Host adapters

RH Guard scores every host through the same scoreEvent path. Adapters only change install location and the deny JSON the host understands. examples/ is the source of truth. Agent-visible text is always AGENT_DENY (opaque filesystem-integrity copy). Scores stay on the operator workbench.

Sibling, not a merge. jevgate uses the same shape: an allowlist proves what may run; Jev judges only the rest. Hard envelope owns safety; soft judgment is never the sole veto (fail-open: it cannot block). rh-guard's structural deny is that first gate; the System One sidecar is the rest. Do not merge the products.

GLiGuard is an encoder-based LLM prompt/response safety guard; rh-guard is a coding-agent reward-hack / eval integrity gate (complementary, not a competitor). gliner25-compaction is the same encoder family (GLiNER2.5) on Claude context compaction, not prompt/response safety and not reward-hack detection. Extractive character-offset spans, not generated summaries; uncertain → fail-closed keep_full; hard shell/mutation policy overrides the soft model; shadowMode default true before rewriting history. Sibling envelope next to jevgate (opposite default).

Sibling, not a merge. Abide also ships Claude / Codex / OpenCode hooks, but it scores project-instruction rules on diffs, not reward-hack hazard. Its hooks fail-open (exit 0; no key → edit proceeds). Soft Jev verdicts are banded (repair / note / silence); they are not a hard veto. Do not merge adapters; Abide does not catch reward hacking.

hooks/run.ts <flavor> reads JSON on stdin. Flavors:

argv	Output shape
claude	Claude Code hook JSON
cursor	Cursor hooks.json JSON
grok	{ decision: "deny", reason } (not Claude JSON)
generic	{ block, reason? }; exit 2 on block
codex	Claude-like hookSpecificOutput.permissionDecision (Codex-safe; no continue)
dsh	alias of generic (DeepSeek Harness stdin / adapter)
exo	alias of generic (no native hooks; wrap ToolRuntime.execute)
pi / prime / amp	host plugin JSON; prefer the TypeScript copies in examples/

HTTP sidecar: POST /api/hooks/<flavor> (Next.js 16 dynamic params is a Promise). Claude and Cursor URLs stay /api/hooks/claude and /api/hooks/cursor. Codex and DeepSeek Harness have no HTTP hook type on the host; POST /api/hooks/codex and /api/hooks/dsh return 404. Use hooks/run.ts. Exo has no native hooks.json and no host HTTP hook type; the sidecar still serves POST /api/hooks/exo (alias of generic { block, reason? }) for the ToolRuntime wrap. Pi, Prime, and Amp reach HTTP from the copied plugin.

Generic stdin schema

Input (any one of these is enough; Claude / Cursor / Grok payloads also parse):

{
  "event": "tool_call",
  "tool": "Bash",
  "input": { "command": "…" },
  "path": "tests/test_foo.py",
  "prompt": "",
  "transcript": ""
}

Aliases: tool_name / toolName for tool; tool_input / toolInput for input; Exo functionName / arguments. See examples/generic-event.json.

Output: { "block": true, "reason": "…" } or { "block": false }. Exit 2 on block.

npx tsx hooks/run.ts generic < examples/generic-event.json
npx tsx hooks/run.ts dsh < examples/generic-event.json
npx tsx hooks/run.ts exo < examples/generic-event.json

