rose & Walters design). Quoted README headline: callback decisions are perfectly determined by resume quality (zero binary-decision name differences); mean-probability name gaps are ~0.4–0.6pp — statistically detectable because the model is near-deterministic, opposite in sign to the human audit-study direction, operationally negligible. Quoted: read the magnitudes, not the p-values. One domain, one prompt; not a claim about Jev in other framings. Fairness audit for guards — not a rh-guard ROC. Do not invent unpublished gaps as a safety proof. Do not merge into examples/. Cousin, not this sidecar.

jevusher is context-window admission control (token VOI gate before expensive models): J1 route, J2 skill gate, J3 memory usher, J4 tool-output filter, J5 compact, J6 stop, J7 injection screen. Quoted README failure posture: admission (J3/J4/J5) unsure → let it in; selection (J1/J2) unsure → surface none; safety (J7) unsure → flag, never pass. Quoted: J7 pass means nothing detected, never safe to obey; unreachable → unavailable, never pass. Provider outage degrades to no lens installed, never to an empty context. Quoted: On small inputs these lenses lose money. Cousin of jevex / jev-sift / jev-routing / compaction gates. Treating a J2 catalog shrink or J7 pass as a hard safety envelope is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

jev-evaluation is an adversarial, pre-registered Jev eval: plan written before any request; 28 predictions each with a falsifier; one run 123,805 requests, 138 minutes, $12.69, five failures, all jev-1.13.0. Quoted README: Twelve of twenty-five testable predictions held. Thirteen were wrong, which is the useful half. Calibration holds in-domain (support-ticket ECE 0.075) and fails completely outside it (3-SAT: answers satisfiable for every formula). Quoted current README: Confidence predicts whether an answer is right, but not whether the question could be answered. Quoted PROMPTING.md: gate on confidence ≥ 0.95 still admits 47% of unanswerable states (mostly fluent nonsense). Quoted README: act when confident and escalate when not catches wrong answers and misses unanswerable inputs. Crude "IGNORE THE QUESTION" moved the answer 0%; a polite invented-supervisor sentence moved it 65% (confidence 1.00 → 0.62). Ground truth from a solver or construction, never from the model. Distinct from jev-baselines-eval. Soft-judgment integrity sentinel: do not hard-gate confidence as fake safety. Do not invent unpublished extras as a rh-guard ROC. Do not merge into examples/. Cousin, not this sidecar.

jev-bias-bench is a one-attribute-at-a-time Jev fairness/calibration bench: counterfactual pairs that differ in one attribute and nothing else. Quoted FINDINGS.md (20 September 2026, jev-latest): 11,984 calls, 52,430 answers, 666 people built from 6 anchors, 8 scenarios. Quoted: 0 of 100 control comparisons significant. Quoted: Do not test it by swapping names. Quoted: Read the deltas, not the stars. Quoted caveats: No build pinned. Distinct from natemoo-re/bias-bench (resume-screening name factorial, pinned jev-1.13.0). Fairness audit for guards — not a rh-guard ROC. jev-latest is a moving alias (contrast rspamd-jev refusing that alias). Do not invent unpublished extras as a safety proof. Do not merge into examples/. Cousin, not this sidecar.

aurum-gate (@ormus/aurum-gate) is a TypeScript confidence-gated action router (Jev Pattern 2): per-action floors, human escalation, refuse-below bands. Packaged export (src/index.ts, package.json main/exports → dist/index.js): decisions auto | escalate | refuse; default autoConfidence 0.85 is an uncalibrated product knob (same 0.85 theater as laya / jev-preflight). Quoted README: Probability opens the door — confidence decides if gold flows automatic, or a human holds the pour. Quoted README: tests are mocked — no live API. Mock router, not live Jev. Parallel non-export src/gate.ts is a second AurumGate (ok / human|deny|ask); quoted comment: Probability is not confidence. index.test.ts hits the packaged API; gate.test.ts hits the parallel class. packaged export ≠ parallel gate.ts. Treating 0.85 auto as a safety envelope is confidence theater / hard-gating soft judgment. Do not merge into examples/. Cousin of jev-logtriage / typed-gate, not this sidecar.

quicksilver-judge (@ormus/quicksilver-judge) is a staged PR/code pre-filter. Packaged export (src/index.ts): sketch a Noul-style risk matrix, emit confidence-gated PASS / HOLD / FAIL. Public sketchRisks / prefilter is a heuristic (churn, auth, deps, labels) — not live Jev. Profiles: Choice minConfidence 0.7, Score 0.65. Gloss: PASS is not a merge grant. Parallel src/stages.ts (runQuicksilver inject-evaluate): quoted Code owns overrides — Jev Choice is advisory when hard flags fire (pass/hold/escalate, not the packaged PASS/HOLD/FAIL). packaged heuristic ≠ live Jev. Soft-score-as-hard-merge without calibration + escape hatch is soundness theater. Cousin of moongate / jev-gate / latch. Do not merge into examples/. Cousin, not this sidecar.

karat-filter (@ormus/karat-filter) is retrieve-then-judge: filter RAG/search hits with lightweight relevance+confidence scores before they burn context (speculative fan-out). Quoted source (src/index.ts): Token overlap judge — mock stand-in for a Jev Noul (no live API). Defaults minRelevance 0.45 / minConfidence 0.5. Inject-a-judge path exists (src/filter.ts); the packaged default is not live Jev. Treating token-overlap keep as calibrated Jev or a hard safety deny is confidence theater. Cousin of jevex / jev-sift / jevusher. Do not merge into examples/. Cousin, not this sidecar.

gold-assay (@ormus/gold-assay) is a UI proof assay: score screenshot/OCR + DOM-as-state before an agent claims the flow worked. Quoted README: Screenshots lie until you assay them. Public assay() is substring/regex GREEN | AMBER | RED (minGreen 0.75); a separate assayQuestions path is Jev-shaped, not the default. Gloss: GREEN ≠ verified UI (quoted README: don't stamp GREEN on fool's gold). Lexical GREEN is not a rh-guard ROC and not action≠verified-outcome (jev-home-assistant-sentinel). Treating GREEN as license to commit/click is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

WaynezProg/jev-kit is source-bound evidence checks plus bounded batch Jev judgments (jev_evidence / jev_classify / jev_extract / jev_decide). Distinct from jonathanavis96/jev-kit (Claude PreToolUse Airlock). Quoted README: A source supporting a claim does not independently prove the claim true. Confidence is not a correctness guarantee. Quoted: No approval gate. Quoted: Exit 0 does not certify task completion or claim truth. Quoted SECURITY.md: Do not use confidence, source support, or CLI success as an authorization boundary (not an authorization boundary). Evidence-bound integrity cousin of clear-head — source support ≠ truth/permit. Do not merge host installers into examples/. Cousin, not this sidecar.

Jev-Examiner is listed as "An AI content moderation workflow powered by the TypeSafe/Jev model." Empty public tree at capture (created 2026-09-20T04:30:19Z). Later public tree is README/LICENSE/COPYRIGHT/.gitignore; README advertises src/ / docs/ / AGENTS.md / CONTRIBUTING.md not in the tree (advertised tree ≠ shipped source). Content-moderation cousin of gg-friggin-ez / jevmod / GLiGuard / tonedown / jevfanity-api. Watch; do not invent a shipped moderator. Do not merge into examples/. Cousin, not this sidecar.

pi-jev-tool-guard (pi-jev-tool-guard@0.1.0) intercepts Pi bash / write / edit immediately before execute. Jev returns typed probabilities; the extension owns the control flow and thresholds. Default evaluatorFailure: "allow" (fails open); headlessRisk: "block"; thresholds reviewProbability 0.35 / highRiskProbability 0.7 uncalibrated. Model default jev-latest (moving alias, not a pin). Quoted README: This extension is a confirmation guard, not an operating-system sandbox. Rule lists have deterministic precedence over Jev (protectedPaths / alwaysConfirmCommands force confirmation; allowedPaths / allowedCommands bypass evaluation; confirmation rules win when both match). disable: true bypasses the guard. Distinct from pi-jev-guard / pi-jev-gate / pi-jev-approver / pi-jev-control / pi-jev-sentinel / pi-jev-command-guard. Contrast jevgate (allowlist then Jev) and this sidecar (structural first; soft never the sole veto). Treating 0.35/0.7 as a safety envelope or fail-open as fail-closed is confidence theater. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

gg-friggin-ez is a fast Node toxicity/profanity screener powered by TypeSafe Jev (isProfane / isToxic / screen()). Actions ALLOW / SUSPICIOUS_REVIEW / AUTO_CENSOR / AUTO_MUTE / AUTO_BAN. Thresholds review 0.3 / censor 0.55 / ban 0.7 uncalibrated. No key → local heuristic; calls never throw (named degraded backend, same lesson as backend: "lexical"). Quoted 42 curated cases 97.6% (41/42) — not a rh-guard ROC. Fold grading/policy-in-code only, not Twitch/Valorant demos. Cousin of jevmod / tonedown / GLiGuard / jevfanity-api. Treating AUTO_BAN as a safety proof is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

jeveryword is Jev field extraction + PII detection + exact quotes: numbered tokens, Jev picks ids, maps to verbatim spans (text.slice(start, end) === value). extractSpans / classifyChunks / PII. Quoted README: Experimental. Small synthetic sample; too small to support an accuracy claim. Labels must include none. Confirm p<0.8. Quoted: text cannot make it produce words that are not in the source. Gloss: untrusted input can still influence which span. Distinct from WaynezProg/jev-kit jev_extract. Not PreToolUse. Sensitive-data / source-bound integrity cousin. Do not merge into examples/. Cousin, not this sidecar.

jevfanity-api (Jevfanity) is a Cloudflare Worker POST /v1/moderate: TypeSafe Jev Nouls for profanity / slur / harassment / threat / sexual; code owns flagged (any selected category ≥ threshold). Default threshold 0.75, default level medium. Model jev-latest (moving alias, not a pin). Category scores are the maximum across chunks (100-token windows, 10-token overlap) — one dirty window flags the request (FP-heavy vs a miss on a later window). Missing TYPESAFE_API_KEY → 500 server_misconfigured (not a named lexical fallback). Upstream error/timeout → 502/504, not a silent allow — the caller owns fail-open vs fail-closed. Quoted README: CORS is open by default. Tighten Access-Control-Allow-Origin before using a browser-facing production deployment with sensitive data. 20/min per client IP (theirs). Quoted: IP-based rate limiting means users on the same shared network may share a limit bucket. Quoted: the underlying category probabilities for custom policy decisions. flagged is a policy bit, not a safety proof. Soft Noul ≥ 0.75 as AUTO_BAN / hard mute is the same theater as gg-friggin-ez. No published ROC. Distinct from gg-friggin-ez (Worker API vs Node lib; 500/502 vs never-throw heuristic) and Jev-Examiner (shipped Worker vs advertised-tree listing). Cousin of jevmod / tonedown / GLiGuard. Posted text leaves the Worker to TypeSafe (PII surface). Do not merge into examples/. Cousin, not this sidecar.

iso-jevdit (iso-jevdit@0.1.0) is an npm CLI that audits a codebase against ISO/IEC 27001:2022 Annex A. Quoted README: This is version 0.1.0 and the audit engine is not finished. Check catalog 3 of ~36; sending chunks, caching, narrowing findings, and writing iso-jevdit-report.md are Not yet. Today iso-jevdit . discovers, chunks, forecasts cost, checks a credential, then tells you the engine is not wired. Quoted: This is not a certification, and it is not a conformity assessment. Quoted: Findings are probabilistic. Expect both false positives and false negatives. Quoted: No static analysis is performed. Quoted Status: The only network call the tool makes today is verifying a key when you save one. When the engine lands, quoted Your source code is sent to the configured provider. README settings comment over failOn / report / cache: Accepted today, acted on when the audit engine lands — treating failOn: "high" as a live CI merge gate is advertised capability ≠ shipped module. Confidence-policy knobs thresholds.report 0.6 / high 0.8 are quoted policy, not physics, and they are not live while sending chunks is Not yet. Model default ~typesafe/jev-latest (moving alias). README describes gating on violation-label probability mass, not the model's confidence (high for a confident pass too) — that envelope is not shipped until the engine is wired. Extra checks must include a no-match label (wellposed cousin). Cousin of jev-security-scan / latch / moongate / apa-agent-harness. Do not treat a future failOn as ISO certification. PII: source leaves only when the engine lands; credentials in ~/.isojevdit/credentials.json are Not encrypted at rest. Do not merge into examples/. Cousin, not this sidecar.

jev-linkedin (Jev Job Match) is a Chrome MV3 extension that scores LinkedIn job↔CV fit via TypeSafe Jev (10 parallel questions). Code computes match % and pass-screening % from the probability distribution. Quoted README: the "odds" numbers are the model's judgement of your CV text and the job description, not real-world probabilities. Quoted: Treat them as an early signal, not a decision. Verdict knobs worth_applying ≥ 0.6 / 0.4 uncalibrated. Model default jev-latest (moving alias). CV text is extracted locally, then sent with the job description to the configured /v1/systemone (PII: CV, location, education, skills; key in chrome.storage.local). When a page signal cannot be read, opportunity_signals is not sent at all. Empty fields omitted. Distinct from bias-bench / jev-bias-bench (product scorer vs fairness audit). High-stakes scoring: treating match % as hire/reject is hard-gating a soft Score. Integration fixture (BJAK Singapore residency vs Batam) is not a rh-guard ROC. Cousin of jeveryword (PII surface) / bias-bench. Do not merge into examples/. Cousin, not this sidecar.

Astro-Han/jev-harness filters every tool result except read through Jev before the main model sees it. Distinct from AntonioCoppe/jev-harness (shadow / confidence action evals), apa-agent-harness (rebrand), and Atikpui007/jev-sift (Claude PostToolUse relevance filter). Quoted README: Filtering is a routing decision, never destruction. Raw output is stored; read can retrieve it. Quoted: Jev failures fail open. Keep at p > 0.5. Quoted: One run per arm: this is a prototype measurement, not a generalization claim. 25/30 vs 22/30 is not a rh-guard ROC. Quoted RESULTS.md: Pass/fail alone is not significant. Intent in the filter state is load-bearing (without it, deliberate reads scored p≈0.1–0.4). Cousin of agent-chaperone (results before the agent reads) / jev-routing (drop/truncate without summarizing). Treating 25/30 as a safety proof or p>0.5 as a hard deny of evidence is confidence theater. Fold the pre-model tool-result filter only. Do not merge into examples/. Cousin, not this sidecar.

Atikpui007/jev-sift is a Claude Code PostToolUse plugin that filters grep/glob/read/web/bash result collections through Jev before Claude sees them. Distinct from kbhuw/jev-sift (classify first, read selectively) and Astro-Han/jev-harness (pre-model tool-result filter; routing never destruction). Quoted source (src/hook-filter.ts): Fails open: on any error the hook prints nothing and the original result is delivered. Hide only when Jev puts at least DROP_THRESHOLD on hide (code default 0.5; env JEV_FILTER_DROP_THRESHOLD — header comment names JEV_FILTER_THRESHOLD; quote the code). Quoted drop marker: This is a relevance filter, not a safety block. Quoted state: hidden_candidates are removed before the assistant sees the result; the assistant never learns they existed. Non-lossless split → passthrough. Model default jev-latest (moving alias, not a pin). Cousin of agent-chaperone / Astro-Han / jevex. Treating a relevance hide as a safety deny, or hiding eval evidence the agent never learns existed, is hard-gating soft judgment. Do not merge into examples/. Cousin, not this sidecar.

jev-cite-check is a Korean ordinance citation-grounding experiment (not a hook): did the answer actually cite the ordinance? Quoted README: 1차 20/20; 2차 97/100, 모순 31/31, 통과시키면 안 될 것을 통과시킨 건 0. Quoted: 1회 관찰이며 성능 주장이 아닙니다. Gloss: one-shot observation, not a performance claim; 0 false-allow of 지지. Quoted: grounded 0.5 미만이면 사람 검토. Quoted: confidence 필드는 분포 집중도이지 정확도가 아닙니다. TypeSafe direct key 아직 지원하지 않습니다; run.mjs uses Vercel experimental_evaluate model typesafe-ai/jev. Cousin of clear-head / WaynezProg/jev-kit (source support ≠ truth) / codebam/dsh-jev-guardrails verifyClaim. 97/100 is not a rh-guard ROC and not legal proof. Treating grounded ≥ 0.5 as a citation/compliance grant is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

pi-jev-command-guard is a Pi bash / powershell command approval extension. Local CRITICAL_PATTERNS always ask (never silent allow; no JEV request). Auto-allow only when choice is allow AND confidence ≥ 0.75 AND ask < 0.25 AND deny < 0.10. Quoted source (src/reviewer.ts): Confidence-gated routing: ambiguity must never silently become permission. API fail / invalid / missing key → ask; no interactive UI → block. Quoted README: do not provide a complete sandbox. Model default jev-latest (moving alias, not a pin). Distinct from pi-jev-tool-guard / pi-jev-gate / pi-jev-approver / pi-jev-guard / pi-jev-sentinel / pi-jev-control. Contrast this sidecar (structural first; soft never the sole veto) and jevgate (allowlist then Jev). Treating 0.75 auto-allow as a sandbox or fail-ask as fail-closed is confidence theater. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

jev-transaction-guard is an autonomous settlement circuit-breaker sim (ledger CVE-bypass / prompt-injection bait). Quoted README: Jev is IMMUNE TO BOTH; quoted Golden Rule: Jev stands as the immutable last line of defense. That marketing is soundness theater. Quoted comparison note: the bench does not show proof that Jev makes better classification choices than GLM 5.3 Flash. Mock path uses labeled features already in state (is_balance_sufficient, is_off_hours_window). Quoted 0.0% FPR on daylight workloads is not a rh-guard ROC. Choice TRIP_CIRCUIT_BREAKER_AND_LOCK is a typed verdict, not a freeze. Model ~typesafe/jev-latest (moving alias). Cousin of actiongate-jev / turnstile / jev-logtriage. Treating IMMUNE / last-line / 0.0% FPR as a safety envelope, or a Choice as a ledger freeze, is hard-gating soft judgment. Do not merge into examples/. Cousin, not this sidecar.

