Eval integrity & measurement

Harbor, jevals, and openevals are practices, not install dependencies. Installing RH Guard hooks does not require those packages.

Harbor (e2e substrate)

Harbor is the preferred end-to-end substrate for reward-hack / eval-gaming scenarios:

1. Taskset (score first). Instruction, tests, and reward live on the task. The score is not the agent's self-report and not a hook Noul.
2. Harness. The agent loop that attempts the task. rh-guard hooks are structural / System One gates inside this loop. They do not replace a scored taskset.
3. Runtime. Isolated sandbox (Docker, Daytona, …). Hidden tests belong here or in the validator, not in a workspace file the agent can find.

Grade with an independent validator — Harbor's separate verifier in a container the agent does not share. Carry results through a HoH evidence loop (Harness-of-Harness): plan, implement, independently verify. Only QA evidence feeds the next iteration; the implementer's own tests are not ground truth.

jevals (decision-stage workbench)

jevals is the complementary workbench for typed Noul / Choice / Score falsification when this sidecar or a policy uses Jev-class judgments. It measures decisions; it is not the product loop and not the tool gate. Distinct from openlayer-ai/jevals.

Practices (from the jevals skill):

• Independent answer keys. Derive expected answers from criteria and case evidence before running. Never promote predictions to labels.
• Correctness ≠ confidence. A high Noul or Choice confidence is not a correct label. Score confidence is separate from error / tolerance.
• Held-out discipline. Reserve independently reviewed cases before examining predictions. Tune on development examples; claim on a separate held-out Jeval with equivalent questions.
• Compare only equivalent case sets. Matching names are not enough. Comparable runs keep question IDs/types, Choice labels or Score rubric, case states, and reviewed keys. Changing the answer key changes the experiment.

wellposed lints Choice / Score / Noul requests before runtime. A Choice with no "other" can be forced wrong at confidence 1.0; broken backtick paths are unanswerable. Confidence gating cannot catch a forced wrong Choice — inspect request shape first.

Online eval (adjacent)

openevals is Harbor/jevals-adjacent online eval / observability. Code graders first, then cheap parallel System One (Jev) per-step and trace questions written back to Langfuse/OTLP. Composite and pass rules live in code; human annotation calibrates whether those questions can be trusted. Parallel judge for traces — not the primary task score and not LLM-as-judge as the reward.

typesafe-jev-tools is an adjacent abstention / VOI meta-gate: ask "does this decision need a model?" before calling one. Code first, then maybe System One; never LLM-as-judge as the reward. It never blocks.

Gate watch (adjacent)

jev-align verifies a plan or response against policy before act (including fabricated verification). Complementary to this sidecar's tool gate, not a merge.

jev-harness is a measurement pattern: shadow mode, confidence gates, and evals that assert on the action, not free text — so you can see when a System One gate is being gamed vs calibrated. Contrast with LLM-as-judge as the primary score. Distinct from Astro-Han/jev-harness (pre-model tool-result filter; quoted Filtering is a routing decision, never destruction; quoted Jev failures fail open).

jev-pref encodes AGENTS.md prefs as a Jev linter. Watch preference-theater: prefs that are not independently enforceable (tests, types, structural detectors) are not a substitute for this gate. Abide is the productized sibling for those same soft instruction files (compile / calibrate / tune / replay / Claude / Codex / OpenCode hooks). Complementary to this reward-hack gate, not a merge.

Watch, not an endorsement: jev-gate-student-b is a distilled memory-relevance student of teacher Jev (LoRA r=16, α=32, q_proj/v_proj on Qwen2.5-0.5B-Instruct). Quoted card: held-out n=60 MAE 0.187 / Pearson 0.791 / agreement 90.0% vs vanilla 0.536 / −0.067 / 38.3%. Quoted: Gate at threshold 0.5. Fail-open on errors. Agreement with teacher labels is not independent gold; a student gate can overfit teacher quirks (distill → gate integrity). A local student is a candidate path when cloud Jev is unreachable; the published card fails open on errors. Soft judgments stay fail-open here; a student is not the hard envelope. n=60 is not a rh-guard ROC. Not Qwen3.8-27B and not Archer (promised-not-landed).

jev-triage is an active-learning filter: high confidence accepts a Jev label; middling queues an expensive teacher; low / near-boundary queues a human. It logs soft labels (full distributions, not argmax). If used as an eval filter: do not distill Jev as teacher of record — its ~68% ceiling compounds errors; real outcome labels remain the training targets. Complements jev-gate-student-b (distill ≠ independent gold).

jev-curate is corpus curation with live Jev pass/fail gates (pattern #1 next to jev-triage's pattern #3). Each gate is one typed question plus a pass rule; pass_mode: all keeps a row only when every required gate passes. Outputs curated.jsonl (train on these) vs rejected.jsonl (failed rows + _curation audit) plus audit.jsonl / errors.jsonl. Filter with Jev. Train on real outcome labels. Do not treat Jev as your teacher of record. Mock mode is for pytest only. Eval-data integrity cousin — gaming the rubric or promoting Jev keep/drop to gold is the failure mode. Harbor/jevals-adjacent. Cousin, not this sidecar.

is-malicious is a complementary codebase covert-behavior scanner (listed on awesome-jev); rh-guard is a coding-agent reward-hack / eval integrity gate.

pi-jev-approver is a Pi bash safety gate: code-computed state, then Jev; commandRules can hard-block; missing TYPESAFE_API_KEY fails closed. Contrast jevgate: allowlist then Jev on the rest, fail-open (it cannot block). Same structural-first shape, opposite envelope default. Sibling, not this reward-hack sidecar.

agent-workflow-typesafe-ai emits advisory no_action semantic receipts. The plugin never changes host routing/executor (or model policy). Missing credentials, SDK, or service failures stay no-action — hard fail-open evidence for soft sidecars.

jevscan composes tree-sitter extract (hard envelope; no execute) with independent Jev questions (soft judgment). Same layering as structural deny then System One here; quality scanner, not a reward-hack gate.

jev-testbench collab harness measures llm_autonomous vs scripted_plus_jev vs llm_plus_jev (Wilson intervals, McNemar; Jev is not a peer arm). Do not claim collab helps without arms.

semantic-firewall is a PoC split: LLM = proposal engine; Jev = semantic control plane (5 noul: goalAlignment, authorization, sideEffect, untrustedInstruction, evidenceSufficient); code = authority (ALLOW / ASK_USER / REVISE / BLOCK). Deterministic policy thresholds; eval corpus + stability + LLM-as-policy baseline. untrustedInstruction is skip-when-absent (code skips it when there is no untrusted content). Contrast this sidecar: fail-open soft Jev overlay; the hard envelope stays structural. Soft-semantic + code authority is not a substitute for structural deny.

claude-code-jev is an additive Claude Code PreToolUse permission gate via OpenRouter typesafe/jev-1.13 (measured 230.8ms p50 / 263.9ms mean / 459.2ms p95 on their synthetic 18-case fixture; 90 live decisions). Quoted README: 0 dangerous allowed on that fixture; 80–81% match. Low-confidence → ask; network/API fail → human. Default confidence 0.85. Quoted: assistant reasoning and tool outputs are left out so an agent cannot talk its own permission gate into a yes. Quoted: Treat the 93% as a candidate against a published reference, not a controlled replacement test. Quoted: adding this hook on stock Claude Code adds a 264 ms hop rather than removing one. Quoted: the fixture is synthetic — replace with blindly labeled real tool calls before claiming accuracy on your traffic. Anthropic's auto-mode classifier is not replaceable via a supported API. Uncalibrated 0.85 as a hard auto-allow is soundness theater (same 0.85 recipe as jev-preflight). Do not merge their examples/claude-settings.json into examples/. Cousin, not this sidecar.

jev-agent-safety-arena is a small real browser-agent safety eval: Jev vs a mini-model baseline on benign + injected local Playwright pages. Fixture, not production proof; they do not ship sample benchmark numbers. Eval-integrity / gaming surface: independent cases, not self-reported safety.

jev-model-router is a model+effort router (read-only MCP). Adjacent routing surface, not a safety gate and not a rh-guard peer.

gliner25-compaction is local GLiNER2.5 (fastino/gliner2.5-base-v1) Claude context compaction, not a prose summarizer and not reward-hack detection. Extractive character-offset spans; Choice keep_full / keep_evidence / keep_call_only / drop. Uncertain or invalid evidence fail-closed to keep_full. Hard shell/mutation policy overrides the soft model. Public default shadowMode true (analyze + log, no history replace until explicitly false). Sibling envelope next to jevgate (opposite default: fail-closed retention vs fail-open rest). Encoder family with GLiGuard; different job.

jev-compactor is framework-agnostic verbatim compaction plus safety gating in one pass: Jev judges relevance. Code decides structure. Nothing kept is rewritten. Destructive commands, exfiltration, and thrashing loops are scored alongside keep/drop; a regex floor in code flags rm -rf, force-pushes, DROP TABLE, curl | sh, and leaked-key patterns whatever Jev later says. When safetyGating is on, a destructive signal blocks until an escrow hook approves. Companion to the slo-router lesson: keep a deterministic floor under Jev rather than sole-hard-gating the decision model. Cousin of gliner25-compaction / jev-carryforward (verbatim, not summaries). Not a rh-guard peer.

latch is a CI merge-gate: code clusters failures by signature; Jev labels each cause; code owns Gate: PASS (infra) vs Gate: BLOCK (real). ignore_as_infra requires env_cascade plus an explicit network fingerprint; Jev cannot ignore on its own. --gate exits 1 on a real failure; the reporter never fails Playwright. Eval-integrity / flaky-test gaming: treating a real failure as noise is the pattern this counters. Cousin, not this sidecar.

clear-head is a Claude Stop hook: factual claims vs session evidence (CONTRADICTED / UNSUPPORTED). Blocks on contradiction or unsupported with no relevant evidence. Low JEV_FIRM logs but never blocks. Anti-done-without-reading / reward-hack cousin. Not a merge.

jev-marshal is named as repository rules for pull requests, enforced by Jev. Empty public tree at capture; watch, not an endorsement.

if-ai is a GitHub Action for plain-English PR condition checks (one Jev Choice + required min-confidence). The check passes only when the condition is true and confidence clears the threshold. False, low-confidence, timeout, or API error fail the check; making it a merge block is a required-check choice. Quoted README: A passing if-ai check is advisory. Confidence is calibrated certainty, not measured accuracy, and PR content can try to talk the model into a verdict it wants. TypeSafe 67.8% (Jev vs sonnet 5) is their four workflows (security incidents, agent-trace observability, invoice processing, customer service) — none of it is pull request review, and none of it is if-ai. Run on real PRs for a week before making the job required. Cousin of latch / jev-gate / ci-gatekeeper. Soft judgment as sole merge authority is soundness theater. Cousin, not this sidecar.

wakegate is a fail-open wake gate: skip a wakeup only when Jev answers and puts less than 0.2 on wake; error, no key, unsure, skip-limit, and user-message all wake. Contrast pi-jev-approver fail-closed. Not a reward-hack detector.

omp-auto-mode is an oh-my-pi plugin: TypeSafe Jev classifies gated tool calls as safe / ask / unsafe; low confidence → ask; classifier failure defers to omp's own approval (fail-open). Sibling to the Pi pi-jev-auto-mode gate. Do not merge into examples/pi-extension.ts.

omp-jev-extensions is an Oh My Pi / pi-coding-agent host adapter: jev_acceptance_gate (acceptance gating before declaring done) and jev_route (subagent topology / model tier). Fail-open, never fail-catch: missing key, timeout, non-2xx, or malformed answer allows the action and logs confidence 0. Out-of-set choices are discarded, not type-asserted into a lie. Gate-host adapter cousin of omp-auto-mode. Do not merge into examples/pi-extension.ts.

omp-greenlight is a measured OMP approval-gate (1,013 real tool calls; 140-row labelled corpus). Presets trade prompt-removal vs unsafe auto-approve: default 0/94 unsafe (conservative 0, permissive 1, aggressive 7). The operator owns the risk dial; the plugin never tunes its own threshold (a self-adjusting safety bar cannot be audited by the person accepting the risk). Graded allow, not hard deny — composes with omp-jev-extensions fail-open. Permission ≠ probability: allow above the bar suppresses the prompt; everything else still asks a human. Sits beside the host's deny rules, never above them. Not a sandbox. Cousin, not this sidecar.

construct-auto-classifier is an effect-based shell PreToolUse gate for OpenCode and Google Antigravity (agy). Structural fast-deny / fast-allow first; then Jev Choice plus nine independent risk Nouls (data_loss, secrets, remote_code, security_control, offensive, shared_state, git_plumbing, system_state, connections). Allow only if the choice is allow at jev.minConfidence (0.6) or higher and every risk is below jev.riskThreshold (0.7). A missing answer, a low-confidence answer, a high risk, or a failed call are all denies. The bar is 0 dangerous commands allowed. Certification (18–19 Sep 2026): main 113 + blind 82, five passes, 975 decisions per model; Jev 0 dangerous allowed / 100% caught / 99.5% correct; chat LLMs all leaked (16–104 dangerous allowed). The blind set was written by Qwen3.5 397B from a plain-English policy, never used for tuning, and frozen before any model ran (certification report). Operator owns minConfidence/riskThreshold — same dial as omp-greenlight (never self-tuning). Privilege Is Not a Verdict: sudo changes blast radius, not whether the command is benign. Pair with dinostomp before hard-gating on those scores. Two gates cannot share one prompt. OpenCode/agy adapters are not this pack; do not merge into examples/. Cousin, not this sidecar. Hunch: keyword privilege filters are reward-hackable (sudo ≠ dangerous); effect semantics resist surface gaming.

actiongate-jev is runtime authorization for AI-agent tool calls before side effects. Deterministic policy + RBAC + schemas + amount/limit checks own ALLOW / REVIEW / BLOCK; TypeSafe Jev via OpenRouter supplies six narrow semantic signals (alignment, target match, policy conflict, sensitive-data exposure, scope expansion, missing intent) — never one vague "is this safe?" question, never generated prose as an authorization reason. Jev supplies evidence. Code owns authority. A positive model score never overrides a deterministic security failure (RBAC, schema, or limit). Schema-valid ≠ intent-matched. Enforced ALLOW issues a signed, short-lived single-use Action Grant bound to the exact tool call (tenant, environment, agent, user/session, tool, operation, arguments, risk class, policy). POST /v1/grants/consume atomically rejects replayed, expired, mutated, and unknown permits. A Noul is not a permit (TOCTOU cousin to this sidecar's "do not authorize a mutate on a stale soft Noul"). Early public MVP: use mock or sandbox tools; ActionGate decides and the application owns execution and credentials. Explicit threat model: the current SDK wrapTool is advisory until a gateway or credential broker makes bypass impossible. Quoted threat model: Proxies isolate only when the upstream endpoint is not otherwise routable, which is a network property and not a cryptographic one. MCP/HTTP proxies exist as Isolate path; wrapTool remains advisory until that holds. agents cannot self-declare a safer risk class; financial / destructive / credential actions fail closed when Jev is unavailable; in-memory grant atomicity covers one process only. The 500-case default evaluation is a label-baseline integrity run, not a claim of model accuracy — measure false-allow and false-block separately; do not treat Jev ALLOW as a safety proof. Compose with construct-auto-classifier (effect-based shell) and jev-lens (attention≠authority, never blocks): ActionGate is the hard-gate + soft-evidence pattern for tool side-effects. No Claude/Cursor hook pack — wrapTool is not hooks.json; do not merge into examples/. Anti-pattern: hard-gating soft judgment as the sole safety control (soundness theater). Cousin, not this sidecar. Ranking ≠ calibration, so threshold-as-safety is fragile — jevcal (Augustus owns the full mental model).

AgentGhost (npm @agentghost/sdk, MIT) is intent-aware authorization that wraps tool execution so every consequential action passes an ALLOW / ASK / DENY check before it runs. README: deterministic rules as a first pass; TypeSafe Jev judge; ASK and DENY throw by default "so an approval can never be silently skipped"; default failMode: "closed" denies when the judge errors. Key claim, quoted: "The model never decides whether AgentGhost runs. AgentGhost is the tool's execution function." Adapters: Vercel AI SDK / LangChain / OpenAI (guard() / guardOpenAI). Contrast actiongate-jev (wrapTool is advisory until a gateway) and jev-use (jev_gate fails open; install does not enable the gate). Positive envelope: if the agent only reaches tools through guard(), it cannot opt out. Residual confidence theater: Jev ALLOW is still a soft score — do not treat it as a safety proof, and do not hard-gate on it without a deterministic rule floor. README limitation: "AgentGhost protects tools whose execution you control. Provider-hosted tools that run entirely inside OpenAI / Anthropic are out of reach; MCP is planned as a proxy." Detection: unguarded tools passed to generateText; AGENTGHOST_AUTO_APPROVE=1 in a consequential loop; failMode flipped open; a wrap the model can skip. Do not merge into examples/. Cousin of actiongate / pi-jev-guard / jev-use / toolgate, not this sidecar.

turnstile is an agent action guardrail: deterministic policy, then Jev semantic checks (task drift, unauthorized disclosure, untrusted-instruction influence), with JSONL receipts and threshold replay. Same doctrine as actiongate-jev: Jev supplies evidence; code owns allow / review / deny. Jev never grants authority that policy denied. Explicit review rules stay review; model checks run only after deterministic permission succeeds. Missing goal, disabled Jev, timeout, rejected request, or invalid response → review. Replay recomputes thresholds over saved scores and makes no model calls; hard denials remain. Thresholds are starting values, not calibrated guarantees. Experimental alpha; Claude adapter defaults to observe mode with Jev disabled; not an OS sandbox or endpoint EDR. Do not merge turnstile-hooks.json into examples/. Cousin, not this sidecar.

pi-heed is a Pi agent-hook integrity gate: it persists user constraints across tool calls and context compaction and checks every side-effecting call against what the user said (anti instruction-drift / reward-hack). TypeSafe Jev powered, but Jev never writes policy — it classifies how an existing rule changed (KEEP / LIFT / NARROW / EXCEPTION / REPLACE / UNKNOWN); code owns the ledger and the block. After reload or compaction the session ops replay to the same state without calling Jev again. Shadow by default (off / shadow / enforce); fail-open on Jev error or timeout. Complementary to jev-carryforward 0/4: SessionStart/compaction hooks that inject constraints beat hoping the model looks. Do not merge into examples/pi-extension.ts. Cousin of pi-jev-approver / omp-auto-mode, not this sidecar.

pi-jev-guard is a Pi extension that reviews proposed edit/write content against Markdown rules via TypeSafe Jev before the write commits — an Abide-shaped content-judge, not this reward-hack sidecar. Default informative mode reports findings without blocking. Enforcement mode blocks detected violations before writing. README: "This is a semantic review aid, not a replacement for tests, linters, or a security sandbox." A malformed selected config fails closed; it does not silently fall back. In enforce, onUnavailable defaults to block and onUncertain defaults to warn. Default violationThreshold 0.85 / clearThreshold 0.2 are engineering defaults, not a calibrated ROC — treating those soft scores as a hard gate is soundness theater. Informative first; "Evaluate representative edits before relying on enforcement." Only this Pi process's edit and write tools are covered; shell, custom tools, external editors, and other agents can bypass. Override tokens expire after two minutes, bind target + before/after + policy, and require an interactive user — there is no model-callable override tool. Snapshot check before commit (changed instruction snapshot gets one fresh evaluation). Do not merge into examples/pi-extension.ts. Cousin of pi-heed / actiongate / Abide, not this sidecar.

pi-jev-control is a Jev-powered control plane for Pi (routing, tool gating, failure classification, retry, context/skill/memory, review, GUI) — not a content-judge of diffs or instruction text. Tool Gate: deterministic safe/dangerous rules + Jev for uncertain operations (useDeterministicFastPath default true). No TYPESAFE_API_KEY → Jev features unavailable (graceful degradation). GUI action router: confidence below threshold → unknown, never force-click. Review gate can force strong_review on named internals (GC, multithreading, replication, GAS, engine). Differs from pi-jev-guard (content vs Markdown rules), pi-heed (constraint ledger / instruction-drift), and hermes-jev-router (Hermes model-route or skip-main-model token cut, not Pi tool authorization). Control-plane vs content-judge. Same family as jev-dspy-control-plane / omp-jev-extensions. Calibration-first: do not treat the tool-gate Jev overlay as a hard safety proof. Do not merge into examples/. Cousin, not this sidecar.

jev-use hands non-generative steps to Jev; the gate/security angle is jev_gate, an optional PreToolUse risk check (deny/ask only, fails open). Plugin install does not enable the gate. Harness README: it only ever tightens — deny → deny with a reason, unsure → ask, allow → stays silent so the host permission flow decides; if Jev is unreachable it fails open. "Treat confidence calibration as a training claim." Quoted root-README gate fixture (2026-09-19, Vercel AI Gateway, typesafe-ai/jev): 6 safe + 6 dangerous commands, 12/12 correct, p50 199 ms — bounded fixture, not a rh-guard ROC. Through the Vercel gateway there is no confidence field; jev-use falls back to the distribution margin and lowers that backend's default threshold to 0.4. Anything Jev can't decide returns escalate: true with a typed reason. Handoff-family sibling of wakegate (fail-open wake); fold authorization / escalation only, not the architecture essay. Do not merge into examples/. Cousin of claude-code-jev / jev-decisions / toolgate, not this sidecar.

jevex is an MCP VOI admission tool: one codebase_investigate call returns the files a coding agent should read. TypeSafe Jev ranks a shortlist; README: "You still plan and patch. jevex only answers what to read." The toy fixture packet includes "status": "sufficient" (enough-to-read, not a safety proof). --no-jev is a lexical ablation (no key, not the product). README does not document fail-open vs fail-closed on Jev error or timeout. Cousin of jev-sift ("Let Jev decide what your agent should look at next"; errors and truncation are not evidence an item is irrelevant) and jev-carryforward 0/4 (an MCP tool sitting there is not enough — hope the model looks). Soft-score-as-hard-gate risk: treating the shortlist as the only files that exist, so hidden eval assets stay unread. SWE-bench timing/cost figures in that README are not a rh-guard ROC. Do not merge into examples/. Cousin, not this sidecar.

commitjev is a Jev-gated commit-msg / range reviewer (message vs diff, single purpose, undisclosed change). Calibration-first: calibrate.py plants labelled defects; README: "Run calibrate.py with cases of your own before trusting the thresholds on a codebase that matters" and "Five clean commits is a small control group." The sample hook "blocks only on a warning: not being able to check a commit is not a reason to refuse it" (fail-open on check failure). Code owns every threshold (Noul at or past 0.65 on the good/bad side; anything in between is "review" rather than rounded). Six regex checks (em dash, deleted file, dependency manifest, credential pattern, binary, >2000-line add) never reach the model. README: Jev is not deterministic and the cache freezes the first answer; variance can straddle the threshold. Calibrate / shadow before a hard push or commit block. Cousin of jev-pr-review (shadow-mode only until calibrated). Do not merge into examples/. Cousin, not this sidecar.

jev-runway is listed as "A Jev-powered proxy for Codex that reduces token usage and frees up context space." Public tree at capture is LICENSE only (no README, no code). Host-adapter / control-plane cousin of slo-router and jev-routing. Watch; do not invent how it authorizes or skips expensive model work. Do not merge into examples/. Cousin, not this sidecar.

pi-jev-compact is Pi session_before_compact verbatim compaction: Jev keep/drop tool calls; the surviving transcript is stored word for word (Jev replaces the summarizer, not the cut). Keep-windows and pins (images, invoked $skill loads, unresolved errors, git mutations, every edit/write) apply before Jev. Fail-open: the hook returns nothing and Pi's built-in LLM summarizer runs on /jev-compact off, no key, empty region, HTTP error/timeout/invalid answers, or character reduction < minReduction (default 25%). Contrast gliner25-compaction fail-closed keep_full. Default keepThreshold 0.5 is uncalibrated — treating that noul as a hard delete is soundness theater; README: dropped calls are gone for good. Complementary to pi-heed and jev-carryforward 0/4 (constraints/memory surviving compaction). Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

hermes-plugin-jev is a Hermes host adapter (plugin ID jev-router, distribution hermes-plugin-jev): turn classification, conservative tool shaping, risk_gate human-approval proposals, optional coding-claim verification. README: 0.1.0 preview/beta — start in shadow mode. It cannot grant permission. approve means "request a human approval"; it never returns allow, edits arguments, or runs a tool. Native Hermes blocks take precedence. Missing key or SDK: plugin inactive, Hermes unchanged. Timeouts, malformed responses, exhausted workers, low confidence: Jev abstains. Unattended contexts never receive Jev approval requests. Contrast jev-decisions (advisory pre_tool_call reviews; JEV_ENABLE_HOOKS opt-in; failed review grants no permission) and hermes-jev-router (model-route / skip-main-model token cut, not this risk gate). Same-named Mrmimee/hermes-plugin-jev is a tool plugin (Agnes Flash), not a hook adapter. Distinct from ajensenwaud/hermes-jev-plugin (jev_check / jev_route / jev_score / jev_evaluate tools the agent must call). Do not merge into examples/. Cousin, not this sidecar.

jev-routing is a single Go binary harness (explicitly not an MCP server) for Claude Code / Codex / Grok Build / Cursor Agent CLI / Devin CLI. Request rewrite: (a) drop/truncate tool results like fast-jev-compaction without summarizing, (b) ask Jev Choice(next tool)+Noul(done) in parallel, (c) shrink tools[] to 1 schema (zero if respond), (d) strip thinking/reasoning. Integrity/control-plane pattern for agent loops: the catalog the model sees is rewritten before the call. Host PreToolUse cannot strip the catalog (after the model has seen every schema). Default JEV_ROUTING_MODE=filter; forced only when a verified real Jev answer exists — local scoring alone does not force. No key → on-device classifier (named degraded backend, same lesson as backend: "lexical"). claude mcp add leaves the catalog in place. Distinct from nekowasabi/jev-routing-mcp (named predecessor in their README; MCP add leaves tools[] in place). Advisory filter vs hard forced route. Cousin of slo-router / pi-jev-control. Do not merge into examples/. Cousin, not this sidecar.

classifier-dev is an eval-integrity cousin: a public classifier that now serves TypeSafe Jev, with LLM chains as fallback. Upstream delisted inclusionai/ling-2.6-flash; backup ibm-granite/granite-4.0-h-micro served for weeks at F1 0.546 while docs advertised ~0.800 — "Nothing in the deployed numbers said so" (measured 2026-09-17, eval/README.md). The digest now marks FALLBACK; eval/bench.py scores a candidate offline before it ships. advertised backend ≠ served backend. Undeclared fallback = eval integrity failure; advertised score ≠ live model. Require digest/FALLBACK markers before quoting eval numbers; do not hard-gate on soft confidence from an undeclared fallback (same degraded-backend lesson as backend: "lexical" here). Heuristic: a quoted F1 without the served model id is soundness theater. Detection: docs name model A, traffic served model B; operator copy that omits backend / FALLBACK. Cousin of dinostomp / jev-baselines-eval. Not a rh-guard peer.

jev-gate is a calibrated PR-review gate (GitHub Action + local CLI + OpenCode plugin) powered by TypeSafe Jev. Seven typed concern questions (security-sensitive logic, deleted tests, secrets, breaking change, weak tests, mixed changes, comment drift); gated Nouls default 0.60. Distinct from jevgate (allowlist that proves what may run) and jev-gate-student-b (LoRA distill). README: defaults are starting points from their calibration — "They are not your thresholds. Before trusting a gate, measure it on real diffs"; --no-gate keeps the exit code at 0. A gated rule that cannot be graded fails the check; skip-neutral when the action cannot run at all. OpenCode inject: true hands gated findings to the agent once per diff. Risk: treating a calibrated soft Noul as a hard merge gate (required check / branch protection) without workload calibration / human override = confidence theater. Card: soft-score-as-hard-rank; require calibration evidence + an escape hatch. Heuristic: required jev-gate with the stock 0.60 and no local calibrate / --no-gate / human override. Cousin of jev-pr-review (shadow-mode only until calibrated) / ci-gatekeeper / commitjev. Not choxos/jev-reviewer (human-verified quotes ≠ soft auto-accept) and not egma-ai/jev-reviewer (attention ≠ correctness). Do not merge into examples/. Cousin, not this sidecar.