Host notes

Claude Code

Merge examples/claude-settings.json (HTTP) or examples/claude-command-settings.json (fail-closed PreToolUse). Plugin pack: hooks/claude-hook.sh. HTTP is fail-open (non-2xx / timeout do not block). Sibling permission gate (not this copy): claude-code-jev — OpenRouter typesafe/jev-1.13 PreToolUse (230.8ms p50 / 263.9ms mean / 459.2ms p95; 90 live decisions on their synthetic 18-case fixture); quoted 0 dangerous allowed on that fixture; low-confidence and network fail → human; quoted adds a 264 ms hop rather than removing one; default 0.85 uncalibrated. Additive; Anthropic auto-mode is not replaceable via a supported API. Distinct pre-execution SDK cousin (not this copy): toolgate — allow / block / review; error/timeout fail-safe stop; not ndolinschi/toolgate. Soft-judgment UX cousin (not this copy): jev-reviewer — P0/P1/P2 attention expand/collapse; never equate P0 with blocked as unsafe. Static shell cousin (not this copy): safe-sh — curl | safe-sh; --error-on; Jev analysis, never executes; secrets-shaped Scores before hard deny; contrast toolgate fail-safe pre-exec. Capability-kernel cousin (not this copy): interlock — Jev is a sensor; policy in code; canaries + closed action space; secrets never enter the agent; do not merge interlock gate --claude-code into examples/. Command Code auto-permission cousin (not this copy): cmdc-auto-mode — beforeToolCall after host permission check; policy decide in code; within_scope ≤ 0.25 out of scope (deny); escalate to a human, never the model; default auto-fail-closed true. Do not merge into examples/. Effect-based OpenCode/agy shell cousin (not this copy): construct-auto-classifier — Privilege Is Not a Verdict; structural rules then Jev Choice + nine risk Nouls (data_loss, …); certified 0 dangerous allowed for Jev; operator-owned minConfidence/riskThreshold; do not merge into examples/. Runtime tool-authorization cousin (not this copy): actiongate-jev — Jev supplies evidence. Code owns authority; a positive score never overrides a deterministic security failure. Schema-valid ≠ intent-matched. single-use Action Grant bound to the exact tool call; replayed/expired/mutated permits fail closed; wrapTool is not hooks.json. Quoted threat model: Proxies isolate only when the upstream endpoint is not otherwise routable, which is a network property and not a cryptographic one. MCP/HTTP proxies exist as Isolate path; wrapTool remains advisory until that holds. Intent-aware SDK wrap cousin (not this copy): AgentGhost (@agentghost/sdk) — AgentGhost is the tool's execution function; ALLOW/ASK/DENY; ASK/DENY throw so approval cannot be silently skipped; default failMode: "closed"; do not merge into examples/. Claude action-guardrail cousin (not this copy): turnstile — Jev never grants authority that policy denied; receipts + threshold replay; do not merge turnstile-hooks.json into examples/. Direct sibling (not this copy): skill-broker quoted Stages 1–4 are built and one Consumer is live.; never grants access; Jev relevance ≠ authority. Formal-consensus cousin (not this copy): jev-labs — Never confidently wrong; escalate-not-guess; TLA+ is not safety without an exception path. Advance-gate cousin (not this copy): seal — coverage ledger; Hiding escalations is a product lie; schema-valid ≠ semantically correct; mint ≠ product brain. Sureness UX cousin (not this copy): how-sure-is-jev — CERTAIN/CONFIDENT/LEANING/TORN/CLUELESS; gaming the sureness metric is not task truth. CI PR-triage cousin (not this copy): ci-gatekeeper-bot-jev — should_review / risk / route / touches_secrets; threshold gaming surface. Changed-file CI cousin (not this copy): jev-pr-review — shadow-mode only until calibrated; automerge path unwritten; calibration-first before any hard merge gate. Whole-repo intent cousin (not this copy): jev-intent-review — VERIFIED / VIOLATION / UNKNOWN; the diff is a search hint; incomplete-change gaming. Routing/latency cousin (not this copy): slo-router — Jev on the hot path preserved accuracy but 77.93→490.38 ms p95; fail-open local features; exactness never overrides context/capability. Advisory Stop-hook cousin (not this copy): jev-lens — never blocks; never says green unless sure. Claude Stop-hook cousin (not this copy): jev-preflight — eight risk axes; one reinspect; 0.85 threshold is uncalibrated; escalate-attention ≠ hard block; fail-open. Skill/MCP supply-chain cousin (not this copy): jev-security-scan — static checks + Jev; Unflagged ≠ certified safe; does not execute the target. Hermes pre-tool cousin (not this copy): jev-decisions — JEV_ENABLE_HOOKS opt-in; Jev review is advisory; failed review grants no