dsh-jev-guardrails is a dedicated DSH plugin monorepo (@codebam/jev-guardrails library + @codebam/dsh-jev-guardrails Cordis plugin). Sibling of already-folded codebam/jev-guardrails (that repo's README title was dsh-jev-guardrails). Quoted: The library owns policy, not the model. Quoted: A heuristic never overrides a Jev block. Quoted library README: A guardrail is not a sandbox. Quoted plugin: The plugin is a policy layer, not a sandbox or an authorization system. Plugin failMode default open. Default action/review thresholds 0.70 / 0.35 uncalibrated. verifyClaim is citation-grounding adjacent. Model jev-latest / ~typesafe/jev-latest (moving alias, not a pin). Distinct from 7starsseeker/dsh-jev-guard / alsoleg89/jev-guard / pablozr/JevGuard / leepokai/jev-guard / seb4ez/jevguard. Cousin of this sidecar's dsh adapter / construct-auto-classifier / AgentGhost. Treating 0.70 as a safety envelope, fail-open as fail-closed, or merging their DSH installer into examples/ is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

jev-auto-approve is a GitHub Action: Jev answers a Noul (needs_human_review); code approves when confidence = 1 - p(human required) ≥ confidence-threshold (default 0.9). Quoted README: does not satisfy required-approval branch protection (GITHUB_TOKEN). Quoted: Failures are loud. Quoted src/main.mjs: a gate, not a substitute for a human reviewer. Model default jev-latest (moving alias). Diff and discussion are untrusted input. Cousin of ci-gatekeeper-bot-jev / jev-pr-review / jev-gate / moongate / if-ai / latch. Treating 0.9 auto-approve as a merge grant is soundness theater / soft-score-as-hard-merge. Do not merge into examples/. Cousin, not this sidecar.

hush is GitHub issue triage that stays quiet when unsure. Quoted README: Silence is the default behaviour, not the failure mode. apply default false. Quoted: Start with apply: false. A label is only ever applied if it already exists; hush never creates labels, never removes one, and never touches a label a human added. Two gates: label-threshold 0.80 AND label-confidence-threshold 0.60; spam 0.90 / needs-info 0.85 / duplicate 0.85. Quoted: it will not Close, lock, delete or edit anything. Quoted: Where it is unsure, it leaves the issue exactly as it found it. Cousin of jev-triage / jev-logtriage / ci-gatekeeper-bot-jev. Treating a quiet skip as a hard reject, or auto-applying below both gates, is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

jev-call-screener is an AI call-screening backend: JEV classifies a transcript; Go policy owns reject/forward/clarify. Quoted README: JEV classifies; it does not generate dialogue or control the call. Quoted: The defaults are deliberately fail-open. Routing: promotional and confidence ≥ 0.90 → reject; wanted ≥ 0.75 → forward; else clarify then forward. Model default jev-1.13.0 (pinned). FORWARD_ON_ERROR default true. Cousin of gg-friggin-ez / jevmod / unslopify. Treating 0.90 reject as a safety envelope, or fail-open as fail-closed, is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

unslopify is a Chrome quality filter for social feeds (AI slop / engagement bait / generic filler / empty hype). Quoted README: It is a quality filter, not an AI-authorship detector. Quoted: Keeps uncertain or failed classifications visible. Classification is still probabilistic. Cousin of jev-call-screener / karat-filter / rspamd-jev. Treating a blur as an authorship proof, or hiding uncertain posts, is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

no-hallucination is three RAG hallucination experiments including TypeSafe Jev quote-checking. Quoted README: quote-forced string-check is The hallucination defence that worked. Jev as a guard that blocks unsupported answers: No effect. It agreed with all 8 remaining errors (confidence 0.82–1.0). Quoted: The one clear win: 78.0% → 81.0% correct (retry triage). Quoted: Recall@k is the wrong thing to optimise. Sample sizes 150–518; not a rh-guard ROC. Cousin of jev-cite-check / clear-head / rag-jev. Treating Jev-as-guard No effect as a safety proof, or 81.0% as a rh-guard ROC, is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

context-evaluator uses Jev as a semantic decision gate over PetClinic files: INCLUDE when evidence is DIRECT, relevance is HIGH, and both confidences ≥ 0.8; EXCLUDE when evidence is NONE or relevance is LOW; else REVIEW. Quoted README: precision/recall are experiment metrics, not proof that Jev will select the correct context for arbitrary questions. Cousin of jevex / jev-assist / karat-filter. Treating INCLUDE as a hard read-only grant is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

jev-assist ranks every file by task relevance before reading (jev rerank / validate / drift / gate). Quoted SKILL.md: Flags are prompts for a human look, never verdicts. Quoted README: Typed output guarantees the shape of an answer, not its correctness. Quoted: Do not judge candidates you just generated. jev gate exits 1 on any flag. Quoted SKILL.md: recall@20 0.68, recall@40 0.80 over 41 files on one 705-file React app — not a rh-guard ROC. Cousin of jevex / context-evaluator / Atikpui007/jev-sift. Treating a rank as the only files that exist, or gate exit 1 as a safety envelope, is hard-gating soft judgment. Do not merge into examples/. Cousin, not this sidecar.

rag-jev is local RAG (LoL CN patch notes) with Jev candidate rerank + answer self-check. Quoted README: numbers 全部来自官方公告的结构化抽取结果，不经过生成模型. Quoted jev.py: rerank only when gap ≥ 0.15 else keep retrieval order; Degradation is never silent. Self-check noul < 0.5 cautions (请以公告原文为准); it does not rewrite. Blind 20/20 is not a rh-guard ROC. Model default jev-latest (moving alias, not a pin). Cousin of karat-filter / no-hallucination / jev-cite-check. Treating 20/20 or a caution line as a rewrite/safety proof is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

mailverdict is a phishing-verdict MCP/REST service: deterministic header/URL/attachment parse, then TypeSafe Jev, then code thresholds. Quoted README: Forward an email, get a calibrated phishing verdict. Quoted: An LLM is only used to write a three-sentence explanation, and only for emails that land in the grey zone. Quoted architecture: the explainer never changes the label. Quoted: A classifier cannot be talked out of a probability. Code owns p ≥ 0.90 → PHISHING, p ≤ 0.10 → LEGITIMATE, else SUSPICIOUS. Quoted ARCHITECTURE: indicator weights do not feed the probability. The probability comes from Jev alone. Missing TYPESAFE_API_KEY throws (no named lexical fallback). Quoted README: 502 upstream (Jev or OpenRouter) failure after retries. Explainer failure still returns the Jev verdict. 24-email eval exits non-zero if PHISHING recall < 0.8. Quoted ARCHITECTURE: 24 fixtures show the pipeline works and expose gross miscalibration; they are not a benchmark. Model default jev-latest (moving alias, not a pin). Distinct from rspamd-jev (shadow, no auto-reject) and jev-call-screener (fail-open). Distinct from mailverdict/mailverdict (quoted Advisory signals, not verdicts; disposable/burner/MX; named snapshot fallback) and jaiswalism/mailverdict (Better-T-Stack scaffold, no Jev). Cousin of jav-email-cascade (decide → policy → LLM leftover). Treating 0.90 as a phishing ROC, 24 fixtures as a rh-guard ROC, or the LLM explanation as the verdict is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

open-jev-approvals is a Codex / Claude Code binary allow/deny hook gate (codex-guardian-v1). Watch brief said fail-closed; recapture from tasks/todo.md: quoted The degradation model changed from fail-closed to fail-open after user review. Quoted README: If Jev is unreachable or returns something unusable, the call is allowed — the gate should not block your work just because the reviewer is down. Quoted: A deny always requires positive evidence that the action is dangerous. Quoted policy README: Fail-open degradation; There is no review_required. Hazard Noul ≥ 0.70 or risk_level == critical denies even on a partial verdict; incomplete / invalid / no-key / audit-store failure → allow with incomplete: true. Quoted: action_probability = 0.70 is an initial, uncalibrated operating value — there is no validated dataset yet. Stale authorization version while review is in flight → deny. A project .env is never read. Offline eval/ feeds fake assessments into policy.Compose (no live Jev). Contrast pi-jev-approver (no key → fail-closed) and typesafe-jev-gate (uncertain → Hermes approval, not allow). Treating 0.70 as calibrated, incomplete-allow as a safety envelope, or inventing fail-closed is soundness theater. Do not merge into examples/. Cousin, not this sidecar.

beat-the-reviewer is a reviewer game: ten levels, each a typed judgement rule answered by pinned jev-1.13.0. Quoted README: No middle ground. Taking the reviewer offline does not count as a pass. Quoted: Not a chatbot reading a prompt. Each level is a typed judgement rule. Quoted: The reviewer cannot move the goalposts without that hash changing. Quoted .github/judge.mjs: Holds no key and reaches no model. Quoted: An unavailable reviewer is not an approval. Quoted levels/01/RULE.md: on_unavailable: "block"; refused at noul ≥ 0.5. The request is the PR body; a win is a real merge. Quoted: Asserting confidence does not move the number. Fair-play removals are velocity / clean-sheet / duplicate — never prose. This is a puzzle, not a production merge gate. Cousin of jev-auto-approve / if-ai / moongate. Treating a game APPROVED as a merge-grant safety proof, 0.5 as a rh-guard ROC, or inventing fail-open is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

dsh-jev-guard is a DSH tools/pre-execute accident net: L0 static hard rules, then a paid Jev semantic question, then one of four states (allow / revise / block / escalate). Quoted English abstract: It is an accident net, not a security boundary. Quoted: degrades loudly instead of silently. D3: timeout / 5xx fail-open. D9: 402/401 degrade l0-only, not silent fail-open. Quoted README: L0 的 deny 类硬规则不受此开关影响. Thresholds 0.5 / 0.7; model jev-latest (moving alias, not a pin). Distinct from codebam/dsh-jev-guardrails. Cousin of this sidecar's dsh adapter / construct-auto-classifier. Treating L0 as a security boundary, timeout fail-open as fail-closed, or merging their DSH installer into examples/ is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

jev-sentinel is a multi-harness reference installer (OpenClaw / Hermes / OpenCode / Codex / Claude / Pi / Gemini / Cursor / Copilot). Initial policy backend=local, mode=shadow. Local rules are not Jev. Quoted README: This is a defense-in-depth sensor and veto layer, not a complete reference monitor. Quoted: DEFER means only no additional veto. Quoted SECURITY.md: Judgments are not grants. Quoted: provisional review/block thresholds 0.35/0.80 are policy starting points. Pin jev-1.13.0. Distinct from harshwasan/pi-jev-sentinel, harshwasan/jev-sentinel, jev-home-assistant-sentinel, jev-oas-sentinel. Treating DEFER as a grant or 0.35/0.80 as calibrated is soundness theater. Do not merge into examples/. Cousin, not this sidecar.

diff-risk-sentinel is CRAP + optional TypeSafe Jev risk triage for large git diffs. Quoted README: It is a prioritization aid, not a bug detector. Quoted: earlier 96% accuracy / 100% bug recall numbers are superseded. Rule 6 badge ACCEPTABLE_LOW_RISK (strategy: Low risk. Safe to merge.) is not a merge grant; BENEFICIAL_REFACTOR is a fast-pass badge. Cousin of jev-pr-review / prune-review. Treating Safe-to-merge as a grant is soundness theater. Do not merge into examples/. Cousin, not this sidecar.

agent-firewall is an L7 HTTP reverse proxy (:8286) plus MCP stdio gateway sharing one eval core (hard rules, then semantic score). Quoted: fail-closed if checks do not pass. After an allow, MCP still runs /bin/bash -c. Quoted: with no TypeSafe credentials, Layer 2 Mock. Quoted: Score ≥ 0.8 → BLOCK. Quoted: git pull is intentionally excluded. Model jev-latest (moving alias). Distinct from 0xrem/agent-firewall and 2026hoohacks/agent-firewall. Treating Mock as Jev or 0.8 as a safety envelope is soundness theater. Do not merge into examples/. Cousin, not this sidecar.

/edit is an approval-first Pi tool for small checked code changes. Quoted README: Nothing changes until you approve the exact request. Quoted: If the provider is unavailable, /edit stops instead of pretending that a review happened. Quoted evals: Four runs of one tiny task is not a benchmark. Quoted: a Jev approval with a failed file check is still a failed run. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

slop-filter is a Chrome extension that hides AI-generated posts. Quoted: Scores every post in your feed for how likely it is to be AI-written. Contrast unslopify (It is a quality filter, not an AI-authorship detector). Treating slop-filter as unslopify is a Distinct-from miss. Do not merge into examples/. Cousin, not this sidecar.

sift is a Chrome extension: every X post gets Substance · Humor · Chit-chat · Promo · Junk plus AI-written and Off-topic. Distinct from kbhuw/jev-sift and Atikpui007/jev-sift. Do not merge into examples/. Cousin, not this sidecar.

Winnow is a Chrome extension: four verdicts read now, skim, save, or skip on articles and YouTube ahead of click. Quoted: every word on the card is a template filled from typed answers. Quoted: held-out split 80% verdict agreement and 90% content-type agreement. Quoted: The goldens are still unreviewed. Treating 80/90 as a rh-guard ROC is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

x-spam-filter-typesafe is a userscript: semantic X-comment filter via Jev (is_spam / is_gibberish; max ≥ 0.85). API fail 放行不隐藏 (fail-open). Do not merge into examples/. Cousin, not this sidecar.

jev-mail is Autonomous 24/7 Zero-Inbox Gmail triage via Jev. Automated Apply Label, Star, Archive. Distinct from muhammedilyasy/jev-mail: quoted Read-only: it never sends, deletes, labels or archives anything. Treating vynnlee as the read-only overlay is a Distinct-from miss. Do not merge into examples/. Cousin, not this sidecar.

system1-fraud-interceptor-demo runs System 1 Jev vs generative Gemini in parallel on synthetic transactions. Quoted: Es una demo de experimentación personal, no un benchmark. Quoted: no está pensada para producción. English: not a benchmark. Do not merge into examples/. Cousin, not this sidecar.

jev-wiki-watch judges live English Wikipedia edits: FLAG vandalism or spam ≥ 80%; REVIEW 40% to 80%; OK below 40%. Do not merge into examples/. Cousin, not this sidecar.

umby-jev-stack is a skill tree: Jev as a cheap code-review classifier (HTTP-first; model jev-latest). Quoted 1.x: 544 flags; a manual confirm pass rejected 543 as false positives. 2.0 hunts executable defects only. Quoted: Never drop a finding. Quoted: Jev only classifies. Optional NiazMorshed2007/jev-review MCP is not bundled. Hope-the-model-looks skills; not this sidecar. Do not merge into examples/. Cousin, not this sidecar.

jev-prune-kit is capability-aware context-pruning plus a bounded Jev assessment. Quoted: Not a universal /prune. Quoted: Not live-tested. Quoted README: 122 passing local tests are not 122 live harness or model tests. Quoted VALIDATION.md: 88 passing local tests are not 88 live harness or model tests. Pin jev-1.13.0. jev-bus with jev-context-fabric. Advertised-vs-measured lock. Do not merge into examples/. Cousin, not this sidecar.

yolo-jev-scene-filter is a Gradio Space: YOLO-World open-vocab boxes, then TypeSafe Jev Noul keep? per box. Quoted Space short_description: YOLO-World detects; TypeSafe Jev keep/skips boxes. Quoted UI: Jev only filters what YOLO already found. UI keep floor 0.55 (uncalibrated); model jev-latest; missing key raises. Not a coding-agent hook. Keep/skip overlay (skip boxes still drawn); not hide-never-learned. Relevance-filter cousin of Atikpui007/jev-sift. Do not merge into examples/. Cousin, not this sidecar.

pi-jev-permit is a Pi permission gate on bash / write / edit, not every tool. L0 hard deny → rules → read-only fast path → one Jev question should this call be allowed. Quoted: silence is never consent. Allowed at p ≥ 0.6 (uncalibrated default). Quoted: A failed judgment is never treated as approval. No key: read-only local; everything else blocked. degraded: L1–2 pass, L3 block. Distinct from pi-jev-approver / pi-jev-gate / pi-jev-guard / pi-jev-sentinel / pi-jev-tool-guard / pi-jev-command-guard / pi-jev-control. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

jevgate-action is advertised as a GitHub Action; public tree is a README title only (# jevgate-action); description null; size 0; no action.yml. advertised Action ≠ shipped workflow. Distinct from thevibeworks/jevgate and totally-tim/jev-gate. Watch; do not invent mechanics. Do not merge into examples/. Cousin, not this sidecar.

boldbug1/jev-triage is a Go CLI that sorts messages by urgency via TypeSafe Jev. Distinct from ThyFriendlyFox/jev-triage. Choice (bug/billing/feature_request/account/other) + Score 0–3 + Noul frustrated; -threshold 0.8 (quoted starting point; uncalibrated); model jev-latest; keep other. Vendor 193.6x / 444.6x: test on own data. Do not merge into examples/. Cousin, not this sidecar.

contact-cleaner sorts Google Other contacts into Keep / Review / Remove via Jev. Quoted: Buckets are code, not the model. Quoted: Deterministic first. KIND_CONFIDENCE_FLOOR 0.5 (uncalibrated); model jev-latest; PII name+email. Distinct from ashafizullah/jev-linkedin. Do not merge into examples/. Cousin, not this sidecar.

claude-code-jev-guardrails is a Claude Code reflex layer. Quoted: Claude thinks. Jev reacts. Code decides. Regex/Math.max floors never overridden. Fail-open on judgment; fail-closed on hard cases. No key / JEV_MODE=mock → offline heuristic mock (named degraded backend; mock can still BLOCK). REFLEX_MODE=shadow default. Quoted: Treat this as a working prototype, not a hardened production guardrail. ASK_USER is in the type; decidePreTool / decidePostTool / decideCompletion emit ALLOW/WARN/BLOCK — advertised ASK_USER ≠ engine emit. Distinct from RahulBalakavi/claude-code-jev and codebam/jev-guardrails. Do not merge .claude/settings.json into examples/. Cousin, not this sidecar.

jev-voice-gate is a local voice gate via OpenJev NLI, not TypeSafe Jev. Quoted: Это не гарантированная замена wake word. OpenJev оценивает текст после распознавания. Whisper hallucination. Thresholds 0.40 / 0.22 are не калиброванные вероятности. After accept: без инструментов. Не включайте --yolo. Distinct from herdr-jev. Do not merge into examples/. Cousin, not this sidecar.

alp-pr-review is an ALP line: Review → Jev-routing → squash-merge or Godkend merge portal. Quoted: Den får aldrig PR-titel, -beskrivelse eller diff. Quoted: ikke kan tale sig selv til automerge. Quoted: Kan Jev ikke nås, lukker linjen sikkert. Quoted: Ikke en erstatning for branch protection. Tærsklerne er ikke tunede (needs_human < 0.25, risk under Medium, confidence over 0.6). Distinct from ohernandezdev/jev-pr-review and metalbear-co/jev-auto-approve. Do not merge into examples/. Cousin, not this sidecar.

youtube-judol-userscript-jev is a Tampermonkey userscript that flags Indonesian judol spam via classifier.dev jev with no API key. confidenceThreshold 0.6 (uncalibrated) → unsure. discussing gambling ≠ promotion. Distinct from rspamd-jev / jevmod / x-spam-filter-typesafe. Cousin of classifier-dev. Do not merge into examples/. Cousin, not this sidecar.