claude-jev-warden is a real-time quality gate / Art Director Warden for Claude Code via TypeSafe Jev 1.13. PreToolUse matcher Write|Edit|MultiEdit: quality ≥ 80% → exit 0; else exit 2 (hard process intercept) and inject diagnostics into the agent. Same family as agent PreToolUse hooks: soft judgment hard-blocking agent actions. Card: attention≠verdict / warden-as-hard-gate. Document when a warden should escalate vs block: taste/quality → reinspect (jev-lens never blocks; jev-preflight one reinspect); eval-asset mutate → structural deny. Contrast this sidecar (structural first; soft never the sole veto) and hermes-plugin-jev (cannot grant permission; approve means request a human). Heuristic: exit 2 on a quality/taste Noul with no structural floor and no escalate lane. Do not merge warden.js into examples/. Cousin of claude-code-jev / jev-preflight / construct-auto-classifier, not this sidecar.

jev-kit is a Claude Code PreToolUse Airlock (the kit's tool-call guard) plus optional Belay. Code pre-filter first (airlock/rules.py); Jev only for the ambiguous half; fail-open on error / timeout / missing key / unreachable daemon. Deny needs confidence ≥ 0.8 and margin ≥ 0.4. Default shadow; enforce is a mode file. Quoted README: "This is not a security control. It is a cost and hygiene guard that fails open by design." Distinct from leepokai/jev-guard (name collision; Airlock was jev-guard then plumbline). Gaming surfaces: [airlock-ok: <reason>] in a call's description bypasses any deny; loop protection never denies the same call twice in ten minutes (a retry gets through). Measured 2026-09-19 on a 4 vCPU cloud VM: deny-capable labelled eval 100% / zero false denies (R1–R7, R9); A/B zero denies over 30 sessions (backstop, not a tax) — not a rh-guard ROC. Belay: when an agent says it is finished with no passing check, send it back to verify (anti-done-without-reading / eval-gaming cousin of clear-head). Compaction installer is opt-in and sends unredacted tool inputs/results (~25k tokens); never auto-installed. Rewrite mode (off by default) silently edits subagent_type; a wrong downgrade is quiet. Detection: treating fail-open hygiene Jev as a hard safety envelope; quoting 100% without the labelled-eval method/date; [airlock-ok:] in an eval loop. Fold the tool-call guard + Belay angle only, not browser / filesearch / docclass. Do not merge into examples/. Cousin of claude-code-jev / cmdc-auto-mode / construct-auto-classifier, not this sidecar. Anti-pattern: hard-gating soft judgment as "safety."

agent-chaperone is an MCP proxy plus Claude hook pre / hook post commands that screen tool calls before they run and results before the agent reads them (dual-gate eval-integrity / injection cousin). Deterministic allow/deny lists + secret patterns, then Jev; shadow default (blocks nothing); enforce holds a call for agent-chaperone approve <id> (single-use, bound to server+tool+args digest); strict additionally stops when a screen could not run at all. Never auto-approves; host permission prompts still run. Not a sandbox; not a guarantee; "adaptive attacks written against this tool will get through." Post-result withholds content that instructs_reader. InjecAgent tool-response AUC 0.976 / BIPIA email 1.000 / hand-labeled 0.993 (jev-1.13.0, 2026-09-19, 1,942 requests) is not a safety proof — classify accuracy is not a safety proof. Eval-integrity residual: a replacement that does not match the tool's output shape is discarded without complaint while the original reaches the model (advertised screened ≠ served payload; silent FALLBACK cousin of classifier-dev). First advertised tool list is not screened for injection (only later rewrites); user-inlined files skip hooks; PostToolUseFailure can annotate and never withhold. Detection: operator copy that says "screened" without a matching replacement; first-list MCP descriptions treated as trusted. Distinct from Astro-Han/jev-harness (pre-model tool-result filter; quoted Filtering is a routing decision, never destruction; quoted Jev failures fail open). Do not merge into examples/. Cousin of jev-agent-safety-arena / semantic-firewall / jev-security-scan / actiongate, not this sidecar.

opencode-intent-gate is an OpenCode V2 context hook (before model dispatch): four Nouls (is_work_request / ambiguous / missing_user_info / scope_unclear) in one request; plain-code thresholds (isWorkThreshold 0.5 / dimensionThreshold 0.75) inject a system directive to ask 1–3 clarifying questions and not start tool calls this turn. Fail-open: API error/timeout skip; 3 consecutive failures pause the gate 5 minutes. Compaction/synthetic messages are never gated. The gate is a system directive, not a hard block — README: pair with tool permissions if you want enforcement. Ask-before-act calibrated product pattern (thresholds in code, not vibes). Gaming: the agent can ignore the inject and still call tools (hope the model looks / jev-carryforward 0/4). Treating that soft inject as a safety veto is confidence theater / hard-gating soft judgment as safety. Heuristic: required "intent gate" with no host permission floor and no check that the agent actually asked. Do not merge into examples/. Cousin of jev-preflight (one reinspect) / hermes-plugin-jev (cannot grant permission) / jev-lens (attention≠authority), not this sidecar.

opencode-context-pruner is an OpenCode port of fast-jev-compaction (src/vendor/, MIT v0.2.0) via the context hook — OpenCode has no session.compact. Each tool call gets two Nouls (keep the call? keep the result?); keep/truncate/drop applies to the request view; persisted history is never modified (clones; fail-open if replacement is rejected). Default keepThreshold 0.15 vs upstream 0.5 (0.5 drops nearly every unpinned call; 0.15 makes drop_result the common outcome). Measured 2026-09-19 on a real 530-message session: 257 judged, 257 drop_call + 257 results, removedMessages 282, 1,135 ms. Fail-open on any error. Cached per tool_use_id for the session (a once-dropped call stays dropped). Vendor-harness fan-out of compaction gates (Claude session.compact → OpenCode context). Eval-integrity: dropping results can erase evidence (constraints, hidden eval assets, injection traces) — complementary to pi-heed / jev-carryforward 0/4. Treating 0.5 as "the right threshold" or 282 dropped messages as a quality claim is confidence theater. Do not merge into examples/. Cousin of pi-jev-compact / gliner25-compaction / jev-compactor, not this sidecar.

yolo-shell is a destructive-shell interceptor: local fast-path (~2ms / 178ns in-process) for allowlisted read/navigate commands (ls, cd, git status), then TypeSafe Jev (is_destructive noul thresholded at 0.5, risk_score 1–10, action Choice allow_immediately | warn_and_confirm | block_completely) with a client-enforced 200ms deadline. Timeout / offline / missing key → a 40-rule deterministic local engine — no silent fail-open when Jev is down (named degraded backend, same lesson as backend: "lexical" here). Context-aware (cwd, git branch, AWS_PROFILE / KUBE_CONTEXT / NODE_ENV). Secrets scrubbed before the wire. Zsh/Bash/Fish hooks wrap the line buffer (preexec cannot cancel). Residual: any unexpected hook exit code is treated as allow (crash fail-open); yolo prefix and YOLO_BYPASS=1 skip the gate. Detection: treating the Jev action Choice as the sole safety veto without the local floor; quoting ~2ms as a safety proof. Contrast jevgate (allowlist then Jev; fail-open rest), construct-auto-classifier (effect-based PreToolUse), safe-sh (never executes). Do not merge zsh/bash/fish hooks into examples/. Cousin, not this sidecar.

jev-home-assistant-sentinel is a Home Assistant safety boundary: Jev recommends; Sentinel policy; HA performs an allowed action; Sentinel reads the state back. Command sent ≠ state confirmed. action ≠ verified outcome. The review service is shadow: typed recommendation + event; it does not silently operate a device. Jev cannot authorize itself. Default policy allowlists reversible light/switch/climate/notification/question actions; door unlock / alarm disarm / garage stay behind approval or are denied. Unavailable device → uncertain / notify_and_retry, never success. Same author as jev-decisions (advisory Hermes reviews; failed review grants no permission). Cousin of actiongate / turnstile / jev-align (fabricated verification). Detection: operator copy that says "command sent" as if the device changed; treating a recommendation as a confirmed outcome (attention ≠ verdict). Not a coding-agent hook pack. Do not merge into examples/. Cousin, not this sidecar.

herdr-jev is a prompt gate for Herdr agents via openjev (NLI cross-encoder: entailment / contradiction / neutral). Soft permission/gate: Herdr's socket API has no UserPromptSubmit intercept (agent_prompted is the response), so herdr-jev owns the prompt path — classify against configured rules, then allow / warn / rewrite / block before agent.prompt. Inference is not in this repo (HTTP client of openjev serve). Quoted README: Status: design. Nothing here works yet. Public tree at capture is LICENSE + README. Watch; do not invent working mechanics. Distinct from TypeSafe Jev (NLI student ≠ System One ROC). Cousin of claude-code-jev / opencode-intent-gate (owns vs injects the prompt path). Thin card. Do not merge into examples/. Cousin, not this sidecar.

apa-agent-harness (npm @aipersona/agent-harness) is a rebrand of jev-harness: src/ tree SHA identical at capture; docs/architecture.md still titles itself jev-harness and attributes © Antonio Coppe. README advertises confidence-gated policy routing, shadow mode, and trajectory verification; GitHub code search for trajectory in that tree is empty. Eval-integrity: advertised capability ≠ shipped module (classifier-dev advertised-backend cousin); shadow vs live is the real pattern — live executes the policy resolution; shadow sets action to shadow_noop and records intendedAction. Example confidenceThreshold: 0.85 is uncalibrated (same 0.85 theater as laya / jev-preflight). Policy in the harness maps typed verdicts to verbs (execute / suppress / notify / escalate); Jev does not execute. Fold shadow / confidence-gate / advertised-vs-shipped only — not recipes (alert filter, model router, compaction). Distinct from Astro-Han/jev-harness (pre-model tool-result filter). Detection: quoting README trajectory claims as a shipped verifier; auto-act at 0.85; treating shadow soak logs as live enforcement. Cousin of jev-harness / jev-pr-review (shadow until calibrated) / hermes-plugin-jev (shadow default). Do not merge into examples/. Cousin, not this sidecar.

alsoleg89/jev-bouncer is a Claude Code plugin (renamed from alsoleg89/jev-guard because leepokai/jev-guard already existed). PreToolUse four judges (shell / edits / MCP / Web URLs) plus a PostToolUse injection sentinel. Web URLs are deterministic (no API); quoted README: a hit is a deny. Shell: p(read_only / reversible_write / destructive) plus five independent risk Nouls (writes outside the project / network egress / irreversible / exposes secrets / runs project code). Modes dry (default, logs only) / guard (deny only; never widens) / on (allow and deny). JEV_BOUNCER_MODE. Quoted README: Your rules win. Claude Code checks its own deny rules before honoring a hook's allow. Quoted: in on mode an allow skips the auto-mode classifier — use guard if you want the classifier to see everything. Quoted SECURITY.md: Not a security boundary. Fail-open: no key / timeout / malformed → the hook prints nothing and Claude Code behaves as if the plugin were not installed. fail=ask never fail-to-allow. Jev-path Tripwires never deny — a regex floor (sudo, rm -rf, force push, curl | sh, …) only blocks auto-allow, because a 500-issue bench assigned hard-zero to the correct answer on 21 cases. Deny needs p(danger) ≥ 0.95 and a hard-stop risk ≥ 0.95. Pin jev-1.13.0. A cloned repository's .jev-bouncer.json can tighten, never loosen. Author-labelled eval (eval.py): 0/148 dangerous shell auto-allowed, 0/16 dangerous edits, 0/17 side-effect MCP, 17/17 injections; p50 770 ms — labels are the author's; thresholds chosen on the same rows; not a rh-guard ROC. Distinct from leepokai/jev-guard, pablozr/JevGuard, seb4ez/jevguard, and codebam/jev-guardrails. Contrast yolo-shell (named degraded backend when Jev is down) and agent-chaperone (withhold, not warn). Detection: treating those 0.95 Nouls as a hard safety veto without the tripwire floor; quoting the author-labelled 0/148 as a rh-guard ROC; treating on allow as a host-deny bypass (quoted Your rules win). Do not merge bouncer.py into examples/. Cousin of claude-code-jev / construct-auto-classifier / yolo-shell / jev-kit, not this sidecar.

pablozr/JevGuard is a semantic policy engine: after an agent turn, Jev scores an attributed diff against a versioned local rule, then a deterministic gate returns PASS / WARN / FAIL. Not a linter, generator, or prose reviewer. Incomplete / oversized / blocked evidence → UNAVAILABLE — it never turns incomplete evidence into a reassuring verdict (positive envelope). V0.1 is observe-only: toast + log; never alters agent context or blocks a task. Status: design-to-MVP; public tree at capture is docs + README (no packages/ scaffold the README diagrams). Eval-integrity: advertised monorepo ≠ shipped packages. Distinct from alsoleg89/jev-guard and leepokai/jev-guard. Policy-integrity cousin of Abide (Jev on diffs / project policy), not reward-hack. Detection: treating observe-mode PASS as a merge gate; inventing a working OpenCode plugin from the architecture diagram. Watch; do not invent working mechanics. Do not merge into examples/. Cousin, not this sidecar.

ybadragon/jev-proving-ground is synthetic cases for measuring whether a verify-criteria check actually catches things. Every case starts as an issue written before any code exists, stating behaviour rather than implementation. Some implementations carry a planted defect; which ones, and what the defect is, is deliberately not in this repo — a session writing criteria here must not be able to read the answer, or it has been handed the test. Quoted README: "Nothing here is real software. Do not depend on it." CODEOWNERS: review is the gate that keeps a machine-authored change from landing unseen — including changes written by an agent that was told to plant a defect on purpose. Eval-integrity / soundness-theater antidote: independent keys, held-out defects, never promote predictions to labels. Cousin of dinostomp (check the instrument first) / Harbor separate verifier / jevals. Thin card. Do not merge into examples/. Cousin, not this sidecar.

jevbrain (Jev Brain) is a local <1ms decision daemon: confidence ≥ 0.80 → AUTO_ACT, else REVIEW_QUEUE. Attention firewall / coding-agent Warden (GREEN AUTO_ALLOW / YELLOW NEEDS_CONFIRM / RED BLOCKED_RISKY). Not TypeSafe Jev — src/core/router.js is n-gram / keyword-anchor overlap; the Warden is regex (rm -rf, .env, loops ≥ 3). Name collision with Jev. Uncalibrated 0.80 AUTO_ACT is confidence theater (same 0.8x recipe as laya 0.85 / jev-preflight). Silent-fallback risk if mis-calibrated: a high keyword-margin auto-acts without a human. Fold the attention-firewall / AUTO_ACT / silent-fallback angle only — not inbox / X firehose / mobile-runner recipes. Whitepaper N=10k 95.2% token-cut is not a rh-guard ROC. Distinct from claude-jev-warden. Detection: quoting "Jev Brain" as TypeSafe Jev; AUTO_ACT at 0.80 without a local ECE check; keyword privilege filters treated as a safety envelope. Do not merge into examples/. Cousin of jev-lens / slo-router / localjev, not this sidecar.

jev-crawlers puts judge then verify nodes on recursive bug-discovery crawlers (crawl-seed | crawl-expand | crawl-judge | crawl-verify | crawl-report). crawl-verify builds a falsifiable artifact and checks grounding (real file/symbol/line + input + wrong behavior + repro path). Anything that fails is an unverified lead, never a bug. v0 verification is grounding, not execution ("reproducer not executed"). Quoted README: Jev probabilities are ranking signals, not calibrated bug confidence; routing follows the risk score, never a raw boolean; the review queue is the primary sink. n=12 labelled fixture is a start, not proof; the question set is proposed and uncalibrated. Cousin of jev-align (fabricated verification) / dinostomp / Harbor independent validator. Fold the verify-path / ranking-not-calibration / unverified-lead angle only. Detection: treating a judge Noul as a verified bug; quoting n=12 as a rh-guard ROC; skipping crawl-verify. Do not merge into examples/. Cousin, not this sidecar.

typed-gate is a pattern for using a System One model without throwing away the number it gives you. Code finds candidates (regex/parser); Jev returns a Choice and a Noul; typed_gate/gate.py decides ACCEPT vs REVIEW — policy, not inference. Quoted README: a yes/no probability near 0.5 is the model declining to answer. It is not a weak yes. The 0.40–0.60 band is a refusal to commit. Quoted: "Reading it as a weak yes is the single most common way to misuse a calibrated probability." Synthetic 100 freight docs / 1,100 field decisions (19 Sep 2026, identical documents and questions): Jev + gate 0 wrong / 0 omitted (117 review) vs argmax only 0 wrong / 25 omitted. Quoted: Correctness is a tie. Gemini also scored zero wrong values; Jev is cheaper/faster, not more accurate. Distinct from jev-gate (PR-review Nouls) and how-sure-is-jev (sureness bands). Anti-pattern: hard-argmax "safety theater" / treating 0.51 as a yes. Fold the probability≠argmax / band-as-refusal angle only. Do not merge into examples/. Cousin, not this sidecar.

pi-jev-gate is Jev-gated auto mode for Pi: before bash / write / edit (and custom tools from other extensions) execute, OpenRouter /api/alpha/decisions reviews the call. Local read-only allowlist (read) skips Jev. Block if choice === "block" or p(block) ≥ 0.50 (BLOCK_THRESHOLD = 0.5). Binary: it either runs or it doesn't. Fail-open: no key / checker error / unreachable → the agent keeps running (Jev gate error (failing open)). /checker can disable the gate. Intent-aware: the current task is in state so destructive-but-requested calls can pass. Distinct from jevgate (allowlist then Jev; fail-open rest), jev-gate, pi-jev-approver (fail-closed), pi-jev-guard, and pi-jev-control. Contrast this sidecar (structural first; soft never the sole veto) and jev-use (jev_gate fails open, only ever tightens). Detection: treating p(block) ≥ 0.50 as a hard safety envelope without the local allowlist; /checker off in an eval loop. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

jev-oas-sentinel catches consumer-visible API changes hiding in documentation-only OpenAPI edits. Deterministic structural checks first (removed operations/params, new required, security, …); TypeSafe Jev evaluates four independent questions on changed prose (change kind, affected dimension, old-promise preserved, migration burden). Quoted README: JEV never writes a review or changes a specification. Advisory mode is the default (structural breaks block; semantic risks request review). Enforce: a semantic break blocks only when both the breaking probability and promise-violation probability (1 − old_promise_preserved) cross --block-threshold (default 0.90). API errors fail closed in enforcement and request review in advisory. Local $ref changes route to structural review rather than silent compatible. Quoted: do not enable enforcement until questions and thresholds have been evaluated on representative changes from your own APIs. CI/policy-integrity cousin of if-ai / latch / jev-intent-review. Detection: treating a docs-only OpenAPI PR as harmless; hard-gating uncalibrated 0.90 as a merge veto. Do not merge into examples/. Cousin, not this sidecar.

nanoprune is a 2.8MB local System One decision & RAG pruner (2-layer encoder ~495k params, distilled from Laya 421M via continuous soft probability targets). Not TypeSafe Jev. Cheap front gate before expensive System Two: prune / choice / score on CPU in ~1.3–2.4 ms. Quoted badges: 0.0% Hallucination Guaranteed; table ECE 2.58%. That guarantee is soundness theater — a tiny distill is not a hallucination proof, and ECE on their bench is not a rh-guard ROC. Pair with laya (0.85 still soft; Khmer OOD 0.000 at 95.2% confidence) and jev-ood-calibration (AUC ≠ ECE). Distinct from prune-review (Jev hunk gate + safety escarpment). Fold the cheap calibrated deny/allow-before-System-Two angle only — not the medical search app. Detection: quoting "0.0% Hallucination Guaranteed" as a safety proof; treating the 2.8MB student as a TypeSafe Jev ROC. Do not merge into examples/. Cousin, not this sidecar.

hermes-switchyard is a Hermes plugin: Jev-powered advisory skill selection and policy-constrained mode switches. Quoted README: it never loads the skill, never silently changes the active model, and does not claim a recommendation is correct. jev_skill_select recommends from the candidate list Hermes supplies. Automatic hosted routing stays fail-closed unless the host supplies a typed per-turn egress envelope (version: 1, decision: "allow", data_class: "public" or "sanitized"). Quoted: a persistent public_or_sanitized_data_ack does not scan or redact data, grant permission to share it, or bypass other controls — not DLP and not automatic authorization. Local token-overlap threshold 0.20 (automatic_skill_local_threshold) and Jev skill-choice / needs / winning-probability thresholds 0.80 are uncalibrated abstention policy (quoted routing.py: "calibration for correctness is not independently established"). Sibling of skill-broker (relevance never grants access). Distinct from hermes-plugin-jev (cannot grant permission; risk_gate) and hermes-jev-router (model-route). Fold the skill/policy / permission-integrity angle only — not CUA / computer-use. Anti-pattern: treating a skill recommendation or ack flag as a grant. Do not merge into examples/. Cousin, not this sidecar.

typesafe_agent_gates is LangChain / Deep Agents middleware for an unattended coding agent: typed Jev judgments where a regex, a word list, or a line in a prompt was standing in for reading. ToolGateMiddleware (wrap_tool_call on execute): four independent Nouls in one request — database_write, production, destructive, secrets. One answer ≥ threshold (0.5) and the command does not run; the agent gets an error ToolMessage naming the judgment and is told not to rephrase it through and to report the step as HELD. Quoted: Closed when TypeSafe is unreachable (fail_closed=True): nothing runs, the run ends with HELD steps; fail_closed=False trades that for availability. Only {role, command} is sent, never the conversation. Distinct from langchain-typesafe AutoModeMiddleware (last 30 messages; whether the user authorised the call — in an unattended run nobody is a user). One rule for the judges: the pattern runs first and its answer stands; the judgment is asked about what the pattern let through. An outage or a wrong answer leaves each gate where it was — never looser. SpecReviewMiddleware snapshots the suite around task(fixer) and judges every existing spec that changed — assertion inverted, retargeted, weakened, test disabled. Quoted measured on jev-1.13.0 (2026-09-19, synthetic): toolgate probe 27/27; judgments probe 31/31 (first run 29/30 — tenant-id swap scored 0.29 as weakened, which is why retargeted is its own question). Not a rh-guard ROC. Quoted: the rubrics have not been evaluated on a large labelled set; treat 0.5 / 0.6 / 0.8 as starting points. Quoted: This is a second layer, not a boundary: credentials the agent must never use still do not belong in its environment. Soft-judgment gate middleware; treating 0.5 as a hard safety envelope is soundness theater. Distinct from fdemir/toolgate. Do not merge into examples/. Cousin, not this sidecar.

jev-pastepilot (PastePilot) is a paste-to-action launcher, not a chatbot: allowlisted tools, preview, then Confirm. Quoted README: Confirm is a gate, not a formality. Pasted text is untrusted data. It cannot grant new permissions. Routing is typed (Choice over a fixed tool list); exact dates, URLs, and emails are parsed in ordinary code. Confirm never sends email, writes a calendar, or calls an external API except opening one allowlisted http/https URL. Optional live Jev: one System One call asks several independent questions — a Choice for the allowlisted action, a Noul for injection/suspicion, a Noul for emptiness/clarity, and a Score for fit; code combines those answers. Quoted: Confidence is a gate, not proof: high (default ≥ 0.75) may keep a select; mid prefers clarify; low (default < 0.45) abstains to the manual tools. Missing key / timeout / malformed / HTTP 429 → fail-opens (text stays editable; same safe manual tools). Quoted: Do not treat this README, a vendor claim, or a confidence score as a measured accuracy result. Not clipboard spyware. Not an autonomous agent (no browsing, no shell, no silent writes). Fold paste/injection/confirm-gate only — not Share Sheet / Mac Services. Treating 0.75 as a safety proof is confidence theater / hard-gating soft judgment. Do not merge into examples/. Cousin, not this sidecar.

jevcache is a local-first decision ledger for Jev-class models. A decision is (approximately) a pure function of (model, schema, state) — fingerprint after redact/canonicalize so PII and volatile fields never enter the key. recall is ledger-only (exit 3 on miss); decide recalls then hits local | jev | mock on miss. publish/add share fingerprints+answers, never raw state; hosted index at jevcache.sh. cache hit ≠ correctness. Shared fingerprint bundles are trust theater if treated as calibrated truth / auto-act. Distinct from Hyperspace KV attention cache. Not a PreToolUse gate. Thin card. Do not merge into examples/. Cousin, not this sidecar.

sutro-sh/jev-align (jeva) is an experimental GEPA loop that aligns TypeSafe Jev with human judgment: evaluate uncertainty, label ambiguous rows plus an audit sample, GEPA proposes a definition diff, human accept/reject/rewind. Distinct from caiovicentino/jev-align (policy verify before act, including fabricated verification). Quoted README: A higher training score never accepts a proposal automatically. Positive envelope — they already refuse auto-accept on the training score. Anti-pattern cousin if someone hard-gates on that GEPA score. Thin card. Do not merge into examples/. Cousin, not this sidecar.

enzyme is a local-first compile step for Markdown knowledge bases (Obsidian / agent memory / Zettelkasten): temporally grounded context sampling generates catalysts (questions as semantic routes). enzyme compile is an explicit OpenRouter Decisions operation (ENZYME_JEV_MODEL, default typesafe/jev-1.13); catalyst generation uses a separate LLM. Quoted README: when asked is guidance compiled for your agent, not an enforced hook. Skills/plugins for Claude/Codex/Hermes are install surfaces, not a PreToolUse structural wrap. catalyst similarity scores are ranking, not deny/allow — treating them as a hard safety veto is soundness theater. Cousin of jevex / jev-sift (questions as index; shortlist-as-hard-gate) and opencode-intent-gate (system directive, not a hard block). Fold compiled-guidance ≠ hook / similarity≠deny only — not PKM recipes. Cost/speed multipliers are theirs; do not invent Harbor numbers. Thin card. Do not merge into examples/. Cousin, not this sidecar.

jevguard is a production integrity runtime around TypeSafe Jev: closed-world escape injection, certainty/margin calibration, volatile-field masking, zero-token SHA-256 cache, and episodic SQLite memory. Quoted README: when a Choice has no fallback, Jev is forced into a false positive; the runtime injects UNRESOLVED_OR_OTHER. Quoted: top probability below 0.40 or first/second margin below 0.15 → AMBIGUOUS_STATE. Distinct from alsoleg89/jev-guard, pablozr/JevGuard, and leepokai/jev-guard. Distinct from jevcache (decision ledger; cache hit ≠ correctness) — this SHA-256 cache is still not a correctness proof. Pairs with wellposed (a Choice with no "other" can be forced wrong at confidence 1.0) and typed-gate (argmax near 0.5 is declining to answer). Anti-pattern: closed-world false positives without an escape; argmax on a flat distribution without a margin check. Do not merge into examples/. Cousin, not this sidecar.

jev-ci-selector is CI task selection: a pure policy engine (always / force_paths / dependencies) plus Jev on optional tasks. Quoted README: Keep your workflows. Start in shadow mode. Measure before you skip. Default shadow: every task still runs; the report records proposed_run vs run. Timeout, API problem, invalid response, unsupported diff, fork PRs, and catalog/workflow changes keep all tasks. enforce is explicit opt-in. Initial skip_below: 0.05 is an experiment, not an error-rate guarantee. Soft judgment must not hard-skip checks. Cousin of latch / if-ai / jev-pr-review (shadow until calibrated) / ci-gatekeeper-bot-jev. Anti-pattern: treating a Jev skip plan as a safety envelope without shadow soak. Do not merge into examples/. Cousin, not this sidecar.