Postmark is a Next demo: tone / virality / cringe via TypeSafe Jev; code stamps cringe ≥ 0.6 / virality ≥ 2.2. GitHub description: LinkedIn post classifier; README never mentions LinkedIn — advertised description ≠ shipped UI. Model jev-latest; missing key → 500. Distinct from ashafizullah/jev-linkedin. Do not merge into examples/. Cousin, not this sidecar.

shipit-gate is a TypeSafe Jev deploy/ship gate (shipit check) as a CLI, git pre-push hook, or GitHub Action. Code collects time/git/diff/tests/env; one Jev call returns should_block, deploy_confidence, rollback_risk, blast_radius. Default blockOn: honor should_block, minConfidence 0.5, maxRollbackRisk 0.7, blockBlastRadius ["critical"]. Quoted FAQ: Does this replace my CI? No. Quoted: Rejects fail closed (exit code 2). Override: shipit check --force or git push --no-verify. Demo ./demo/run.sh uses a mocked Jev verdict. Model typesafe-ai/jev via Vercel AI Gateway. Uncalibrated 0.5/0.7 floors; tests-pass is a signal Jev sees, not a merge grant. Soft-score-as-hard-ship. Do not merge the pre-push hook into examples/. Cousin of commitjev / jev-ci-selector, not this sidecar.

jev-brig is a Claude Code PreToolUse Bash AST allow/ask/deny hook. Not TypeSafe Jev — name collision (jev CLI); bashlex → effects → policy. Quoted: jev-brig is a guardrail, not a boundary. Judges only commands Claude waved through via allow rules; no allow rules → silent on everything. Unparsable / runtime path → ask — never a silent allow. Default auto_approve off: allow is silence (only ever restrict). yolo = no opinion. Git pre-commit/pre-push are the actual floor. 99 tests. Distinct from TypeSafe Jev / thevibeworks/jevgate. Do not merge into examples/. Cousin of yolo-shell / construct-auto-classifier / jev-bouncer, not this sidecar.

JevGuard-NSFA default branch develop; public tree at capture is .gitignore only; description null; size 0. advertised Guard ≠ shipped source. Watch; do not invent mechanics. Distinct from alsoleg89/jev-guard / alsoleg89/jev-bouncer / pablozr/JevGuard / leepokai/jev-guard / seb4ez/jevguard / codebam/jev-guardrails. Do not merge into examples/. Cousin, not this sidecar.

jevengineeringgate is a calibrated coding-agent risk gate: L0 deterministic (never referred to the model) then L1–L4 TypeSafe Jev. Quoted: The gate never says yes — PreToolUse emits deny, ask, or nothing (allow would bypass the host). Fitted on 26 labeled cases: 0/26 wrong, 25/26 primary-label, 0 unsafe, min margin 0.025. Quoted: Is this a security boundary? No. Jev is advisory, never authorization. Outage: fail-open for non-alarming; ask for destructive patterns. JEV_HOOKS_DISABLE=1. 48 offline tests. Distinct from thevibeworks/jevgate / totally-tim/jev-gate / ktsu2i/jevgate-action. 26-case fit is not a rh-guard ROC. Do not merge hooks into examples/. Cousin, not this sidecar.

lgtm (@stardeckai/lgtm) is a Jev linter for tests that pass but prove nothing (would-pass-if-broken, mocks-seam-under-test, swallowed-error-as-success, …). Quoted: lgtm is advisory by default: it prints findings and exits 0. Add --fail once findings are clean enough to block. Holdout precision 1.00 on their corpus — not a rh-guard ROC. Weakened-test cousin of typesafe_agent_gates SpecReviewMiddleware. Do not merge /lgtm skills into examples/. Cousin, not this sidecar.

openclaw-tool-prefilter is an OpenClaw before_prompt_build skill/tool catalog shrink: Jev thresholdAnyTool 0.35 (500ms) → toolsAllow: [] else pass-through. Quoted: Bulletproof Fail-Open Safety — timeout/error never blocks dialogue. Quoted Zero Hallucination is theater (catalog prune ≠ no tool calls). catalog shrink ≠ deny. Do not merge into examples/. Cousin of jev-routing / omo-jevlike-router, not this sidecar.

pi-jev-helm is a Pi extension: Jev classifies a unit of work and temporarily selects a Pi model. Fail-open to Baseline Model. Default confidenceThreshold 0.75 (uncalibrated); OpenRouter default, TypeSafe on explicit selection; one 2500 ms attempt, no retries. Quoted: a future Safety Gate and Verifier are separate, uncommitted exploration directions — not this release (v0.2.0 preview). Distinct from pi-jev-approver / pi-jev-gate / pi-jev-guard / pi-jev-permit / pi-jev-control. Routing ≠ permission. Do not merge into examples/pi-extension.ts. Cousin of slo-router / hermes-switchyard, not this sidecar.

jev-claude-controller (jcc) is a System-1/2 coding agent: Python owns the loop; Jev returns a candidate id, never a command/path. Quoted: no function in the safety layer accepts a model signal. Quoted: The thresholds are uncalibrated. Quoted: No claim about which arm is better appears anywhere in this repository. Not a Claude Code plugin. Do not merge into examples/. Cousin of jev-dspy-control-plane / construct-auto-classifier, not this sidecar.

ask-jev is a fail-open advisory CLI (choose / check / purify) with a 280ms hard deadline. Quoted SKILL: never use a verdict to grant permissions, execute an action, certify truth or promote memory. Dual floor: choose needs confidence and winner p ≥ 0.85. Remote only with HARNESS_JEV_ALLOW_REMOTE. 146 mocked tests. GPL-3.0. Do not merge into examples/. Cousin of jev-use / typed-gate, not this sidecar.

switchboard GitHub description: Cost-aware LLM router on Cloudflare Workers & D1 with TypeSafe Jev classification. Public tree empty (409) at capture. advertised router ≠ shipped source. Distinct from hermes-switchyard. Watch; do not invent mechanics. Do not merge into examples/. Cousin of slo-router, not this sidecar.

FastRisk-Jev is a Gradio Space: OpenRouter typesafe/jev-1.13; code maps is_fraudulent noul ≥ 0.80 → BLOCK, ≥ 0.35 → STEP-UP, else APPROVED. No env-key fallback. Quoted README: 0% Type Errors / Calibrated Probabilities — theater. UI halt labels are not a freeze (cousin of jev-transaction-guard TRIP≠freeze). Report markdown includes PII plus last-6 of the user key. Do not merge into examples/. Cousin, not this sidecar.

jev-resume-match (Job Match) scores a resume vs a role via TypeSafe Jev; code combines typed scores. Pin jev-1.13.0. Quoted: Scores are a guide to the text as written, not a hiring prediction. Resume text is sent to TypeSafe. Demo cookie / in-memory cap is not a reliable public spending limit. Distinct from ashafizullah/jev-linkedin / fatelei/yueli / natemoo-re/bias-bench. Do not merge into examples/. Cousin, not this sidecar.

yueli (阅历) is a desktop batch resume classifier (Choice role/level, Score 0–10, Noul padding). Quoted: 仅供参考，不构成招聘决策依据. Model jev-latest; resume text to api.typesafe.ai. Distinct from jev-resume-match / jev-linkedin / bias-bench. Do not merge into examples/. Cousin, not this sidecar.

ismailakdag/typesafe-jev is a sahibinden listing filter: 22 Jev questions; Quoted: Kararı yine kod verir. Quoted: Yargılar karar desteğidir, karar değil. Quoted: Jev metin üretmez. Turkish is not Jev's primary training language. Distinct from the TypeSafe product and russleyshaw/typesafe-jev-gate. Do not merge into examples/. Cousin, not this sidecar.

Mailbox-Boy-With-Jev public tree empty (409) at capture; description null; size 0. advertised mailbox ≠ shipped source. Distinct from vynnlee/jev-mail / muhammedilyasy/jev-mail / pantos12/mailverdict. Watch; do not invent mechanics. Do not merge into examples/. Cousin, not this sidecar.

jevshield (pip install jevshield, Apache-2.0) is a TypeSafe Jev decorator / LangChain wrap (@guard, guard_langchain_tool). Quoted README: Sub-100ms, non-autoregressive runtime security gate. Dual-Validation Matrix: Choice safe/medium_risk/critical_danger + Noul is_destructive + Score blast 0–4. Code blocks if (Tier ≥ Threshold ∧ P_destructive > 0.75) ∨ (BlastRadius ≥ 3 ∧ IsDestructive = True). Quoted SECURITY.md: policy fail-closed; the local heuristic fallback is not a security boundary; interactive is TTY-only. No key → is_mock_mode _heuristic_fallback (named degraded backend; heuristic confidence 0.99 / 0.85). Timeout 2.0s; 429/529 retry once then heuristic. Distinct from uberto/jev-brig (name collision; jev-brig is Not TypeSafe Jev). Uncalibrated 0.75 noul as a hard halt is theater; treating heuristic 0.85/0.99 as Jev is advertised backend ≠ served. Do not merge into examples/. Cousin of construct-auto-classifier / AgentGhost / yolo-shell / jev-bouncer, not this sidecar.

pi-warden (npm:pi-warden, MIT) is a Pi extension: Action / Rules / Slop / Stuck / Done-check / Security / Runaway / Subagent. Default steer (hold → agent, not user); confirm; advise never blocks. Quoted FAQ: It is advisory, not a sandbox, and it runs alongside pi-ward / pi-sensitive-guard. Patterns set the floor; Jev can only raise it; a plan never removes a hold. failOpen: true (TypeSafe fail → allow + warning). Irreversible 0.5 warn / 0.7 hold; off-task never holds; should_proceed steers never holds. README evals: 150 paired runs control 6 vs Warden 0; overnight 13,952 cases / 109 cycles — quoted project-maintained benchmarks, not universal claims — not a rh-guard ROC. Distinct from claude-jev-warden / pi-jev-guard / pi-jev-helm / pi-jev-permit. Do not merge into examples/pi-extension.ts. Cousin of pi-jev-guard / clear-head / yolo-shell, not this sidecar.

jev-demo-triage is a mock incident-triage (GLM via OpenRouter). Modes: baseline / tool (ask_jev) / gate (blocks run_shell/restart_service; fails closed if Jev errors) / both. rollback_deploy and escalate_to_human are not gated. Tuned policy written after Run 1 (not blind). Quoted: Jev did not beat baseline on pass rate (Run 2 composite baseline 17/21, tool/gate/both 16/21); N is 3 per cell. Distinct from ThyFriendlyFox/jev-triage / boldbug1/jev-triage / jev-logtriage. Treating Run 1 simple-restart 0/3 as a Jev-is-unsafe ROC, or the 0.5 AutoModeMiddleware floor as calibrated safety, is theater. Do not merge into examples/. Cousin of jev-vs-llm-guardrails / llm-vs-jev / FastRisk-Jev, not this sidecar.

volumetric-intelligence is a typed agent mesh for video takes / table→dashboard. Quoted README: Jev is the typed gate (Choice / Score / Noul), never the runtime. Quoted: Fail closed. Compose only on GREEN. UI: Jev classifies. Code gates. Schema pin jev-1.13.0; gate ship/hold/block at act 0.72 / dangerous_export 0.5 / sensory_load 7. /api/walk is rehearsal presets (not live Jev); quoted note: Rehearsal schema. Wire TypeSafe Jev as a step without changing questions. Uncalibrated 0.72/0.5/7 as a ship grant is theater. Do not flatten pass|fail. Do not merge into examples/. Cousin of gold-assay / typed-gate / hermes-switchyard, not this sidecar.

Jev-Auto-Router (renamed from Codex Auto Router; Apache-2.0) is a Codex skill: Jev Choice → Policy Guard → native child. README/CONTEXT/spec at SHA 5e65bf3 are Jev Auto Router (remaining Codex Auto Router strings are historical/stale-identity sweeps). Quoted spec: Jev is forbidden Execution, generating specifications, granting authorization. Quoted: Policy Guard Deterministic ALLOW(plan) or DENY(reason) — ranking/selecting alternatives forbidden. Quoted SKILL: The Guard's only verdicts are ALLOW (execute exactly the plan) and DENY → this unit runs in Root. Pin jev-1.13.0. Quoted README.en: real host evidence + benchmark qualification are still UNVERIFIED, so automatic delegation is off by default. Quoted: No evidence means no production delegation; passing static tests do not constitute runtime qualification. Dashboard / ccusage are observers only. Distinct from jev-model-router / jev-routing / hermes-jev-router / pi-jev-helm. Claiming quota savings before qualification, or treating a Jev route as permission, is theater. Do not merge into examples/. Cousin of jev-routing / slo-router / hermes-switchyard / skill-broker, not this sidecar.

jev-web-analyzer is a Next demo: SaaS URL → ReplyNodes Markdown → Jev via Vercel AI Gateway (typesafe-ai/jev; public alias jev-latest moving). Quoted: It is a developer demo, not a ReplyNodes marketing site, SEO score, objective company or product rating, AI detector, customer-research replacement, or definitive SaaS score. Website text is untrusted state. There is no mocked provider. Unofficial, not affiliated with TypeSafe AI. Not a PreToolUse gate. Distinct from unslopify / Winnow / gold-assay / Postmark. Treating founder judgments as a score or grant is theater. Do not merge into examples/. Cousin of gold-assay / Postmark, not this sidecar.

ai-provider-triage-comparison is three arms on five support tickets: openai-luna-none, deepseek-flash-none, vercel-jev. Asymmetric (Jev via Gateway). Latest run 2026-09-20T12:23:23Z sequential; quoted not a controlled benchmark. Unanimous 2/5. Jev booleans probability >= 0.5; severity clamp(floor(score+0.5),0,4). Quoted: These statements are generated only from the committed JSON and describe this run, not a general model ranking. Distinct from jev-vs-llm-guardrails-intent-router / llm-vs-jev / jasonli0226/jev-demo-triage / FastRisk-Jev. Ranking from one 15-call run, or 0.5 as calibrated safety, is theater. Do not merge into examples/. Cousin of llm-vs-jev / jev-demo-triage, not this sidecar.

zerosweep is a Next.js 14 email triage showcase (MIT): TypeSafe Jev via /api/triage/typesafe; code in src/lib/safetyGate.ts owns CONFIDENCE_SAFETY_THRESHOLD 0.85. Confidence < 0.85 → human_review (quoted: NEVER take an automated destructive or aggressive routing step). phishing_attempt or safeToTrashProb ≥ 0.85 → trash_quarantine. Quoted README: Zero Format Errors. Not a PreToolUse gate. Distinct from vynnlee/jev-mail / muhammedilyasy/jev-mail / pantos12/mailverdict / ohernandezdev/jevmod / jasonli0226/jev-demo-triage / Mailbox-Boy. Treating 0.85 auto-trash as a safety envelope, or Zero Format Errors as a safety proof, is soundness theater. not a rh-guard ROC. Do not merge into examples/. Cousin of jav-email-cascade / jev-mail / mailverdict, not this sidecar.

jev-codex-router is per-turn Codex routing (MIT): Jev classifies; code picks luna / sol / astra (or Codex-dry tandem). Quoted README: Fail-open — any Jev error keeps the turn alive. Kill switch sentinel routes without Jev. Confidence below 0.5 does not downgrade to cheap: fallback is middle tier (Sol), not frontier. Quoted BACKTEST.md: −59.9% vs full-frontier on 237 turns ($871 → $349); prompt-cache invalidation from switching models not modelled. Routing ≠ permission. Distinct from miniLV/Jev-Auto-Router / jev-model-router / jev-routing / hermes-jev-router / pi-jev-helm. Treating −59.9% as a rh-guard ROC, 0.5 as a safety envelope, or this router as Jev-Auto-Router, is theater. Do not merge into examples/. Cousin of jev-routing / slo-router / Jev-Auto-Router, not this sidecar.

pi-jev (@y0usaf/pi-jev) is a Pi extension: bash/write/edit gate + bash output judge + jev_ask. Quoted README: Shadow mode is the default. Quoted AGENTS.md: The gate fails open by design. Thresholds: destructive 0.90 / exfiltration 0.70 / beyond_scope 0.85 / impact 2.50. Output judge never blocks. Quoted Calibration: Six states and a handful of runs each is a smoke calibration, not a labelled evaluation set. It is enough to reject obviously wrong thresholds and not enough to switch the gate to enforce by default. Distinct from fivethirty/pi-jev-gate / Reindeer-AI/pi-jev-guard / harshwasan/pi-jev-sentinel / JasonHZS/pi-jev-command-guard / kurihada/pi-jev-permit / phin-tech/pi-jev-approver / BubbatheVTOG/pi-jev-tool-guard / DevMortimer/pi-warden. Treating the smoke table as an enforce grant, or hard-gating those uncalibrated floors as safety, is theater. Do not merge into examples/pi-extension.ts. Cousin of pi-jev-gate / pi-jev-guard / pi-warden, not this sidecar.

pi-jev-prune is a Pi context prune: Jev Noul "needed again?" then recoverable stubs. Quoted README: default dry; Fails open; Ephemeral — session file untouched. Default threshold 0.25. Quoted: below p 0.15, 1 of 28 outputs was used later; 0.15–0.30 ≈ random. Quoted: a no-model code rule (read later superseded by edit/read of the same file) did much of the useful pruning. Distinct from pi-jev-compact / opencode-context-pruner / nanoprune / jev-prune-kit. prune ≠ deny. Treating 0.25 as a safety deny is theater. Do not merge into examples/pi-extension.ts. Cousin of pi-jev-compact / opencode-context-pruner / jev-prune-kit, not this sidecar.

jev-guard-mcp is an experimental browser-only MCP (MIT): Codex intent → isolated Playwright → code-owned candidate IDs → Jev Choice → human approval → execute. Pin jev-1.13.0. Min conf 0.80. Quoted README: Possession of a preview token is the technical authorization to execute; the server cannot independently attest human approval. Quoted: experimental research; not a general-purpose browser agent. TypeSafe Jev cousin. Distinct from leepokai/jev-guard / alsoleg89/jev-guard / codebam/jev-guardrails / jonathanavis96/jev-kit. Treating 0.80 as a safety envelope, or a preview token as attested human approval, is theater. Do not merge into examples/. Cousin of jev-kit / open-jev-approvals, not this sidecar.

jev-router is TypeSafe Jev role routing (MIT): jev-gate in front of OpenCodex + opt-in CLI. Quoted README: Jev does not pick model ids. It picks a role. Failures pass through. Without a key: pure proxy (error-pass). SPEC confidence_floor 0.6. Quoted: Fixture numbers in artifacts/ test the evaluator. They are not a live quality claim. Routing ≠ permission. Distinct from TypeSafe same-name justinhsu1477/jev-router (LiteLLM cloud/local; ≥0.6 cloud ≤0.4 local) / robbyczgw-cla/hermes-plugin-jev plugin ID jev-router / Mandrilsquad1441/jev-model-router / rsdkrasen/hermes-jev-router / 0xNatoshi/jev-codex-router. Treating 0.6 as a safety envelope, or fixtures as a ROC, is theater. Do not merge into examples/. Cousin of jev-codex-router / Jev-Auto-Router / slo-router, not this sidecar.

pi-jev-router is a Pi OpenRouter model router (TypeSafe Jev). /router shadow recommend only (default); /router auto switches. Quoted AGENTS.md: Jev output is evidence, not truth. Benchmarks: writing 89% cheaper; code 88% cheaper with empirical_cost — not a rh-guard ROC. Distinct from TypeSafe same-name rizafahmi/pi-jev-task-router (per-prompt pi.setModel(); owns the model while on; keyword heuristic fallback) / Z761293629/pi-jev-helm / goodruizhan/pi-jev-control / reallygood83/jev-router. Routing ≠ permission. Do not merge into examples/pi-extension.ts. Cousin of pi-jev-helm / jev-codex-router, not this sidecar.