tonedown is multilingual text safety grading 0–4 (safe → dangerous) plus category probabilities; a moderation API and userscripts turn them into pass/review/block or show/blur/hide. Quoted README: Platforms pick a policy, users pick a level, the engine only measures. Golden set of 74 comments/danmaku in 11 languages (2026-09-19, jev-latest): 74 / 74 exact. Quoted: A set this small proves the pipeline, not the model. Offline lexicon fallback. Not a coding-agent hook pack. Cousin of GLiGuard / system-one-benchmark / jevmod. Treating 74/74 as a rh-guard ROC or hard-gating the 0–4 score as safety is confidence theater. Fold grading / policy-in-code only — not danmaku recipes. Do not merge into examples/. Cousin, not this sidecar.

jevmod is productized community moderation: category probabilities (spam, scam, harassment, nsfw, offtopic, selfharm, doxxing, minors) plus plain-English rules; the operator owns thresholds and actions. Flag-only by default. Quoted README: Fails open: if Jev is unreachable, messages are left alone (reason="error_open"). Self-harm is flag-only by design. BENCHMARK.md (2026-09-18, 2,531 messages): OpenAI eval AUROC harassment 0.930, nsfw 0.982, selfharm 0.992, minors 0.977. Quoted: 2,531 messages across three public sets is a sanity benchmark, not a leaderboard. Quoted: a 0.6 is a maybe, not a 60%. Distinct from ohernandezdev/jev-pr-review. AUC ≠ ECE (pair jev-ood-calibration). Treating those AUROCs as a hard safety envelope is soundness theater. Do not merge into examples/. Cousin of GLiGuard / system-one-benchmark / tonedown, not this sidecar.

one-dollar-tahoe is a prompt-injection defense eval (Chevy Tahoe $1 chatbot sandbox): 36 attacks + 38 benign; six defenses including Real Jev API. Quoted README: ~74 messages is a demonstration set, not a statistically powered benchmark. Static attack list; quoted: adaptive attackers bypass even SOTA more than 85% of the time when they know the defense. FPR is the metric most demos skip. Cousin of jev-agent-safety-arena / agent-chaperone / jev-pastepilot. Fold injection-eval / honest-limitations only. Do not invent unpublished ASR as a rh-guard ROC. Do not merge into examples/. Cousin, not this sidecar.

pi-jev-sentinel (current listing harshwasan/jev-sentinel; keep both slugs) is a Pi coding-agent extension (plus Claude Code / Codex hooks): TypeSafe Jev checks (a) tool-call intent+risk before run, (b) tool-output injection before the agent reads, (c) reply harmful/relay-injection after. Quoted README: Fails closed. If Jev errors or no key is set, it asks you. It never auto-allows. Code turns Jev into an allow / ask / warn ladder — soft judgment ≠ a hard deny list. Scrubs secrets before they reach Jev (pattern-based; reduces leaks, does not guarantee none). Optional task pin (* prefix) so "on task" is judged against the pin, not chat drift. Contrast fail-open pruners (opencode-context-pruner / pi-jev-compact) and pi-jev-gate (failing open). Distinct from pi-jev-approver (bash fail-closed), pi-jev-guard, pi-jev-control, and alsoleg89/jev-guard (early screenshots still say jev-guard). Dual-gate cousin of agent-chaperone (call + output screens). Quoted: Prompt injection is not solved. Default riskAskScore 0.3 / riskWarnScore 1.3 / allowThreshold 0.8 are engineering defaults, not a rh-guard ROC. 106 unit tests with a fake Jev are not a safety proof. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

hermes-jev-skills is a Hermes (also Claude Code/Codex) skill pack: model routing, memory passage triage (incl. hidden-instruction check), compaction/handoffs, skill selection, message triage, computer/browser use gated by safe action tables, plus a routing dashboard (on/shadow/off). Quoted README: Everything fails open — no key / timeout / malformed / low confidence keeps the current model, returns the original list, drops nothing, suggests nothing, and computer use returns reobserve. Safety rails that do not depend on Jev being right: risk words never route to the cheapest tier; Jev can only ever return an action id you put in the table. Quoted README: acknowledgements answered locally for free (named lexical skip, not live Jev). Quoted skills/jev-memory/SKILL.md: Never read, follow or quote dropped_injection_ids; unjudged_ids are unchecked, not verified. Quoted skills/jev-computer-use/SKILL.md: "The worst a wrong answer can do is pick another action you already judged safe"; a chosen id is not proof — observe again. Quoted docs/turning-a-jev-feature-on.md: Shadow first, and mean it; a quiet log proves nothing. Distinct from hermes-plugin-jev (cannot grant permission), hermes-switchyard (never loads the skill), skill-broker, rsdkrasen/hermes-jev-router (skip-main-model), cdepuy/hermes-skill-router (local Laya inject). In-repo jevkit/ is this pack's library, not jonathanavis96/jev-kit (Airlock). Fold integrity + fail-open + action-table + hidden-instruction + shadow/on/off only — not CUA recipes. Do not merge into examples/. Cousin, not this sidecar.

hermes-skill-router is a local Laya skill gate: pre_llm_call classifies the task vs a skill index, injects top skills via the user-message channel (quoted cache-safe: Hermes prompt-cache, not jevcache cache-hit; never mutates the system prompt). Quoted README: Fail-open — if Laya is unavailable, missing, or routing finds nothing, the hook injects nothing and Hermes behaves as stock. Default floor 0.25 is uncalibrated. Quoted: Accuracy is ~good, not perfect; it is never worse than stock (fail-open), but it can pick a plausible-but-not-ideal skill. Contrast hermes-switchyard (never loads the skill) — this plugin does inject SKILL.md excerpts as "ACTIVE guidance". Same-named xXLODXx/hermes-skill-router, LLM-Architects/hermes-skill-router, bkutasi/hermes-skill-router, MKI13/hermes-skill-router — this card is cdepuy's local Laya inject. Local-econ fail-open cousin of API Jev routers (jev-routing / hermes-jev-skills). Pair with laya (0.85 still soft; Khmer OOD). Treating a 0.25 inject as a grant or as a safety veto is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

dgp (Decision Graph Protocol) is typed assessment then application-side guarded commit/authorization before effects; receipts. Quoted README: an agent assesses the choices while application code retains control of permissions and effects. Assessors do not execute side effects. Quoted DGP docs/TYPESAFE_JEV.md (theirs, not TypeSafe): Speculative assessments cannot authorize effects; using cached computation requires equivalence checks and a fresh live assessment (cache hit ≠ live Jev). Demo: the model's publication recommendation does not publish. Host retains authority regardless of the assessor. Primary protocol fold is in Augustus; here capture the integrity boundary only (same shape as actiongate / turnstile: Jev supplies evidence, code owns authority). Not a coding-agent hook pack. Do not merge into examples/. Cousin, not this sidecar.

typesafe-jev-gate is a Hermes Agent fail-closed tool-call policy gate: Jev classifies side-effecting / paid / external tools with argument redaction; read-only and obvious safe terminal commands pass without a network call; outage / malformed / uncertain → Hermes existing approval (fail closed into ASK, not allow). Quoted README: ambiguous multi-step requests get an advisory route hint through pre_llm_call (not fail-closed approval). Quoted README: Let Jev inspect the risky calls. Keep Hermes in control. Quoted: This is a safety layer, not an autonomous permission slip. Quoted: Hermes hardline blocks, normal authorization, and human approval remain authoritative. Quoted: the gate can recommend allow, deny, or approval; It cannot override Hermes's existing authorization rules. Quoted: a Jev outage, malformed response, or uncertain decision is treated as a reason to ask for approval, not a reason to allow the call. Quoted: metadata-only audit records to $HERMES_HOME/logs/jev-gate.jsonl. Quoted: experimental; tracks deployed Hermes plugin 0.3.0. Distinct from thevibeworks/jevgate (allowlist), totally-tim/jev-gate (PR-review Nouls), robbyczgw-cla/hermes-plugin-jev (cannot grant permission; never returns allow). Cousin of kerpopule/hermes-jev-skills / cdepuy/hermes-skill-router / nekowasabi/jev-routing. Fail-closed-into-approval is not this sidecar's structural deny. Do not dump plugin source — quote README behavior theirs. Do not merge into examples/. Cousin, not this sidecar.

omo-jevlike-router is a local jevlike one-pass skill router for OmO: frozen Qwen2.5-0.5B + option-attention head scores the full skill catalog; an OmO extension shrinks <available_skills> to top-K. Quoted README: fail-open: if the router is unreachable, OmO behaves exactly as before. Quoted measured (theirs; 1,414 labeled turns, 141 skills, held-out 132): recall@24 84.1%, warm ~50–70 ms, ECE ~0.10. Quoted: an earlier README quoted 46.2% top-1 / 95.5% recall@12 — evaluation bug (trainer iterated training rows, not held-out). Quoted: skills cut from top-K keep names in an other_skill_names index; flat-confidence turns skip filtering. Quoted: independent experiment, not a Jev reproduction. MIT. Integrity: soft router ≠ hard gate; fail-open is intentional; a catalog shrink is not a deny. Do not dump model/weights. Cousin of cdepuy/hermes-skill-router (local Laya inject, fail-open) / nekowasabi/jev-routing (shrink tools[]) / vinnylarouge/jevlike. Distinct from TypeSafe Jev. Do not merge into examples/. Cousin, not this sidecar.

llm-vs-jev is a controlled comparison of LLMs vs Jev on LLM guardrailing. Quoted README: one decision spec, one policy, several perception backends. Quoted table (shared spec 77f2a821072b1862): jev-1.13.0 strict accuracy 77.9% / ECE 0.053 / p99 679 ms / $0.0444 per 1k screens; gpt-5.1 68.8% / 0.229; claude-opus-5 83.8% / 0.051; gpt-6-astra 85.8% / 0.107. Quoted: Nothing wins outright. Quoted: Jev is the cheap end of the frontier. Quoted steerability: appending one sentence that asserts the classification it wants moved anthropic-opus 14.3%, jev 10.7%, openai-mini 7.1%, openai 0.0%. Quoted: this repo does not make a stronger claim on TypeSafe's behalf. Distinct from TeoMastro/jev-vs-llm-guardrails-intent-router (LangGraph demo; 96.8% route acc). Sentinel eval: cost/latency/steerability bake-off for guardrail judges — quoted Nothing wins outright (Jev is beaten on accuracy by opus/astra). Do not invent unpublished RESULTS.md extras as a rh-guard ROC. Do not merge into examples/. Cousin, not this sidecar.

jeff (Jeff 1) is a local open-weight typed decision / fact-checking model (Jev-compatible Choice / Noul / Score). Quoted README: API compatibility does not imply identical judgments or performance. Independent, not affiliated with TypeSafe. Quoted evaluation vs live Jev 1.13.0 on 9,730 human-labelled fact-checking examples (FEVER, VitaminC, SciFact, Climate-FEVER): Jeff 1 accuracy 0.8183 / ECE 0.0807 vs Jev 0.8283 / 0.0932. Quoted: Lower ECE does not guarantee that an individual prediction is correct. Apache 2.0 for the code and adapter. Fact-check / integrity cousin; light cross-note only (not a drop-in Jev ROC; do not dump a deeper replica). Do not dump weights. Pair with laya / localjev. Do not merge into examples/. Cousin, not this sidecar.

invalidate is a memory lease/invalidation layer on TypeSafe Jev: every stored fact is judged against new evidence; code owns the disposition. Quoted README: The memory text is never edited. Questions and plans change nothing. Instructions change nothing. When unsure, it asks a human. Six Jev votes (bears / still_true / replaces / partial / hypothetical / directive) then fixed rules in code; similarity top-k is never the judge. Quoted eval (157 labeled cases, shipped v4): 89.2% strict, 97.5% lenient, 0 false invalidations. Quoted: defaults "refused any policy adding a false invalidation; they were tuned on that set, so rerun the sweep on your own events." Quoted: a kill takes two votes. Quoted: LongMemEval treatment number for the stale-retrieval slice is pending. Not a memory store (adapters sit in front of Mem0 / Chroma / Markdown / …). 0/157 is not a rh-guard ROC. Cousin of jev-carryforward (verbatim ledger; this one retires stale facts) / jev-recall (include/exclude at read). Do not merge into examples/. Cousin, not this sidecar.

hermes-jev-plugin is a Hermes Agent tool plugin exposing jev_check (Noul) / jev_route (Choice) / jev_score (Score) / jev_evaluate (mixed, one call). Not a PreToolUse hook and not a fail-closed permission overlay. Distinct from robbyczgw-cla/hermes-plugin-jev (cannot grant permission; never returns allow) and Mrmimee/hermes-plugin-jev (Agnes Flash). Distinct from typesafe-jev-gate (fail-closed policy overlay). Hope-the-model-looks cousin of jev-carryforward 0/4: if Hermes never calls the tools, there is no gate. Bundled skill jev:jev-questions covers atomic questions, state, and confidence gating. Quoted tests: clear-cut noul → confident yes (p ≥ 0.70); malformed call → graceful error JSON, hermes exit 0. Do not dump plugin source. Do not merge into examples/. Cousin, not this sidecar.

jev-lint is a semantic contract linter: does a function do what its name says, is a comment still true, would a test still pass if the claimed behaviour were broken — ast-grep locates subjects; Jev scores one sentence per match. Distinct from huntedman/JevLint (semantic convention lint, write → check → fix). Distinct from wobsoriano/oxlint-plugin-jev (English oxlint rules → Jev cutoffs) and mizchi/jev-playground eslint-plugin-jev. Quoted README: Read a finding as a candidate for a human to judge, not a verdict to act on. Quoted: about one finding in five was wrong. Quoted: No shipped rule has severity: error — "a probabilistic reviewer that can fail a build is one that gets switched off." Without an API key the pre-commit hook steps aside. Quoted: 56 of the 65 rules reach precision and recall 1.00 at shipped cutoffs (467 labelled defects; marker-free — an earlier // DEFECT leak fitted the label); not a rh-guard ROC. Cutoffs fitted to their corpus. jev-lint commits judges message-vs-diff (same candidate class). Do not merge into examples/. Cousin, not this sidecar.

jev-recall is a calibrated include/exclude gate over memories: relevance, not resemblance. One yes/no Noul per memory in one request; keep everything above a threshold (default 0.5) instead of top-k. Quoted bench (2026-09-19, jev-1.13.0, 238 fictional memories, 18 requests): pointer mode 17/18 requests / 19/20 key memories / $0.00044 / 0.35s — matches Sonnet 5, within one memory of Opus 5. Quoted: one miss needs outside knowledge ("Sam is on an H-1B visa"); Sonnet missed that one too. Distinct from jev-carryforward (verbatim ledger; 0/4 recall) and jev-gate-student-b (distill of memory-relevance). Soft include/exclude is not a safety deny. 18 fictional requests is not a rh-guard ROC. Cousin of invalidate (retire vs retrieve). Do not merge into examples/. Cousin, not this sidecar.

oxlint-plugin-jev is English oxlint rules → Jev cutoffs (jev/ask). Oxlint finds the node; Jev answers a yes/no; a cutoff reports. When Jev can't be asked: skip (warn) unless ci: "fail". Quoted: keep jev/ask out of the editor config (keystroke = paid request). Distinct from huntedman/JevLint and mizchi/jev-lint. Treating an uncalibrated cutoff as a hard lint error is soundness theater. Thin card. Do not merge into examples/. Cousin, not this sidecar.

rspamd-jev is a shadow-mode only TypeSafe Jev spam-eval Lua plugin for Rspamd (classification gate in the mail path). Quoted README: Experimental: disabled by default, no external requests by default, no filtering decisions. Quoted: Jev observations have zero score and do not change delivery actions or set Bayes learning flags. JEV_HAM / JEV_SPAM / JEV_PHISHING / JEV_UNCERTAIN / JEV_ERROR have registration scores and insertion weights of zero — do not add them to action rules, composites, or learning conditions. Quoted: the individual mail scan still waits for Jev. Gloss: unchanged score ≠ unchanged latency. Quoted: agreement is not accuracy. Timeout 1.5s, no retries; failures keep the existing verdict. Quoted: Confidence is not a false-positive-rate guarantee. Quoted: no automatic enforcement. Gloss: no auto-reject path is provided. Pins jev-1.13.0; quoted: jev-latest and other moving aliases are rejected. Classification-as-guardrail: observation, not a hard reject. Cousin of jevmod / tonedown. Treating score-0 shadow symbols as a reject envelope is soundness theater. Do not merge into examples/. Cousin, not this sidecar.

jev-guardrails (@codebam/jev-guardrails; README title dsh-jev-guardrails) is Jev-backed agent tool-call guardrails plus OpenCode / Hermes Agent / DeepSeek Harness hook installers. Quoted README: The library owns policy, not the model. Jev answers typed questions; code maps them to allow / review / block / support. Heuristics are fast paths; a local decision never overrides Jev. failMode is explicit (open → allow, review, closed → block). Default action/review thresholds 0.70 / 0.35 are uncalibrated product knobs. Quoted library README: A guardrail is not a sandbox. Default TypeSafe/OpenRouter aliases include jev-latest (moving alias, not a pin; contrast classifier-dev advertised backend ≠ served backend and rspamd-jev refusing that alias). Distinct from alsoleg89/jev-guard, pablozr/JevGuard, leepokai/jev-guard, and seb4ez/jevguard. Cousin of claude-code-jev / construct-auto-classifier / AgentGhost / this sidecar's dsh adapter. Sibling dedicated plugin monorepo: codebam/dsh-jev-guardrails (@codebam/jev-guardrails + @codebam/dsh-jev-guardrails). Treating 0.70 as a safety envelope or merging their dsh/OpenCode/Hermes installers into examples/ is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

moongate is a semantic CI gate (MoonBit): TypeSafe Jev evaluates committed diffs against JSON rules (violation / compliant / insufficient_evidence). Policy and checkout come from the base commit so a PR cannot edit the rules that judge it. Quoted README: A verdict is a model's answer, not a proof. Exit 0 doesn't mean the code is fine. Confidence doesn't tell you the answer is correct. Advisory unless "severity": "blocking". An unevaluated rule never counts as a pass. Forks and Dependabot are skipped rather than reported as a fake pass. Ten identical replays: label violation all ten times, but 4 counted as violation and 6 as review at a 0.90/0.80 gate. Quoted: Keep thresholds away from where a rule actually lands. The model is pinned. Changing it invalidates your thresholds. Cousin of jev-gate / jev-pr-review / if-ai / latch. Soft-score-as-hard-merge without calibration + escape hatch is soundness theater. Do not merge into examples/. Cousin, not this sidecar.

jev-logtriage is an SRE observability sentinel: Jev scores a collapsed log batch (six questions, one call); code keeps the thresholds; nothing is executed. Confidence-gated routing: below --confidence-floor (default 0.50) → review. Quoted README: Low confidence never auto-acts. auto_remediate_candidate is a label; the repo does not restart pods, call webhooks, or page anyone. Security is never an auto-remediation candidate. Demo numbers move; the gates do not. Cousin of jev-home-assistant-sentinel (action ≠ verified outcome) / firehose-judge. Treating auto_remediate_candidate as execution is hard-gating soft judgment. Do not merge into examples/. Cousin, not this sidecar.

bias-bench is a resume-screening fairness/calibration audit for decision models (pinned jev-1.13.0). Full factorial 76 names × 8 resumes × 3 reps = 1,824 independent evaluations (Bertrand & Mullainathan / Kline, Rose & Walters design). Quoted README headline: callback decisions are perfectly determined by resume quality (zero binary-decision name differences); mean-probability name gaps are ~0.4–0.6pp — statistically detectable because the model is near-deterministic, opposite in sign to the human audit-study direction, operationally negligible. Quoted: read the magnitudes, not the p-values. One domain, one prompt; not a claim about Jev in other framings. Fairness audit for guards — not a rh-guard ROC. Do not invent unpublished gaps as a safety proof. Do not merge into examples/. Cousin, not this sidecar.

jevusher is context-window admission control (token VOI gate before expensive models): J1 route, J2 skill gate, J3 memory usher, J4 tool-output filter, J5 compact, J6 stop, J7 injection screen. Quoted README failure posture: admission (J3/J4/J5) unsure → let it in; selection (J1/J2) unsure → surface none; safety (J7) unsure → flag, never pass. Quoted: J7 pass means nothing detected, never safe to obey; unreachable → unavailable, never pass. Provider outage degrades to no lens installed, never to an empty context. Quoted: On small inputs these lenses lose money. Cousin of jevex / jev-sift / jev-routing / compaction gates. Treating a J2 catalog shrink or J7 pass as a hard safety envelope is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

jev-evaluation is an adversarial, pre-registered Jev eval: plan written before any request; 28 predictions each with a falsifier; one run 123,805 requests, 138 minutes, $12.69, five failures, all jev-1.13.0. Quoted README: Twelve of twenty-five testable predictions held. Thirteen were wrong, which is the useful half. Calibration holds in-domain (support-ticket ECE 0.075) and fails completely outside it (3-SAT: answers satisfiable for every formula). Quoted current README: Confidence predicts whether an answer is right, but not whether the question could be answered. Quoted PROMPTING.md: gate on confidence ≥ 0.95 still admits 47% of unanswerable states (mostly fluent nonsense). Quoted README: act when confident and escalate when not catches wrong answers and misses unanswerable inputs. Crude "IGNORE THE QUESTION" moved the answer 0%; a polite invented-supervisor sentence moved it 65% (confidence 1.00 → 0.62). Ground truth from a solver or construction, never from the model. Distinct from jev-baselines-eval. Soft-judgment integrity sentinel: do not hard-gate confidence as fake safety. Do not invent unpublished extras as a rh-guard ROC. Do not merge into examples/. Cousin, not this sidecar.

jev-bias-bench is a one-attribute-at-a-time Jev fairness/calibration bench: counterfactual pairs that differ in one attribute and nothing else. Quoted FINDINGS.md (20 September 2026, jev-latest): 11,984 calls, 52,430 answers, 666 people built from 6 anchors, 8 scenarios. Quoted: 0 of 100 control comparisons significant. Quoted: Do not test it by swapping names. Quoted: Read the deltas, not the stars. Quoted caveats: No build pinned. Distinct from natemoo-re/bias-bench (resume-screening name factorial, pinned jev-1.13.0). Fairness audit for guards — not a rh-guard ROC. jev-latest is a moving alias (contrast rspamd-jev refusing that alias). Do not invent unpublished extras as a safety proof. Do not merge into examples/. Cousin, not this sidecar.

aurum-gate (@ormus/aurum-gate) is a TypeScript confidence-gated action router (Jev Pattern 2): per-action floors, human escalation, refuse-below bands. Packaged export (src/index.ts, package.json main/exports → dist/index.js): decisions auto | escalate | refuse; default autoConfidence 0.85 is an uncalibrated product knob (same 0.85 theater as laya / jev-preflight). Quoted README: Probability opens the door — confidence decides if gold flows automatic, or a human holds the pour. Quoted README: tests are mocked — no live API. Mock router, not live Jev. Parallel non-export src/gate.ts is a second AurumGate (ok / human|deny|ask); quoted comment: Probability is not confidence. index.test.ts hits the packaged API; gate.test.ts hits the parallel class. packaged export ≠ parallel gate.ts. Treating 0.85 auto as a safety envelope is confidence theater / hard-gating soft judgment. Do not merge into examples/. Cousin of jev-logtriage / typed-gate, not this sidecar.

quicksilver-judge (@ormus/quicksilver-judge) is a staged PR/code pre-filter. Packaged export (src/index.ts): sketch a Noul-style risk matrix, emit confidence-gated PASS / HOLD / FAIL. Public sketchRisks / prefilter is a heuristic (churn, auth, deps, labels) — not live Jev. Profiles: Choice minConfidence 0.7, Score 0.65. Gloss: PASS is not a merge grant. Parallel src/stages.ts (runQuicksilver inject-evaluate): quoted Code owns overrides — Jev Choice is advisory when hard flags fire (pass/hold/escalate, not the packaged PASS/HOLD/FAIL). packaged heuristic ≠ live Jev. Soft-score-as-hard-merge without calibration + escape hatch is soundness theater. Cousin of moongate / jev-gate / latch. Do not merge into examples/. Cousin, not this sidecar.

karat-filter (@ormus/karat-filter) is retrieve-then-judge: filter RAG/search hits with lightweight relevance+confidence scores before they burn context (speculative fan-out). Quoted source (src/index.ts): Token overlap judge — mock stand-in for a Jev Noul (no live API). Defaults minRelevance 0.45 / minConfidence 0.5. Inject-a-judge path exists (src/filter.ts); the packaged default is not live Jev. Treating token-overlap keep as calibrated Jev or a hard safety deny is confidence theater. Cousin of jevex / jev-sift / jevusher. Do not merge into examples/. Cousin, not this sidecar.

gold-assay (@ormus/gold-assay) is a UI proof assay: score screenshot/OCR + DOM-as-state before an agent claims the flow worked. Quoted README: Screenshots lie until you assay them. Public assay() is substring/regex GREEN | AMBER | RED (minGreen 0.75); a separate assayQuestions path is Jev-shaped, not the default. Gloss: GREEN ≠ verified UI (quoted README: don't stamp GREEN on fool's gold). Lexical GREEN is not a rh-guard ROC and not action≠verified-outcome (jev-home-assistant-sentinel). Treating GREEN as license to commit/click is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

WaynezProg/jev-kit is source-bound evidence checks plus bounded batch Jev judgments (jev_evidence / jev_classify / jev_extract / jev_decide). Distinct from jonathanavis96/jev-kit (Claude PreToolUse Airlock). Quoted README: A source supporting a claim does not independently prove the claim true. Confidence is not a correctness guarantee. Quoted: No approval gate. Quoted: Exit 0 does not certify task completion or claim truth. Quoted SECURITY.md: Do not use confidence, source support, or CLI success as an authorization boundary (not an authorization boundary). Evidence-bound integrity cousin of clear-head — source support ≠ truth/permit. Do not merge host installers into examples/. Cousin, not this sidecar.

Jev-Examiner is listed as "An AI content moderation workflow powered by the TypeSafe/Jev model." Empty public tree at capture (created 2026-09-20T04:30:19Z). Later public tree is README/LICENSE/COPYRIGHT/.gitignore; README advertises src/ / docs/ / AGENTS.md / CONTRIBUTING.md not in the tree (advertised tree ≠ shipped source). Content-moderation cousin of gg-friggin-ez / jevmod / GLiGuard / tonedown / jevfanity-api. Watch; do not invent a shipped moderator. Do not merge into examples/. Cousin, not this sidecar.

pi-jev-tool-guard (pi-jev-tool-guard@0.1.0) intercepts Pi bash / write / edit immediately before execute. Jev returns typed probabilities; the extension owns the control flow and thresholds. Default evaluatorFailure: "allow" (fails open); headlessRisk: "block"; thresholds reviewProbability 0.35 / highRiskProbability 0.7 uncalibrated. Model default jev-latest (moving alias, not a pin). Quoted README: This extension is a confirmation guard, not an operating-system sandbox. Rule lists have deterministic precedence over Jev (protectedPaths / alwaysConfirmCommands force confirmation; allowedPaths / allowedCommands bypass evaluation; confirmation rules win when both match). disable: true bypasses the guard. Distinct from pi-jev-guard / pi-jev-gate / pi-jev-approver / pi-jev-control / pi-jev-sentinel / pi-jev-command-guard. Contrast jevgate (allowlist then Jev) and this sidecar (structural first; soft never the sole veto). Treating 0.35/0.7 as a safety envelope or fail-open as fail-closed is confidence theater. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

gg-friggin-ez is a fast Node toxicity/profanity screener powered by TypeSafe Jev (isProfane / isToxic / screen()). Actions ALLOW / SUSPICIOUS_REVIEW / AUTO_CENSOR / AUTO_MUTE / AUTO_BAN. Thresholds review 0.3 / censor 0.55 / ban 0.7 uncalibrated. No key → local heuristic; calls never throw (named degraded backend, same lesson as backend: "lexical"). Quoted 42 curated cases 97.6% (41/42) — not a rh-guard ROC. Fold grading/policy-in-code only, not Twitch/Valorant demos. Cousin of jevmod / tonedown / GLiGuard / jevfanity-api. Treating AUTO_BAN as a safety proof is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

jeveryword is Jev field extraction + PII detection + exact quotes: numbered tokens, Jev picks ids, maps to verbatim spans (text.slice(start, end) === value). extractSpans / classifyChunks / PII. Quoted README: Experimental. Small synthetic sample; too small to support an accuracy claim. Labels must include none. Confirm p<0.8. Quoted: text cannot make it produce words that are not in the source. Gloss: untrusted input can still influence which span. Distinct from WaynezProg/jev-kit jev_extract. Not PreToolUse. Sensitive-data / source-bound integrity cousin. Do not merge into examples/. Cousin, not this sidecar.

jevfanity-api (Jevfanity) is a Cloudflare Worker POST /v1/moderate: TypeSafe Jev Nouls for profanity / slur / harassment / threat / sexual; code owns flagged (any selected category ≥ threshold). Default threshold 0.75, default level medium. Model jev-latest (moving alias, not a pin). Category scores are the maximum across chunks (100-token windows, 10-token overlap) — one dirty window flags the request (FP-heavy vs a miss on a later window). Missing TYPESAFE_API_KEY → 500 server_misconfigured (not a named lexical fallback). Upstream error/timeout → 502/504, not a silent allow — the caller owns fail-open vs fail-closed. Quoted README: CORS is open by default. Tighten Access-Control-Allow-Origin before using a browser-facing production deployment with sensitive data. 20/min per client IP (theirs). Quoted: IP-based rate limiting means users on the same shared network may share a limit bucket. Quoted: the underlying category probabilities for custom policy decisions. flagged is a policy bit, not a safety proof. Soft Noul ≥ 0.75 as AUTO_BAN / hard mute is the same theater as gg-friggin-ez. No published ROC. Distinct from gg-friggin-ez (Worker API vs Node lib; 500/502 vs never-throw heuristic) and Jev-Examiner (shipped Worker vs advertised-tree listing). Cousin of jevmod / tonedown / GLiGuard. Posted text leaves the Worker to TypeSafe (PII surface). Do not merge into examples/. Cousin, not this sidecar.

iso-jevdit (iso-jevdit@0.1.0) is an npm CLI that audits a codebase against ISO/IEC 27001:2022 Annex A. Quoted README: This is version 0.1.0 and the audit engine is not finished. Check catalog 3 of ~36; sending chunks, caching, narrowing findings, and writing iso-jevdit-report.md are Not yet. Today iso-jevdit . discovers, chunks, forecasts cost, checks a credential, then tells you the engine is not wired. Quoted: This is not a certification, and it is not a conformity assessment. Quoted: Findings are probabilistic. Expect both false positives and false negatives. Quoted: No static analysis is performed. Quoted Status: The only network call the tool makes today is verifying a key when you save one. When the engine lands, quoted Your source code is sent to the configured provider. README settings comment over failOn / report / cache: Accepted today, acted on when the audit engine lands — treating failOn: "high" as a live CI merge gate is advertised capability ≠ shipped module. Confidence-policy knobs thresholds.report 0.6 / high 0.8 are quoted policy, not physics, and they are not live while sending chunks is Not yet. Model default ~typesafe/jev-latest (moving alias). README describes gating on violation-label probability mass, not the model's confidence (high for a confident pass too) — that envelope is not shipped until the engine is wired. Extra checks must include a no-match label (wellposed cousin). Cousin of jev-security-scan / latch / moongate / apa-agent-harness. Do not treat a future failOn as ISO certification. PII: source leaves only when the engine lands; credentials in ~/.isojevdit/credentials.json are Not encrypted at rest. Do not merge into examples/. Cousin, not this sidecar.

jev-linkedin (Jev Job Match) is a Chrome MV3 extension that scores LinkedIn job↔CV fit via TypeSafe Jev (10 parallel questions). Code computes match % and pass-screening % from the probability distribution. Quoted README: the "odds" numbers are the model's judgement of your CV text and the job description, not real-world probabilities. Quoted: Treat them as an early signal, not a decision. Verdict knobs worth_applying ≥ 0.6 / 0.4 uncalibrated. Model default jev-latest (moving alias). CV text is extracted locally, then sent with the job description to the configured /v1/systemone (PII: CV, location, education, skills; key in chrome.storage.local). When a page signal cannot be read, opportunity_signals is not sent at all. Empty fields omitted. Distinct from bias-bench / jev-bias-bench (product scorer vs fairness audit). High-stakes scoring: treating match % as hire/reject is hard-gating a soft Score. Integration fixture (BJAK Singapore residency vs Batam) is not a rh-guard ROC. Cousin of jeveryword (PII surface) / bias-bench. Do not merge into examples/. Cousin, not this sidecar.

Astro-Han/jev-harness filters every tool result except read through Jev before the main model sees it. Distinct from AntonioCoppe/jev-harness (shadow / confidence action evals), apa-agent-harness (rebrand), and Atikpui007/jev-sift (Claude PostToolUse relevance filter). Quoted README: Filtering is a routing decision, never destruction. Raw output is stored; read can retrieve it. Quoted: Jev failures fail open. Keep at p > 0.5. Quoted: One run per arm: this is a prototype measurement, not a generalization claim. 25/30 vs 22/30 is not a rh-guard ROC. Quoted RESULTS.md: Pass/fail alone is not significant. Intent in the filter state is load-bearing (without it, deliberate reads scored p≈0.1–0.4). Cousin of agent-chaperone (results before the agent reads) / jev-routing (drop/truncate without summarizing). Treating 25/30 as a safety proof or p>0.5 as a hard deny of evidence is confidence theater. Fold the pre-model tool-result filter only. Do not merge into examples/. Cousin, not this sidecar.

Atikpui007/jev-sift is a Claude Code PostToolUse plugin that filters grep/glob/read/web/bash result collections through Jev before Claude sees them. Distinct from kbhuw/jev-sift (classify first, read selectively) and Astro-Han/jev-harness (pre-model tool-result filter; routing never destruction). Quoted source (src/hook-filter.ts): Fails open: on any error the hook prints nothing and the original result is delivered. Hide only when Jev puts at least DROP_THRESHOLD on hide (code default 0.5; env JEV_FILTER_DROP_THRESHOLD — header comment names JEV_FILTER_THRESHOLD; quote the code). Quoted drop marker: This is a relevance filter, not a safety block. Quoted state: hidden_candidates are removed before the assistant sees the result; the assistant never learns they existed. Non-lossless split → passthrough. Model default jev-latest (moving alias, not a pin). Cousin of agent-chaperone / Astro-Han / jevex. Treating a relevance hide as a safety deny, or hiding eval evidence the agent never learns existed, is hard-gating soft judgment. Do not merge into examples/. Cousin, not this sidecar.

jev-cite-check is a Korean ordinance citation-grounding experiment (not a hook): did the answer actually cite the ordinance? Quoted README: 1차 20/20; 2차 97/100, 모순 31/31, 통과시키면 안 될 것을 통과시킨 건 0. Quoted: 1회 관찰이며 성능 주장이 아닙니다. Gloss: one-shot observation, not a performance claim; 0 false-allow of 지지. Quoted: grounded 0.5 미만이면 사람 검토. Quoted: confidence 필드는 분포 집중도이지 정확도가 아닙니다. TypeSafe direct key 아직 지원하지 않습니다; run.mjs uses Vercel experimental_evaluate model typesafe-ai/jev. Cousin of clear-head / WaynezProg/jev-kit (source support ≠ truth) / codebam/dsh-jev-guardrails verifyClaim. 97/100 is not a rh-guard ROC and not legal proof. Treating grounded ≥ 0.5 as a citation/compliance grant is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

pi-jev-command-guard is a Pi bash / powershell command approval extension. Local CRITICAL_PATTERNS always ask (never silent allow; no JEV request). Auto-allow only when choice is allow AND confidence ≥ 0.75 AND ask < 0.25 AND deny < 0.10. Quoted source (src/reviewer.ts): Confidence-gated routing: ambiguity must never silently become permission. API fail / invalid / missing key → ask; no interactive UI → block. Quoted README: do not provide a complete sandbox. Model default jev-latest (moving alias, not a pin). Distinct from pi-jev-tool-guard / pi-jev-gate / pi-jev-approver / pi-jev-guard / pi-jev-sentinel / pi-jev-control. Contrast this sidecar (structural first; soft never the sole veto) and jevgate (allowlist then Jev). Treating 0.75 auto-allow as a sandbox or fail-ask as fail-closed is confidence theater. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

jev-transaction-guard is an autonomous settlement circuit-breaker sim (ledger CVE-bypass / prompt-injection bait). Quoted README: Jev is IMMUNE TO BOTH; quoted Golden Rule: Jev stands as the immutable last line of defense. That marketing is soundness theater. Quoted comparison note: the bench does not show proof that Jev makes better classification choices than GLM 5.3 Flash. Mock path uses labeled features already in state (is_balance_sufficient, is_off_hours_window). Quoted 0.0% FPR on daylight workloads is not a rh-guard ROC. Choice TRIP_CIRCUIT_BREAKER_AND_LOCK is a typed verdict, not a freeze. Model ~typesafe/jev-latest (moving alias). Cousin of actiongate-jev / turnstile / jev-logtriage. Treating IMMUNE / last-line / 0.0% FPR as a safety envelope, or a Choice as a ledger freeze, is hard-gating soft judgment. Do not merge into examples/. Cousin, not this sidecar.

dsh-jev-guardrails is a dedicated DSH plugin monorepo (@codebam/jev-guardrails library + @codebam/dsh-jev-guardrails Cordis plugin). Sibling of already-folded codebam/jev-guardrails (that repo's README title was dsh-jev-guardrails). Quoted: The library owns policy, not the model. Quoted: A heuristic never overrides a Jev block. Quoted library README: A guardrail is not a sandbox. Quoted plugin: The plugin is a policy layer, not a sandbox or an authorization system. Plugin failMode default open. Default action/review thresholds 0.70 / 0.35 uncalibrated. verifyClaim is citation-grounding adjacent. Model jev-latest / ~typesafe/jev-latest (moving alias, not a pin). Distinct from 7starsseeker/dsh-jev-guard / alsoleg89/jev-guard / pablozr/JevGuard / leepokai/jev-guard / seb4ez/jevguard. Cousin of this sidecar's dsh adapter / construct-auto-classifier / AgentGhost. Treating 0.70 as a safety envelope, fail-open as fail-closed, or merging their DSH installer into examples/ is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

jev-auto-approve is a GitHub Action: Jev answers a Noul (needs_human_review); code approves when confidence = 1 - p(human required) ≥ confidence-threshold (default 0.9). Quoted README: does not satisfy required-approval branch protection (GITHUB_TOKEN). Quoted: Failures are loud. Quoted src/main.mjs: a gate, not a substitute for a human reviewer. Model default jev-latest (moving alias). Diff and discussion are untrusted input. Cousin of ci-gatekeeper-bot-jev / jev-pr-review / jev-gate / moongate / if-ai / latch. Treating 0.9 auto-approve as a merge grant is soundness theater / soft-score-as-hard-merge. Do not merge into examples/. Cousin, not this sidecar.

hush is GitHub issue triage that stays quiet when unsure. Quoted README: Silence is the default behaviour, not the failure mode. apply default false. Quoted: Start with apply: false. A label is only ever applied if it already exists; hush never creates labels, never removes one, and never touches a label a human added. Two gates: label-threshold 0.80 AND label-confidence-threshold 0.60; spam 0.90 / needs-info 0.85 / duplicate 0.85. Quoted: it will not Close, lock, delete or edit anything. Quoted: Where it is unsure, it leaves the issue exactly as it found it. Cousin of jev-triage / jev-logtriage / ci-gatekeeper-bot-jev. Treating a quiet skip as a hard reject, or auto-applying below both gates, is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

jev-call-screener is an AI call-screening backend: JEV classifies a transcript; Go policy owns reject/forward/clarify. Quoted README: JEV classifies; it does not generate dialogue or control the call. Quoted: The defaults are deliberately fail-open. Routing: promotional and confidence ≥ 0.90 → reject; wanted ≥ 0.75 → forward; else clarify then forward. Model default jev-1.13.0 (pinned). FORWARD_ON_ERROR default true. Cousin of gg-friggin-ez / jevmod / unslopify. Treating 0.90 reject as a safety envelope, or fail-open as fail-closed, is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

unslopify is a Chrome quality filter for social feeds (AI slop / engagement bait / generic filler / empty hype). Quoted README: It is a quality filter, not an AI-authorship detector. Quoted: Keeps uncertain or failed classifications visible. Classification is still probabilistic. Cousin of jev-call-screener / karat-filter / rspamd-jev. Treating a blur as an authorship proof, or hiding uncertain posts, is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

no-hallucination is three RAG hallucination experiments including TypeSafe Jev quote-checking. Quoted README: quote-forced string-check is The hallucination defence that worked. Jev as a guard that blocks unsupported answers: No effect. It agreed with all 8 remaining errors (confidence 0.82–1.0). Quoted: The one clear win: 78.0% → 81.0% correct (retry triage). Quoted: Recall@k is the wrong thing to optimise. Sample sizes 150–518; not a rh-guard ROC. Cousin of jev-cite-check / clear-head / rag-jev. Treating Jev-as-guard No effect as a safety proof, or 81.0% as a rh-guard ROC, is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

context-evaluator uses Jev as a semantic decision gate over PetClinic files: INCLUDE when evidence is DIRECT, relevance is HIGH, and both confidences ≥ 0.8; EXCLUDE when evidence is NONE or relevance is LOW; else REVIEW. Quoted README: precision/recall are experiment metrics, not proof that Jev will select the correct context for arbitrary questions. Cousin of jevex / jev-assist / karat-filter. Treating INCLUDE as a hard read-only grant is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

jev-assist ranks every file by task relevance before reading (jev rerank / validate / drift / gate). Quoted SKILL.md: Flags are prompts for a human look, never verdicts. Quoted README: Typed output guarantees the shape of an answer, not its correctness. Quoted: Do not judge candidates you just generated. jev gate exits 1 on any flag. Quoted SKILL.md: recall@20 0.68, recall@40 0.80 over 41 files on one 705-file React app — not a rh-guard ROC. Cousin of jevex / context-evaluator / Atikpui007/jev-sift. Treating a rank as the only files that exist, or gate exit 1 as a safety envelope, is hard-gating soft judgment. Do not merge into examples/. Cousin, not this sidecar.

rag-jev is local RAG (LoL CN patch notes) with Jev candidate rerank + answer self-check. Quoted README: numbers 全部来自官方公告的结构化抽取结果，不经过生成模型. Quoted jev.py: rerank only when gap ≥ 0.15 else keep retrieval order; Degradation is never silent. Self-check noul < 0.5 cautions (请以公告原文为准); it does not rewrite. Blind 20/20 is not a rh-guard ROC. Model default jev-latest (moving alias, not a pin). Cousin of karat-filter / no-hallucination / jev-cite-check. Treating 20/20 or a caution line as a rewrite/safety proof is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

mailverdict is a phishing-verdict MCP/REST service: deterministic header/URL/attachment parse, then TypeSafe Jev, then code thresholds. Quoted README: Forward an email, get a calibrated phishing verdict. Quoted: An LLM is only used to write a three-sentence explanation, and only for emails that land in the grey zone. Quoted architecture: the explainer never changes the label. Quoted: A classifier cannot be talked out of a probability. Code owns p ≥ 0.90 → PHISHING, p ≤ 0.10 → LEGITIMATE, else SUSPICIOUS. Quoted ARCHITECTURE: indicator weights do not feed the probability. The probability comes from Jev alone. Missing TYPESAFE_API_KEY throws (no named lexical fallback). Quoted README: 502 upstream (Jev or OpenRouter) failure after retries. Explainer failure still returns the Jev verdict. 24-email eval exits non-zero if PHISHING recall < 0.8. Quoted ARCHITECTURE: 24 fixtures show the pipeline works and expose gross miscalibration; they are not a benchmark. Model default jev-latest (moving alias, not a pin). Distinct from rspamd-jev (shadow, no auto-reject) and jev-call-screener (fail-open). Distinct from mailverdict/mailverdict (quoted Advisory signals, not verdicts; disposable/burner/MX; named snapshot fallback) and jaiswalism/mailverdict (Better-T-Stack scaffold, no Jev). Cousin of jav-email-cascade (decide → policy → LLM leftover). Treating 0.90 as a phishing ROC, 24 fixtures as a rh-guard ROC, or the LLM explanation as the verdict is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

open-jev-approvals is a Codex / Claude Code binary allow/deny hook gate (codex-guardian-v1). Watch brief said fail-closed; recapture from tasks/todo.md: quoted The degradation model changed from fail-closed to fail-open after user review. Quoted README: If Jev is unreachable or returns something unusable, the call is allowed — the gate should not block your work just because the reviewer is down. Quoted: A deny always requires positive evidence that the action is dangerous. Quoted policy README: Fail-open degradation; There is no review_required. Hazard Noul ≥ 0.70 or risk_level == critical denies even on a partial verdict; incomplete / invalid / no-key / audit-store failure → allow with incomplete: true. Quoted: action_probability = 0.70 is an initial, uncalibrated operating value — there is no validated dataset yet. Stale authorization version while review is in flight → deny. A project .env is never read. Offline eval/ feeds fake assessments into policy.Compose (no live Jev). Contrast pi-jev-approver (no key → fail-closed) and typesafe-jev-gate (uncertain → Hermes approval, not allow). Treating 0.70 as calibrated, incomplete-allow as a safety envelope, or inventing fail-closed is soundness theater. Do not merge into examples/. Cousin, not this sidecar.

beat-the-reviewer is a reviewer game: ten levels, each a typed judgement rule answered by pinned jev-1.13.0. Quoted README: No middle ground. Taking the reviewer offline does not count as a pass. Quoted: Not a chatbot reading a prompt. Each level is a typed judgement rule. Quoted: The reviewer cannot move the goalposts without that hash changing. Quoted .github/judge.mjs: Holds no key and reaches no model. Quoted: An unavailable reviewer is not an approval. Quoted levels/01/RULE.md: on_unavailable: "block"; refused at noul ≥ 0.5. The request is the PR body; a win is a real merge. Quoted: Asserting confidence does not move the number. Fair-play removals are velocity / clean-sheet / duplicate — never prose. This is a puzzle, not a production merge gate. Cousin of jev-auto-approve / if-ai / moongate. Treating a game APPROVED as a merge-grant safety proof, 0.5 as a rh-guard ROC, or inventing fail-open is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

dsh-jev-guard is a DSH tools/pre-execute accident net: L0 static hard rules, then a paid Jev semantic question, then one of four states (allow / revise / block / escalate). Quoted English abstract: It is an accident net, not a security boundary. Quoted: degrades loudly instead of silently. D3: timeout / 5xx fail-open. D9: 402/401 degrade l0-only, not silent fail-open. Quoted README: L0 的 deny 类硬规则不受此开关影响. Thresholds 0.5 / 0.7; model jev-latest (moving alias, not a pin). Distinct from codebam/dsh-jev-guardrails. Cousin of this sidecar's dsh adapter / construct-auto-classifier. Treating L0 as a security boundary, timeout fail-open as fail-closed, or merging their DSH installer into examples/ is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

jev-sentinel is a multi-harness reference installer (OpenClaw / Hermes / OpenCode / Codex / Claude / Pi / Gemini / Cursor / Copilot). Initial policy backend=local, mode=shadow. Local rules are not Jev. Quoted README: This is a defense-in-depth sensor and veto layer, not a complete reference monitor. Quoted: DEFER means only no additional veto. Quoted SECURITY.md: Judgments are not grants. Quoted: provisional review/block thresholds 0.35/0.80 are policy starting points. Pin jev-1.13.0. Distinct from harshwasan/pi-jev-sentinel, harshwasan/jev-sentinel, jev-home-assistant-sentinel, jev-oas-sentinel. Treating DEFER as a grant or 0.35/0.80 as calibrated is soundness theater. Do not merge into examples/. Cousin, not this sidecar.

diff-risk-sentinel is CRAP + optional TypeSafe Jev risk triage for large git diffs. Quoted README: It is a prioritization aid, not a bug detector. Quoted: earlier 96% accuracy / 100% bug recall numbers are superseded. Rule 6 badge ACCEPTABLE_LOW_RISK (strategy: Low risk. Safe to merge.) is not a merge grant; BENEFICIAL_REFACTOR is a fast-pass badge. Cousin of jev-pr-review / prune-review. Treating Safe-to-merge as a grant is soundness theater. Do not merge into examples/. Cousin, not this sidecar.

agent-firewall is an L7 HTTP reverse proxy (:8286) plus MCP stdio gateway sharing one eval core (hard rules, then semantic score). Quoted: fail-closed if checks do not pass. After an allow, MCP still runs /bin/bash -c. Quoted: with no TypeSafe credentials, Layer 2 Mock. Quoted: Score ≥ 0.8 → BLOCK. Quoted: git pull is intentionally excluded. Model jev-latest (moving alias). Distinct from 0xrem/agent-firewall and 2026hoohacks/agent-firewall. Treating Mock as Jev or 0.8 as a safety envelope is soundness theater. Do not merge into examples/. Cousin, not this sidecar.

/edit is an approval-first Pi tool for small checked code changes. Quoted README: Nothing changes until you approve the exact request. Quoted: If the provider is unavailable, /edit stops instead of pretending that a review happened. Quoted evals: Four runs of one tiny task is not a benchmark. Quoted: a Jev approval with a failed file check is still a failed run. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

slop-filter is a Chrome extension that hides AI-generated posts. Quoted: Scores every post in your feed for how likely it is to be AI-written. Contrast unslopify (It is a quality filter, not an AI-authorship detector). Treating slop-filter as unslopify is a Distinct-from miss. Do not merge into examples/. Cousin, not this sidecar.

sift is a Chrome extension: every X post gets Substance · Humor · Chit-chat · Promo · Junk plus AI-written and Off-topic. Distinct from kbhuw/jev-sift and Atikpui007/jev-sift. Do not merge into examples/. Cousin, not this sidecar.

Winnow is a Chrome extension: four verdicts read now, skim, save, or skip on articles and YouTube ahead of click. Quoted: every word on the card is a template filled from typed answers. Quoted: held-out split 80% verdict agreement and 90% content-type agreement. Quoted: The goldens are still unreviewed. Treating 80/90 as a rh-guard ROC is confidence theater. Do not merge into examples/. Cousin, not this sidecar.

x-spam-filter-typesafe is a userscript: semantic X-comment filter via Jev (is_spam / is_gibberish; max ≥ 0.85). API fail 放行不隐藏 (fail-open). Do not merge into examples/. Cousin, not this sidecar.

jev-mail is Autonomous 24/7 Zero-Inbox Gmail triage via Jev. Automated Apply Label, Star, Archive. Distinct from muhammedilyasy/jev-mail: quoted Read-only: it never sends, deletes, labels or archives anything. Treating vynnlee as the read-only overlay is a Distinct-from miss. Do not merge into examples/. Cousin, not this sidecar.

system1-fraud-interceptor-demo runs System 1 Jev vs generative Gemini in parallel on synthetic transactions. Quoted: Es una demo de experimentación personal, no un benchmark. Quoted: no está pensada para producción. English: not a benchmark. Do not merge into examples/. Cousin, not this sidecar.

jev-wiki-watch judges live English Wikipedia edits: FLAG vandalism or spam ≥ 80%; REVIEW 40% to 80%; OK below 40%. Do not merge into examples/. Cousin, not this sidecar.

umby-jev-stack is a skill tree: Jev as a cheap code-review classifier (HTTP-first; model jev-latest). Quoted 1.x: 544 flags; a manual confirm pass rejected 543 as false positives. 2.0 hunts executable defects only. Quoted: Never drop a finding. Quoted: Jev only classifies. Optional NiazMorshed2007/jev-review MCP is not bundled. Hope-the-model-looks skills; not this sidecar. Do not merge into examples/. Cousin, not this sidecar.

jev-prune-kit is capability-aware context-pruning plus a bounded Jev assessment. Quoted: Not a universal /prune. Quoted: Not live-tested. Quoted README: 122 passing local tests are not 122 live harness or model tests. Quoted VALIDATION.md: 88 passing local tests are not 88 live harness or model tests. Pin jev-1.13.0. jev-bus with jev-context-fabric. Advertised-vs-measured lock. Do not merge into examples/. Cousin, not this sidecar.

yolo-jev-scene-filter is a Gradio Space: YOLO-World open-vocab boxes, then TypeSafe Jev Noul keep? per box. Quoted Space short_description: YOLO-World detects; TypeSafe Jev keep/skips boxes. Quoted UI: Jev only filters what YOLO already found. UI keep floor 0.55 (uncalibrated); model jev-latest; missing key raises. Not a coding-agent hook. Keep/skip overlay (skip boxes still drawn); not hide-never-learned. Relevance-filter cousin of Atikpui007/jev-sift. Do not merge into examples/. Cousin, not this sidecar.

pi-jev-permit is a Pi permission gate on bash / write / edit, not every tool. L0 hard deny → rules → read-only fast path → one Jev question should this call be allowed. Quoted: silence is never consent. Allowed at p ≥ 0.6 (uncalibrated default). Quoted: A failed judgment is never treated as approval. No key: read-only local; everything else blocked. degraded: L1–2 pass, L3 block. Distinct from pi-jev-approver / pi-jev-gate / pi-jev-guard / pi-jev-sentinel / pi-jev-tool-guard / pi-jev-command-guard / pi-jev-control. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

jevgate-action is advertised as a GitHub Action; public tree is a README title only (# jevgate-action); description null; size 0; no action.yml. advertised Action ≠ shipped workflow. Distinct from thevibeworks/jevgate and totally-tim/jev-gate. Watch; do not invent mechanics. Do not merge into examples/. Cousin, not this sidecar.

boldbug1/jev-triage is a Go CLI that sorts messages by urgency via TypeSafe Jev. Distinct from ThyFriendlyFox/jev-triage. Choice (bug/billing/feature_request/account/other) + Score 0–3 + Noul frustrated; -threshold 0.8 (quoted starting point; uncalibrated); model jev-latest; keep other. Vendor 193.6x / 444.6x: test on own data. Do not merge into examples/. Cousin, not this sidecar.

contact-cleaner sorts Google Other contacts into Keep / Review / Remove via Jev. Quoted: Buckets are code, not the model. Quoted: Deterministic first. KIND_CONFIDENCE_FLOOR 0.5 (uncalibrated); model jev-latest; PII name+email. Distinct from ashafizullah/jev-linkedin. Do not merge into examples/. Cousin, not this sidecar.

claude-code-jev-guardrails is a Claude Code reflex layer. Quoted: Claude thinks. Jev reacts. Code decides. Regex/Math.max floors never overridden. Fail-open on judgment; fail-closed on hard cases. No key / JEV_MODE=mock → offline heuristic mock (named degraded backend; mock can still BLOCK). REFLEX_MODE=shadow default. Quoted: Treat this as a working prototype, not a hardened production guardrail. ASK_USER is in the type; decidePreTool / decidePostTool / decideCompletion emit ALLOW/WARN/BLOCK — advertised ASK_USER ≠ engine emit. Distinct from RahulBalakavi/claude-code-jev and codebam/jev-guardrails. Do not merge .claude/settings.json into examples/. Cousin, not this sidecar.

jev-voice-gate is a local voice gate via OpenJev NLI, not TypeSafe Jev. Quoted: Это не гарантированная замена wake word. OpenJev оценивает текст после распознавания. Whisper hallucination. Thresholds 0.40 / 0.22 are не калиброванные вероятности. After accept: без инструментов. Не включайте --yolo. Distinct from herdr-jev. Do not merge into examples/. Cousin, not this sidecar.

alp-pr-review is an ALP line: Review → Jev-routing → squash-merge or Godkend merge portal. Quoted: Den får aldrig PR-titel, -beskrivelse eller diff. Quoted: ikke kan tale sig selv til automerge. Quoted: Kan Jev ikke nås, lukker linjen sikkert. Quoted: Ikke en erstatning for branch protection. Tærsklerne er ikke tunede (needs_human < 0.25, risk under Medium, confidence over 0.6). Distinct from ohernandezdev/jev-pr-review and metalbear-co/jev-auto-approve. Do not merge into examples/. Cousin, not this sidecar.

youtube-judol-userscript-jev is a Tampermonkey userscript that flags Indonesian judol spam via classifier.dev jev with no API key. confidenceThreshold 0.6 (uncalibrated) → unsure. discussing gambling ≠ promotion. Distinct from rspamd-jev / jevmod / x-spam-filter-typesafe. Cousin of classifier-dev. Do not merge into examples/. Cousin, not this sidecar.