JEV-Dual-Spectrum-Phishing-Guardian is a Vite/Express phishing dual-spectrum dashboard (MIT): TypeSafe @typesafe-ai/sdk model jev-latest. Spectrum 1 V-Triad (Authority / Fear / Urgency) vs Spectrum 2 GenAI (Vanilla Tone / Structural Rigidity / Temporal Blindness / Emotional Inflation). Threat 0–100: Safe 0–20 / Suspicious 21–60 / Malicious 61–100. Missing key throws (TYPESAFE_API_KEY environment variable is not configured) — no named lexical fallback. Code comment: Section 4: Counter-Measures are exemplary and decoupled from individual verdicts. Not a PreToolUse gate. Distinct from sysadarsh/zerosweep / pantos12/mailverdict / vynnlee/jev-mail / ordepas/system1-fraud-interceptor-demo / FastRisk-Jev. Treating Malicious 61–100 as a safety envelope is a shipit-gate anti-pattern. not a rh-guard ROC. Do not merge into examples/. Cousin of zerosweep / mailverdict / jev-mail, not this sidecar.

slop-guard is a Ruby guideline-driven review bot: TypeSafe Jev. Quoted README: code identifies what to inspect, Jev judges it, and explicit rules decide what to report. Quoted report-schema: severity always advisory; the reviewer never blocks. Exit 0: Review completed (concerns may be present). Distinct from adamnroman/slop-filter / SwastikGorai/unslopify / stardeckai/lgtm / Not-TypeSafe-Jev uberto/jev-brig. Treating advisory exit 0 as a merge grant is a shipit-gate anti-pattern. Do not merge into examples/. Cousin of lgtm / Abide / jev-reviewer, not this sidecar.

jev-corrective-rag is Corrective RAG where every decision gate is typed System One vs LLM judge (MIT). Headline table: p50 4.0×, LLM calls 7.2× fewer. Quoted Honest status: Jev decision gates | Stubbed — no API key yet. Keyword heuristic sleeps 300 ms; bench prints PARTIAL. Quoted gates.py: stub is NOT a simulation of Jev's quality. Code VERIFY_CONF_FLOOR = 0.60; RELEVANCE_CONF_FLOOR = 0.50; AUTO_ANSWER when confidence ≥ floor. Distinct from Nixz0824/rag-jev / Ormus-Solutions/karat-filter. Treating stubbed 4.0× / 7.2× as a rh-guard ROC, or 0.60 AUTO_ANSWER as a safety envelope, is theater. Do not merge into examples/. Cousin of rag-jev / karat-filter, not this sidecar.

jev-issue-radar is evidence-based GitHub duplicate triage (MIT): TypeSafe Jev via OpenRouter. Quoted README: It never closes issues, adds labels, or posts comments. Quoted SECURITY.md: The application does not close issues or write comments. Initial smoke 2/4 matched labels — not a rh-guard ROC. Confidence ≥ 0.8 is a conservative product rule, not a calibrated accuracy guarantee. Distinct from sysadarsh/zerosweep / jasonli0226/jev-demo-triage / Umbylicus/umby-jev-stack. Treating 2/4 or 0.8 as a close-issue grant is theater. Do not merge into examples/. Cousin of jev-demo-triage / umby-jev-stack, not this sidecar.

jev-review is a TypeSafe diff triage filter via Vercel AI Gateway typesafe-ai/jev. Flag if needs_review/security_concern p ≥ 0.5 or risk.score ≥ 2. Quoted SKILL: It never approves or rejects anything. Quoted: non-zero exit is "couldn't triage," not "diff is clean." Distinct from TypeSafe same-name NiazMorshed2007/jev-review (MCP quality scores; agent changes code) / egma-ai/jev-reviewer / ohernandezdev/jev-pr-review. Treating 0.5 / risk≥2 as a merge grant is a shipit-gate anti-pattern. Do not merge into examples/. Cousin of jev-reviewer / prune-review / slop-guard, not this sidecar.

jcr (Jev Capability Resolver, MIT, private jcr 1.0.0, @typesafe-ai/sdk) is TypeSafe Jev MCP resolve_capabilities over a nested capability tree, with Claude and Codex comparison harnesses. Quoted README: JCR returns documentation. It does not execute commands. Quoted: The included harnesses also stop at explaining the steps needed to carry out a task. Quoted: Both modes only looked up instructions and explained the steps required for each task. They did not execute those steps. Quoted: The commands being documented can be deterministic. The model-based choice of which command fits a request is probabilistic. Beam defaults: width 3, JCR_BAND_RATIO 0.6, maxDepth 16. Catalog 11 groups / 960 nodes / 11,360 items. Ambiguous / no-match / depth-limit are resolver outcomes, not merge grants. Routing ≠ permission. Treating capability context as attested approval to run is theater (preview-token analog of jev-guard-mcp). jev-latest moving alias. sol-vs-opus5-20: 80 runs; input 85% / 23%, cost 67% / 16% vs skills — lookup comparison, not a rh-guard ROC. Distinct from raniellimontagna/jev-guard-mcp / reallygood83/jev-router / justinhsu1477/jev-router / robbyczgw-cla/hermes-plugin-jev plugin ID jev-router / TypeSafe same-org NiazMorshed2007/jev-review. Cousin of jevex / enzyme / dgp / skill-broker. Do not merge into examples/. Cousin, not this sidecar.

JevPR is a GitHub App (Apache-2.0, jevpr 0.1.0, typesafe-sdk>=0.7.0) that routes PR review via TypeSafe Jev Nouls (breaking_api_change / security_sensitive / production_infra_change) plus Score 0–9 overall_risk and per-file scores. Code computes a composite (0.45 model + 0.35 signal + 0.20 top-3 file weights) then DecisionLevel.from_score: LOW if score < 3.5, NORMAL < 7.0, else SPECIALIST. YAML LOW: action: approve maps to GitHub event: "APPROVE". Quoted README: This Project is Under Development and can contain bugs. Additionally Jev is an AI model, and can make mistakes. Webhook reads payload["files"] (not the standard GitHub PR event files list). Treating LOW auto-APPROVE as a merge grant is hard-gating soft judgment / shipit-gate theater. Distinct from ohernandezdev/jev-pr-review (shadow until calibrated) / metalbear-co/jev-auto-approve / MaxIvanyshen/jev-review. Do not merge into examples/. Cousin of jev-auto-approve / jev-pr-review / ci-gatekeeper, not this sidecar.

model-switch is a local Codex model/reasoning router (MIT) powered by TypeSafe Jev. Quoted README: Experimental. Start in observe mode. Quoted: Fail open — if Jev errors or times out, the original Codex request is forwarded. Quoted: Observe first — routing is disabled by default. minConfidence 0.65. Candidates gpt-5.6-luna / gpt-5.6-terra / gpt-5.6-sol; Astra excluded. No TYPESAFE_API_KEY → passthrough. Routing ≠ permission. Treating 0.65 route as a safety envelope is confidence theater. Distinct from Mandrilsquad1441/jev-model-router / 0xNatoshi/jev-codex-router / miniLV/Jev-Auto-Router / reallygood83/jev-router / philippdubach/pi-jev-router. Do not merge into examples/. Cousin of jev-codex-router / Jev-Auto-Router, not this sidecar.

typesafe-pi (typesafe-pi 0.1.1, @typesafe-ai/sdk) is a consent-gated Pi typesafe_judge (Choice / Score / Noul). Disabled by default; /typesafe enable (or PI_TYPESAFE_ENABLED=1 for headless). Quoted README: Results are model judgments—not proof or authorization. Quoted promptGuidelines: never as permission to perform an action. Fold consent/gate only — skip the bundled workflow skill. Distinct from DevMortimer/pi-typesafe / twilwa/pi-typesafe / nardinmarcus/pi-jev-typesafe / name-lookalike pfuller/Typesafe-Pi (2011 Scala tutorial, not TypeSafe Jev). Treating a judgment as authorization is theater. Do not merge into examples/pi-extension.ts. Cousin of pi-jev-approver / pi-warden, not this sidecar.

the-jev-enator is three Claude Code hooks (MIT, stdlib Python): danger gate (PreToolUse, enforcing), failure notice (PostToolUse, enforcing inject), completion check (Stop, log-only). Quoted README: all three fail open. Quoted: The completion check does not block anything by default. Model jev-latest (moving alias). Danger deny floors 0.80 / 0.90 uncalibrated. Fixture 23/23, 19/19, 12 synthetic transcripts — not a rh-guard ROC. Quoted: nearly all from one developer's machine. Enforcing the danger gate on those floors is hard-gating soft judgment / safety theater. Distinct from thevibeworks/jevgate / totally-tim/jev-gate / RahulBalakavi/claude-code-jev / jonathanavis96/jev-kit / alsoleg89/jev-bouncer. Do not merge into examples/. Cousin of claude-code-jev / jev-kit / jev-bouncer, not this sidecar.

jev-vault-gate is a Claude plugin: Jev noul gate (default 0.6) then topic Choice; raw capture is verbatim (not a summary). Quoted README: never blocks or alters the actual turn. Quoted: Nothing is ever deleted automatically. Model jev-latest (moving alias). plugin.json 0.3.0 ≠ package.json 0.1.0. Distinct from Dharundp6/jev-carryforward / samdotmak/jev-recall / chopratejas/invalidate. Treating 0.6 capture as a safety grant, or safe_to_delete as auto-delete, is theater. Do not merge into examples/. Cousin of jev-carryforward / jev-recall, not this sidecar.

dsh-jev-tools (dsh-jev-tools 0.1.3, MIT) is a DeepSeek Harness plugin: prune long tool output, screen fetched pages for injected instructions, suggest a skill, plus jev_ask / jev_gate. Quoted README.en: it ranks, it never thresholds (the probabilities are a good ranking and a bad threshold); deterministic floors; fail-open (every failure path passes content through untouched). Quoted: With no key the plugin is completely inert. Model jev-latest (moving alias). jev_gate is the only inverted fail-open: unclear paths land on escalate (a gate that fails open fails all the way to "approved"). Quality evidence: 8/8 on eight self-authored Chinese three-way samples — not enough to state an accuracy / not a rh-guard ROC. Shadow prune (prune.shadow) judges and records, changes nothing. Screen is advisory; never blocks a call. Distinct from tr1v3r/dsh-jev / codebam/dsh-jev-guardrails / 7starsseeker/dsh-jev-guard. Treating ranks as thresholds, or 8/8 as a ROC, is theater. Do not merge into examples/. Cousin of dsh-jev-guardrails / dsh-jev-guard / pi-jev-prune, not this sidecar.

JEV-Prompt-Injection-Guardian is a Vite/Express prompt-injection quarantine dashboard (MIT): TypeSafe Jev (jev-1.13.0) then Gemini then local heuristic. Actions BLOCK / QUARANTINE / INSPECT / MONITOR / ALLOW; 80%+ BLOCK. Code clamps the 0–9 Score into the Choice band (Critical → max(score, 80)). Heuristic fallback is not live Jev. Distinct from YuyaForest/JEV-Dual-Spectrum-Phishing-Guardian. Treating BLOCK 80% as a safety envelope, or heuristic fallback as live Jev, is theater. Do not merge into examples/. Cousin of Dual-Spectrum-Phishing-Guardian / zerosweep / mailverdict, not this sidecar.

jev-healthcare-support-router is a TypeScript demo: Jev classifies intent/urgency; TypeScript routes. Quoted README: Jev → makes the decision / TypeScript → controls the action. Code: urgency ≥ 0.8 or confidence < 0.7 → Human Support. Quoted scope: does not make medical diagnoses, treatment recommendations, clinical decisions, or insurance approval decisions. Treating 0.8/0.7 as clinical authority is theater. Do not merge into examples/. Cousin of jev-demo-triage / FastRisk-Jev, not this sidecar.

prMonster is a FujiNet firmware PR triage harness: deterministic gates then Jev; piles READY / NEEDS REVIEW / BLOCKED. Quoted README: It never touches a pull request on its own. Quoted: Merging is never offered. Human confirm: type CONFIRM and your name. ALLOW_GITHUB_WRITES default off. reviewer_directed_text hard block at 0.7. No key → mock mode. confidenceFloor 0.5. Quoted: Answers are calibrated probabilities, not facts. Distinct from HexyeDEV/JevPR / ohernandezdev/jev-pr-review / MaxIvanyshen/jev-review. Treating READY as a merge grant is shipit-gate theater. Do not merge into examples/. Cousin of JevPR / jev-pr-review / jev-review, not this sidecar.

dsh-jev is a DSH monorepo: @dsh-jev/core (choice/score/noul; degrade-on-failure, never throws), MCP jev_choice/jev_score/jev_noul, per-turn router, effort plugin. Quoted router README: Never registers or modifies LLM routes. Quoted: Shadow-run by default. Quoted: Degrades, never breaks. Local file plugins must use name: not path: (path: is silently ignored). VERIFY.md: 35/35 mocked vitest; fake-key tools/call → jev: degraded (HTTP 403). Distinct from HorusJiang/dsh-jev-tools / codebam/dsh-jev-guardrails / 7starsseeker/dsh-jev-guard. Routing ≠ permission. Do not merge into examples/. Cousin of dsh-jev-tools / dsh-jev-guardrails, not this sidecar.

hermes-jev is an async Jev nervous system for Hermes Agent. gate_mode default off; gate_scope default selective; min_confidence 0.80. Quoted SECURITY.md: Do not treat a Jev probability as proof of correctness. Quoted README: enforce — high-confidence BLOCK can block; APPROVAL, low confidence, or provider failure route toward human approval. Catalog template v0.2.1.2; development line v0.2.2.dev4 (non-catalog). Live suite (theirs): $0.000095088 / 419.276 ms — not a rh-guard ROC. Distinct from robbyczgw-cla/hermes-plugin-jev / rsdkrasen/hermes-jev-router / kerpopule/hermes-jev-skills / russleyshaw/typesafe-jev-gate / ajensenwaud/hermes-jev-plugin. Treating 0.80 as a safety envelope, or catalog 0.2.1.2 as the 0.2.2.dev4 line, is theater. Do not merge into examples/. Cousin of hermes-plugin-jev / typesafe-jev-gate / hermes-jev-skills, not this sidecar.

win4r/pi-jev-router is a task-boundary Pi model router (TypeSafe Jev). Quoted README.en: Default mode is shadow, with Jev networking disabled. Exact in-memory request hashes. Pin jev-1.13.0. First eval 15/16 on 16 synthetic cases — This measures neither executor task success nor production accuracy / not a rh-guard ROC. Quoted: Production task quality and net savings have not been established. Auto holds when no eligible model; shadow reports while the current model executes. Quoted: Neither mode validates generated code or grants permissions. Routing ≠ permission. Distinct from philippdubach/pi-jev-router / rizafahmi/pi-jev-task-router / Z761293629/pi-jev-helm / goodruizhan/pi-jev-control. Do not merge into examples/pi-extension.ts. Cousin of philippdubach/pi-jev-router / pi-jev-helm, not this sidecar.

sys1 is a System One gateway: hosted Jev plus experimental local Qwen; Node/Bun client. Quoted README: Hosted Jev is disabled by default. Quoted: Local Qwen is an experimental adapter, not a qualified substitute for Jev. Broader tests (theirs): Qwen3 1.7B 32/72, Qwen3.5 4B 44/72 — not a rh-guard ROC; different fixtures are not a measured improvement. Quoted: Do not reuse Jev probability thresholds for generic GGUF output without model-specific evidence. Quoted: a local-only policy also constrains explicit pins; a pin never bypasses the policy. Network listener rejects browser origins; does not authenticate local processes. Wire-compatible ≠ identical judgments. Cousin of githubnext/localjev / NandhaKishorM/laya / razorback16/openjev. Treating 32/72 or 44/72 as a Jev ROC, or loopback as authentication, is theater. Do not merge into examples/. Cousin, not this sidecar.

jev-regime-gate is a Jev regime gate for trading strategy backtests. Quoted README: Research experiment, not investment advice. Code: viable < 0.4 or changeLikely > 0.6 → stand_down; then confidenceThreshold 0.60 / halfSizeThreshold 0.45 size policy. Soft confidence is application policy, not a safety gate and not investment advice. No key → uniform default answers (not live Jev). Treating 0.4/0.6 as investment advice is theater. Do not merge into examples/. Cousin of FastRisk-Jev / jev-transaction-guard, not this sidecar.

model-effort-router is provider-neutral task-DAG decomposition plus (model, effort) routing with optional Jev. Quoted README: No benchmark claims. Quoted: TypeSafe is an unofficial optional integration. Without key: framework-only / dry-run; no external network request. Unknown/malformed responses fail closed. Quoted: default confidence threshold of 0.5 is a conservative, configurable dispatch policy, not an empirically calibrated accuracy claim. Quoted: This project selects a plan; it does not invoke a model provider or execute the resulting tasks. Distinct from Mandrilsquad1441/jev-model-router. Treating 0.5 as accuracy, or a plan as execution, is theater. Do not merge into examples/. Cousin of jev-model-router / model-switch, not this sidecar.

windows2text is a Windows UI Automation screen-to-text MCP server and Jev-gated computer-use loop (windows_list / windows_observe / windows_snapshot / windows_decide / windows_act / windows_step / windows_run). UIA tree, not OCR. Observation and explicit actions work without a Jev key. Quoted MCP.md: A Jev confirm, escalate, or abort gate never executes automatically. Quoted: windows_step defaults to act=false. Jev chooses type/target; the generating model supplies text. Matches the public Jevbridge visible/targets shape. Distinct from tacticocc/Jevbridge. Jev-backed tools send projected accessibility labels and values to TypeSafe. Treating a confirm/escalate/abort gate as auto-exec, or collapsing this into Jevbridge, is theater. Do not merge into examples/. Cousin of Jevbridge, not this sidecar.