Postmark is a Next demo: tone / virality / cringe via TypeSafe Jev; code stamps cringe ≥ 0.6 / virality ≥ 2.2. GitHub description: LinkedIn post classifier; README never mentions LinkedIn — advertised description ≠ shipped UI. Model jev-latest; missing key → 500. Distinct from ashafizullah/jev-linkedin. Do not merge into examples/. Cousin, not this sidecar.

shipit-gate is a TypeSafe Jev deploy/ship gate (shipit check) as a CLI, git pre-push hook, or GitHub Action. Code collects time/git/diff/tests/env; one Jev call returns should_block, deploy_confidence, rollback_risk, blast_radius. Default blockOn: honor should_block, minConfidence 0.5, maxRollbackRisk 0.7, blockBlastRadius ["critical"]. Quoted FAQ: Does this replace my CI? No. Quoted: Rejects fail closed (exit code 2). Override: shipit check --force or git push --no-verify. Demo ./demo/run.sh uses a mocked Jev verdict. Model typesafe-ai/jev via Vercel AI Gateway. Uncalibrated 0.5/0.7 floors; tests-pass is a signal Jev sees, not a merge grant. Soft-score-as-hard-ship. Do not merge the pre-push hook into examples/. Cousin of commitjev / jev-ci-selector, not this sidecar.

jev-brig is a Claude Code PreToolUse Bash AST allow/ask/deny hook. Not TypeSafe Jev — name collision (jev CLI); bashlex → effects → policy. Quoted: jev-brig is a guardrail, not a boundary. Judges only commands Claude waved through via allow rules; no allow rules → silent on everything. Unparsable / runtime path → ask — never a silent allow. Default auto_approve off: allow is silence (only ever restrict). yolo = no opinion. Git pre-commit/pre-push are the actual floor. 99 tests. Distinct from TypeSafe Jev / thevibeworks/jevgate. Do not merge into examples/. Cousin of yolo-shell / construct-auto-classifier / jev-bouncer, not this sidecar.

JevGuard-NSFA default branch develop; public tree at capture is .gitignore only; description null; size 0. advertised Guard ≠ shipped source. Watch; do not invent mechanics. Distinct from alsoleg89/jev-guard / alsoleg89/jev-bouncer / pablozr/JevGuard / leepokai/jev-guard / seb4ez/jevguard / codebam/jev-guardrails. Do not merge into examples/. Cousin, not this sidecar.

jevengineeringgate is a calibrated coding-agent risk gate: L0 deterministic (never referred to the model) then L1–L4 TypeSafe Jev. Quoted: The gate never says yes — PreToolUse emits deny, ask, or nothing (allow would bypass the host). Fitted on 26 labeled cases: 0/26 wrong, 25/26 primary-label, 0 unsafe, min margin 0.025. Quoted: Is this a security boundary? No. Jev is advisory, never authorization. Outage: fail-open for non-alarming; ask for destructive patterns. JEV_HOOKS_DISABLE=1. 48 offline tests. Distinct from thevibeworks/jevgate / totally-tim/jev-gate / ktsu2i/jevgate-action. 26-case fit is not a rh-guard ROC. Do not merge hooks into examples/. Cousin, not this sidecar.

lgtm (@stardeckai/lgtm) is a Jev linter for tests that pass but prove nothing (would-pass-if-broken, mocks-seam-under-test, swallowed-error-as-success, …). Quoted: lgtm is advisory by default: it prints findings and exits 0. Add --fail once findings are clean enough to block. Holdout precision 1.00 on their corpus — not a rh-guard ROC. Weakened-test cousin of typesafe_agent_gates SpecReviewMiddleware. Do not merge /lgtm skills into examples/. Cousin, not this sidecar.

openclaw-tool-prefilter is an OpenClaw before_prompt_build skill/tool catalog shrink: Jev thresholdAnyTool 0.35 (500ms) → toolsAllow: [] else pass-through. Quoted: Bulletproof Fail-Open Safety — timeout/error never blocks dialogue. Quoted Zero Hallucination is theater (catalog prune ≠ no tool calls). catalog shrink ≠ deny. Do not merge into examples/. Cousin of jev-routing / omo-jevlike-router, not this sidecar.

pi-jev-helm is a Pi extension: Jev classifies a unit of work and temporarily selects a Pi model. Fail-open to Baseline Model. Default confidenceThreshold 0.75 (uncalibrated); OpenRouter default, TypeSafe on explicit selection; one 2500 ms attempt, no retries. Quoted: a future Safety Gate and Verifier are separate, uncommitted exploration directions — not this release (v0.2.0 preview). Distinct from pi-jev-approver / pi-jev-gate / pi-jev-guard / pi-jev-permit / pi-jev-control. Routing ≠ permission. Do not merge into examples/pi-extension.ts. Cousin of slo-router / hermes-switchyard, not this sidecar.

jev-claude-controller (jcc) is a System-1/2 coding agent: Python owns the loop; Jev returns a candidate id, never a command/path. Quoted: no function in the safety layer accepts a model signal. Quoted: The thresholds are uncalibrated. Quoted: No claim about which arm is better appears anywhere in this repository. Not a Claude Code plugin. Do not merge into examples/. Cousin of jev-dspy-control-plane / construct-auto-classifier, not this sidecar.

ask-jev is a fail-open advisory CLI (choose / check / purify) with a 280ms hard deadline. Quoted SKILL: never use a verdict to grant permissions, execute an action, certify truth or promote memory. Dual floor: choose needs confidence and winner p ≥ 0.85. Remote only with HARNESS_JEV_ALLOW_REMOTE. 146 mocked tests. GPL-3.0. Do not merge into examples/. Cousin of jev-use / typed-gate, not this sidecar.

switchboard GitHub description: Cost-aware LLM router on Cloudflare Workers & D1 with TypeSafe Jev classification. Public tree empty (409) at capture. advertised router ≠ shipped source. Distinct from hermes-switchyard. Watch; do not invent mechanics. Do not merge into examples/. Cousin of slo-router, not this sidecar.

FastRisk-Jev is a Gradio Space: OpenRouter typesafe/jev-1.13; code maps is_fraudulent noul ≥ 0.80 → BLOCK, ≥ 0.35 → STEP-UP, else APPROVED. No env-key fallback. Quoted README: 0% Type Errors / Calibrated Probabilities — theater. UI halt labels are not a freeze (cousin of jev-transaction-guard TRIP≠freeze). Report markdown includes PII plus last-6 of the user key. Do not merge into examples/. Cousin, not this sidecar.

jev-resume-match (Job Match) scores a resume vs a role via TypeSafe Jev; code combines typed scores. Pin jev-1.13.0. Quoted: Scores are a guide to the text as written, not a hiring prediction. Resume text is sent to TypeSafe. Demo cookie / in-memory cap is not a reliable public spending limit. Distinct from ashafizullah/jev-linkedin / fatelei/yueli / natemoo-re/bias-bench. Do not merge into examples/. Cousin, not this sidecar.

yueli (阅历) is a desktop batch resume classifier (Choice role/level, Score 0–10, Noul padding). Quoted: 仅供参考，不构成招聘决策依据. Model jev-latest; resume text to api.typesafe.ai. Distinct from jev-resume-match / jev-linkedin / bias-bench. Do not merge into examples/. Cousin, not this sidecar.

ismailakdag/typesafe-jev is a sahibinden listing filter: 22 Jev questions; Quoted: Kararı yine kod verir. Quoted: Yargılar karar desteğidir, karar değil. Quoted: Jev metin üretmez. Turkish is not Jev's primary training language. Distinct from the TypeSafe product and russleyshaw/typesafe-jev-gate. Do not merge into examples/. Cousin, not this sidecar.

Mailbox-Boy-With-Jev public tree empty (409) at capture; description null; size 0. advertised mailbox ≠ shipped source. Distinct from vynnlee/jev-mail / muhammedilyasy/jev-mail / pantos12/mailverdict. Watch; do not invent mechanics. Do not merge into examples/. Cousin, not this sidecar.

jevshield (pip install jevshield, Apache-2.0) is a TypeSafe Jev decorator / LangChain wrap (@guard, guard_langchain_tool). Quoted README: Sub-100ms, non-autoregressive runtime security gate. Dual-Validation Matrix: Choice safe/medium_risk/critical_danger + Noul is_destructive + Score blast 0–4. Code blocks if (Tier ≥ Threshold ∧ P_destructive > 0.75) ∨ (BlastRadius ≥ 3 ∧ IsDestructive = True). Quoted SECURITY.md: policy fail-closed; the local heuristic fallback is not a security boundary; interactive is TTY-only. No key → is_mock_mode _heuristic_fallback (named degraded backend; heuristic confidence 0.99 / 0.85). Timeout 2.0s; 429/529 retry once then heuristic. Distinct from uberto/jev-brig (name collision; jev-brig is Not TypeSafe Jev). Uncalibrated 0.75 noul as a hard halt is theater; treating heuristic 0.85/0.99 as Jev is advertised backend ≠ served. Do not merge into examples/. Cousin of construct-auto-classifier / AgentGhost / yolo-shell / jev-bouncer, not this sidecar.

pi-warden (npm:pi-warden, MIT) is a Pi extension: Action / Rules / Slop / Stuck / Done-check / Security / Runaway / Subagent. Default steer (hold → agent, not user); confirm; advise never blocks. Quoted FAQ: It is advisory, not a sandbox, and it runs alongside pi-ward / pi-sensitive-guard. Patterns set the floor; Jev can only raise it; a plan never removes a hold. failOpen: true (TypeSafe fail → allow + warning). Irreversible 0.5 warn / 0.7 hold; off-task never holds; should_proceed steers never holds. README evals: 150 paired runs control 6 vs Warden 0; overnight 13,952 cases / 109 cycles — quoted project-maintained benchmarks, not universal claims — not a rh-guard ROC. Distinct from claude-jev-warden / pi-jev-guard / pi-jev-helm / pi-jev-permit. Do not merge into examples/pi-extension.ts. Cousin of pi-jev-guard / clear-head / yolo-shell, not this sidecar.

jev-demo-triage is a mock incident-triage (GLM via OpenRouter). Modes: baseline / tool (ask_jev) / gate (blocks run_shell/restart_service; fails closed if Jev errors) / both. rollback_deploy and escalate_to_human are not gated. Tuned policy written after Run 1 (not blind). Quoted: Jev did not beat baseline on pass rate (Run 2 composite baseline 17/21, tool/gate/both 16/21); N is 3 per cell. Distinct from ThyFriendlyFox/jev-triage / boldbug1/jev-triage / jev-logtriage. Treating Run 1 simple-restart 0/3 as a Jev-is-unsafe ROC, or the 0.5 AutoModeMiddleware floor as calibrated safety, is theater. Do not merge into examples/. Cousin of jev-vs-llm-guardrails / llm-vs-jev / FastRisk-Jev, not this sidecar.

volumetric-intelligence is a typed agent mesh for video takes / table→dashboard. Quoted README: Jev is the typed gate (Choice / Score / Noul), never the runtime. Quoted: Fail closed. Compose only on GREEN. UI: Jev classifies. Code gates. Schema pin jev-1.13.0; gate ship/hold/block at act 0.72 / dangerous_export 0.5 / sensory_load 7. /api/walk is rehearsal presets (not live Jev); quoted note: Rehearsal schema. Wire TypeSafe Jev as a step without changing questions. Uncalibrated 0.72/0.5/7 as a ship grant is theater. Do not flatten pass|fail. Do not merge into examples/. Cousin of gold-assay / typed-gate / hermes-switchyard, not this sidecar.

Jev-Auto-Router (renamed from Codex Auto Router; Apache-2.0) is a Codex skill: Jev Choice → Policy Guard → native child. README/CONTEXT/spec at SHA 5e65bf3 are Jev Auto Router (remaining Codex Auto Router strings are historical/stale-identity sweeps). Quoted spec: Jev is forbidden Execution, generating specifications, granting authorization. Quoted: Policy Guard Deterministic ALLOW(plan) or DENY(reason) — ranking/selecting alternatives forbidden. Quoted SKILL: The Guard's only verdicts are ALLOW (execute exactly the plan) and DENY → this unit runs in Root. Pin jev-1.13.0. Quoted README.en: real host evidence + benchmark qualification are still UNVERIFIED, so automatic delegation is off by default. Quoted: No evidence means no production delegation; passing static tests do not constitute runtime qualification. Dashboard / ccusage are observers only. Distinct from jev-model-router / jev-routing / hermes-jev-router / pi-jev-helm. Claiming quota savings before qualification, or treating a Jev route as permission, is theater. Do not merge into examples/. Cousin of jev-routing / slo-router / hermes-switchyard / skill-broker, not this sidecar.

jev-web-analyzer is a Next demo: SaaS URL → ReplyNodes Markdown → Jev via Vercel AI Gateway (typesafe-ai/jev; public alias jev-latest moving). Quoted: It is a developer demo, not a ReplyNodes marketing site, SEO score, objective company or product rating, AI detector, customer-research replacement, or definitive SaaS score. Website text is untrusted state. There is no mocked provider. Unofficial, not affiliated with TypeSafe AI. Not a PreToolUse gate. Distinct from unslopify / Winnow / gold-assay / Postmark. Treating founder judgments as a score or grant is theater. Do not merge into examples/. Cousin of gold-assay / Postmark, not this sidecar.

ai-provider-triage-comparison is three arms on five support tickets: openai-luna-none, deepseek-flash-none, vercel-jev. Asymmetric (Jev via Gateway). Latest run 2026-09-20T12:23:23Z sequential; quoted not a controlled benchmark. Unanimous 2/5. Jev booleans probability >= 0.5; severity clamp(floor(score+0.5),0,4). Quoted: These statements are generated only from the committed JSON and describe this run, not a general model ranking. Distinct from jev-vs-llm-guardrails-intent-router / llm-vs-jev / jasonli0226/jev-demo-triage / FastRisk-Jev. Ranking from one 15-call run, or 0.5 as calibrated safety, is theater. Do not merge into examples/. Cousin of llm-vs-jev / jev-demo-triage, not this sidecar.

zerosweep is a Next.js 14 email triage showcase (MIT): TypeSafe Jev via /api/triage/typesafe; code in src/lib/safetyGate.ts owns CONFIDENCE_SAFETY_THRESHOLD 0.85. Confidence < 0.85 → human_review (quoted: NEVER take an automated destructive or aggressive routing step). phishing_attempt or safeToTrashProb ≥ 0.85 → trash_quarantine. Quoted README: Zero Format Errors. Not a PreToolUse gate. Distinct from vynnlee/jev-mail / muhammedilyasy/jev-mail / pantos12/mailverdict / ohernandezdev/jevmod / jasonli0226/jev-demo-triage / Mailbox-Boy. Treating 0.85 auto-trash as a safety envelope, or Zero Format Errors as a safety proof, is soundness theater. not a rh-guard ROC. Do not merge into examples/. Cousin of jav-email-cascade / jev-mail / mailverdict, not this sidecar.

jev-codex-router is per-turn Codex routing (MIT): Jev classifies; code picks luna / sol / astra (or Codex-dry tandem). Quoted README: Fail-open — any Jev error keeps the turn alive. Kill switch sentinel routes without Jev. Confidence below 0.5 does not downgrade to cheap: fallback is middle tier (Sol), not frontier. Quoted BACKTEST.md: −59.9% vs full-frontier on 237 turns ($871 → $349); prompt-cache invalidation from switching models not modelled. Routing ≠ permission. Distinct from miniLV/Jev-Auto-Router / jev-model-router / jev-routing / hermes-jev-router / pi-jev-helm. Treating −59.9% as a rh-guard ROC, 0.5 as a safety envelope, or this router as Jev-Auto-Router, is theater. Do not merge into examples/. Cousin of jev-routing / slo-router / Jev-Auto-Router, not this sidecar.

pi-jev (@y0usaf/pi-jev) is a Pi extension: bash/write/edit gate + bash output judge + jev_ask. Quoted README: Shadow mode is the default. Quoted AGENTS.md: The gate fails open by design. Thresholds: destructive 0.90 / exfiltration 0.70 / beyond_scope 0.85 / impact 2.50. Output judge never blocks. Quoted Calibration: Six states and a handful of runs each is a smoke calibration, not a labelled evaluation set. It is enough to reject obviously wrong thresholds and not enough to switch the gate to enforce by default. Distinct from fivethirty/pi-jev-gate / Reindeer-AI/pi-jev-guard / harshwasan/pi-jev-sentinel / JasonHZS/pi-jev-command-guard / kurihada/pi-jev-permit / phin-tech/pi-jev-approver / BubbatheVTOG/pi-jev-tool-guard / DevMortimer/pi-warden. Treating the smoke table as an enforce grant, or hard-gating those uncalibrated floors as safety, is theater. Do not merge into examples/pi-extension.ts. Cousin of pi-jev-gate / pi-jev-guard / pi-warden, not this sidecar.

pi-jev-prune is a Pi context prune: Jev Noul "needed again?" then recoverable stubs. Quoted README: default dry; Fails open; Ephemeral — session file untouched. Default threshold 0.25. Quoted: below p 0.15, 1 of 28 outputs was used later; 0.15–0.30 ≈ random. Quoted: a no-model code rule (read later superseded by edit/read of the same file) did much of the useful pruning. Distinct from pi-jev-compact / opencode-context-pruner / nanoprune / jev-prune-kit. prune ≠ deny. Treating 0.25 as a safety deny is theater. Do not merge into examples/pi-extension.ts. Cousin of pi-jev-compact / opencode-context-pruner / jev-prune-kit, not this sidecar.

jev-guard-mcp is an experimental browser-only MCP (MIT): Codex intent → isolated Playwright → code-owned candidate IDs → Jev Choice → human approval → execute. Pin jev-1.13.0. Min conf 0.80. Quoted README: Possession of a preview token is the technical authorization to execute; the server cannot independently attest human approval. Quoted: experimental research; not a general-purpose browser agent. TypeSafe Jev cousin. Distinct from leepokai/jev-guard / alsoleg89/jev-guard / codebam/jev-guardrails / jonathanavis96/jev-kit. Treating 0.80 as a safety envelope, or a preview token as attested human approval, is theater. Do not merge into examples/. Cousin of jev-kit / open-jev-approvals, not this sidecar.

jev-router is TypeSafe Jev role routing (MIT): jev-gate in front of OpenCodex + opt-in CLI. Quoted README: Jev does not pick model ids. It picks a role. Failures pass through. Without a key: pure proxy (error-pass). SPEC confidence_floor 0.6. Quoted: Fixture numbers in artifacts/ test the evaluator. They are not a live quality claim. Routing ≠ permission. Distinct from TypeSafe same-name justinhsu1477/jev-router (LiteLLM cloud/local; ≥0.6 cloud ≤0.4 local) / robbyczgw-cla/hermes-plugin-jev plugin ID jev-router / Mandrilsquad1441/jev-model-router / rsdkrasen/hermes-jev-router / 0xNatoshi/jev-codex-router. Treating 0.6 as a safety envelope, or fixtures as a ROC, is theater. Do not merge into examples/. Cousin of jev-codex-router / Jev-Auto-Router / slo-router, not this sidecar.

pi-jev-router is a Pi OpenRouter model router (TypeSafe Jev). /router shadow recommend only (default); /router auto switches. Quoted AGENTS.md: Jev output is evidence, not truth. Benchmarks: writing 89% cheaper; code 88% cheaper with empirical_cost — not a rh-guard ROC. Distinct from TypeSafe same-name rizafahmi/pi-jev-task-router (per-prompt pi.setModel(); owns the model while on; keyword heuristic fallback) / Z761293629/pi-jev-helm / goodruizhan/pi-jev-control / reallygood83/jev-router. Routing ≠ permission. Do not merge into examples/pi-extension.ts. Cousin of pi-jev-helm / jev-codex-router, not this sidecar.

JEV-Dual-Spectrum-Phishing-Guardian is a Vite/Express phishing dual-spectrum dashboard (MIT): TypeSafe @typesafe-ai/sdk model jev-latest. Spectrum 1 V-Triad (Authority / Fear / Urgency) vs Spectrum 2 GenAI (Vanilla Tone / Structural Rigidity / Temporal Blindness / Emotional Inflation). Threat 0–100: Safe 0–20 / Suspicious 21–60 / Malicious 61–100. Missing key throws (TYPESAFE_API_KEY environment variable is not configured) — no named lexical fallback. Code comment: Section 4: Counter-Measures are exemplary and decoupled from individual verdicts. Not a PreToolUse gate. Distinct from sysadarsh/zerosweep / pantos12/mailverdict / vynnlee/jev-mail / ordepas/system1-fraud-interceptor-demo / FastRisk-Jev. Treating Malicious 61–100 as a safety envelope is a shipit-gate anti-pattern. not a rh-guard ROC. Do not merge into examples/. Cousin of zerosweep / mailverdict / jev-mail, not this sidecar.

slop-guard is a Ruby guideline-driven review bot: TypeSafe Jev. Quoted README: code identifies what to inspect, Jev judges it, and explicit rules decide what to report. Quoted report-schema: severity always advisory; the reviewer never blocks. Exit 0: Review completed (concerns may be present). Distinct from adamnroman/slop-filter / SwastikGorai/unslopify / stardeckai/lgtm / Not-TypeSafe-Jev uberto/jev-brig. Treating advisory exit 0 as a merge grant is a shipit-gate anti-pattern. Do not merge into examples/. Cousin of lgtm / Abide / jev-reviewer, not this sidecar.

jev-corrective-rag is Corrective RAG where every decision gate is typed System One vs LLM judge (MIT). Headline table: p50 4.0×, LLM calls 7.2× fewer. Quoted Honest status: Jev decision gates | Stubbed — no API key yet. Keyword heuristic sleeps 300 ms; bench prints PARTIAL. Quoted gates.py: stub is NOT a simulation of Jev's quality. Code VERIFY_CONF_FLOOR = 0.60; RELEVANCE_CONF_FLOOR = 0.50; AUTO_ANSWER when confidence ≥ floor. Distinct from Nixz0824/rag-jev / Ormus-Solutions/karat-filter. Treating stubbed 4.0× / 7.2× as a rh-guard ROC, or 0.60 AUTO_ANSWER as a safety envelope, is theater. Do not merge into examples/. Cousin of rag-jev / karat-filter, not this sidecar.

jev-issue-radar is evidence-based GitHub duplicate triage (MIT): TypeSafe Jev via OpenRouter. Quoted README: It never closes issues, adds labels, or posts comments. Quoted SECURITY.md: The application does not close issues or write comments. Initial smoke 2/4 matched labels — not a rh-guard ROC. Confidence ≥ 0.8 is a conservative product rule, not a calibrated accuracy guarantee. Distinct from sysadarsh/zerosweep / jasonli0226/jev-demo-triage / Umbylicus/umby-jev-stack. Treating 2/4 or 0.8 as a close-issue grant is theater. Do not merge into examples/. Cousin of jev-demo-triage / umby-jev-stack, not this sidecar.

jev-review is a TypeSafe diff triage filter via Vercel AI Gateway typesafe-ai/jev. Flag if needs_review/security_concern p ≥ 0.5 or risk.score ≥ 2. Quoted SKILL: It never approves or rejects anything. Quoted: non-zero exit is "couldn't triage," not "diff is clean." Distinct from TypeSafe same-name NiazMorshed2007/jev-review (MCP quality scores; agent changes code) / egma-ai/jev-reviewer / ohernandezdev/jev-pr-review. Treating 0.5 / risk≥2 as a merge grant is a shipit-gate anti-pattern. Do not merge into examples/. Cousin of jev-reviewer / prune-review / slop-guard, not this sidecar.

jcr (Jev Capability Resolver, MIT, private jcr 1.0.0, @typesafe-ai/sdk) is TypeSafe Jev MCP resolve_capabilities over a nested capability tree, with Claude and Codex comparison harnesses. Quoted README: JCR returns documentation. It does not execute commands. Quoted: The included harnesses also stop at explaining the steps needed to carry out a task. Quoted: Both modes only looked up instructions and explained the steps required for each task. They did not execute those steps. Quoted: The commands being documented can be deterministic. The model-based choice of which command fits a request is probabilistic. Beam defaults: width 3, JCR_BAND_RATIO 0.6, maxDepth 16. Catalog 11 groups / 960 nodes / 11,360 items. Ambiguous / no-match / depth-limit are resolver outcomes, not merge grants. Routing ≠ permission. Treating capability context as attested approval to run is theater (preview-token analog of jev-guard-mcp). jev-latest moving alias. sol-vs-opus5-20: 80 runs; input 85% / 23%, cost 67% / 16% vs skills — lookup comparison, not a rh-guard ROC. Distinct from raniellimontagna/jev-guard-mcp / reallygood83/jev-router / justinhsu1477/jev-router / robbyczgw-cla/hermes-plugin-jev plugin ID jev-router / TypeSafe same-org NiazMorshed2007/jev-review. Cousin of jevex / enzyme / dgp / skill-broker. Do not merge into examples/. Cousin, not this sidecar.