JohnsonRan/pi-jev is a Claude-style auto-mode classifier for Pi (TypeSafe Jev). Quoted README: This is not a sandbox. Quoted: The classifier can be wrong. Quoted: This remains a permission aid, not a security boundary. No key: mutating tools ask. Four safety Nouls ask ≥ 0.30 / deny ≥ 0.85; beyond_request never denies. Output screen ≥ 0.85 strip/redact; HTTP errors pass through. Compaction fail-open to Pi. Hand-labelled 3/10 → 0/10 "not a measurement of real-world false-positive or false-negative rates" / not a rh-guard ROC. Distinct from y0usaf/pi-jev / fivethirty/pi-jev-gate. Treating 3/10 as a ROC, or collapsing JohnsonRan into y0usaf, is theater. Do not merge into examples/pi-extension.ts. Cousin of y0usaf/pi-jev / pi-jev-gate / omp-auto-mode, not this sidecar.

PavelLizunov/jev-sentinel is a Rust infrastructure watchdog (probes → Jev → dashboard/Telegram), not a coding-agent hook. Quoted README: the client validates schema and ranges, not the truth of a diagnosis. Quoted: Self-healing currently logs suggested actions without executing commands. Quoted: missing advice is not interpreted as zero risk. Quoted: Schema validity is not evidence that a diagnosis is correct. Quoted: mutation endpoints do not provide application authentication. Quoted: require_confirmation is Not an implemented approval workflow. Illustrative 95.0% / 0.12 is not a measurement / not a rh-guard ROC. Distinct from CompleteTech-LLC-AI-Research/jev-sentinel. Treating 95.0% as a measurement, or collapsing Pavel into CompleteTech, is theater. Do not merge into examples/. Cousin of CompleteTech jev-sentinel / jev-home-assistant-sentinel, not this sidecar.

omapi-overlay is a Nix flake overlay: stock omp pin, thin omapi wrap, skills input, optional Jev/cursor-agent gates. Quoted README: There is no omp source tree in this repository. Quoted: No omp sources here. Default JEV_MODE=shadow; shadow never blocks. JEV_BYPASS=1 skips the router. Missing key: shadow continues unclassified; active fail-closes. Empty findings are not approval. Keys stay in the process environment; the flake does not bake them. Distinct from omp-auto-mode / omp-jev-extensions. Treating the overlay as an omp fork, or empty findings as approval, is theater. Do not merge into examples/pi-extension.ts. Cousin of omp-auto-mode / omp-jev-extensions, not this sidecar.

jev-test-confidence-gate is a support-triage experiment: one graph, one policy, two engines, a confidence gate. Theirs: Jev 163 ms / 87.5% / $0.06 vs gpt-4o-mini 1164 ms / 75.0% / $0.37. Gate caught 0 of 3 Jev routing errors. Confidence separation -0.010. Quoted: 24 invented tickets. Quoted: sample too small to establish calibration. Quoted: untested at adequate power, not refuted. Quoted: the speed and cost claims hold; the calibration claim is not demonstrated. 24-ticket accuracy is not a rh-guard ROC. Distinct from jasonli0226/jev-demo-triage. Treating 0 of 3 or 24 tickets as calibration is theater. Do not merge into examples/. Cousin of jev-demo-triage / jev-vs-llm-guardrails, not this sidecar.

Twitter-keyword-shield is an X (Twitter) userscript: local rules (quoted 0ms) then optional Jev. Default threshold 0.5 (uncalibrated). Key in GM_setValue. README "sub-100ms" is marketing, not a rh-guard ROC. Distinct from yonsakhan/x-spam-filter-typesafe / bohutang/sift. Treating 0.5 as calibrated, or collapsing this into x-spam-filter-typesafe, is theater. Do not merge into examples/. Cousin of x-spam-filter-typesafe / sift, not this sidecar.

Laya-GuardRails-Harness is a Claude PreToolUse/PostToolUse/Stop harness: Rules → Laya → Policy → Frontier/Human → Execution. Quoted README: Laya is a semantic risk sensor, not a security authority. BLOCK comes from rules or policy, never from a Laya label. Default shadow. Repo policy is untrusted (can only tighten). Quoted: Human approval is approve this exact action once. Confidence is chosen-label probability, not entropy; quoted low confidence escalates, never allows. Distinct from NandhaKishorM/laya. Treating a Laya label as BLOCK, or collapsing this into laya, is theater. Do not merge into examples/. Cousin of laya / hermes-skill-router, not this sidecar.

hermes-jev-approvals is a Hermes approvals.mode: smart reviewer (TypeSafe Jev). Quoted README: Scope: approvals only. Quoted: Not a sandbox. Quoted: It only sees what core's regex flags. Policy lives in code. Theirs: 156 real commands, 9.8x faster, 4.2x fewer interruptions vs one aux chat LLM on one machine (not a universal Jev speedup). Independent live-sandbox: 1.24x Mini/Jev reviewer-time (28 synthetic commands / 156 observations, v0.2.1 9ad1901). Thresholds tuned on one machine; not held-out. Complementary to jev-decisions (0.2.1 smart approvals adapted from this tree). Distinct from rsdkrasen/hermes-jev-router. Treating 9.8x as a universal speedup, or this reviewer as a sandbox, is theater. Do not merge into examples/. Cousin of jev-decisions / typesafe-jev-gate, not this sidecar.

scx-router is a GLiClass model router (scx-admin/scx-router-v0.1). Candidate labels can change at inference. Example threshold 0.5. Not TypeSafe Jev. Same class as the degraded lexical/GLiClass fallback here, not a calibrated substitute. Treating 0.5 as a Jev gate is theater. Do not merge into examples/. Cousin of slo-router / jev-model-router, not this sidecar.

pii-masker is on-device reversible PII masking (GLiNER ONNX INT8; Swift + .NET). Quoted SECURITY.md: Fail-closed. Quoted: It never returns the input unchanged as a fallback. Quoted: Do not read "fail-closed" as "catches everything". Distinct from BuilderChat/PII-Redactor. Treating fail-closed as complete recall is theater. Do not merge into examples/. Cousin of PII-Redactor / guardrails-demo, not this sidecar.

PII-Redactor is REST redact/rehydrate middleware. Default fail-closed. SLM defaults: PII_REDACTOR_USE_GLINER=false, PII_REDACTOR_USE_PRESIDIO=false (heuristic-only). Shadow integration is fail-open (CHAT_REDACTION_FAIL_OPEN=true). A listing that says Presidio + GLiNER + Ollama is the full-detector line, not the default slm branch. Distinct from BlinkWrite/pii-masker. Treating GLiNER/Presidio as default, or shadow fail-open as the envelope, is theater. Do not merge into examples/. Cousin of pii-masker / guardrails-demo, not this sidecar.

guardrails-demo is LangChain AgentMiddleware PII mask/restore (GLiNER person/location; regex email/phone). Theirs: PII masking ~180 ms. Demo, not a production envelope. Distinct from morre95/Laya-GuardRails-Harness. Treating 180 ms as a rh-guard ROC, or this demo as a Laya harness, is theater. Do not merge into examples/. Cousin of pii-masker / PII-Redactor, not this sidecar.

systemone-gatekeeper-war is Uppsala University Library Cora (se.uu.ub.cora) Systemone Gatekeeper WAR (gatekeeperserver). No README. Name collision only: not TypeSafe System One, not a Jev gate. Distinct from hraness/sys1. Collapsing this into TypeSafe System One is theater. Do not merge into examples/. Cousin (name collision), not this sidecar.

hermes-slash-router is a Hermes Agent + Desktop plugin: TypeSafe Jev routes misspelled, shortened, and meaning-based slash tokens. Quoted README: stored routes are never applied automatically. A choice needs confidence ≥ 0.85 and a real available command. No key: fails closed and the draft is left alone. Pin jev-1.13.0. Routing ≠ permission. Distinct from rsdkrasen/hermes-jev-router. Treating 0.85 as a safety envelope, or collapsing this into hermes-jev-router, is theater. Do not merge into examples/. Cousin of hermes-skill-router / hermes-jev-router, not this sidecar.

airlock is a local egress privacy airlock (regex/entropy then Nemotron-3-Nano-4B; optional NVIDIA GLiNER-PII; gate in code). Quoted README: A model never gets to say "this is fine." Quoted: Airlock fails closed. Theirs: linkable disclosure 7.5% ± 0.6 on 243 synthetic cases (not held-out). Distinct from jonathanavis96/jev-kit PreToolUse Airlock. Treating 7.5% as a rh-guard ROC, or collapsing this into jev-kit, is theater. Do not merge into examples/. Cousin of pii-masker / PII-Redactor, not this sidecar.

jevlike-esp32 is an ESP32 demo of vinnylarouge/jevlike. Quoted demo README: This is intentionally a demo, not a production model. Training stays in Python; the scorer runs in Python or ESP-IDF. Routes ASCII to command / weather / complex. Not TypeSafe Jev. Distinct from islee23520/omo-jevlike-router. Treating this demo as a production gate, or as official Jev, is theater. Do not merge into examples/. Cousin of omo-jevlike-router, not this sidecar.

typesafeai-dotnet-sdk is a community .NET client for TypeSafe System One (Noul / Choice / Score). Quoted README: This project is not affiliated with, sponsored by, or endorsed by TypeSafe AI. Quoted: Thresholds belong in your code, next to the decision they gate. Confidence is reported, never invented. An SDK is a policy surface only when the caller puts thresholds in code. Do not merge into examples/. Cousin of the official TypeSafe SDKs, not this sidecar.

RiskAverseTech/toolgate (@riskaverse/toolgate) is a Claude Code PreToolUse hook plus an MCP proxy. Quoted README: Static rules run first. Seven Nouls plus an authorized mitigator. Thresholds deny 0.85 / ask 0.55. Default fail_mode: ask. Unattended ask becomes deny. Policy lives only in ~/.toolgate; a cloned repo cannot reconfigure the firewall. Quoted: toolgate's allow is advisory. Quoted: defense in depth, not a sandbox. Theirs: held-out 20/20 after a truncation bug, 19/20 after 0.6.0, 151 real decisions with 40% ask. Distinct from fdemir/toolgate and ndolinschi/toolgate. Treating 20/20 as a rh-guard ROC, or collapsing this into fdemir, is theater. Do not merge into examples/. Cousin of claude-code-jev / fdemir/toolgate, not this sidecar.

ailerix is a type-safe model router. Quoted README: Jev classifies task families only. Software picks the Pareto point. The only public slug is ailerix/auto. Local System One so the playground works without credentials. Routing ≠ permission. Distinct from slo-router / jev-model-router / reallygood83/jev-router. Treating ailerix/auto as a permission grant is theater. Do not merge into examples/. Cousin of slo-router, not this sidecar.

jev-github-quality-gate (Q-GATE) produces auto_approved / needs_review / blocked. Policy lives in code. Quoted README: Supports shadow mode. Heuristic fallback when Jev is unavailable. Gloss: auto_approved is not a merge grant. Distinct from totally-tim/jev-gate / ohernandezdev/jev-pr-review / HexyeDEV/JevPR / if-ai. Treating auto_approved as branch protection is theater. Do not merge into examples/. Cousin of jev-gate / JevPR, not this sidecar.

win-cu-router is experimental Windows Jev-first computer-use orchestration. Quoted README: Jev chooses among observed candidates. Quoted: planner(checkpoint) currently only returns a stage goal and cannot increase operation permissions. Quoted: the local HTTP bridge's range check is not an operating-system sandbox. Theirs: limited E01 through E05 samples. Distinct from ArronHC/windows2text / tacticocc/Jevbridge. Treating the HTTP bridge as a sandbox, or a Jev pick as auto-exec, is theater. Do not merge into examples/. Cousin of windows2text, not this sidecar.

herdr-jev-router is mandatory agent.spawn routing for Herdr. Quoted README: This project is experimental and mandatory routing is not complete. Treat the enforcement claims as unproven. Fail closed on missing key, timeout, Jev failure, invalid decision, or audit write failure. Protocol v2 recommend then authorize without calling Jev again. Quoted: The caller still cannot choose one. Distinct from muthuishere/herdr-jev (openjev NLI; Nothing here works yet). Treating experimental routing as a proven envelope, or collapsing this into herdr-jev, is theater. Do not merge into examples/. Cousin of herdr-jev, not this sidecar.

grok-jev-router is a Grok Bot decision router. Quoted README: The router is advice; those rules are the boundary. Quoted: Grok Bot obeying the route is instruction-following, not enforcement. Shadow first. Hard rules in code override Jev's lane. Distinct from rsdkrasen/hermes-jev-router. Treating the router as the boundary, or proceed as a grant, is theater. Do not merge into examples/. Cousin of hermes-jev-router / this sidecar's grok adapter, not this sidecar.

braess-router is bounded Rust semantic routing with Jev and Poise. Quoted README: Alpha · single server · loopback only. Quoted: No distributed quota, public-network listener, or workload accuracy guarantee. Quoted: This project is independent of TypeSafe. Same author as jev-labs. Routing ≠ safety envelope. Do not merge into examples/. Cousin of slo-router / jev-labs, not this sidecar.

gowtham980/jev-router is an OpenClaw plugin. Quoted README: This is NOT a universal automatic model-and-thinking switcher. Quoted: Classifier failures retain the current model. Thinking is advisory. Quoted: we intentionally do not patch OpenClaw, spoof directives, or bypass native session locks. Start in observe mode. Distinct from reallygood83/jev-router / justinhsu1477/jev-router / openclaw-tool-prefilter. Treating this as a universal switcher, or collapsing it into reallygood83, is theater. Do not merge into examples/. Cousin of openclaw-tool-prefilter / reallygood83/jev-router, not this sidecar.

PrivaParse is a local PII layer plus an OpenAI-compatible gateway. Quoted README: Nothing leaves the machine. Phase 1 calls no external service at all. Theirs: German gold 124 documents, PERSON F1 0.964. Quoted: LICENSE_NUMBER and ROUTING_NUMBER measured 0.000 recall. Not a rh-guard ROC. Cousin of pii-masker / airlock / PII-Redactor. Treating 0.964 as a rh-guard ROC is theater. Do not merge into examples/. Cousin, not this sidecar.

anonde is local-first Go PII anonymization. Quoted README: reveal gated by actor + purpose. Quoted: NER models baked in, no outbound HuggingFace traffic at request time. Telemetry optional; quoted No input/output text sent. Theirs: lowest leak_rate on 29 gold-annotated corpora. Quoted: Recall-biased. OpenAI-compatible proxy. Cousin of PrivaParse / pii-masker. Not a coding-agent hook. Treating leak_rate as a rh-guard ROC is theater. Do not merge into examples/. Cousin, not this sidecar.

decision-kernel is a Cloudflare Worker judgment API: POST /classify (triage / urgency / spam / tone / risk) and POST /guard. Quoted README: Judgment proposals only. Quoted: The guard never executes anything itself. Guard JSON note: Never moves money or executes the action by itself. Code guardDecision: spend==="deny" → verdict block; review or conf<0.7 → review; else approve unless (offGoal>=0.9 or dup>=0.9) and undoable<0.5 → review. Missing TYPESAFE_API_KEY → 503. Model jev-latest. Theirs: 40-action simulated day blocked 10/10 malicious, 0 false-block after verdict fix. Soft /guard JSON is a proposal; caller owns execute. Treating 10/10 as a rh-guard ROC is theater. Do not merge into examples/. Cousin, not this sidecar.

kev-model-router is local kev (LoRA + readout on Qwen), not TypeSafe Jev. OpenAI-compatible proxy. Quoted README: Fail-open. Quoted: The router never blocks traffic. Quoted source: kev being down never blocks traffic. Distinct from jev-model-router and jaredpalmer/kev. Theirs: Accuracy 10/10 on 10 probes. Routing ≠ permission. Treating 10/10 as a rh-guard ROC, or collapsing this into Mandrilsquad1441, is theater. Do not merge into examples/. Cousin of jev-model-router / ailerix / slo-router, not this sidecar.

eugeniughelbur/jev-gate is a Claude PreToolUse (plus Codex/Cursor) tool-call gate. Order: FAST_ALLOW then HARD_DENY regex then Jev destructive noul + verdict choice then thresholds. Defaults: MODE observe (return 0, log only); DENY_ABOVE 0.90; ALLOW_BELOW 0.10; CONFIDENCE_FLOOR 0.45; timeout 5s. Fail-open: no key / unreachable / malformed → ask / exit 0. guard/enforce: deny→exit 2; enforce also ask→exit 2. Quoted README: It catches mistakes, not attackers. Quoted: Fails open. Distinct from totally-tim/jev-gate, thevibeworks/jevgate, ktsu2i/jevgate-action, RavenRepo/jevengineeringgate. MCP wrap is hope-the-model-looks. Theirs injection test 2026-09-20, 300 calls typesafe/jev-1.13: blunt 0/30 dangerous allowed (jam: 8/30 safe denied); authority owner 3/30, lead 1/30, policy 1/30; git stash clear flipped under all three (hard-rule). Catching all attacks needed a 0.8 floor (58% clean escalated). Soft p(destructive)>=0.90 can deny in guard/enforce without a hard rule; flag as soft-as-veto when hard rules miss. Treating the 300-call injection test as a rh-guard ROC, or collapsing this into totally-tim/jev-gate, is theater. Do not merge into examples/. Cousin of claude-code-jev / jevengineeringgate, not this sidecar.

gentle-browser-jev is a lab separating Gentle policy/stop, JEV typed choice, and browser execution. Without TYPESAFE_API_KEY: local-fallback. Real browser/device not enabled. Code: confidence<0.75 → click_search fallback. Quoted README: never claim savings without a controlled A/B run. Cousin of jev-agent-safety-arena. Treating this as a shipped production hook, or 0.75 as a safety envelope, is theater. Do not merge into examples/. Cousin, not this sidecar.

MarcoLoDico/pi-jev-router is a Pi /model picker. Jev answers self-contained yes/no; else backup. Selecting another model bypasses entirely. JEV_THRESHOLD default 0.95 (>0.5 and <=1); quoted unvalidated starting policy, not a 95% accuracy guarantee. Missing key/failures → backup. jev-latest on TypeSafe, typesafe/jev-1.13 on OpenRouter. Distinct from philippdubach/pi-jev-router, win4r/pi-jev-router, rizafahmi/pi-jev-task-router, Z761293629/pi-jev-helm. Routing ≠ permission. Do not merge into examples/pi-extension.ts. Treating 0.95 as a 95% accuracy guarantee, or collapsing this into philippdubach, is theater. Cousin, not this sidecar.

harshwasan/jev-sentinel is the current listing of the Pi/Claude/Codex integrity gate previously published as harshwasan/pi-jev-sentinel. TypeSafe Jev on tool-call intent+risk, tool-output injection, and replies. Quoted README: Fails closed. Errors / no key → ask you; never auto-allows. Code owns an allow / ask / warn ladder. Secret scrub before Jev. Optional task pin. Quoted: Prompt injection is not solved. Uncalibrated riskAskScore / riskWarnScore / allowThreshold 0.3 / 1.3 / 0.8. Theirs: 106 unit tests with a fake Jev. Distinct from CompleteTech-LLC-AI-Research/jev-sentinel. Keep both GitHub slugs. Do not merge into examples/pi-extension.ts. Treating 106 tests as a rh-guard ROC, or collapsing this into CompleteTech, is theater. Cousin, not this sidecar.

Koushik890/jev-firewall is a Claude/Codex PreToolUse firewall: deterministic rules then Jev allow / ask / block. Quoted README: Fail closed. Any error produces block or ask, never a silent allow. Quoted: Rules can only tighten. Model allow below ask_below (default 0.7) becomes ask. Theirs: 104 tests. Distinct from wmsing/agent-firewall. Soft allow is not a grant; Claude permissions.allow can bypass hooks. Do not merge into examples/. Treating 104 tests as a rh-guard ROC, or collapsing this into wmsing, is theater. Cousin of claude-code-jev / pi-jev-sentinel, not this sidecar.

jackbarunz/jev-tool-router is Codex MCP tool routing. Default selection threshold 0.90. Every routing choice includes none_of_the_above. Quoted README: The router narrows discovery; it does not permanently remove the fallback path. Quoted: Tool execution is not automatically replayed after an uncertain transport failure. Routing ≠ permission. Distinct from esinocchi/jev-tool-router. Treating 0.90 as a safety envelope, or collapsing this into esinocchi, is theater. Do not merge into examples/. Cousin of jev-routing / jev-model-router, not this sidecar.

esinocchi/jev-tool-router is an experimental Python SDK plus routing/agent-loop benches. Quoted README: It does not generate arguments, approve actions, or execute tools. Quoted: This package is an experimental routing component, not an agent framework or a security boundary. Theirs: routing-only median tool fit 76/81 versus Luna 77/81; not a ROC. Distinct from jackbarunz/jev-tool-router. Treating 76/81 as a rh-guard ROC, or collapsing this into jackbarunz, is theater. Do not merge into examples/. Cousin, not this sidecar.

devjtv/jev-router is an Oh My Pi model+thinking picker (plus a Claude Code gateway model named jev-router). Quoted README: This is cost control, not a quality upgrade. Quoted: A router must never break a turn. Missing credential / dead endpoint / thrown handler → keep the current model. minConfidence 0.55. Routing ≠ permission. Distinct from gowtham980/jev-router / reallygood83/jev-router / justinhsu1477/jev-router. Treating 0.55 as a safety envelope, or collapsing this into reallygood83, is theater. Do not merge into examples/pi-extension.ts. Cousin of gowtham980 / MarcoLoDico, not this sidecar.

cyriusweng/omp-jev-gate is an OMP plugin: prompt preflight, jev-judge, guide vs enforce. Quoted README: User authorisation and OMP permissions continue to govern actions. Quoted: 0.5 is an initial checkpoint threshold, not a calibrated envelope. Default mode off. guide injects policy; enforce checkpoints first edit/write/bash only. Distinct from luw2007/omp-jev-extensions. Treating 0.5 as a safety envelope, or collapsing this into omp-jev-extensions, is theater. Do not merge into examples/pi-extension.ts. Cousin of omp-jev-extensions / omp-auto-mode, not this sidecar.

CompleteTech-LLC-AI-Research/jev-codex-approval is experimental typed JEV approval preflight for Codex. Quoted README: Codex retains responsibility for permission enforcement, action binding, cancellation, and final execution. Quoted: native adapter has not been compiled or exercised inside a running Codex instance. Quoted: mode = "shadow" always returns defer. Example thresholds are unvalidated starting hypotheses. Distinct from CompleteTech-LLC-AI-Research/jev-sentinel. Treating shadow defer as a grant, or collapsing this into jev-sentinel, is theater. Do not merge into examples/. Cousin of open-jev-approvals / jev-sentinel, not this sidecar.

JxWayne890/jev-control-plane is Codex model/reasoning routing plus project-scope safety floors. Quoted README: Prevents the decision model from weakening verified safety rules. Quoted: labeled local rules engine when JEV is unavailable. Routing ≠ permission. Theirs: 33 automated tests. Distinct from jev-dspy-control-plane / pi-jev-control. Treating 33 tests as a rh-guard ROC, or collapsing this into pi-jev-control, is theater. Do not merge into examples/. Cousin, not this sidecar.

dr-dimitru/claude-jev-plugin (claude-jev) is Claude PreToolUse/PostToolUse semantic judgments. Quoted README: This plugin is a semantic guardrail, not a security sandbox. Quoted: Plugin never returns allow from TypeSafe confidence. Shadow default; fails open when no validated judgment is available. Distinct from RahulBalakavi/claude-code-jev. Treating TypeSafe confidence as an allow grant, or collapsing this into RahulBalakavi, is theater. Do not merge into examples/. Cousin of claude-code-jev / eugeniughelbur/jev-gate, not this sidecar.

4rays/profanity-checker is a Cloudflare Worker that maps Jev Nouls to is_profane in code. Default PROFANITY_THRESHOLD 0.5; quoted: threshold lives in your code. Not a coding-agent hook. Cousin of jevmod / tonedown / jevfanity-api. Treating 0.5 as a safety envelope is theater. Do not merge into examples/. Cousin, not this sidecar.

vzornjak/typesafe-decision is an unofficial advisory Jev layer for Minis. Quoted README: Not a safety control, not an authorization mechanism. Quoted: triage authorization is always false. Fail closed to human_review. Quoted: 51.7% may only be cited as an uncontrolled projection, never as a measurement (theirs retraction of the shortlist v1.1 claim). Distinct from TypeSafe official skills. Treating 51.7% as a measurement, or allow_advisory as a grant, is theater. Do not merge into examples/. Cousin, not this sidecar.

openlayer-ai/jevals is agent evals and in-loop gates on Jev/Kev/Laya. Quoted README: don't let the classifier become the authorizer. Quoted: if the backend is down, a gate lets the call through by default. Quoted: table numbers are estimates, not measurements. Distinct from dayhaysoos/jevals. Treating on_error fail-open as a safety envelope, or collapsing this into dayhaysoos, is theater. Do not merge into examples/. Cousin of dayhaysoos/jevals, not this sidecar.

DihRJ/claude-code-jev-compaction is a LiteLLM tutorial that drops completed tool results below relevance_threshold 0.2. Quoted README: Nothing is summarized or paraphrased. Quoted: It fails open by default. Dropping results can erase eval evidence. Distinct from fast-jev-compaction / jev-compactor. Treating 0.2 as a safety deny is theater. Do not merge into examples/. Cousin of opencode-context-pruner / fast-jev-compaction, not this sidecar.

Gtrkrsk/laya is a Hugging Face listing of the Laya family hub (same checkpoints as NandhaKishorM/laya / convaiinnovations/laya). Cousin note only, not a new model. Quoted: Khmer 0.000 accuracy at 0.952 confidence; confidence gating cannot save you. The 0.85 recipe is still soft. Not a drop-in ROC. Pair with jev-ood-calibration. Do not dump weights. Do not merge into examples/. Cousin, not this sidecar.

localjev is a thin soundness-theater cousin: a local, Jev-wire-compatible POST /v1/systemone that prompts a chat model for JSON probability vectors. README: wire-compatible, not mathematically equivalent to a logit read — "The probabilities are generated/self-reported by the model rather than read directly from its logits. Evaluate their calibration on your own workload before relying on them for consequential decisions." Treating prompted JSON probs as calibrated logits for hard gates is soundness theater. One thin card only; not a new hook pack. Cousin of jev-arena / jev-ood-calibration. Not a rh-guard peer.

laya is an open System One head (typed Choice / Score / Noul). Confidence-gating recipe at 0.85 (RLCD → "statistically meaningful") is still soft. Auto-act at that uncalibrated threshold is confidence theater, especially given Khmer OOD 0.000 at 95.2% confidence — the model's own confidence gives no warning. Future backend, not a drop-in ROC replacement for this hook. Pair with jev-ood-calibration / capability-atlas. HF family listing Gtrkrsk/laya is the same hub, not a new model.

jev-labs wraps a probabilistic oracle in a formal consensus kernel (TLA+ → AsyncAPI → Rust). Pharmacy-sim golden 1,080 rounds: wrong=0; under severe chaos 314 correct / 46 escalated / 0 wrong (accuracy 0.834–0.903). Never confidently wrong. The invariant is escalate-not-guess: the kernel may escalate, and it may never return a confident wrong verdict. A stability gate excludes votes whose margin sits inside the measured noise floor (identity 0.042). Anti-pattern: treating TLA+/model-check theater as proof the soft judge is safe without an exception path. TLC 1,049,750 states / 0 errors proves the protocol, not that the oracle is never wrong. Scope: synthetic pharmacy, not clinical. Limitation: underdetermined records escalated 86/120 and decided 34 split both ways — the stability gate is not an answerability check. Cousin, not this sidecar.

seal is an advance gate plus a visible coverage ledger (auto | code | human | escalate). No seal, no advance. Effects stay locked while escalations remain open. Hiding escalations is a product lie. schema-valid ≠ semantically correct (pairs with jev-capability-atlas jaggedness / ActionGate Schema-valid ≠ intent-matched — contrast only). mint ≠ product brain. Zero runtime Python deps. Cousin, not this sidecar.

firehose-judge puts typed Jev judgment on the Bluesky firehose (Cloudflare Durable Objects). Uncertain answers route to a "needs a human" lane; nsfw is dropped server-side. Jev is a sensor, not a verdict.

jav-email-cascade is decide → policy → LLM leftover: Jev answers typed questions; Python policy routes auto / review / llm. A Noul at 0.5 means "cannot tell" (never rounded); a Score with confidence 0.0 is never acted on; injection_suspected always force-review even with an LLM configured. Force-review is a real lane, not soundness theater.

waymode lets an app keep host permissions, validation, and handlers; Jev decides over typed actions on the live UI with retained evidence. Jev confidence grants no permission (sensor ≠ verdict). Cousin, not this sidecar.

skill-broker is a Hermes skill-intervention layer. Quoted README: Stages 1–4 are built and one Consumer is live. Quoted: the pipeline is implemented through ticket #50 (prepare_turn, Authorised Closure, Candidate Retrieval, Judgment validation and the Grant, Skill Pack, live Jev with recorded/No-Skill fallback). Stages 5-6 (offline routing evaluation and shadow-mode integration) are next. Quoted: Jev never grants access. Jev relevance ≠ authority. Direct sibling to turnstile (evidence ≠ authority). Anti-pattern: letting System One confidence expand the allowed skill set. Same permission boundary as waymode. Do not treat a live Consumer as Hermes enforce. Do not merge into examples/. Cousin, not this sidecar.

jev-lens is an advisory Claude Stop hook that answers "do I need to look?": it never blocks, never edits, and never says green unless it is sure (JEV_LENS_GREEN 0.9). Shadow mode first. Attention/VOI, not authority — keep it separate from skill-broker / construct-auto-classifier when you need a gate. Cousin of jev-reviewer; not a merge. Hunch: collapsing attention and authority invites gaming the green light.

jev-preflight is a Claude Code Stop-hook: UserPromptSubmit snapshots a private Git baseline; Stop sends a redacted turn diff to Jev on eight risk axes. Assist mode: high risk asks at most one reinspect, then finishes. Fail-open (no key / timeout / invalid / oversized skip evaluation). Default 0.85 threshold is uncalibrated. Scores direct attention, not proof of defects; not a merge blocker. Pattern: escalate-attention ≠ hard block. Soft gate that can be gamed by ignoring the reinspect. Do not merge into examples/. Cousin of jev-lens; not this sidecar.

jev-security-scan reviews Agent Skills and MCP code for suspicious behavior with TypeSafe Jev plus static checks. Direct sibling: structural denies + Jev sidecar over the skill/MCP supply chain (not eval-asset tool use). Policy in code: a high finding needs both Nouls ≥ 0.85, window confidence ≥ 0.6, and active context ≥ 0.7. Unflagged ≠ certified safe; two same-model passes are not independent verification. Does not execute the target. Cousin of is-malicious. Complementary to jev-preflight (post-turn attention) and to jev-carryforward 0/4 (an MCP tool sitting there is not enough — scan before install). Do not merge into examples/. Cousin, not this sidecar.

jev-decisions is a Hermes plugin: tool risk reviews + human approval routing via Jev. pre_tool_call is an agent-hook risk gate before tool execution, but opt-in (JEV_ENABLE_HOOKS) and advisory — install does not stop dangerous commands. Jev review is advisory; Hermes policy remains authoritative. Local gateway in code: destructive / credential / external-irreversible → human. A failed review grants no permission. Proof fields (changed / read_back / evidence) cannot catch invented facts. Version 0.2.1 optional smart approvals adapted from anpicasso/hermes-jev-approvals. Quoted docs/approvals.md: It never silently approves. Quoted: The workflow is shadow only. Quoted README: Installation does not select the provider, change approvals.mode. Complementary to jev-preflight (Stop-hook attention) and jev-carryforward (hope the model looks — if Hermes never calls jev_gateway, there is no gate). Contrast skill-broker (relevance never grants access). Do not merge into examples/. Cousin, not this sidecar.

jev-vs-llm-guardrails-intent-router is a LangGraph support-bot demo: Jev vs LLM for guardrails and intent routing. Shared rules hard-gate soft scores (jailbreak / prompt_injection / harmful ≥ 0.70 or severity ≥ 2 → block). Fixture (218 items): Jev route acc 96.8% vs LLM 99.1%; Jev classify p50 593ms / $0.046 per 1k vs LLM 1883ms / $0.99. Eval-integrity: classify accuracy is not a safety proof — watch soundness theater if those soft scores are hard-gated as safety. Bounded demo, not a rh-guard ROC. Complementary to jev-preflight's uncalibrated 0.85 attention threshold. Cousin, not this sidecar.

jev-gate-student-b is a LoRA (r=16, α=32, q_proj/v_proj) distill of Jev memory-relevance onto Qwen2.5-0.5B-Instruct. Quoted card: held-out n=60 MAE 0.187 / Pearson 0.791 / agreement 90.0% vs vanilla 0.536 / −0.067 / 38.3%. Quoted: Gate at threshold 0.5. Fail-open on errors. Distill agreement is not independent gold; a student is not the hard envelope. n=60 is not a rh-guard ROC. Not Qwen3.8-27B and not Archer (promised-not-landed). Card: docs/eval-integrity.md.

jev-triage routes unlabeled data by calibrated confidence and logs soft labels. If used as an eval filter: do not distill Jev as teacher of record — real outcome labels remain the training targets.

jev-curate is corpus curation with Jev pass/fail gates → curated.jsonl vs rejected.jsonl (eval-data integrity). Filter with Jev; train on real outcome labels. Sibling of jev-triage (curate first, then triage). Do not treat Jev as teacher of record.

system-one-benchmark is a 50-sample LMSYS toxic-chat safety eval: Jev precision 90.9% (1 FP) vs local PCD flooding FPs (16). Calibration is the eval-integrity angle; do not treat uncalibrated open PCD as a safety gate. Bounded fixture, not a rh-guard ROC.

dinostomp audits eval instruments (data / scorer / runs / claims) before you trust the score. Pointer when people hard-gate on Jev scores inside reward/eval loops: check the instrument first. Harbor/jevals-adjacent; not a rh-guard peer.

jev-packs is an evidence-gated registry of Jev question packs: a pack is verified only when accuracy / ECE / cost / latency are recorded on a pinned Jev version. Every Choice and Score must offer unknown (mandatory abstention). Anti-soundness-theater for gate criteria: no numbers, no endorsement.

ci-gatekeeper-bot-jev matured: README + action.yml + src/ + committed dist/. Jev via Vercel AI Gateway asks four typed questions (should_review, risk, route, touches_secrets); configurable thresholds route to auto-approve | human-review | block. Conservative default risk_threshold_for_review: cosmetic escalated even trivial diffs Jev called moderate. Timeout/Jev-failure still → human-review, never silent auto-approve. Eval-gaming surface: optimizing the four Jev questions / thresholds instead of real review quality. Watch, not an endorsement — do not hard-gate merge on a Jev auto-approve without a deterministic path floor.

jev-pr-review is a GitHub Action that scores each changed file with Jev. Shadow-mode only until calibrated — automerge is designed but unreachable (mode: enforce fails loudly; the merge path is unwritten). Hard path gates (blocked_paths, max_lines, CI) run before scores; max aggregation, never average. Calibration-first gating before any automerge. Soft judgment as sole merge authority is soundness theater. Cousin of ci-gatekeeper / jev-reviewer / prune-review.

prune-review is a cost-aware Jev gate before a generative PR reviewer: Jev scores hunks; a deterministic safety escarpment always keeps matching hunks whatever Jev says. Jev does not generate review comments. Cost results are not quality claims. Source preview. Cousin of jev-reviewer; not this sidecar.

jev-intent-review is whole-repo intent verification beyond the diff: typed Jev judgments VERIFIED / VIOLATION / UNKNOWN against stated requirements — catches incomplete-change gaming (requirement misses in unchanged paths). The diff is a search hint, not the object being verified. Prefer UNKNOWN over a false VERIFIED. CLI works; GitHub Action not written yet. Watch, not an endorsement.

jev-baselines-eval is a pre-registered Jev-vs-baselines eval with three same-day errata rounds after external review found overstated results (both experiments AMBIGUOUS; headline cascade sign flips at a tighter margin). Harbor/jevals lesson: independent review; do not promote first-publish numbers to labels.

jev-carryforward is a verbatim fact ledger scored for relevance (nothing summarised, nothing deleted). Anti-summarization that erases evidence; cousin to extractive compaction and to clear-head claim/evidence checks. No key → whole list (fail-open). Eval suite: with MCP recall available, the agent called it 0/4 on a force-push prohibition task — an MCP tool sitting there is not enough. SessionStart/compaction hooks that inject constraints beat voluntary tool use. Anti-pattern: hope the model looks. databricks-jev-pdf-lab publishes a measured negative result (no quality-equivalent Jev PDF payoff). Anti-soundness-theater.