JevPR is a GitHub App (Apache-2.0, jevpr 0.1.0, typesafe-sdk>=0.7.0) that routes PR review via TypeSafe Jev Nouls (breaking_api_change / security_sensitive / production_infra_change) plus Score 0–9 overall_risk and per-file scores. Code computes a composite (0.45 model + 0.35 signal + 0.20 top-3 file weights) then DecisionLevel.from_score: LOW if score < 3.5, NORMAL < 7.0, else SPECIALIST. YAML LOW: action: approve maps to GitHub event: "APPROVE". Quoted README: This Project is Under Development and can contain bugs. Additionally Jev is an AI model, and can make mistakes. Webhook reads payload["files"] (not the standard GitHub PR event files list). Treating LOW auto-APPROVE as a merge grant is hard-gating soft judgment / shipit-gate theater. Distinct from ohernandezdev/jev-pr-review (shadow until calibrated) / metalbear-co/jev-auto-approve / MaxIvanyshen/jev-review. Do not merge into examples/. Cousin of jev-auto-approve / jev-pr-review / ci-gatekeeper, not this sidecar.

model-switch is a local Codex model/reasoning router (MIT) powered by TypeSafe Jev. Quoted README: Experimental. Start in observe mode. Quoted: Fail open — if Jev errors or times out, the original Codex request is forwarded. Quoted: Observe first — routing is disabled by default. minConfidence 0.65. Candidates gpt-5.6-luna / gpt-5.6-terra / gpt-5.6-sol; Astra excluded. No TYPESAFE_API_KEY → passthrough. Routing ≠ permission. Treating 0.65 route as a safety envelope is confidence theater. Distinct from Mandrilsquad1441/jev-model-router / 0xNatoshi/jev-codex-router / miniLV/Jev-Auto-Router / reallygood83/jev-router / philippdubach/pi-jev-router. Do not merge into examples/. Cousin of jev-codex-router / Jev-Auto-Router, not this sidecar.

typesafe-pi (typesafe-pi 0.1.1, @typesafe-ai/sdk) is a consent-gated Pi typesafe_judge (Choice / Score / Noul). Disabled by default; /typesafe enable (or PI_TYPESAFE_ENABLED=1 for headless). Quoted README: Results are model judgments—not proof or authorization. Quoted promptGuidelines: never as permission to perform an action. Fold consent/gate only — skip the bundled workflow skill. Distinct from DevMortimer/pi-typesafe / twilwa/pi-typesafe / nardinmarcus/pi-jev-typesafe / name-lookalike pfuller/Typesafe-Pi (2011 Scala tutorial, not TypeSafe Jev). Treating a judgment as authorization is theater. Do not merge into examples/pi-extension.ts. Cousin of pi-jev-approver / pi-warden, not this sidecar.

the-jev-enator is three Claude Code hooks (MIT, stdlib Python): danger gate (PreToolUse, enforcing), failure notice (PostToolUse, enforcing inject), completion check (Stop, log-only). Quoted README: all three fail open. Quoted: The completion check does not block anything by default. Model jev-latest (moving alias). Danger deny floors 0.80 / 0.90 uncalibrated. Fixture 23/23, 19/19, 12 synthetic transcripts — not a rh-guard ROC. Quoted: nearly all from one developer's machine. Enforcing the danger gate on those floors is hard-gating soft judgment / safety theater. Distinct from thevibeworks/jevgate / totally-tim/jev-gate / RahulBalakavi/claude-code-jev / jonathanavis96/jev-kit / alsoleg89/jev-bouncer. Do not merge into examples/. Cousin of claude-code-jev / jev-kit / jev-bouncer, not this sidecar.

jev-vault-gate is a Claude plugin: Jev noul gate (default 0.6) then topic Choice; raw capture is verbatim (not a summary). Quoted README: never blocks or alters the actual turn. Quoted: Nothing is ever deleted automatically. Model jev-latest (moving alias). plugin.json 0.3.0 ≠ package.json 0.1.0. Distinct from Dharundp6/jev-carryforward / samdotmak/jev-recall / chopratejas/invalidate. Treating 0.6 capture as a safety grant, or safe_to_delete as auto-delete, is theater. Do not merge into examples/. Cousin of jev-carryforward / jev-recall, not this sidecar.

dsh-jev-tools (dsh-jev-tools 0.1.3, MIT) is a DeepSeek Harness plugin: prune long tool output, screen fetched pages for injected instructions, suggest a skill, plus jev_ask / jev_gate. Quoted README.en: it ranks, it never thresholds (the probabilities are a good ranking and a bad threshold); deterministic floors; fail-open (every failure path passes content through untouched). Quoted: With no key the plugin is completely inert. Model jev-latest (moving alias). jev_gate is the only inverted fail-open: unclear paths land on escalate (a gate that fails open fails all the way to "approved"). Quality evidence: 8/8 on eight self-authored Chinese three-way samples — not enough to state an accuracy / not a rh-guard ROC. Shadow prune (prune.shadow) judges and records, changes nothing. Screen is advisory; never blocks a call. Distinct from tr1v3r/dsh-jev / codebam/dsh-jev-guardrails / 7starsseeker/dsh-jev-guard. Treating ranks as thresholds, or 8/8 as a ROC, is theater. Do not merge into examples/. Cousin of dsh-jev-guardrails / dsh-jev-guard / pi-jev-prune, not this sidecar.

JEV-Prompt-Injection-Guardian is a Vite/Express prompt-injection quarantine dashboard (MIT): TypeSafe Jev (jev-1.13.0) then Gemini then local heuristic. Actions BLOCK / QUARANTINE / INSPECT / MONITOR / ALLOW; 80%+ BLOCK. Code clamps the 0–9 Score into the Choice band (Critical → max(score, 80)). Heuristic fallback is not live Jev. Distinct from YuyaForest/JEV-Dual-Spectrum-Phishing-Guardian. Treating BLOCK 80% as a safety envelope, or heuristic fallback as live Jev, is theater. Do not merge into examples/. Cousin of Dual-Spectrum-Phishing-Guardian / zerosweep / mailverdict, not this sidecar.

jev-healthcare-support-router is a TypeScript demo: Jev classifies intent/urgency; TypeScript routes. Quoted README: Jev → makes the decision / TypeScript → controls the action. Code: urgency ≥ 0.8 or confidence < 0.7 → Human Support. Quoted scope: does not make medical diagnoses, treatment recommendations, clinical decisions, or insurance approval decisions. Treating 0.8/0.7 as clinical authority is theater. Do not merge into examples/. Cousin of jev-demo-triage / FastRisk-Jev, not this sidecar.

prMonster is a FujiNet firmware PR triage harness: deterministic gates then Jev; piles READY / NEEDS REVIEW / BLOCKED. Quoted README: It never touches a pull request on its own. Quoted: Merging is never offered. Human confirm: type CONFIRM and your name. ALLOW_GITHUB_WRITES default off. reviewer_directed_text hard block at 0.7. No key → mock mode. confidenceFloor 0.5. Quoted: Answers are calibrated probabilities, not facts. Distinct from HexyeDEV/JevPR / ohernandezdev/jev-pr-review / MaxIvanyshen/jev-review. Treating READY as a merge grant is shipit-gate theater. Do not merge into examples/. Cousin of JevPR / jev-pr-review / jev-review, not this sidecar.

dsh-jev is a DSH monorepo: @dsh-jev/core (choice/score/noul; degrade-on-failure, never throws), MCP jev_choice/jev_score/jev_noul, per-turn router, effort plugin. Quoted router README: Never registers or modifies LLM routes. Quoted: Shadow-run by default. Quoted: Degrades, never breaks. Local file plugins must use name: not path: (path: is silently ignored). VERIFY.md: 35/35 mocked vitest; fake-key tools/call → jev: degraded (HTTP 403). Distinct from HorusJiang/dsh-jev-tools / codebam/dsh-jev-guardrails / 7starsseeker/dsh-jev-guard. Routing ≠ permission. Do not merge into examples/. Cousin of dsh-jev-tools / dsh-jev-guardrails, not this sidecar.

hermes-jev is an async Jev nervous system for Hermes Agent. gate_mode default off; gate_scope default selective; min_confidence 0.80. Quoted SECURITY.md: Do not treat a Jev probability as proof of correctness. Quoted README: enforce — high-confidence BLOCK can block; APPROVAL, low confidence, or provider failure route toward human approval. Catalog template v0.2.1.2; development line v0.2.2.dev4 (non-catalog). Live suite (theirs): $0.000095088 / 419.276 ms — not a rh-guard ROC. Distinct from robbyczgw-cla/hermes-plugin-jev / rsdkrasen/hermes-jev-router / kerpopule/hermes-jev-skills / russleyshaw/typesafe-jev-gate / ajensenwaud/hermes-jev-plugin. Treating 0.80 as a safety envelope, or catalog 0.2.1.2 as the 0.2.2.dev4 line, is theater. Do not merge into examples/. Cousin of hermes-plugin-jev / typesafe-jev-gate / hermes-jev-skills, not this sidecar.

win4r/pi-jev-router is a task-boundary Pi model router (TypeSafe Jev). Quoted README.en: Default mode is shadow, with Jev networking disabled. Exact in-memory request hashes. Pin jev-1.13.0. First eval 15/16 on 16 synthetic cases — This measures neither executor task success nor production accuracy / not a rh-guard ROC. Quoted: Production task quality and net savings have not been established. Auto holds when no eligible model; shadow reports while the current model executes. Quoted: Neither mode validates generated code or grants permissions. Routing ≠ permission. Distinct from philippdubach/pi-jev-router / rizafahmi/pi-jev-task-router / Z761293629/pi-jev-helm / goodruizhan/pi-jev-control. Do not merge into examples/pi-extension.ts. Cousin of philippdubach/pi-jev-router / pi-jev-helm, not this sidecar.

sys1 is a System One gateway: hosted Jev plus experimental local Qwen; Node/Bun client. Quoted README: Hosted Jev is disabled by default. Quoted: Local Qwen is an experimental adapter, not a qualified substitute for Jev. Broader tests (theirs): Qwen3 1.7B 32/72, Qwen3.5 4B 44/72 — not a rh-guard ROC; different fixtures are not a measured improvement. Quoted: Do not reuse Jev probability thresholds for generic GGUF output without model-specific evidence. Quoted: a local-only policy also constrains explicit pins; a pin never bypasses the policy. Network listener rejects browser origins; does not authenticate local processes. Wire-compatible ≠ identical judgments. Cousin of githubnext/localjev / NandhaKishorM/laya / razorback16/openjev. Treating 32/72 or 44/72 as a Jev ROC, or loopback as authentication, is theater. Do not merge into examples/. Cousin, not this sidecar.

jev-regime-gate is a Jev regime gate for trading strategy backtests. Quoted README: Research experiment, not investment advice. Code: viable < 0.4 or changeLikely > 0.6 → stand_down; then confidenceThreshold 0.60 / halfSizeThreshold 0.45 size policy. Soft confidence is application policy, not a safety gate and not investment advice. No key → uniform default answers (not live Jev). Treating 0.4/0.6 as investment advice is theater. Do not merge into examples/. Cousin of FastRisk-Jev / jev-transaction-guard, not this sidecar.

model-effort-router is provider-neutral task-DAG decomposition plus (model, effort) routing with optional Jev. Quoted README: No benchmark claims. Quoted: TypeSafe is an unofficial optional integration. Without key: framework-only / dry-run; no external network request. Unknown/malformed responses fail closed. Quoted: default confidence threshold of 0.5 is a conservative, configurable dispatch policy, not an empirically calibrated accuracy claim. Quoted: This project selects a plan; it does not invoke a model provider or execute the resulting tasks. Distinct from Mandrilsquad1441/jev-model-router. Treating 0.5 as accuracy, or a plan as execution, is theater. Do not merge into examples/. Cousin of jev-model-router / model-switch, not this sidecar.

windows2text is a Windows UI Automation screen-to-text MCP server and Jev-gated computer-use loop (windows_list / windows_observe / windows_snapshot / windows_decide / windows_act / windows_step / windows_run). UIA tree, not OCR. Observation and explicit actions work without a Jev key. Quoted MCP.md: A Jev confirm, escalate, or abort gate never executes automatically. Quoted: windows_step defaults to act=false. Jev chooses type/target; the generating model supplies text. Matches the public Jevbridge visible/targets shape. Distinct from tacticocc/Jevbridge. Jev-backed tools send projected accessibility labels and values to TypeSafe. Treating a confirm/escalate/abort gate as auto-exec, or collapsing this into Jevbridge, is theater. Do not merge into examples/. Cousin of Jevbridge, not this sidecar.

JohnsonRan/pi-jev is a Claude-style auto-mode classifier for Pi (TypeSafe Jev). Quoted README: This is not a sandbox. Quoted: The classifier can be wrong. Quoted: This remains a permission aid, not a security boundary. No key: mutating tools ask. Four safety Nouls ask ≥ 0.30 / deny ≥ 0.85; beyond_request never denies. Output screen ≥ 0.85 strip/redact; HTTP errors pass through. Compaction fail-open to Pi. Hand-labelled 3/10 → 0/10 "not a measurement of real-world false-positive or false-negative rates" / not a rh-guard ROC. Distinct from y0usaf/pi-jev / fivethirty/pi-jev-gate. Treating 3/10 as a ROC, or collapsing JohnsonRan into y0usaf, is theater. Do not merge into examples/pi-extension.ts. Cousin of y0usaf/pi-jev / pi-jev-gate / omp-auto-mode, not this sidecar.

PavelLizunov/jev-sentinel is a Rust infrastructure watchdog (probes → Jev → dashboard/Telegram), not a coding-agent hook. Quoted README: the client validates schema and ranges, not the truth of a diagnosis. Quoted: Self-healing currently logs suggested actions without executing commands. Quoted: missing advice is not interpreted as zero risk. Quoted: Schema validity is not evidence that a diagnosis is correct. Quoted: mutation endpoints do not provide application authentication. Quoted: require_confirmation is Not an implemented approval workflow. Illustrative 95.0% / 0.12 is not a measurement / not a rh-guard ROC. Distinct from CompleteTech-LLC-AI-Research/jev-sentinel. Treating 95.0% as a measurement, or collapsing Pavel into CompleteTech, is theater. Do not merge into examples/. Cousin of CompleteTech jev-sentinel / jev-home-assistant-sentinel, not this sidecar.

omapi-overlay is a Nix flake overlay: stock omp pin, thin omapi wrap, skills input, optional Jev/cursor-agent gates. Quoted README: There is no omp source tree in this repository. Quoted: No omp sources here. Default JEV_MODE=shadow; shadow never blocks. JEV_BYPASS=1 skips the router. Missing key: shadow continues unclassified; active fail-closes. Empty findings are not approval. Keys stay in the process environment; the flake does not bake them. Distinct from omp-auto-mode / omp-jev-extensions. Treating the overlay as an omp fork, or empty findings as approval, is theater. Do not merge into examples/pi-extension.ts. Cousin of omp-auto-mode / omp-jev-extensions, not this sidecar.

jev-test-confidence-gate is a support-triage experiment: one graph, one policy, two engines, a confidence gate. Theirs: Jev 163 ms / 87.5% / $0.06 vs gpt-4o-mini 1164 ms / 75.0% / $0.37. Gate caught 0 of 3 Jev routing errors. Confidence separation -0.010. Quoted: 24 invented tickets. Quoted: sample too small to establish calibration. Quoted: untested at adequate power, not refuted. Quoted: the speed and cost claims hold; the calibration claim is not demonstrated. 24-ticket accuracy is not a rh-guard ROC. Distinct from jasonli0226/jev-demo-triage. Treating 0 of 3 or 24 tickets as calibration is theater. Do not merge into examples/. Cousin of jev-demo-triage / jev-vs-llm-guardrails, not this sidecar.

Twitter-keyword-shield is an X (Twitter) userscript: local rules (quoted 0ms) then optional Jev. Default threshold 0.5 (uncalibrated). Key in GM_setValue. README "sub-100ms" is marketing, not a rh-guard ROC. Distinct from yonsakhan/x-spam-filter-typesafe / bohutang/sift. Treating 0.5 as calibrated, or collapsing this into x-spam-filter-typesafe, is theater. Do not merge into examples/. Cousin of x-spam-filter-typesafe / sift, not this sidecar.

Laya-GuardRails-Harness is a Claude PreToolUse/PostToolUse/Stop harness: Rules → Laya → Policy → Frontier/Human → Execution. Quoted README: Laya is a semantic risk sensor, not a security authority. BLOCK comes from rules or policy, never from a Laya label. Default shadow. Repo policy is untrusted (can only tighten). Quoted: Human approval is approve this exact action once. Confidence is chosen-label probability, not entropy; quoted low confidence escalates, never allows. Distinct from NandhaKishorM/laya. Treating a Laya label as BLOCK, or collapsing this into laya, is theater. Do not merge into examples/. Cousin of laya / hermes-skill-router, not this sidecar.

hermes-jev-approvals is a Hermes approvals.mode: smart reviewer (TypeSafe Jev). Quoted README: Scope: approvals only. Quoted: Not a sandbox. Quoted: It only sees what core's regex flags. Policy lives in code. Theirs: 156 real commands, 9.8x faster, 4.2x fewer interruptions vs one aux chat LLM on one machine (not a universal Jev speedup). Independent live-sandbox: 1.24x Mini/Jev reviewer-time (28 synthetic commands / 156 observations, v0.2.1 9ad1901). Thresholds tuned on one machine; not held-out. Complementary to jev-decisions (0.2.1 smart approvals adapted from this tree). Distinct from rsdkrasen/hermes-jev-router. Treating 9.8x as a universal speedup, or this reviewer as a sandbox, is theater. Do not merge into examples/. Cousin of jev-decisions / typesafe-jev-gate, not this sidecar.

scx-router is a GLiClass model router (scx-admin/scx-router-v0.1). Candidate labels can change at inference. Example threshold 0.5. Not TypeSafe Jev. Same class as the degraded lexical/GLiClass fallback here, not a calibrated substitute. Treating 0.5 as a Jev gate is theater. Do not merge into examples/. Cousin of slo-router / jev-model-router, not this sidecar.

pii-masker is on-device reversible PII masking (GLiNER ONNX INT8; Swift + .NET). Quoted SECURITY.md: Fail-closed. Quoted: It never returns the input unchanged as a fallback. Quoted: Do not read "fail-closed" as "catches everything". Distinct from BuilderChat/PII-Redactor. Treating fail-closed as complete recall is theater. Do not merge into examples/. Cousin of PII-Redactor / guardrails-demo, not this sidecar.

PII-Redactor is REST redact/rehydrate middleware. Default fail-closed. SLM defaults: PII_REDACTOR_USE_GLINER=false, PII_REDACTOR_USE_PRESIDIO=false (heuristic-only). Shadow integration is fail-open (CHAT_REDACTION_FAIL_OPEN=true). A listing that says Presidio + GLiNER + Ollama is the full-detector line, not the default slm branch. Distinct from BlinkWrite/pii-masker. Treating GLiNER/Presidio as default, or shadow fail-open as the envelope, is theater. Do not merge into examples/. Cousin of pii-masker / guardrails-demo, not this sidecar.

guardrails-demo is LangChain AgentMiddleware PII mask/restore (GLiNER person/location; regex email/phone). Theirs: PII masking ~180 ms. Demo, not a production envelope. Distinct from morre95/Laya-GuardRails-Harness. Treating 180 ms as a rh-guard ROC, or this demo as a Laya harness, is theater. Do not merge into examples/. Cousin of pii-masker / PII-Redactor, not this sidecar.

systemone-gatekeeper-war is Uppsala University Library Cora (se.uu.ub.cora) Systemone Gatekeeper WAR (gatekeeperserver). No README. Name collision only: not TypeSafe System One, not a Jev gate. Distinct from hraness/sys1. Collapsing this into TypeSafe System One is theater. Do not merge into examples/. Cousin (name collision), not this sidecar.

hermes-slash-router is a Hermes Agent + Desktop plugin: TypeSafe Jev routes misspelled, shortened, and meaning-based slash tokens. Quoted README: stored routes are never applied automatically. A choice needs confidence ≥ 0.85 and a real available command. No key: fails closed and the draft is left alone. Pin jev-1.13.0. Routing ≠ permission. Distinct from rsdkrasen/hermes-jev-router. Treating 0.85 as a safety envelope, or collapsing this into hermes-jev-router, is theater. Do not merge into examples/. Cousin of hermes-skill-router / hermes-jev-router, not this sidecar.

airlock is a local egress privacy airlock (regex/entropy then Nemotron-3-Nano-4B; optional NVIDIA GLiNER-PII; gate in code). Quoted README: A model never gets to say "this is fine." Quoted: Airlock fails closed. Theirs: linkable disclosure 7.5% ± 0.6 on 243 synthetic cases (not held-out). Distinct from jonathanavis96/jev-kit PreToolUse Airlock. Treating 7.5% as a rh-guard ROC, or collapsing this into jev-kit, is theater. Do not merge into examples/. Cousin of pii-masker / PII-Redactor, not this sidecar.

jevlike-esp32 is an ESP32 demo of vinnylarouge/jevlike. Quoted demo README: This is intentionally a demo, not a production model. Training stays in Python; the scorer runs in Python or ESP-IDF. Routes ASCII to command / weather / complex. Not TypeSafe Jev. Distinct from islee23520/omo-jevlike-router. Treating this demo as a production gate, or as official Jev, is theater. Do not merge into examples/. Cousin of omo-jevlike-router, not this sidecar.

typesafeai-dotnet-sdk is a community .NET client for TypeSafe System One (Noul / Choice / Score). Quoted README: This project is not affiliated with, sponsored by, or endorsed by TypeSafe AI. Quoted: Thresholds belong in your code, next to the decision they gate. Confidence is reported, never invented. An SDK is a policy surface only when the caller puts thresholds in code. Do not merge into examples/. Cousin of the official TypeSafe SDKs, not this sidecar.

RiskAverseTech/toolgate (@riskaverse/toolgate) is a Claude Code PreToolUse hook plus an MCP proxy. Quoted README: Static rules run first. Seven Nouls plus an authorized mitigator. Thresholds deny 0.85 / ask 0.55. Default fail_mode: ask. Unattended ask becomes deny. Policy lives only in ~/.toolgate; a cloned repo cannot reconfigure the firewall. Quoted: toolgate's allow is advisory. Quoted: defense in depth, not a sandbox. Theirs: held-out 20/20 after a truncation bug, 19/20 after 0.6.0, 151 real decisions with 40% ask. Distinct from fdemir/toolgate and ndolinschi/toolgate. Treating 20/20 as a rh-guard ROC, or collapsing this into fdemir, is theater. Do not merge into examples/. Cousin of claude-code-jev / fdemir/toolgate, not this sidecar.

ailerix is a type-safe model router. Quoted README: Jev classifies task families only. Software picks the Pareto point. The only public slug is ailerix/auto. Local System One so the playground works without credentials. Routing ≠ permission. Distinct from slo-router / jev-model-router / reallygood83/jev-router. Treating ailerix/auto as a permission grant is theater. Do not merge into examples/. Cousin of slo-router, not this sidecar.

jev-github-quality-gate (Q-GATE) produces auto_approved / needs_review / blocked. Policy lives in code. Quoted README: Supports shadow mode. Heuristic fallback when Jev is unavailable. Gloss: auto_approved is not a merge grant. Distinct from totally-tim/jev-gate / ohernandezdev/jev-pr-review / HexyeDEV/JevPR / if-ai. Treating auto_approved as branch protection is theater. Do not merge into examples/. Cousin of jev-gate / JevPR, not this sidecar.

win-cu-router is experimental Windows Jev-first computer-use orchestration. Quoted README: Jev chooses among observed candidates. Quoted: planner(checkpoint) currently only returns a stage goal and cannot increase operation permissions. Quoted: the local HTTP bridge's range check is not an operating-system sandbox. Theirs: limited E01 through E05 samples. Distinct from ArronHC/windows2text / tacticocc/Jevbridge. Treating the HTTP bridge as a sandbox, or a Jev pick as auto-exec, is theater. Do not merge into examples/. Cousin of windows2text, not this sidecar.

herdr-jev-router is mandatory agent.spawn routing for Herdr. Quoted README: This project is experimental and mandatory routing is not complete. Treat the enforcement claims as unproven. Fail closed on missing key, timeout, Jev failure, invalid decision, or audit write failure. Protocol v2 recommend then authorize without calling Jev again. Quoted: The caller still cannot choose one. Distinct from muthuishere/herdr-jev (openjev NLI; Nothing here works yet). Treating experimental routing as a proven envelope, or collapsing this into herdr-jev, is theater. Do not merge into examples/. Cousin of herdr-jev, not this sidecar.

grok-jev-router is a Grok Bot decision router. Quoted README: The router is advice; those rules are the boundary. Quoted: Grok Bot obeying the route is instruction-following, not enforcement. Shadow first. Hard rules in code override Jev's lane. Distinct from rsdkrasen/hermes-jev-router. Treating the router as the boundary, or proceed as a grant, is theater. Do not merge into examples/. Cousin of hermes-jev-router / this sidecar's grok adapter, not this sidecar.

braess-router is bounded Rust semantic routing with Jev and Poise. Quoted README: Alpha · single server · loopback only. Quoted: No distributed quota, public-network listener, or workload accuracy guarantee. Quoted: This project is independent of TypeSafe. Same author as jev-labs. Routing ≠ safety envelope. Do not merge into examples/. Cousin of slo-router / jev-labs, not this sidecar.

gowtham980/jev-router is an OpenClaw plugin. Quoted README: This is NOT a universal automatic model-and-thinking switcher. Quoted: Classifier failures retain the current model. Thinking is advisory. Quoted: we intentionally do not patch OpenClaw, spoof directives, or bypass native session locks. Start in observe mode. Distinct from reallygood83/jev-router / justinhsu1477/jev-router / openclaw-tool-prefilter. Treating this as a universal switcher, or collapsing it into reallygood83, is theater. Do not merge into examples/. Cousin of openclaw-tool-prefilter / reallygood83/jev-router, not this sidecar.

PrivaParse is a local PII layer plus an OpenAI-compatible gateway. Quoted README: Nothing leaves the machine. Phase 1 calls no external service at all. Theirs: German gold 124 documents, PERSON F1 0.964. Quoted: LICENSE_NUMBER and ROUTING_NUMBER measured 0.000 recall. Not a rh-guard ROC. Cousin of pii-masker / airlock / PII-Redactor. Treating 0.964 as a rh-guard ROC is theater. Do not merge into examples/. Cousin, not this sidecar.

anonde is local-first Go PII anonymization. Quoted README: reveal gated by actor + purpose. Quoted: NER models baked in, no outbound HuggingFace traffic at request time. Telemetry optional; quoted No input/output text sent. Theirs: lowest leak_rate on 29 gold-annotated corpora. Quoted: Recall-biased. OpenAI-compatible proxy. Cousin of PrivaParse / pii-masker. Not a coding-agent hook. Treating leak_rate as a rh-guard ROC is theater. Do not merge into examples/. Cousin, not this sidecar.

decision-kernel is a Cloudflare Worker judgment API: POST /classify (triage / urgency / spam / tone / risk) and POST /guard. Quoted README: Judgment proposals only. Quoted: The guard never executes anything itself. Guard JSON note: Never moves money or executes the action by itself. Code guardDecision: spend==="deny" → verdict block; review or conf<0.7 → review; else approve unless (offGoal>=0.9 or dup>=0.9) and undoable<0.5 → review. Missing TYPESAFE_API_KEY → 503. Model jev-latest. Theirs: 40-action simulated day blocked 10/10 malicious, 0 false-block after verdict fix. Soft /guard JSON is a proposal; caller owns execute. Treating 10/10 as a rh-guard ROC is theater. Do not merge into examples/. Cousin, not this sidecar.

kev-model-router is local kev (LoRA + readout on Qwen), not TypeSafe Jev. OpenAI-compatible proxy. Quoted README: Fail-open. Quoted: The router never blocks traffic. Quoted source: kev being down never blocks traffic. Distinct from jev-model-router and jaredpalmer/kev. Theirs: Accuracy 10/10 on 10 probes. Routing ≠ permission. Treating 10/10 as a rh-guard ROC, or collapsing this into Mandrilsquad1441, is theater. Do not merge into examples/. Cousin of jev-model-router / ailerix / slo-router, not this sidecar.

eugeniughelbur/jev-gate is a Claude PreToolUse (plus Codex/Cursor) tool-call gate. Order: FAST_ALLOW then HARD_DENY regex then Jev destructive noul + verdict choice then thresholds. Defaults: MODE observe (return 0, log only); DENY_ABOVE 0.90; ALLOW_BELOW 0.10; CONFIDENCE_FLOOR 0.45; timeout 5s. Fail-open: no key / unreachable / malformed → ask / exit 0. guard/enforce: deny→exit 2; enforce also ask→exit 2. Quoted README: It catches mistakes, not attackers. Quoted: Fails open. Distinct from totally-tim/jev-gate, thevibeworks/jevgate, ktsu2i/jevgate-action, RavenRepo/jevengineeringgate. MCP wrap is hope-the-model-looks. Theirs injection test 2026-09-20, 300 calls typesafe/jev-1.13: blunt 0/30 dangerous allowed (jam: 8/30 safe denied); authority owner 3/30, lead 1/30, policy 1/30; git stash clear flipped under all three (hard-rule). Catching all attacks needed a 0.8 floor (58% clean escalated). Soft p(destructive)>=0.90 can deny in guard/enforce without a hard rule; flag as soft-as-veto when hard rules miss. Treating the 300-call injection test as a rh-guard ROC, or collapsing this into totally-tim/jev-gate, is theater. Do not merge into examples/. Cousin of claude-code-jev / jevengineeringgate, not this sidecar.

gentle-browser-jev is a lab separating Gentle policy/stop, JEV typed choice, and browser execution. Without TYPESAFE_API_KEY: local-fallback. Real browser/device not enabled. Code: confidence<0.75 → click_search fallback. Quoted README: never claim savings without a controlled A/B run. Cousin of jev-agent-safety-arena. Treating this as a shipped production hook, or 0.75 as a safety envelope, is theater. Do not merge into examples/. Cousin, not this sidecar.