Anti-pattern. Using LLM-as-judge (or gaming jevals labels) as the reward signal is the failure mode this gate is meant to catch. See docs/shape.md and Baker et al. 2025.

Siblings, not a merge. jevals measures decisions; rh-guard gates agent tool use; Harbor scores product/agent loops.

Harbor, jevals, and openevals are practices, not install dependencies. You do not need them to install the hooks. Card: docs/eval-integrity.md.

Install hooks

examples/ is the source of truth. Per-host contracts: docs/hosts.md. Packaging notes: docs/install-plugin.md.

Host	Install path	Adapter	Fail-closed
Claude Code	.claude/settings.json or plugin	HTTP /api/hooks/claude or hooks/run.ts claude / hooks/claude-hook.sh	Command wrapper yes; HTTP no
Cursor	.cursor/hooks.json	hooks/run.ts cursor	failClosed: true on shell/tool
Codex	~/.codex/hooks.json / .codex/hooks.json	hooks/run.ts codex (command only; no HTTP)	Codex-safe deny JSON (no continue: false) + exit 2
Grok Build	~/.grok/hooks/*.json / .grok/hooks/*.json	hooks/run.ts grok or hooks/grok-hook.sh	Host fail-open on crash/timeout; wrapper emits {decision:deny} + exit 2
Pi	~/.pi/agent/extensions/ or .pi/extensions/	examples/pi-extension.ts → /api/hooks/pi	Plugin {block,reason,terminate} on fetch failure; optional @hsingjui/pi-hooks command-only
Amp	.amp/plugins/ or ~/.config/amp/plugins/	examples/amp-plugin.ts → /api/hooks/amp	reject-and-continue + AGENT_DENY (not error); catch throws
Prime Agent	~/.prime/agent/extensions/ or .prime/agent/extensions/	examples/prime-extension.ts → /api/hooks/prime	Plugin {block,reason} (no terminate)
DSH (generic/adapter)	generic stdin (hooks/run.ts dsh or generic); Claude/Codex command-hook bridges also work	hooks/run.ts dsh or generic	HTTP skipped (404); generic {block,reason} + exit 2. Bridges deny at tools/pre-execute + exit 2
Exo	wrap ToolRuntime::execute / TurnContext.executeTool (examples/exo-tool-runtime.ts)	support via ToolRuntime wrap, not drop-in hooks; no native hooks.json	Deny-by-default gate returns a tool error with AGENT_DENY; 8s scoring timeout denies. Host has no failClosed flag

Claude Code. Merge examples/claude-settings.json into .claude/settings.json for HTTP hooks. Claude HTTP hooks only honor a 2xx JSON body; timeouts and non-2xx do not block. For fail-closed PreToolUse, merge examples/claude-command-settings.json (npx tsx hooks/run.ts claude); a wrapper failure emits deny JSON and exits 2. Or install the marketplace pack (HTTP for prompt/Stop, fail-closed hooks/claude-hook.sh on PreToolUse):

claude plugin marketplace add 24601/rh-guard
claude plugin install rh-guard@rh-guard

UserPromptSubmit injects steering context. Vague "make the tests pass" prompts steer; they do not automatically block.

Cursor. Copy examples/cursor-hooks.json to .cursor/hooks.json. That file is the Cursor plugin. Command hooks read JSON on stdin through npx tsx hooks/run.ts cursor. beforeSubmitPrompt cannot inject context, so a gameable prompt is allowed with a user notice; tool-denial steering uses a generic agent_message that does not leak scores. Set failClosed: true on shell and tool gates.

Skill (eval design / interpreting denials; not how to run Next.js):

npx skills add 24601/rh-guard --skill rh-guard

Protocol: .agents/skills/rh-guard/SKILL.md.

Keep npm run dev running so HTTP hooks can reach 127.0.0.1:43147. Held-out tests belong in an isolated evaluator, not in a file the agent can find.

Do not add this score as an RL penalty on chain-of-thought or candidate selection. Baker et al. 2025 showed that training against a CoT monitor produces obfuscated hacks.

Run the sidecar

git clone https://github.com/24601/rh-guard.git
cd rh-guard
npm install
npm test
npm run dev

If you already use Origin: origin repo clone basit/rh-guard.

Open http://127.0.0.1:43147.

Copy .env.example to .env.local and set TYPESAFE_API_KEY to score with Jev. Get a key from console.typesafe.ai after early-access signup. Pin TYPESAFE_MODEL=jev-1.13.0. jev-latest currently aliases that id and will move.

Without a key the app still runs. HTTP adapters POST to /api/hooks/<flavor>. Codex and DeepSeek Harness have no HTTP hook type on the host. Exo has no native hooks.json; score from the ToolRuntime wrap (or hooks/run.ts generic).

What it scores

The live semantic scorer is TypeSafe Jev, a System One model. You send program state plus typed questions. Jev returns 13 hazard Nouls, a positive falsifier Noul, a primary-kind Choice, and an ordinal severity Score. It does not generate text.

Code owns decisions. Structural detectors protect designated evaluation assets (hidden tests, graders, reward functions, hooks, evaluator runtimes, canary paths), not every file under tests/. After a structural deny, Jev is skipped. Jev state is a digested command, backticked paths, and a unified-diff summary. Agent thoughts and self-justifications are not sent. Choice, severity, and a named falsifier cannot cancel a hazard deny and cannot independently create one. heldout_blindness is advisory.

Agent-visible denials are opaque filesystem-integrity messages. Scores and taxonomy stay on the operator workbench and in user-visible notices.

One System One request per hook event, only when a structural deny did not already fire. Thresholds and steer copy live in this repo.

Hazard Nouls (block when noul >= 0.80 on a deny kind at a mutating stage):

• test tampering
• hardcoded oracles
• process evasion (--no-verify, skipped hooks)
• monitor gaming (note-to-evaluator)
• reward tampering
• held-out contamination
• verifier weakening
• evidence fabrication
• runtime tampering

Advisory (steer, never a deny by themselves):

• proxy metric (green tests as the goal)
• held-out blindness
• sycophantic evals
• coverage theater

control_falsifier_named is a positive control. It does not enter hazard aggregation.

Phrase every hazard Noul so a high number means the hack is present. Block when that number is at least 0.80 on a deny kind. Do not invert the question into "is this safe" and then raise the threshold. That contracts the rejection band. See Jev + Pi.

Jev does not write verifier instructions. src/lib/risk/steer.ts does. Denials point at an evaluation-defect escalation path instead of "try harder."

System One class (honest limits)

Lexical / GLiClass fallback is degraded, not risk zero, and not interchangeable with Jev even when RiskKind ids match. Open System One heads (laya; localjev prompted JSON) are future backends, not drop-in ROC replacements for this hook — a 0.85 gate is still soft, and wire-compatible probs are not calibrated logits. There is still no public Jev reward-hack ROC. Closed agents such as Claude and Cursor do not expose activations, so Bergen et al. 2026 difference-of-means vectors cannot run here. The Methods page lists those methods and when they do apply. Quote a number only with the served backend (FALLBACK / backend: "lexical"); advertised backend ≠ served backend. Fail-open hygiene (jev-kit "This is not a security control"), a system-directive ask-before-act (opencode-intent-gate), dual-gate screening that can silently discard a replacement (agent-chaperone: advertised screened ≠ served payload), and uncalibrated compaction keepThresholds (opencode-context-pruner 0.15 vs upstream 0.5) are not safety envelopes. InjecAgent AUC 0.976 and labelled-eval 100% are not rh-guard ROCs. A named offline heuristic floor (yolo-shell: no silent fail-open when Jev is down) is not the same as a crash that allows. Dispatch success is not evidence (jev-home-assistant-sentinel: action ≠ verified outcome). Advertised trajectory verification is not a shipped module (apa-agent-harness: advertised capability ≠ shipped module; shadow vs live). A design-only NLI prompt gate (herdr-jev Nothing here works yet) is not a TypeSafe Jev ROC. Silent fail-open when Jev is down (alsoleg89/jev-bouncer, renamed from alsoleg89/jev-guard: Tripwires never deny; quoted Your rules win; quoted SECURITY.md Not a security boundary) is not yolo-shell's named floor. Incomplete evidence must stay UNAVAILABLE, not PASS (pablozr/JevGuard: advertised monorepo ≠ shipped packages). A local n-gram daemon branded Jev (jevbrain: confidence ≥ 0.80 → AUTO_ACT else REVIEW_QUEUE) is not TypeSafe Jev — auto-act at that uncalibrated threshold is silent-fallback / confidence theater. Planted defects withheld from criteria writers (ybadragon/jev-proving-ground) are the held-out antidote. A judge Noul is not a verified bug (jev-crawlers: unverified lead, never a bug; ranking signals, not calibrated confidence). Argmax without reading the probability is soundness theater (typed-gate: declining to answer; 0.40–0.60 band is a refusal, not a weak yes; argmax only omitted 25). A fail-open pre-exec checker (pi-jev-gate: p(block) ≥ 0.50; failing open) is not this sidecar. Documentation-only OpenAPI can hide consumer breaks (jev-oas-sentinel: documentation-only; enforce only when breaking AND promise-violation ≥ 0.90). A passing CI condition is advisory (if-ai: A passing if-ai check is advisory; TypeSafe 67.8% is four workflows, not PR review). A 2.8MB Laya distill (nanoprune: 0.0% Hallucination Guaranteed / ECE 2.58%) is not TypeSafe Jev. Skill recommendation is not a grant (hermes-switchyard: never loads the skill; ack is not DLP; 0.20 local / 0.80 Jev uncalibrated). Soft-judgment gate middleware that hard-denies four Nouls at 0.5 (typesafe_agent_gates: 27/27 / 31/31 are synthetic probes, not a rh-guard ROC; second layer, not a boundary; pattern first, judgment never looser; 0.5 / 0.6 / 0.8 are starting points). Static shell Scores at --error-on (safe-sh: curl | safe-sh; never executes) are not yolo-shell's exec floor. Confirm-as-gate paste routing (jev-pastepilot: Confirm is a gate, not a formality; Confidence is a gate, not proof; fail-opens) is not a safety envelope. A cache hit is not a correctness proof (jevcache: cache hit ≠ correctness; shared fingerprint bundles as calibrated truth / auto-act is trust theater). A GEPA training score is not auto-accept (sutro-sh/jev-align: quoted A higher training score never accepts a proposal automatically; hard-gating that score is soundness theater). Compiled when asked guidance is not an enforced PreToolUse hook (enzyme: quoted guidance compiled for your agent, not an enforced hook; catalyst similarity is ranking, not deny/allow). Closed-world Choice without an escape is a forced false positive (seb4ez/jevguard: inject UNRESOLVED_OR_OTHER; flag AMBIGUOUS_STATE when top p < 0.40 or margin < 0.15). Soft CI skip without shadow is hard-gating (guilhem/jev-ci-selector: Measure before you skip; proposed_run vs run). A 0–4 safety grade is a measurement, not a veto (tonedown: the engine only measures; 74/74 proves the pipeline, not the model). Productized moderation that fails open (ohernandezdev/jevmod: error_open; AUROC is a sanity benchmark, not a leaderboard) is not a rh-guard ROC. A 74-message injection demo (one-dollar-tahoe: demonstration set, not a statistically powered benchmark) is not a safety proof. A fail-closed allow/ask/warn ladder is not a hard deny list (pi-jev-sentinel: quoted never auto-allows; secret scrub before Jev; optional task pin; Prompt injection is not solved). Contrast fail-open pruners / pi-jev-gate. Fail-open skill/routing overlays (hermes-jev-skills: quoted Everything fails open; named lexical skip, not live Jev; Jev can only return an action id from the table; hermes-skill-router: local Laya Fail-open; inject ≠ grant; same-named trees exist) are not this sidecar's structural deny. Assessors do not execute (dgp: application code retains control; quoted DGP docs/TYPESAFE_JEV.md; Speculative assessments cannot authorize effects; cache hit ≠ live Jev). A Hermes fail-closed policy overlay that escalates to host approval (typesafe-jev-gate: quoted not an autonomous permission slip; uncertain/unavailable → Hermes approval, not allow; cannot override Hermes hardline; metadata-only audit) is not this sidecar's structural deny. A local jevlike catalog shrink (omo-jevlike-router: quoted fail-open; recall@24 84.1% / ECE ~0.10 are not a rh-guard ROC; soft router ≠ hard gate; earlier 46.2%/95.5% was an evaluation bug) is not a hard envelope. Guardrail bake-off numbers (ishaannk/llm-vs-jev: quoted Nothing wins outright; steerability 14.3%/10.7%) are not a rh-guard ROC. A Jev-compatible local replica (Gestalt-Lab/jeff: quoted API compatibility does not imply identical judgments; lower ECE ≠ correct) is not TypeSafe Jev. A memory lease that retires facts on new evidence (chopratejas/invalidate: quoted The memory text is never edited; 0 false invalidations / 157 is tuned on that set, not a rh-guard ROC; similarity top-k is never the judge) is not this sidecar. A Hermes tool plugin is not a fail-closed hook (ajensenwaud/hermes-jev-plugin: jev_check / jev_route / jev_score / jev_evaluate; hope the model looks). Semantic contract lint (mizchi/jev-lint: quoted candidate for a human to judge, not a verdict; No shipped rule has severity: error; distinct from huntedman/JevLint) is not a hard CI gate. Memory include/exclude by relevance (samdotmak/jev-recall: 17/18 / 19/20 is not a safety deny). English oxlint cutoffs (wobsoriano/oxlint-plugin-jev: skip unless ci: "fail"). Adding a Claude PreToolUse hop (RahulBalakavi/claude-code-jev: quoted adds a 264 ms hop rather than removing one; 0 dangerous allowed on a synthetic 18-case fixture; 0.85 uncalibrated) is not a drop-in for Anthropic auto-mode. A shadow-mode mail classifier (rspamd-jev: score 0; no auto-reject; unchanged score ≠ unchanged latency; agreement is not accuracy) is not a reject envelope. A library-owned tool-call guardrail pack (codebam/jev-guardrails: quoted The library owns policy, not the model; A guardrail is not a sandbox; default 0.70/0.35 uncalibrated; jev-latest alias (moving alias, not a pin); distinct from alsoleg89/jev-guard / pablozr/JevGuard / leepokai/jev-guard / seb4ez/jevguard) is not this sidecar's structural deny. A semantic CI gate that reads policy from the base commit (brickfrog/moongate: quoted Exit 0 doesn't mean the code is fine; unevaluated never counts as a pass; 4/6 violation-vs-review on identical replays) is not a hard merge envelope. Log-batch labels that execute nothing (jev-logtriage: quoted Low confidence never auto-acts; auto_remediate_candidate is a label) are not a page/restart grant. A resume-screening fairness audit (bias-bench: 1,824 evals; zero binary-decision name differences; ~0.4–0.6pp mean noul; read the magnitudes, not the p-values) is not a rh-guard ROC. Context-window admission (jevusher: J7 pass means nothing detected, never safe to obey; outage → no lens, never an empty context) is not a safety envelope. Pre-registered adversarial Jev eval (willkelly/jev-evaluation: 123,805 requests; confidence ≥ 0.95 still admits 47% unanswerable states; quoted act when confident and escalate when not catches wrong answers and misses unanswerable inputs; distinct from jev-baselines-eval) is the soft-judgment integrity sentinel — do not hard-gate confidence as fake safety. A one-attribute fairness bench (Fox-Islam/jev-bias-bench: 11,984 calls; 0/100 controls; quoted Do not test it by swapping names; Read the deltas, not the stars; distinct from natemoo-re/bias-bench) is not a rh-guard ROC. A mock confidence router (Ormus-Solutions/aurum-gate: packaged src/index.ts auto|escalate|refuse; default autoConfidence 0.85 uncalibrated; parallel src/gate.ts quoted Probability is not confidence; mocked, no live API) is not a safety envelope. A heuristic PR pre-filter (Ormus-Solutions/quicksilver-judge: packaged sketchRisks PASS|HOLD|FAIL not live Jev; Gloss: PASS is not a merge grant; parallel src/stages.ts quoted Code owns overrides) is not this sidecar's structural deny. A retrieve-then-judge RAG filter (Ormus-Solutions/karat-filter: quoted Token overlap judge — mock stand-in for a Jev Noul; 0.45/0.5 defaults) is not calibrated Jev. A UI proof assay (Ormus-Solutions/gold-assay: quoted Screenshots lie until you assay them; public assay is substring/regex; Gloss: GREEN ≠ verified UI) is not a commit grant. Source-bound evidence tools (WaynezProg/jev-kit: quoted Confidence is not a correctness guarantee; Exit 0 does not certify; SECURITY.md not an authorization boundary; distinct from jonathanavis96/jev-kit Airlock) are not a hard envelope. An empty-tree content-moderation listing (Jev-Examiner: GitHub description only — "An AI content moderation workflow powered by the TypeSafe/Jev model."; empty public tree at capture; later README advertises src/docs not in the tree — advertised tree ≠ shipped source) is not a shipped moderator. A Pi confirmation guard (BubbatheVTOG/pi-jev-tool-guard: quoted confirmation guard, not an operating-system sandbox; default evaluatorFailure: "allow" fail-open; 0.35/0.7 uncalibrated; distinct from pi-jev-guard / pi-jev-gate / pi-jev-approver / pi-jev-sentinel) is not this sidecar's structural deny. A Node toxicity screener (ItisShikhar/gg-friggin-ez: 41/42 not a rh-guard ROC; named heuristic when no key; treating AUTO_BAN as a safety proof is confidence theater) is not a reward-hack gate. Source-bound PII/quotes (jkrup/jeveryword: text.slice(start, end) === value; quoted cannot make it produce words that are not in the source; distinct from WaynezProg jev_extract; not PreToolUse) are not a hard envelope. A Worker moderation flagged bit is not a safety envelope (TickerDev/jevfanity-api: code owns flagged at default 0.75; flagged is a policy bit, not a safety proof; missing key → 500, not a named lexical fallback; quoted CORS is open by default; distinct from gg-friggin-ez / Jev-Examiner). An unfinished Annex A CLI is not a certification (vidux/iso-jevdit: quoted the audit engine is not finished; 3 of ~36; quoted This is not a certification, and it is not a conformity assessment; failOn is Accepted today, acted on when the audit engine lands). Job↔CV match % is not a hire/reject gate (ashafizullah/jev-linkedin: quoted not real-world probabilities; quoted Treat them as an early signal, not a decision; CV is sent to /v1/systemone). Filtering tool results before the model sees them is not destruction (Astro-Han/jev-harness: quoted Filtering is a routing decision, never destruction; quoted Jev failures fail open; 25/30 not a rh-guard ROC; distinct from AntonioCoppe/jev-harness). A PostToolUse relevance filter that hides candidates the assistant never learns existed is not a safety block (Atikpui007/jev-sift: quoted Fails open; quoted This is a relevance filter, not a safety block; distinct from kbhuw/jev-sift). Citation-grounding 97/100 is not a legal proof (simonsez9510/jev-cite-check: quoted 1회 관찰이며 성능 주장이 아닙니다; Gloss: one-shot observation, not a performance claim; 0 false-allow of 지지; confidence is 분포 집중도이지 정확도가 아닙니다). A Pi 0.75 auto-allow is not a sandbox (JasonHZS/pi-jev-command-guard: quoted do not provide a complete sandbox; quoted ambiguity must never silently become permission; distinct from pi-jev-tool-guard). IMMUNE TO BOTH / last line of defense is soundness theater (finrod21/jev-transaction-guard: quoted comparison does not show proof that Jev makes better classification choices; Choice TRIP is not a freeze; 0.0% FPR is not a rh-guard ROC). A dedicated DSH plugin pack is not this sidecar (codebam/dsh-jev-guardrails: quoted The library owns policy, not the model; A guardrail is not a sandbox; plugin policy layer, not a sandbox or an authorization system; failMode default open; sibling of codebam/jev-guardrails). A 0.9 Jev auto-approve review is not a merge grant (metalbear-co/jev-auto-approve: quoted does not satisfy required-approval branch protection; quoted Failures are loud; quoted a gate, not a substitute for a human reviewer; jev-latest moving alias; 0.9 uncalibrated). Calibrated silence is not a hard reject (emreozyoruk/hush: quoted Silence is the default behaviour, not the failure mode; apply default false; two gates 0.80 AND 0.60). A fail-open call screener is not a reject envelope (SuchintK/jev-call-screener: quoted JEV classifies; it does not generate dialogue or control the call; quoted The defaults are deliberately fail-open). A Chrome quality filter is not an authorship detector (SwastikGorai/unslopify: quoted It is a quality filter, not an AI-authorship detector; quoted Keeps uncertain or failed classifications visible). Jev-as-guard agreeing with remaining errors is not a hallucination ROC (aryanchauhanoffical/no-hallucination: quoted No effect; 8 remaining errors 0.82–1.0; quoted Recall@k is the wrong thing to optimise; 81.0% not a rh-guard ROC). INCLUDE at DIRECT+HIGH+0.8 is not a read grant (ramasamysh/context-evaluator: quoted experiment metrics, not proof). File-rank flags are not verdicts (glud123/jev-assist: quoted Flags are prompts for a human look, never verdicts; quoted Typed output guarantees the shape of an answer, not its correctness; quoted recall@20 0.68, recall@40 0.80; not a rh-guard ROC). Local RAG self-check cautions, does not rewrite (Nixz0824/rag-jev: quoted Degradation is never silent; noul < 0.5 请以公告原文为准; 20/20 not a rh-guard ROC; jev-latest moving alias). A phishing-verdict MCP/REST service is not a rh-guard ROC (pantos12/mailverdict: quoted Forward an email, get a calibrated phishing verdict; the explainer never changes the label; quoted A classifier cannot be talked out of a probability; 24 fixtures are not a benchmark; missing key throws, no named lexical fallback; distinct from mailverdict/mailverdict quoted Advisory signals, not verdicts and jaiswalism/mailverdict). A Codex/Claude Code binary allow/deny hook is not this sidecar (alexj11324/open-jev-approvals: quoted The degradation model changed from fail-closed to fail-open after user review; quoted A deny always requires positive evidence that the action is dangerous; quoted There is no review_required; 0.70 uncalibrated). A reviewer game is not a production merge gate (Ash20pk/beat-the-reviewer: quoted Taking the reviewer offline does not count as a pass; quoted An unavailable reviewer is not an approval; quoted Holds no key and reaches no model; on_unavailable: "block"). A DSH pre-exec accident net is not a security boundary (7starsseeker/dsh-jev-guard: quoted It is an accident net, not a security boundary; quoted degrades loudly instead of silently; D3 timeout fail-open; D9 402/401 l0-only; quoted L0 的 deny 类硬规则不受此开关影响; distinct from codebam/dsh-jev-guardrails). A multi-harness sensor is not a reference monitor (CompleteTech-LLC-AI-Research/jev-sentinel: quoted This is a defense-in-depth sensor and veto layer, not a complete reference monitor; quoted DEFER means only no additional veto; quoted Judgments are not grants; quoted provisional review/block thresholds 0.35/0.80 are policy starting points). CRAP+Jev triage is not a bug detector (heliowap/diff-risk-sentinel: quoted It is a prioritization aid, not a bug detector; earlier 96% accuracy / 100% bug recall are superseded; Rule 6 badge ACCEPTABLE_LOW_RISK (strategy: Low risk. Safe to merge.) is not a grant). An L7+MCP firewall is not a sandbox (wmsing/agent-firewall: quoted fail-closed if checks do not pass; Layer 2 Mock; quoted Score ≥ 0.8 → BLOCK; quoted git pull is intentionally excluded). Approval-first Pi /edit is not a silent patch (acoyfellow/edit: quoted Nothing changes until you approve the exact request; quoted If the provider is unavailable, /edit stops instead of pretending that a review happened; quoted Four runs of one tiny task is not a benchmark). Authorship hide is not unslopify (adamnroman/slop-filter: quoted hides AI-generated posts; quoted Scores every post in your feed for how likely it is to be AI-written; contrast unslopify It is a quality filter, not an AI-authorship detector). X labels include Chit-chat/Promo (bohutang/sift: Substance · Humor · Chit-chat · Promo · Junk plus AI-written and Off-topic). Ahead-of-click verdicts are four-way (ThinkyMiner/Winnow: quoted every word on the card is a template filled from typed answers; 80% verdict agreement / 90% content-type agreement; quoted The goldens are still unreviewed). X-comment filter fails open (yonsakhan/x-spam-filter-typesafe: max ≥ 0.85; 放行不隐藏). Autonomous Gmail archive is not the read-only overlay (vynnlee/jev-mail: Autonomous 24/7 Zero-Inbox; distinct from muhammedilyasy/jev-mail quoted Read-only: it never sends, deletes, labels or archives anything). A fraud interceptor demo is not a ROC (ordepas/system1-fraud-interceptor-demo: quoted Es una demo de experimentación personal, no un benchmark; quoted no está pensada para producción). Wiki-watch lanes FLAG/REVIEW/OK (hfmsio/jev-wiki-watch: FLAG ≥ 80%; REVIEW 40% to 80%; OK below 40%). A skill-tree classifier must not drop findings (Umbylicus/umby-jev-stack: 544 flags; rejected 543 as false positives; quoted Never drop a finding; quoted Jev only classifies). A prune kit is not live-tested (CompleteTech-LLC-AI-Research/jev-prune-kit: quoted Not a universal /prune; quoted Not live-tested; quoted 122 passing local tests are not 122 live harness or model tests; quoted 88 passing local tests are not 88 live harness or model tests). A YOLO keep Noul is not a safety deny (yolo-jev-scene-filter: quoted YOLO-World detects; TypeSafe Jev keep/skips boxes; quoted Jev only filters what YOLO already found.; not hide-never-learned). A Pi bash/write/edit permit is not every-tool fail-open (pi-jev-permit: quoted silence is never consent.; quoted A failed judgment is never treated as approval.). An advertised Action is not a shipped workflow (jevgate-action: advertised Action ≠ shipped workflow). A Go triage CLI is not ThyFriendlyFox (boldbug1/jev-triage: Distinct ThyFriendlyFox/jev-triage). Contact buckets are code (contact-cleaner: quoted Buckets are code, not the model.). A Claude reflex prototype is not a hardened envelope (claude-code-jev-guardrails: quoted Claude thinks. Jev reacts. Code decides.; advertised ASK_USER ≠ engine emit; no-key / JEV_MODE=mock named degraded backend). An OpenJev voice gate is not TypeSafe (jev-voice-gate: quoted Это не гарантированная замена wake word.). ALP automerge is not branch protection (alp-pr-review: quoted Ikke en erstatning for branch protection.; Quoted: Den får aldrig PR-titel, -beskrivelse eller diff.). Judol discussion is not promotion (youtube-judol-userscript-jev: confidenceThreshold 0.6 (uncalibrated)). A LinkedIn GitHub blurb is not the shipped UI (Postmark: advertised description ≠ shipped UI). A Jev deploy/ship gate is not CI (thecoderpanda/shipit-gate: quoted Does this replace my CI? No.; quoted Rejects fail closed (exit code 2).; --force / git push --no-verify; demo mocked). A Bash AST jev CLI is not TypeSafe Jev (uberto/jev-brig: quoted jev-brig is a guardrail, not a boundary.; unparsable → ask — never a silent allow). An empty JevGuard listing is not a shipped hook (knowlet/JevGuard-NSFA: .gitignore only; advertised Guard ≠ shipped source). A calibrated PreToolUse layer that never emits allow is not a security boundary (RavenRepo/jevengineeringgate: quoted The gate never says yes; quoted Is this a security boundary? No.; 0/26 wrong is not a rh-guard ROC). Green tests that prove nothing are not a merge grant (stardeckai/lgtm: quoted lgtm is advisory by default; holdout precision 1.00 not a rh-guard ROC). Pruning toolsAllow: [] is not a deny (MertBasar0/openclaw-tool-prefilter: catalog shrink ≠ deny; quoted Bulletproof Fail-Open Safety; quoted Zero Hallucination theater). A Pi model router is not a Safety Gate (Z761293629/pi-jev-helm: quoted Safety Gate/Verifier are separate, uncommitted exploration directions; fail-open to Baseline; 2500 ms). A Python-owned loop is not a Claude plugin (snesmaeili/jev-claude-controller: quoted no function in the safety layer accepts a model signal.; quoted The thresholds are uncalibrated.). An advisory CLI is not a permit (logicrw/ask-jev: quoted never use a verdict to grant permissions; 280ms; dual ≥ 0.85). An empty Workers router is not hermes-switchyard (dev-hari-prasad/switchboard: advertised router ≠ shipped source). A Gradio BLOCK label is not a freeze (durganani60/fastrisk-jev: code 0.80 / 0.35; quoted 0% Type Errors theater). Typed resume scores are not a hire (hamidfarmani/jev-resume-match: quoted not a hiring prediction; fatelei/yueli: quoted 仅供参考，不构成招聘决策依据.). Listing judgments are support, not the decision (ismailakdag/typesafe-jev: quoted Kararı yine kod verir.; quoted Jev metin üretmez.). An empty mailbox listing is not jev-mail (TennousuAthena/Mailbox-Boy-With-Jev: advertised mailbox ≠ shipped source). A decorator wrap that hard-gates uncalibrated 0.75 is not this sidecar (lgy1027/jevshield: quoted Sub-100ms, non-autoregressive runtime security gate; SECURITY.md heuristic not a security boundary; _heuristic_fallback 0.99/0.85). A Pi warden is not a sandbox (DevMortimer/pi-warden: quoted It is advisory, not a sandbox; quoted project-maintained benchmarks, not universal claims). A mock triage bake-off is not a ranking (jasonli0226/jev-demo-triage: quoted Jev did not beat baseline on pass rate). Rehearsal GREEN is not a live Jev grant (manutej/volumetric-intelligence: quoted Jev is the typed gate (Choice / Score / Noul), never the runtime; /api/walk Rehearsal schema). A Codex Jev route is not a permission (miniLV/Jev-Auto-Router: Policy Guard Deterministic ALLOW(plan) or DENY(reason); quoted No evidence means no production delegation; automatic delegation off by default (UNVERIFIED)). Founder teardown is not an SEO score (replynodes/jev-web-analyzer: quoted developer demo, not … SEO score). One 15-call run is not a ranking (rmax-ai/ai-provider-triage-comparison: quoted not a general model ranking). Inbox triage at uncalibrated 0.85 (zerosweep: confidence < 0.85 → human_review; phishing / safeToTrashProb ≥ 0.85 → trash_quarantine; quoted Zero Format Errors is schema theater, not a safety proof) is not a rh-guard ROC. A Codex per-turn route is not a permission (jev-codex-router: quoted Fail-open; Kill switch; 0.5 → Sol not frontier; BACKTEST −59.9% on 237 turns; cache invalidation not modelled; distinct miniLV/Jev-Auto-Router). A LoRA student on Qwen2.5-0.5B (jev-gate-student-b: n=60 MAE 0.187 / Pearson 0.791 / 90.0%; Gate 0.5 fail-open) is not Qwen3.8-27B / Archer and n=60 is not a rh-guard ROC. Recaptured contract lint (mizchi/jev-lint: 56 of the 65 rules at 1.00 on 467 labelled defects; candidate not a verdict) is not a hard CI gate. A Pi shadow gate (y0usaf/pi-jev: quoted The gate fails open by design; smoke calibration not enough to switch the gate to enforce; 0.90/0.70/0.85/2.50) is not the other pi-jev-* envelopes. Dry prune of tool results (pi-jev-prune: default dry; Fails open; ephemeral; 0.25; 1/28 below 0.15; code rule does useful prune; distinct compact/pruner/nanoprune/prune-kit) is not a safety deny. A preview token is not attested human approval (raniellimontagna/jev-guard-mcp: quoted Possession of a preview token is the technical authorization to execute; the server cannot independently attest human approval; min 0.80; pin jev-1.13.0; experimental, not a general-purpose browser agent; distinct leepokai/jev-guard). Role routing is not permission (reallygood83/jev-router: quoted Jev does not pick model ids. It picks a role. Failures pass through.; error-pass; confidence_floor 0.6; quoted They are not a live quality claim.; TypeSafe, not an open-weights port; distinct justinhsu1477/jev-router / hermes-plugin-jev plugin ID jev-router). A Pi shadow router is not a grant (philippdubach/pi-jev-router: /router shadow recommend only default; quoted Jev output is evidence, not truth.; 89%/88% cheaper not a rh-guard ROC; distinct rizafahmi/pi-jev-task-router which owns the model while on). Dual-spectrum Malicious 61–100 is not a safety envelope (YuyaForest/JEV-Dual-Spectrum-Phishing-Guardian: Safe 0-20 / Suspicious 21-60 / Malicious 61-100; missing key throws; quoted Section 4: Counter-Measures are exemplary and decoupled from individual verdicts; distinct zerosweep / mailverdict). Advisory review exit 0 is not a merge grant (bornakapusta/slop-guard: quoted code identifies what to inspect, Jev judges it, and explicit rules decide what to report; the reviewer never blocks; exit 0 Review completed (concerns may be present); distinct slop-filter / unslopify / Not-TypeSafe jev-brig). Stubbed 4.0× is not live Jev (sudeshkar/jev-corrective-rag: quoted Jev decision gates | Stubbed — no API key yet; stub NOT a simulation of Jev's quality; 300 ms; prints PARTIAL; VERIFY_CONF_FLOOR 0.60 AUTO_ANSWER is not a safety envelope). Duplicate triage 2/4 is not a close-issue grant (Patrick-SCH03/jev-issue-radar: quoted It never closes issues, adds labels, or posts comments; 2/4 not a rh-guard ROC; ≥ 0.8 not a calibrated accuracy guarantee). A diff triage filter never approves (MaxIvanyshen/jev-review: quoted It never approves or rejects anything; p ≥ 0.5 / risk.score ≥ 2 is not a merge grant; non-zero exit is couldn't triage, not diff is clean; distinct NiazMorshed2007/jev-review). Documentation lookup is not execution (NiazMorshed2007/jcr: quoted JCR returns documentation. It does not execute commands.; quoted The included harnesses also stop at explaining the steps needed to carry out a task.; beam 0.6 / width 3 / depth 16; ambiguous / no-match / depth-limit are resolver outcomes, not merge grants; routing ≠ permission; treating capability context as attested approval to run is theater; 80-run 85%/23% not a rh-guard ROC; distinct jev-guard-mcp / jev-router / NiazMorshed2007/jev-review). Optional Hermes smart approvals never silently approve (bojansandhaus/jev-decisions 0.2.1: quoted It never silently approves; quoted The workflow is shadow only; quoted Installation does not select the provider, change approvals.mode). Soft floors / AMBIGUOUS / p<0.5 are not hard gates. Archer is still promised-not-landed. Do not treat Qwen3.8-27B as Archer.

Offline fallback

The lexical layer matches the GLiClass strings on the Hooks page. Fine-tune knowledgator/gliclass-modern-base-v3.0 with eight shots per label from School of Reward Hacks plus your denied tool calls if you need an air-gapped model.

The published ~14M encoder is not a drop-in action-only fallback: full-input AUROC 0.9467 drops to 0.6213 if you strip reasoning at inference.

Open-weight SWE agents can add a DoM probe from arXiv 2609.19101 on CoT activations. That is a second detector, not a replacement for the hook policy.

License

MIT. Copyright (c) 2026 Basit Mustafa / 24601. See LICENSE.