MarcoLoDico/pi-jev-router is a Pi /model picker. Jev answers self-contained yes/no; else backup. Selecting another model bypasses entirely. JEV_THRESHOLD default 0.95 (>0.5 and <=1); quoted unvalidated starting policy, not a 95% accuracy guarantee. Missing key/failures → backup. jev-latest on TypeSafe, typesafe/jev-1.13 on OpenRouter. Distinct from philippdubach/pi-jev-router, win4r/pi-jev-router, rizafahmi/pi-jev-task-router, Z761293629/pi-jev-helm. Routing ≠ permission. Do not merge into examples/pi-extension.ts. Treating 0.95 as a 95% accuracy guarantee, or collapsing this into philippdubach, is theater. Cousin, not this sidecar.

harshwasan/jev-sentinel is the current listing of the Pi/Claude/Codex integrity gate previously published as harshwasan/pi-jev-sentinel. TypeSafe Jev on tool-call intent+risk, tool-output injection, and replies. Quoted README: Fails closed. Errors / no key → ask you; never auto-allows. Code owns an allow / ask / warn ladder. Secret scrub before Jev. Optional task pin. Quoted: Prompt injection is not solved. Uncalibrated riskAskScore / riskWarnScore / allowThreshold 0.3 / 1.3 / 0.8. Theirs: 106 unit tests with a fake Jev. Distinct from CompleteTech-LLC-AI-Research/jev-sentinel. Keep both GitHub slugs. Do not merge into examples/pi-extension.ts. Treating 106 tests as a rh-guard ROC, or collapsing this into CompleteTech, is theater. Cousin, not this sidecar.

Koushik890/jev-firewall is a Claude/Codex PreToolUse firewall: deterministic rules then Jev allow / ask / block. Quoted README: Fail closed. Any error produces block or ask, never a silent allow. Quoted: Rules can only tighten. Model allow below ask_below (default 0.7) becomes ask. Theirs: 104 tests. Distinct from wmsing/agent-firewall. Soft allow is not a grant; Claude permissions.allow can bypass hooks. Do not merge into examples/. Treating 104 tests as a rh-guard ROC, or collapsing this into wmsing, is theater. Cousin of claude-code-jev / pi-jev-sentinel, not this sidecar.

jackbarunz/jev-tool-router is Codex MCP tool routing. Default selection threshold 0.90. Every routing choice includes none_of_the_above. Quoted README: The router narrows discovery; it does not permanently remove the fallback path. Quoted: Tool execution is not automatically replayed after an uncertain transport failure. Routing ≠ permission. Distinct from esinocchi/jev-tool-router. Treating 0.90 as a safety envelope, or collapsing this into esinocchi, is theater. Do not merge into examples/. Cousin of jev-routing / jev-model-router, not this sidecar.

esinocchi/jev-tool-router is an experimental Python SDK plus routing/agent-loop benches. Quoted README: It does not generate arguments, approve actions, or execute tools. Quoted: This package is an experimental routing component, not an agent framework or a security boundary. Theirs: routing-only median tool fit 76/81 versus Luna 77/81; not a ROC. Distinct from jackbarunz/jev-tool-router. Treating 76/81 as a rh-guard ROC, or collapsing this into jackbarunz, is theater. Do not merge into examples/. Cousin, not this sidecar.

devjtv/jev-router is an Oh My Pi model+thinking picker (plus a Claude Code gateway model named jev-router). Quoted README: This is cost control, not a quality upgrade. Quoted: A router must never break a turn. Missing credential / dead endpoint / thrown handler → keep the current model. minConfidence 0.55. Routing ≠ permission. Distinct from gowtham980/jev-router / reallygood83/jev-router / justinhsu1477/jev-router. Treating 0.55 as a safety envelope, or collapsing this into reallygood83, is theater. Do not merge into examples/pi-extension.ts. Cousin of gowtham980 / MarcoLoDico, not this sidecar.

cyriusweng/omp-jev-gate is an OMP plugin: prompt preflight, jev-judge, guide vs enforce. Quoted README: User authorisation and OMP permissions continue to govern actions. Quoted: 0.5 is an initial checkpoint threshold, not a calibrated envelope. Default mode off. guide injects policy; enforce checkpoints first edit/write/bash only. Distinct from luw2007/omp-jev-extensions. Treating 0.5 as a safety envelope, or collapsing this into omp-jev-extensions, is theater. Do not merge into examples/pi-extension.ts. Cousin of omp-jev-extensions / omp-auto-mode, not this sidecar.

CompleteTech-LLC-AI-Research/jev-codex-approval is experimental typed JEV approval preflight for Codex. Quoted README: Codex retains responsibility for permission enforcement, action binding, cancellation, and final execution. Quoted: native adapter has not been compiled or exercised inside a running Codex instance. Quoted: mode = "shadow" always returns defer. Example thresholds are unvalidated starting hypotheses. Distinct from CompleteTech-LLC-AI-Research/jev-sentinel. Treating shadow defer as a grant, or collapsing this into jev-sentinel, is theater. Do not merge into examples/. Cousin of open-jev-approvals / jev-sentinel, not this sidecar.

JxWayne890/jev-control-plane is Codex model/reasoning routing plus project-scope safety floors. Quoted README: Prevents the decision model from weakening verified safety rules. Quoted: labeled local rules engine when JEV is unavailable. Routing ≠ permission. Theirs: 33 automated tests. Distinct from jev-dspy-control-plane / pi-jev-control. Treating 33 tests as a rh-guard ROC, or collapsing this into pi-jev-control, is theater. Do not merge into examples/. Cousin, not this sidecar.

dr-dimitru/claude-jev-plugin (claude-jev) is Claude PreToolUse/PostToolUse semantic judgments. Quoted README: This plugin is a semantic guardrail, not a security sandbox. Quoted: Plugin never returns allow from TypeSafe confidence. Shadow default; fails open when no validated judgment is available. Distinct from RahulBalakavi/claude-code-jev. Treating TypeSafe confidence as an allow grant, or collapsing this into RahulBalakavi, is theater. Do not merge into examples/. Cousin of claude-code-jev / eugeniughelbur/jev-gate, not this sidecar.

4rays/profanity-checker is a Cloudflare Worker that maps Jev Nouls to is_profane in code. Default PROFANITY_THRESHOLD 0.5; quoted: threshold lives in your code. Not a coding-agent hook. Cousin of jevmod / tonedown / jevfanity-api. Treating 0.5 as a safety envelope is theater. Do not merge into examples/. Cousin, not this sidecar.

vzornjak/typesafe-decision is an unofficial advisory Jev layer for Minis. Quoted README: Not a safety control, not an authorization mechanism. Quoted: triage authorization is always false. Fail closed to human_review. Quoted: 51.7% may only be cited as an uncontrolled projection, never as a measurement (theirs retraction of the shortlist v1.1 claim). Distinct from TypeSafe official skills. Treating 51.7% as a measurement, or allow_advisory as a grant, is theater. Do not merge into examples/. Cousin, not this sidecar.

openlayer-ai/jevals is agent evals and in-loop gates on Jev/Kev/Laya. Quoted README: don't let the classifier become the authorizer. Quoted: if the backend is down, a gate lets the call through by default. Quoted: table numbers are estimates, not measurements. Distinct from dayhaysoos/jevals. Treating on_error fail-open as a safety envelope, or collapsing this into dayhaysoos, is theater. Do not merge into examples/. Cousin of dayhaysoos/jevals, not this sidecar.

DihRJ/claude-code-jev-compaction is a LiteLLM tutorial that drops completed tool results below relevance_threshold 0.2. Quoted README: Nothing is summarized or paraphrased. Quoted: It fails open by default. Dropping results can erase eval evidence. Distinct from fast-jev-compaction / jev-compactor. Treating 0.2 as a safety deny is theater. Do not merge into examples/. Cousin of opencode-context-pruner / fast-jev-compaction, not this sidecar.

Gtrkrsk/laya is a Hugging Face listing of the Laya family hub (same checkpoints as NandhaKishorM/laya / convaiinnovations/laya). Cousin note only, not a new model. Quoted: Khmer 0.000 accuracy at 0.952 confidence; confidence gating cannot save you. The 0.85 recipe is still soft. Not a drop-in ROC. Pair with jev-ood-calibration. Do not dump weights. Do not merge into examples/. Cousin, not this sidecar.

jev-harness-router is a per-turn harness router on TypeSafe Jev: one batched call picks tools (Noul per tool plus ranking Choice) and skill (Choice gated by four request-shape Nouls); model tier and effort are derived in code from Score, not asked. Deadline HARNESS_ROUTER_DEADLINE_MS; shipped 600 ms fitted in Buenos Aires; npm run calibrate. route.source: jev, cache, shortcut, fallback. MOCK=1 heuristic. Quoted README: This is where safety lives. The turn message is untrusted; tool risk floors live in code (read 0.35, write 0.6, execute 0.8). Quoted: It does not execute tools. Pin jev-1.13.0, not jev-latest. Theirs fixtures/turns.jsonl 54 labelled turns: skill exact 94.4% vs keyword 81.5%; tier too cheap 1.9% vs 31.5%; p50 351 to 376 ms; 113 tests, no key. Distinct from AntonioCoppe/jev-harness / Astro-Han/jev-harness / apa-agent-harness / jev-model-router. Routing ≠ permission. Treating 94.4% as a rh-guard ROC, or collapsing this into AntonioCoppe, is theater. Do not merge into examples/. Cousin, not this sidecar.

aniruddh-krovvidi/switchboard is a stdlib Python LLM gateway (POST /v1/chat/completions) on TypeSafe Jev: one call asks injection/harmful/pii Nouls plus tier Choice small|large|unclear. policy.py owns the outcome. Code BLOCK 0.50 and REVIEW 0.10 from their reliability table, not the cookbook 0.8/0.4 (the README diagram still prints 0.80/0.40). small only if confidence ≥ TIER_MIN_CONF 0.60, else large. GROUNDED_MIN_CONF 0.80. Fail-open to large plus flag; FAIL_MODE=closed rejects. Quoted README: routing quality is not measured here. Theirs eval_guardrail.py 2026-09-20 jev-latest cassette on deepset/prompt-injections 662 prompts: ROC-AUC 0.990, ECE 0.122, Brier 0.092, p50 226 ms, p95 291 ms. 11 offline tests. Distinct from dev-hari-prasad/switchboard (empty advertised router) and hermes-switchyard. Soft risk ≥ 0.50 can 403 without a structural deny; flag as soft-as-veto. Treating 0.990 as a rh-guard ROC, or collapsing this into dev-hari-prasad, is theater. Do not merge into examples/. Cousin, not this sidecar.

da-vinci-noob/pi-jev-model-router (pi-jev-model-router npm, pi-package) routes Pi prompts with TypeSafe Jev. Four questions: task_kind Choice, complexity Score, capability_deserved Score, needs_deep_reasoning Noul. Quoted README: Jev judges the task, code owns the budget. Quoted: Fails open. Caps redirect routing; they do not block turns. jevModel jev-latest; confidenceThreshold 0.34; timeoutMs 3500. Distinct from jev-model-router / philippdubach/pi-jev-router / win4r/pi-jev-router / rizafahmi/pi-jev-task-router / MarcoLoDico/pi-jev-router / pi-jev-helm / pi-jev-control / pi-auto-model-router. Routing ≠ permission. Treating 0.34 as a safety envelope, or collapsing this into Mandrilsquad1441, is theater. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

pi-auto-model-router is a score-based auto router for Pi Coding Agent. Starts off with an empty profile. Quoted README: The parent model is not switched. Work that needs another model is sent to a worker subagent. Without the subagent tool, routing does not dispatch. useJev default on; missing key or Jev fail uses the prompted model as judge; /auto-router-jev off uses that LLM judge. Distinct from da-vinci-noob/pi-jev-model-router and the same author's pi-jev-compact. Routing ≠ permission. Treating a worker dispatch as a permission grant, or collapsing this into da-vinci-noob, is theater. Do not merge into examples/pi-extension.ts. Cousin, not this sidecar.

outbound-draft-gate is a Vercel-branded Outbound Draft Gate demo (Next.js 15; live https://outbound-draft-gate.vercel.app). Jev-style evaluate, not TypeSafe Jev: one call returns parallel Boolean judgments via Vercel AI Gateway. Quoted README: Code owns policy. Quoted: Fail open to "hold". Quoted: Nothing auto-sends. You always click send. Draft-only; the human clicks send. Mock scorer without a key. Distinct from jev-linkedin / Postmark. Soft judgment is never the sole veto. Treating this as TypeSafe Jev, or as auto-send, is theater. Do not merge into examples/. Cousin, not this sidecar.

vexjoy-agent is a multi-host toolkit (Claude /do, Codex $do, Factory, Reasonix) with Jev-first /d routing plus lifecycle hooks. Quoted README: /d uses TypeSafe Jev to classify and dispatch; if Jev is unavailable, /d falls back to /do. Quoted command: one TypeSafe call replaces the manifest read; falls back when unavailable or unconfident. Quoted EVAL.md: force routes make no Jev calls; other gateway errors fail open; confidently-wrong classification has no runtime backstop. Quoted README: checks require evidence rather than confidence; the exit gate requires test output. Quoted: Codex adapter cannot intercept writes through unified_exec, unmatched MCP tools, WebSearch, or other unsupported paths. Theirs catalog counts: 43 agents, 59 skills, 78 hooks, 160 scripts. Quoted EVAL.md: 269-case routing corpus is a regression tool; historical v1/v2 percentages are absent. Distinct from JoacoMarc/jev-harness-router / hermes-skill-router. Routing ≠ permission. Fold the /d router and evidence-gate hooks only; skip the skill catalog and game demo. Treating /d as a safety envelope, or 269 cases as a rh-guard ROC, is theater. Do not merge into examples/. Cousin, not this sidecar.

qkal/Canny is a Claude Code / Codex Stop plus Pre/PostToolUse warden. Quoted README: Facts go to code. Judgments go to Jev. Only facts can block. Append-only session ledger. Quoted: Jev never blocks. A "done" claim is refused because the ledger holds no passing check. Quoted src/hook.ts: Only the ledger can block; Jev can only relax the block when it is sure the message is not a "done" claim. Code YES 0.9 / NO 0.1. Secrets and test-removal are pattern checks. Quoted: a hook that fails always answers {}. Model default jev-latest. Distinct from clear-head / pi-warden / jonathanavis96/jev-kit Belay. Soft judgment is never the sole veto. Treating Jev claims_done as the hard Stop, or collapsing this into clear-head, is theater. Do not merge into examples/. Cousin, not this sidecar.

jevguard-mcp is a stdio MCP server that exposes seb4ez/jevguard primitives (jevguard_evaluate / jevguard_calibrate / prune / fingerprint). Quoted README: closed-world UNRESOLVED_OR_OTHER; top_prob below 0.40 or gap below 0.15 → AMBIGUOUS_STATE. Quoted: Official MCP server for JevGuard (theirs, not TypeSafe). Theirs 5-vs-5 live jev-latest bench: cache 0.099 ms / 7,400x; OOD trap caught. Not a rh-guard ROC. Distinct from raniellimontagna/jev-guard-mcp. Hope-the-model-looks: if the host never calls the tools, there is no gate. SHA-256 cache hit ≠ correctness. Do not merge into examples/. Cousin of seb4ez/jevguard, not this sidecar.

sathariels/jevtriage is a GitHub Action plus CLI PR triage gate. One Choice: ready / needs_review / risky. Quoted README: ready only exits 0 when confidence ≥ threshold (default 0.8). Low confidence fails closed to needs_review (exit 1). risky or config/API error is exit 2. Pin jev-1.13.0; latest / preview rejected. Quoted: the step fails on exit 1 or 2. Distinct from ThyFriendlyFox/jev-triage / boldbug1/jev-triage / HexyeDEV/JevPR / 1jehuang/jev-pr-labeler. Soft-score-as-hard-gate. Treating ready as a merge grant, or collapsing this into ThyFriendlyFox/jev-triage, is theater. Do not merge into examples/. Cousin of jev-gate / JevPR / jev-pr-review, not this sidecar.

opencode-langsearch (@jamubc/opencode-langsearch) is an unofficial OpenCode LangSearch provider with an optional TypeSafe Jev result gate. Quoted README: Status: work in progress. Gate is off by default. Quoted: Fails open. Quoted: Treat it as a mitigation, not a security boundary. Defaults: minRelevance 0.45, maxInjection 0.5, maxResults 4, model jev-latest. Local duplicate collapsing before the gate. Quoted: a passage the model did not judge is kept. Theirs: 176 tests; passage trim 79% less text on eight live searches. Distinct from Astro-Han/jev-harness / Atikpui007/jev-sift. Dropped results never reach the model. Treating 0.45/0.5 thresholds as a safety envelope, or 79% as a rh-guard ROC, is theater. Do not merge into examples/. Cousin, not this sidecar.

bramtechs/Focus is a browser MV3 extension that blocks distracting sites. Allowlist / blocklist win first; 7-day cached verdicts win second; else TypeSafe Jev via OpenRouter POST /api/alpha/decisions (typesafe/jev-1.13). Code blocks when choice === "distracting" and P(distracting) >= threshold (default 0.6). Without a key, or if the API fails, a named offline heuristic list is used. Not a coding-agent hook. Distinct from gentle-browser-jev. Cache hit ≠ live Jev. Soft P(distracting) can redirect without a structural deny; flag as soft-as-veto. Treating 0.6 as a safety envelope, or collapsing this into gentle-browser-jev, is theater. Do not merge into examples/. Cousin, not this sidecar.

jev-editor-skill is an agent skill editorial gate: code lint.py for countable tells, then TypeSafe Jev on small states, then the host agent for fact-check. Quoted README: a draft passes when tells, editorial, and SEO each score 70 or higher, voice 60 or higher, and there are no deal-breakers. Quoted SKILL: area scores are a to-do list with a number on it, not a grade. Quoted: stop after 3 passes. Theirs: 54 candidate questions, 21 used. Not PreToolUse; hope the model looks. Distinct from claude-jev-warden. Treating 70/60 as a publish grant, or collapsing this into claude-jev-warden, is theater. Do not merge into examples/. Cousin, not this sidecar.

jev-notion fills Notion database properties with TypeSafe Jev. Native macOS SwiftUI plus CLI. Quoted README: Uncertain entries go to a review queue. Quoted: calibrated probabilities ≥ 60%. npx jev-notion scan is read-only. Theirs: 269 tests; ≤ 2s poll; ~$0.00004 / row. Distinct from mailverdict / vynnlee/jev-mail. Soft 60% as an auto-write, or 269 tests as a rh-guard ROC, is theater. Do not merge into examples/. Cousin, not this sidecar.

tenbin is an MCP server plus agent skill for designing TypeSafe Jev questions at design time: lint, measure on labelled data, put thresholds in code. Quoted README: production calls the TypeSafe SDK directly and never depends on the MCP. Quoted: cookbook thresholds marked provisional until measured. Quoted: code owns the control flow; AI makes only narrow, atomic judgments. Without a key, lint and cost estimates still work. Distinct from wellposed / typesafe-ai/skills. Treating cookbook cutoffs as a safety envelope, or collapsing this into wellposed, is theater. Do not merge into examples/. Cousin, not this sidecar.

jev-ra is browser use for coding agents (MCP plus CLI). Quoted README: TypeSafe Jev picks the operation and the target element for every step. Quoted: No second LLM runs inside the loop. Quoted: The only text typed into the page is text you supplied. Quoted: jev-ra never guesses a credential. Status done / blocked / escalate / budget. Theirs 2026-09-18: Wikipedia 8.50× vs browser-use; 25 of 25 verified; headline 3-5× below the fastest-run ratios. Distinct from dtduc-git/jevnav / gentle-browser-jev / browser-use/jev-ultrafast. 25/25 is not a rh-guard ROC. Soft Jev pick as a sole click grant is theater. Do not merge into examples/. Cousin, not this sidecar.

jev-gmail-labeler uses Jev plus the Gmail API to classify mail. Quoted README: This is a work in progress. The label command is still on the TODO list. Classify writes classification_cache.json; report writes CSV. Distinct from vynnlee/jev-mail (autonomous label/star/archive) / muhammedilyasy/jev-mail (read-only). Advertised labeler ≠ shipped apply-labels. Treating this as zero-inbox automation is theater. Do not merge into examples/. Cousin, not this sidecar.

jev-quilt is a cellular-first decision substrate: typed cells, hooks on deltas, bookkeeper WAL, last-mile projection decoupled. Quoted README: The decider never renders; the renderer never decides. Quoted: backends auto → q16 → openjev-local → typesafe-api. Quoted status: v0 design + reference kernel skeleton; Not yet: plugin binaries. Quoted caveat: open clones can pick the wrong valid option confidently. Distinct from browser-use/jev-ultrafast. Watch; do not invent shipped spreadsheet plugins. Do not merge into examples/. Cousin, not this sidecar.

ThePFMind/jev-mcp is a stdio MCP with two tools: jev_evaluate and jev_route. Quoted README: jev_route is one Choice plus a confidence threshold → {choice, confidence, escalate}. Quoted: live API base https://jev-ai.pro/api (JEV_AI_API_KEY); api.typesafe.ai rejects sk_jev-ai_ keys. Hope-the-model-looks: if Claude never calls the tools, there is no gate. Distinct from seb4ez/jevguard-mcp / raniellimontagna/jev-guard-mcp / ajensenwaud/hermes-jev-plugin. Treating this host as official TypeSafe, or jev_route as a PreToolUse deny, is theater. Do not merge into examples/. Cousin, not this sidecar.

DriftLab is a local-first momentum-research CLI. Quoted README: Python exclusively owns prices, returns, metrics, selection, weights, and costs. Quoted: Jev cannot modify a run or automatically perform its suggested experiment. Quoted: a missing key or failed audit does not invalidate or remove deterministic outputs. Quoted: Choice below 0.65 displays as Ambiguous; no automated conclusion assigned. Quoted: Jev is a methodology aid, not a market forecast or investment recommendation. Distinct from cristiancolon/jev-hft / jev-regime-gate. Treating 0.65 as a safety envelope, or collapsing this into jev-hft, is theater. Do not merge into examples/. Cousin, not this sidecar.

jevwrapper is inspectable LLM-to-JEV middleware (English in, typed decisions out). Quoted README: This tool returns recommendations; it never sends mail, transfers funds, or executes downstream actions. Quoted: default review threshold 0.7 is an adjustable demonstration policy, not an empirically calibrated operating recommendation. Quoted: Type correctness does not guarantee factual correctness. Quoted: there is no silent simulated fallback. Quoted: Not affiliated with or endorsed by TypeSafe or OpenAI. Distinct from official TypeSafe skills. Treating 0.7 as a safety envelope, or the wrapper as an executor, is theater. Do not merge into examples/. Cousin, not this sidecar.

jev-hft is a paper-trading research pipeline: TypeSafe Jev via Vercel AI Gateway on news and Bitcoin market data. Quoted README: It never places real trades, and nothing here is investment advice. Quoted: through TypeSafe about 130 ms; through the gateway about 260 ms. Quoted: On market data, Jev doesn't beat a one-line rule. Quoted: pipeline-corrected 2-second lean 66% (theirs). Distinct from DriftLab / jev-regime-gate. 66% is not a rh-guard ROC. Treating paper calls as live orders is theater. Do not merge into examples/. Cousin, not this sidecar.

jevnav is browser automation whose decisions you can replay, test, and audit. Quoted README: Jev picks the element. Quoted: done is a claim, not evidence. Quoted: What keeps the loop safe is deterministic. Quoted: in loop mode p does not separate correct vs wrong. MCP: only auto runs; review comes back unexecuted. Theirs 2026-09-21: 8/8 goals; 44/44 element decisions; treat as direction, not proof. Same author as jev-packs. Distinct from brnyxx/jev-ra. 8/8 is not a rh-guard ROC. Soft p as an auto-click without the deterministic floor is theater. Do not merge into examples/. Cousin, not this sidecar.

jevx is an open-source Chrome and Firefox extension: find relevant X posts and score unpublished drafts with TypeSafe Jev. Quoted README: This is a writing-quality assessment, not a validated prediction of views. Quoted: timeout, cache lifetime, and visual tokens are explicitly unvalidated settings. Quoted: not affiliated with X or TypeSafe. Distinct from x-spam-filter-typesafe / Twitter-keyword-shield. Treating a 1-5 score as a post grant is theater. Do not merge into examples/. Cousin, not this sidecar.

frankyy03/laya-pt-es-nli fine-tunes Laya multilingual for three-way PT/ES NLI (contradiction / entailment / neutral). Not TypeSafe Jev. Theirs 512-example comparison: overall macro F1 0.8670, ECE 0.0611, p50 31.7 ms. Quoted: Calibration is domain-specific. Refit temperature ... before using probabilities as risk scores. Quoted: the 512-example comparison does not establish superiority over OpenJEV or TypeSafe. Quoted: Other Laya question types were not retrained or validated. Distinct from NandhaKishorM/laya / Gtrkrsk/laya. 0.867 is not a rh-guard ROC. Do not dump weights. Do not merge into examples/. Cousin, not this sidecar.

assay-001 is independent, pre-registered verification of TypeSafe Jev calibration and type-safety claims. Quoted README: on CLINC150 ECE 0.0204 (calibrated); on Banking77 ECE 0.0936 (systematically overconfident). Quoted: 8,576 responses, zero type errors. Quoted: A result applies to the artifacts and criteria examined. It is not a statement about Jev on any other task, corpus, or day. PROTOCOL frozen before any query. Distinct from gold-assay. type-safe ≠ calibrated. Split verdict is not a rh-guard ROC. Do not merge into examples/. Cousin, not this sidecar.

dsh-jev-decide (dsh-jev-decide npm) registers TypeSafe Jev as a DSH agent tool jev_decide (noul/choice/score; no text generation). Quoted README: it only registers jev_decide into the tool set. Hope-the-model-looks: if the agent never calls it, there is no gate. Distinct from codebam/dsh-jev-guardrails / 7starsseeker/dsh-jev-guard / tr1v3r/dsh-jev / noetion/dsh-jev. Soft jev_decide as a DSH hard deny is theater. Do not merge into examples/. Cousin, not this sidecar.

semantic-find is local evidence search with optional Jev semantic ranking. Quoted README: --semantic sends only selected candidate chunks; never sends the whole filesystem. Quoted: it never prints a quotation returned by Jev; text comes from local source bytes. Quoted: no key / timeout / invalid answer → local-lexical-fallback and keep local results. Pin jev-1.13.0. Distinct from jevex / kbhuw/jev-sift / karat-filter. Named lexical fallback is not live Jev. Soft rerank as a deny of unread files is theater. Do not merge into examples/. Cousin, not this sidecar.

MinusPodJev is a FastAPI OpenAI-compatible proxy that exposes TypeSafe Jev as an ad-detection model for MinusPod. Quoted README: Jev Proxy is a POC shim. It does not change the MinusPod runtime that controls holds, autoapproval, or verification logs. Quoted: Keep production operations in the existing MinusPod application until Jev is mature. Quoted: Jev Proxy does not support chapter generation. Theirs: offline bench vs 84 chat models on a 14-episode corpus. Distinct from jev-runway. Proxy ≠ permission. 84-model bench is not a rh-guard ROC. Do not merge into examples/. Cousin, not this sidecar.

fast-jev-opencode is an OpenCode V2 context hook port of fast-jev-compaction. Quoted README: Rewrites only the outgoing request: stored history, /compact and automatic compaction are untouched. Quoted: Fails open (missing key, timeout, transport/HTTP error, malformed answer or unreadable config leaves the request unmodified). Shipped defaults and config.example.json are observe-only (enabled: true, dryRun: true). Going live means "dryRun": false. Default keepThreshold 0.5 matches upstream (invalid values fall back to 0.5). Distinct from opencode-context-pruner (keepThreshold 0.15). Quoted DESIGN.md: protected tools are never dropped; preserveCurrentTurn true. Model jev-latest (moving alias). Cached per tool_use_id. Theirs: projected character reduction 72–92% on live dry-run logs; not a rh-guard ROC. prune ≠ deny. Dropping results can erase eval evidence. Do not merge into examples/. Cousin of opencode-context-pruner / fast-jev-compaction / jev-compactor, not this sidecar.

jev-linter-action is a GitHub Action plus local CLI: TypeSafe Jev yes/no questions on repository files. Quoted README: a plain question expects yes, with probability at least 0.8. Quoted: A probability of 0.5 fails; uncertainty needs review. Quoted: The model can be wrong, and static lint does not measure how an agent behaves in a call. Missing keys/files/answers, malformed configuration, API errors, and over-limit input fail closed. Pin a model for repeatability; jev-latest is also accepted. Exit 0 passed, 1 review check failed, 2 configuration/provider failure. Distinct from JevLint / mizchi/jev-lint / oxlint-plugin-jev. Soft-score-as-hard-CI-gate. Treating 0.8 as a safety envelope, or collapsing this into JevLint, is theater. Do not merge into examples/. Cousin, not this sidecar.

jev-relay is a local-first advisory router for Claude Code, Codex, and Hermes/Jax. Quoted README: requires_review is always true. The router never executes actions. Quoted: Frontier is a handoff to your calling assistant, not another API call. Quoted: Never use confidence as permission or a universal accuracy score. Quoted: it does not replace their main models, private memory, quota routing, or permission systems. Skill install (scripts/install_skill.py). Hope-the-model-looks: if the host never calls the CLI, there is no gate. Distinct from hermes-plugin-jev / jev-routing / ajensenwaud/hermes-jev-plugin. Treating a review status as a permission grant is theater. Do not merge into examples/. Cousin, not this sidecar.

ashafizullah/jev-triage is a GitHub App (Probot) that classifies issues and PRs, then labels and comments. Quoted README: Destructive actions are off by default. allowAutoClose default false. thresholds.actMin 0.6. Label names are created automatically (contrast hush, where silence is the default). Quoted: Uncorrected predictions count as correct, so these numbers are a lower bound. Distinct from ThyFriendlyFox/jev-triage / boldbug1/jev-triage / sathariels/jevtriage / Patrick-SCH03/jev-issue-radar. Treating uncorrected predictions as gold, or auto-close as a merge grant, is theater. Do not merge into examples/. Cousin, not this sidecar.

jev-guard-smoke is a lab smoke proof for leepokai/jev-guard npm 0.3.1. Default branch docs/jev-guard-smoke-lab. Docs live in SMOKE.md (no root README). Quoted SMOKE.md: policy fail-open default (did not set JEV_GUARD_FAIL_CLOSED). Quoted: Never: authorize merge / pay / send; dual LGTM ≠ merge. Stock JEV_API_KEY → api.typesafe.ai with an OpenRouter key: 401. OpenRouter System One shim (https://openrouter.ai/api/v1/systemone, model typesafe/jev-1.13): works. Advertised backend ≠ served backend. User-asked force-push: ALLOW (ask→allow, user-asked p=0.94). Nine-row smoke table is not a rh-guard ROC. Quoted: No API keys are stored in this repo. Distinct from leepokai/jev-guard (this is a smoke lab, not the guard). Do not merge into examples/. Cousin, not this sidecar.

olivdx/jev-mcp GitHub description: "Jev-powered decision layer for coding agents. Analyze code and diffs, assess bugs, security, risk, and breaking changes, and return structured decisions for automated continue, fix, retry, or human-review workflows." Created 2026-09-21; public tree empty (size 0; Git 409). advertised MCP ≠ shipped source. Watch; do not invent continue/fix/retry/human-review mechanics. Distinct from ThePFMind/jev-mcp. Do not merge into examples/. Cousin, not this sidecar.

localjev is a thin soundness-theater cousin: a local, Jev-wire-compatible POST /v1/systemone that prompts a chat model for JSON probability vectors, then normalizes them into Choice / Score / Noul shape. README: wire-compatible, not mathematically equivalent to a logit read — "The probabilities are generated/self-reported by the model rather than read directly from its logits. Evaluate their calibration on your own workload before relying on them for consequential decisions." Treating prompted JSON probs as calibrated logits for hard gates is soundness theater. One thin card only; not a new hook pack. Cousin of jev-arena / jev-ood-calibration. Not a rh-guard peer.

laya is an open System One head (typed choice / score / noul). The README's automated confidence-gating recipe at 0.85 (RLCD → "statistically meaningful") is still soft. Auto-act at that uncalibrated threshold is confidence theater, especially given Khmer OOD 0.000 at 95.2% confidence — "the model's own confidence gives no warning, so the routing decision has to be made before the forward pass." Future backend, not a drop-in ROC replacement for this reward-hack hook. Pair with jev-ood-calibration / jev-capability-atlas. HF family listing Gtrkrsk/laya is the same hub, not a new model. Cousin, not this sidecar.

jev-labs is a formal consensus kernel around a probabilistic oracle (TLA+ → AsyncAPI → Rust), tested as you would a database: 1,680 simulated pharmacy decisions under seeded chaos against live Jev. Golden 1,080 rounds: wrong=0. Severe chaos: 314 correct / 46 escalated / 0 wrong, accuracy 0.834–0.903 vs 0.989–1.000 none/realistic. Never confidently wrong. The invariant is not "always right"; the kernel may escalate to a human, and it may never return a confident wrong verdict. A stability gate excludes votes whose margin sits inside the measured noise floor (identity 0.042). Anti-pattern: treating TLA+/model-check theater as proof the soft judge is safe without an exception path. TLC on DecisionIsReproducible: 1,049,750 distinct states, 0 errors — that proves the protocol, not that the oracle is never wrong (rule of three bounds the violation rate below 0.28% at 95%; it does not prove the rate is zero). Scope: synthetic pharmacy, not clinical guidance. Limitation: on an underdetermined record, Jev escalated 86 of 120 and decided 34, split both ways — the stability gate is not an answerability check. Cousin, not this sidecar.

seal is a workflow kernel whose unit of progress is a recorded Seal, not a step that ran. Advance gate: generation fills Candidates; only a Seal advances the product; Effects stay locked while escalations remain open. Visible coverage ledger stamps every seal auto | code | human | escalate. Hiding escalations is a product lie. Developers' warning it encodes: schema-valid ≠ semantically correct, accuracy without coverage is dishonest, mint ≠ product brain. Pairs with jev-capability-atlas jaggedness and ActionGate Schema-valid ≠ intent-matched (contrast only). Zero runtime Python deps; TypeSafe mint is optional Strike machinery, not the product object. Cousin, not this sidecar.

toolgate is a pre-execution tool-call gate: allow / block / review before the executor runs. Guard error or timeout stops the call (fail-safe), distinct from a model decision. Distinct from ndolinschi/toolgate (awesomejev demo: allow / ask_human / deny). AI SDK + LangGraph adapters. Eval CLI is given → expected → actual; only given reaches Jev; labels stay local; the CLI never executes scenario tools. Jev is a probabilistic check, not an authorization system. Cousin, not this sidecar.

jev-reviewer is a local PR overlay: Jev assigns P0/P1/P2 attention priorities (P0 expanded; P1/P2 collapsed). Attention is not a correctness verdict; never equate P0 with "blocked as unsafe". Policy: P0 is attention, not a bug claim; P2 is never proof of correctness; uncertain/incomplete never lands on P2. alwaysReviewPaths is a deterministic P0 override (structural attention, not a deny). Anti-soundness-theater / soft-judgment UX for gates. Cousin, not this sidecar.

safe-sh is static shell analysis with Jev: tree-sitter bash chunks, then Scores; high score plus --error-on confidence exits 1; the wrapper never executes the script. README: replace sh/bash with safe-sh (curl … | safe-sh); --warn-on / --error-on own the hard exit. Scores include credential/exfil-shaped questions — shell/secrets judgment before a hard deny, still not execution. Contrast yolo-shell (exec interceptor + named local floor) and toolgate: fail-safe pre-exec allow / block / review (error/timeout stops the call). Same extract-then-Jev layering as jevscan. Weakened-test review lives on typesafe_agent_gates (SpecReviewMiddleware), not here. Gate-adjacent; not a reward-hack detector.

interlock is a capability kernel for untrusted agents. Jev (or a bundled System One stand-in) is a sensor; policy in ordinary code decides allow / ask / block. Deterministic detectors first (C2, reverse shell, canaries, paths). Placeholders and canaries only: secrets never enter the agent; any canary use is a catch. The action space is closed, so the kernel cannot emit an unlisted string. Explicit critique of post-hoc "is this dangerous?" firewalls that score a tool call after the LLM already decided, with real secrets still in scope. 38-case regression suite (attacks, benign, hard negatives); not a blind paper — wire Jev and run held-out attacks before trusting a number. Positive pattern: hard envelope owns safety. Anti-pattern: soundness theater / soft judgment hard-gated as safety. Cousin, not this sidecar.

port-cleanup is a gate UX exemplar for irreversible actions: Jev recommends Stop / Keep / Your decision from local evidence; the human confirms the exact list; shields (executable + project + port set) override Jev; identity re-check before SIGTERM (UID/path/start-identity/cwd/shield/endpoints, and again immediately before signalling). Displayed explanations are app-owned text mapped from typed responses, not raw model prose. Kill recs need confidence ≥ 0.8 and supported provenance; otherwise "Your decision". Never auto-kills. TOCTOU cousin: no atomic pidfd-style checked kill. Cousin, not this sidecar.

jev-dspy-control-plane is a typed control plane around a probabilistic agent: closed ontology, then deterministic rules, then allow-listed tools; DSPy drafts wording only after route and action are fixed. Fraud/security (intent or lexical signals) force SECURITY_ESCALATE even when the classifier predicts a routine intent. The LLM cannot add a route, change the selected action, or invoke an unapproved tool. Same shape as structural-first here. Cousin, not this sidecar.

jev-arena is a calibration arena for native Jev probabilities (noul/choice/score; Brier, log loss, ECE). A live jev-1.13.0 run is systematically overconfident in the low bins (near-perfect in the high bins). Do not treat native probabilities as truth without Harbor-style measurement. Not a reward-hack ROC for this sidecar.

jev-capability-atlas is a jagged hold-vs-break map of Jev with real API receipts (not a leaderboard). type-safe ≠ correct: a typed Choice/Score/Noul cannot emit an off-menu value — a type guarantee, not a correctness guarantee. Receipts: DAIR Emotion mean confidence 0.819 vs 48% accuracy, and 16% of items assigned probability 0 to the correct label; history trivia wrong at 0.90 with no supporting passage, then correct at 0.97 once the passage is in state. Holds when the answer is recoverable from the given state; breaks — often confidently — when it needs unsupplied knowledge. Receipts first; no hand-typed numbers. Pair with dinostomp before hard-gating on those scores. Eval-integrity cousin, not a rh-guard peer.

jev-ood-calibration asks whether Jev knows when it does not know: OOD ECE versus its noise floor on an unknowable org-rule priority label (absent from the text). In-domain public benches look calibrated (OpenBookQA ECE 0.024 = 1.0× floor). On the synthetic set, priority accuracy 44.7% with mean stated probability 0.74, ECE 0.107 = 4.4× the noise floor, refit T 3.40. Sign of miscalibration flips by question type (Choice/Score overconfident, boolean underconfident on the same tickets). AUC ≠ ECE — ranking is not calibration; pairs with does-jev-confidence-mean-anything (Augustus / jevcal own the mental model). Do not threshold the confidence field; calibrate per question, not per model. Harbor/jevals-adjacent. Not a rh-guard ROC.

how-sure-is-jev (jevsure) is a math black box over Jev probability distributions: one number in [0,1] plus a plain-English band CERTAIN / CONFIDENT / LEANING / TORN / CLUELESS. Choice confidence == max_prob (the most generous metric: a 75/25 two-option answer is 0.5 from Jev vs 0.19 from entropy). Thresholds are opinions, not physics. Good abstention UX (TORN/CLUELESS → human). Eval-gaming risk: agents optimizing the sureness metric rather than task truth. Pair with jev-ood-calibration / ECE noise floor (contrast only). Cousin, not this sidecar.

slo-router is an OpenAI-compatible proxy that can put Jev 1.13 on the routing hot path, with fail-open to deterministic local features (lexical_fallback / slo_no_jev) when the key is absent, times out, or returns invalid. A live OpenRouter Decisions run on their bundled fixture (19 Sep 2026, live-jev-analysis): SLO no-Jev p95 77.93 ms vs SLO+Jev 490.38 ms (~6.3×); same routes and accuracy. Their engineering conclusion: keep Jev off the synchronous path for this workload unless a larger real-model dataset justifies the tail. An exactness signal raises the quality floor; it never overrides context or capability checks. If no backend is feasible, the API returns 503 with per-backend reasons instead of silently violating the contract. Adjacent routing/latency cousin, not a rh-guard peer. Hunch: hard-gating latency-sensitive control on a decision model without a measured fallback is itself a reliability/eval failure mode — agents will learn to skip or stub the gate. Controllers must keep capability/context checks non-overridable by exactness signals.

cmdc-auto-mode is a Command Code auto-permission plugin: host permission check first, then beforeToolCall screens every selected tool. Independent Jev questions; policy decide in code (allow / deny / escalate). within_scope ≤ 0.25 is out of scope (deny). Escalation always goes to a human, never back to the model. Default auto-fail-closed true (unreachable screener blocks). Prefilter is tiny (bare read-only commands). Jev is a sensor; policy in code owns the verdict. Do not merge into examples/. Cousin of omp-auto-mode, not this sidecar.

firehose-judge is typed Jev on the Bluesky firehose, held in a Cloudflare Durable Object. Eight questions per sampled post; anything the model would not commit to slides into a "needs a human" lane. nsfw is dropped server-side (never a displayed judgment). Review thresholds live in src/jev.ts (scores get a lower bar than choices). Uncertain → human, not a hard-gated soft veto. Cousin, not this sidecar.

jav-email-cascade is decide → policy → LLM leftover: one backend answers typed questions; ordinary Python policy routes auto / review / llm; a generative model drafts only leftover text. A Noul at 0.5 means "cannot tell", not "somewhat" — never rounded. A Score with confidence 0.0 is a flat distribution — never acted on. injection_suspected always force-review, even with an LLM configured. Contrast soundness theater (soft judgment hard-gated as safety): this is an actual force-review lane. Cousin, not this sidecar.

waymode matured: the host keeps permissions, validation, and handlers; Jev decides over typed actions on the live UI; evals keep retained evidence. Waymode validates the decision and live action handle; it does not grant access. Jev confidence grants no permission. Sensor ≠ verdict. Bounded development evidence, not a claim that every app becomes self-driving. Cousin, not this sidecar.

skill-broker is a Hermes skill-intervention layer. Quoted README: Stages 1–4 are built and one Consumer is live. Quoted: the pipeline is implemented through ticket #50 (prepare_turn, Authorised Closure, Candidate Retrieval, Judgment validation and the Grant, Skill Pack, live Jev with recorded/No-Skill fallback). Stages 5-6 (offline routing evaluation and shadow-mode integration) are next. Deterministic code owns authority, limits, and routing; Jev judges relevance only and never grants access. Jev relevance ≠ authority. Direct sibling to turnstile (evidence ≠ authority). Candidates are inputs to judgment, not grants. Router failure must never broaden access. Anti-pattern: letting System One confidence expand the allowed skill set. Same permission boundary as waymode (skill-routing as soft label, not a capability grant). Do not treat a live Consumer as Hermes enforce. Do not merge into examples/. Cousin, not this sidecar.

jev-lens is an advisory Claude Code Stop hook that answers "do I need to look?": it never blocks Claude, never edits files, and never says green unless it is sure (JEV_LENS_GREEN 0.9). Shadow mode first. Attention / VOI, not authority — when you need a gate, keep this separate from skill-broker (relevance never grants access) and construct-auto-classifier (effect-based allow/deny). Cousin of jev-reviewer (attention ≠ correctness) and typesafe-jev-tools (abstention/VOI that never blocks). Not a merge. Hunch: collapsing attention/VOI and authority invites gaming the green light.

jev-preflight is a Claude Code Stop-hook: UserPromptSubmit snapshots a private Git baseline; Stop sends a selected, redacted turn diff to Jev on eight risk axes (behavior, authorization, input validation, data integrity, error handling, compatibility, lifecycle, regression tests). Assist mode: at or above threshold, Claude gets at most one additional investigation, then finishes. Fail-open: no key, timeout, invalid response, or oversized diff skip evaluation and Claude finishes. Default 0.85 threshold is uncalibrated. Scores direct attention, not proof of defects; not an autofix or merge blocker. Pattern: escalate-attention ≠ hard block. Soft gate that can be gamed by ignoring the reinspect. Do not merge into examples/. Cousin of jev-lens / prune-review; not this sidecar.

jev-security-scan reviews Agent Skills, MCP configuration, and source for suspicious behavior using TypeSafe Jev plus local static checks. Direct sibling to this sidecar: structural denies + Jev over the skill/MCP supply chain, not eval-asset tool use. Inspired by is-malicious (typed checks, chunking, evidence-window verification); independently written Python, not a TypeScript copy. The scanner reads text; it does not execute the target, install deps, or start MCP servers. Policy in code: high suspected behavior needs both Nouls ≥ 0.85, selected-window confidence ≥ 0.6, and active-context confidence ≥ 0.7; telemetry stays advisory. Thresholds are engineering defaults, not calibrated accuracy. Two same-model passes are not independent verification. Unflagged ≠ certified safe — never "safe to run." Small synthetic 4-specimen eval (2026-09-19, jev-1.13.0), not a malware ROC. Complementary to jev-preflight (post-turn attention on diffs) and to jev-carryforward 0/4 (an MCP tool sitting there is not enough — scan before install). Do not merge into examples/. Cousin, not this sidecar.

jev-decisions is a Hermes plugin: 25 prepared Jev reviews plus a local deterministic gateway. pre_tool_call / post_tool_call / post_llm_call are registered but off unless JEV_ENABLE_HOOKS=1; even then they stay in shadow mode and do not block. Reviews are advice; installing does not stop dangerous commands or replace host approval. Jev review is advisory; Hermes policy remains authoritative. Local gateway.decide: destructive / credential / external-and-not-reversible → human. A failed review grants no permission. verify requires explicit boolean changed / read_back / evidence — missing or non-boolean fields never count; it cannot detect invented proof. Version 0.2.1 optional smart approvals adapted from anpicasso/hermes-jev-approvals. Quoted docs/approvals.md: It never silently approves. Quoted: The workflow is shadow only. Quoted README: Installation does not select the provider, change approvals.mode. Complementary to jev-preflight (Stop-hook attention after the turn) and jev-carryforward (hope the model looks: if Hermes never calls jev_gateway, there is no gate). Contrast skill-broker (relevance never grants access). Same doctrine as actiongate / turnstile. Do not merge into examples/. Cousin, not this sidecar.

jev-vs-llm-guardrails-intent-router is a LangGraph support-bot demo comparing Jev vs gpt-5.4-mini for the classify stage (guardrail + intent router). Graph, prompts, question texts, thresholds, and subagents are shared; the comparison isolates accuracy / cost / latency. Decision rules in code: block if jailbreak, prompt_injection, or harmful ≥ 0.70, or severity ≥ 2 (of 0..3). Published classify fixture (218 labelled items): Jev route acc 96.8% / guardrail 97.7% vs LLM 99.1% / 99.5%; Jev classify p50 592.7ms / $0.0461 per 1k vs LLM 1883.3ms / $0.9900. Eval-integrity: classify accuracy is not a safety proof. Watch soundness theater if those uncalibrated soft scores are hard-gated as safety (same lesson as jev-preflight's 0.85 attention threshold). Bounded Trailhead Supply demo, not a rh-guard ROC. Pair with dinostomp before treating the fixture as an instrument. Cousin, not this sidecar.

system-one-benchmark is a 50-sample LMSYS toxic-chat safety eval: Jev (jev-1.13.0) precision 90.9% (1 FP) vs local open PCD flooding FPs (16 of 50 at 36.0% precision). Jev Brier 0.1096 vs PCD 0.3884 (uncalibrated). Calibration is the eval-integrity angle; do not treat uncalibrated open PCD as a safety gate. Bounded fixture, not a rh-guard ROC and not a shipped claim.

dinostomp is a local-first eval-instrument audit: data defects, misleading scorers, run records, and unsupported claims, before you trust the score. Pointer when people hard-gate on Jev scores inside reward/eval loops: check the instrument first. Harbor/jevals-adjacent (independent evidence, not self-reported labels). Not a rh-guard peer and not a substitute for this sidecar's structural deny.

jev-packs is an evidence-gated registry of Jev question packs (questions-as-data + golden cases + pinned model version). A pack is verified in index.json only when jevassert has recorded accuracy / ECE / cost / latency on that pin — no numbers, no endorsement. Every Choice and Score must offer unknown (mandatory abstention; Jev cannot abstain so the question set must). Anti-soundness-theater for gate criteria. The named runner was not a public repo at capture; packs remain loadable YAML/JSONL. Harbor/jevals-adjacent.

ci-gatekeeper-bot-jev matured past the draft spec: README + action.yml + src/ + committed dist/. Jev via Vercel AI Gateway (experimental_evaluate against typesafe-ai/jev) asks four typed questions (should_review, risk, route, touches_secrets); repo-configurable thresholds compute auto-approve | human-review | block. Conservative default risk_threshold_for_review: cosmetic escalated even trivial diffs Jev itself called moderate. Timeout/Jev-failure still routes to human-review, never silent auto-approve — fail-open to a human, not to merge. Eval-gaming surface: optimizing the four Jev questions / thresholds instead of real review quality. Watch, not an endorsement: do not hard-gate merge on a Jev auto-approve without a deterministic path floor (latch / if-ai cousins). Soft judgment as sole merge authority is soundness theater.

jev-pr-review is a GitHub Action that scores each changed file with Jev (dimensions, not a "needs review?" Choice — that returned a useless ~0.46). Shadow-mode only until calibrated: it comments; it never merges. mode: enforce fails loudly; the automerge path is unwritten, not just disabled. Hard gates run before any score (blocked_paths, max_lines, CI not green) and Jev API failure after retries also escalates — never automerge. Aggregation is max across files, never an average, so one risky file cannot hide behind trivial ones. Starting automerge_when thresholds are launch values, not calibrated. Lesson: calibration-first gating before any automerge. Soft judgment as sole merge authority is soundness theater. Trigger on pull_request, never pull_request_target; reads the diff via API, never checks out or executes PR code. Cousin of ci-gatekeeper / jev-reviewer / prune-review / latch. Watch, not an endorsement.

prune-review is a cost-aware Jev gate before a generative PR reviewer: each hunk gets typed actionable-finding / required-context probabilities; a deterministic safety escarpment (auth/secrets, concurrency, lifecycle, injection patterns) always keeps matching hunks whatever Jev says. Jev does not generate review comments or code. Source preview; packages and Action unpublished. Bounded pilot: 15 of 22 paired runs saved money (27.9% on winners); all-in including a 305% cost outlier the saving was 1.18%. Cost results, not quality claims — findings still need blind adjudication. Cousin of jev-reviewer (attention ≠ correctness) and latch. Not a rh-guard peer.

jev-intent-review is whole-repo intent verification beyond the diff: typed Jev judgments VERIFIED / VIOLATION / UNKNOWN (and NOT_APPLICABLE) of the post-change repository against stated requirements. The diff is a search hint, not the object being verified (review_scope != changed_files) — catches incomplete-change gaming (requirement misses in unchanged paths). CLI works; GitHub Action not written yet. Jev judgment → deterministic policy → finding; thresholds live in code. Prefer UNKNOWN over a false VERIFIED. Never claims that finding nothing means the code is correct. Watch, not an endorsement. Cousin of jev-reviewer / ci-gatekeeper / jev-pr-review.

jev-baselines-eval is a pre-registered independent Jev-vs-baselines eval. Three same-day errata rounds after external review found overstated results (calibration language, mixed samples, missing cross-fit accuracies, and a threshold-margin sensitivity that flips the sign of the headline cascade result). Both experiments returned AMBIGUOUS. Harbor/jevals lesson: independent review; do not promote first-publish numbers to labels; do not cite the withdrawn framing. Not a rh-guard peer and not a ROC for this sidecar.

jev-carryforward is a verbatim fact ledger scored for relevance: record saves the original words; recall ranks them; nothing summarised, nothing deleted. Constraints and corrections always return in full (Jev never votes on a rule). No key / scorer down → whole list (fail-open). Claim/evidence cousin to clear-head and to gliner25-compaction extractive spans (anti-summarization that erases evidence). Eval suite (evals/): with MCP recall available and the skill installed, the agent called recall 0/4 on a force-push prohibition task — not blocked, just never reached for; it proposed a force push. An MCP tool sitting there is not enough. SessionStart/compaction hooks that inject constraints beat voluntary tool use. Anti-pattern: hope the model looks. Not a reward-hack detector.

databricks-jev-pdf-lab publishes a measured negative result: no quality-equivalent, end-to-end Jev PDF payoff demonstrated. Typed output is not truth; missing evidence must remain unknown. Anti-soundness-theater / honest eval culture. Cousin, not this sidecar.

Anti-pattern

Using LLM-as-judge (or gaming jevals labels) as the reward signal is the failure mode rh-guard is meant to catch — reward tampering, monitor gaming, and training against the monitor. See docs/shape.md (LLM-as-judge as an alternative considered) and Baker et al. 2025: pressure on a CoT monitor produces obfuscated hacks. Do not put this sidecar's score, a jevals accuracy number, or an LLM judge into the RL reward.

Siblings, not a merge

jevals measures decisions; rh-guard gates agent tool use; Harbor scores product/agent loops.

jevgate is an allowlist that proves what may run; Jev judges only the rest. Hard envelope owns safety; soft judgment is never the sole veto (fail-open: it cannot block). Complementary to this sidecar's structural deny + Jev overlay. JevLint is semantic convention Noul lint in a write → check → fix loop (quality, not gaming). Distinct from mizchi/jev-lint (name/comment/test truth-of-contract; findings are candidates, not verdicts). GLiGuard is an encoder-based LLM prompt/response safety guard; rh-guard is a coding-agent reward-hack / eval integrity gate.

Abide enforces soft project instructions (AGENTS.md / CLAUDE.md) via Jev on diffs — not reward hacking. Shared patterns: multi-host hooks, fail-open (no key/network → edit proceeds), banded confidence (repair / note / silence), and soft judgment never the sole hard veto. Its replay plus independent review (flagged edits/turns confirmed or not; flags are not labels) is Harbor/jevals-adjacent measurement discipline, not a claim that Abide measures reward hacking.