permission; 0.2.1 adapted from anpicasso/hermes-jev-approvals; quoted It never silently approves; quoted The workflow is shadow only; quoted Installation does not select the provider, change approvals.mode. Optional PreToolUse cousin (not this copy): jev-use — jev_gate deny/ask only, fails open; only ever tightens; install does not enable the gate; 12/12 is not a safety proof. MCP VOI-admission cousin (not this copy): jevex — codebase_investigate; Jev ranks a shortlist of files to read; fail-open vs fail-closed on Jev error is undocumented; treating the shortlist as the only files that exist is a soft-score-as-hard-gate. Jev-gated commit-msg cousin (not this copy): commitjev — calibration-first; hook fail-open on check failure; middle band is review. Multi-host routing-proxy cousin (not this copy): jev-routing — Go binary harness; explicitly not an MCP server; distinct from nekowasabi/jev-routing-mcp; drop/truncate without summarizing; default filter; forced only with a verified real Jev answer; tools[] → 1 schema. Hermes host-adapter cousin (not this copy): hermes-plugin-jev — shadow default; cannot grant permission; contrast jev-decisions / hermes-jev-router. Distinct from ajensenwaud/hermes-jev-plugin (jev_check / jev_route / jev_score / jev_evaluate tools; hope the model looks). Guardrail-demo cousin (not this copy): jev-vs-llm-guardrails-intent-router — 96.8% route acc; classify accuracy is not a safety proof. Eval-integrity cousin (not this copy): jev-carryforward — 0/4 recall; hope the model looks. Silent FALLBACK cousin (not this copy): classifier-dev — advertised backend ≠ served backend; F1 0.546 vs ~0.800; digest marks FALLBACK; do not hard-gate on undeclared-fallback confidence. Calibrated PR-review cousin (not this copy): jev-gate — Action + CLI + OpenCode; soft-score-as-hard-rank; require calibration evidence + --no-gate / human override; not thevibeworks/jevgate; not choxos/jev-reviewer. Claude PreToolUse Art Director cousin (not this copy): claude-jev-warden — quality ≥ 80% or exit 2; attention≠verdict / warden-as-hard-gate; escalate taste/quality, block only eval-asset / structural; do not merge warden.js into examples/. Claude PreToolUse Airlock cousin (not this copy): jev-kit — code first, fail-open hygiene; quoted README "This is not a security control"; [airlock-ok:] / retry loop; labelled-eval 100% / A/B zero denies are not a rh-guard ROC; Belay anti-done-without-reading; do not merge into examples/. Dual-gate MCP/hook cousin (not this copy): agent-chaperone — screens calls before run AND results before the agent reads; never auto-approves; InjecAgent AUC 0.976 is not a safety proof; shape-mismatched replacement discarded without complaint (advertised screened ≠ served payload; silent FALLBACK); do not merge into examples/. OpenCode ask-before-act cousin (not this copy): opencode-intent-gate — four Nouls; isWorkThreshold 0.5 / dimensionThreshold 0.75; the gate is a system directive, not a hard block; hope the model asks; do not merge into examples/. OpenCode context-hook compaction cousin (not this copy): opencode-context-pruner — port of fast-jev-compaction; request view only; keepThreshold 0.15 vs upstream 0.5; measured removedMessages 282 is not a quality claim; evidence-erasure; do not merge into examples/. Destructive-shell cousin (not this copy): yolo-shell — ~2ms fast-path then Jev (200ms deadline) then 40-rule floor; no silent fail-open when Jev is down; YOLO_BYPASS / yolo skip; crash still allows; do not merge zsh/bash/fish hooks into examples/. HA readback cousin (not this copy): jev-home-assistant-sentinel — Command sent ≠ state confirmed; action ≠ verified outcome; review is shadow; attention ≠ verdict. Herdr prompt-path cousin (not this copy): herdr-jev — openjev NLI; Nothing here works yet; do not invent mechanics. jev-harness rebrand cousin (not this copy): apa-agent-harness — advertised capability ≠ shipped module; shadow vs live (shadow_noop); 0.85 uncalibrated; do not merge into examples/. Claude Bash/injection-sentinel cousin (not this copy): alsoleg89/jev-bouncer (renamed from alsoleg89/jev-guard) — Tripwires never deny; quoted Your rules win; quoted SECURITY.md Not a security boundary; fail-open (fail=ask never fail-to-allow); on skips auto-mode classifier (use guard); distinct from leepokai/jev-guard and pablozr/JevGuard; do not merge bouncer.py into examples/. Semantic policy-engine cousin (not this copy): pablozr/JevGuard — attributed diff + local gate; UNAVAILABLE on incomplete evidence; advertised monorepo ≠ shipped packages; observe-only. Verify-criteria proving-ground cousin (not this copy): ybadragon/jev-proving-ground — planted defect withheld from criteria writers. Local n-gram attention-firewall cousin (not this copy): jevbrain — confidence ≥ 0.80 → AUTO_ACT else REVIEW_QUEUE; not TypeSafe Jev; silent-fallback if mis-calibrated. Judge/verify crawler cousin (not this copy): jev-crawlers — unverified lead, never a bug; ranking signals, not calibrated confidence. Probability≠argmax cousin (not this copy): typed-gate — declining to answer; 0.40–0.60 band is a refusal; argmax only omitted 25. OpenAPI docs-only cousin (not this copy): jev-oas-sentinel — documentation-only consumer breaks; enforce only when breaking AND promise-violation ≥ 0.90. Plain-English PR-condition cousin (not this copy): if-ai — A passing if-ai check is advisory; TypeSafe 67.8% is four workflows, not PR review. Cheap Laya-distill front-gate cousin (not this copy): nanoprune — 2.8MB; 0.0% Hallucination Guaranteed / ECE 2.58% theater. Hermes skill-policy cousin (not this copy): hermes-switchyard — never loads the skill; ack is not DLP; 0.20 local / 0.80 Jev uncalibrated. LangChain/Deep Agents middleware cousin (not this copy): typesafe_agent_gates — four Nouls at 0.5 HELD; never looser; second layer, not a boundary; 27/27 / 31/31 synthetic, not a rh-guard ROC; do not merge into examples/. Paste confirm-gate cousin (not this copy): jev-pastepilot — Confirm is a gate, not a formality; Confidence is a gate, not proof; fail-opens; do not merge into examples/. Decision-ledger cousin (not this copy): jevcache — cache hit ≠ correctness; shared fingerprint bundles as calibrated truth / auto-act is trust theater. GEPA-align cousin (not this copy): sutro-sh/jev-align — quoted A higher training score never accepts a proposal automatically; distinct from caiovicentino/jev-align; hard-gating that GEPA score is soundness theater. Knowledge-compile cousin (not this copy): enzyme — quoted when asked is guidance compiled for your agent, not an enforced hook; not PreToolUse; do not hard-gate catalyst similarity as deny/allow. Production-integrity runtime cousin (not this copy): jevguard — inject UNRESOLVED_OR_OTHER; AMBIGUOUS_STATE on flat margin; distinct from alsoleg89/jev-guard; SHA-256 cache still not a correctness proof. CI-selector cousin (not this copy): jev-ci-selector — quoted Measure before you skip; default shadow; proposed_run vs run; do not hard-skip checks. Multilingual 0–4 grading cousin (not this copy): tonedown — the engine only measures; 74/74 proves the pipeline, not the model. Productized-moderation cousin (not this copy): jevmod — fails open error_open; AUROC is a sanity benchmark, not a leaderboard; distinct from ohernandezdev/jev-pr-review. Prompt-injection eval cousin (not this copy): one-dollar-tahoe — demonstration set, not a statistically powered benchmark; Real Jev API. Pi/Claude/Codex fail-closed integrity-gate cousin (not this copy): pi-jev-sentinel — allow / ask / warn; quoted never auto-allows; secret scrub; optional task pin; Prompt injection is not solved; do not merge into examples/. Hermes fail-open skill-pack cousin (not this copy): hermes-jev-skills — routing / memory hidden-instruction / compaction / skill / triage / computer-use gated by safe action tables; dashboard on/shadow/off; quoted Everything fails open; named lexical skip, not live Jev; Jev can only return an action id from the table; quoted skills/jev-memory/SKILL.md Never read dropped_injection_ids; quoted enablement Shadow first, and mean it; distinct from rsdkrasen/hermes-jev-router; in-repo jevkit/ ≠ jonathanavis96/jev-kit; fold integrity only, not CUA; do not merge into examples/. Local Laya skill-inject cousin (not this copy): hermes-skill-router — pre_llm_call via the user-message channel; quoted Fail-open; quoted Accuracy is ~good, not perfect; inject ≠ grant (contrast hermes-switchyard never loads the skill); same-named xXLODXx/hermes-skill-router; Hermes prompt-cache, not jevcache; do not merge into examples/. Guarded-commit integrity cousin (not this copy): dgp — typed assessment then application-side guarded commit; application code retains control; quoted DGP docs/TYPESAFE_JEV.md (theirs, not TypeSafe); Speculative assessments cannot authorize effects; cache hit ≠ live Jev; assessors do not execute; primary protocol fold is in Augustus; do not merge into examples/. Hermes fail-closed tool-call policy-gate cousin (not this copy): typesafe-jev-gate — quoted not an autonomous permission slip; uncertain/unavailable → Hermes approval, not allow; cannot override Hermes hardline; metadata-only audit; distinct from thevibeworks/jevgate / totally-tim/jev-gate / hermes-plugin-jev; do not dump plugin source; do not merge into examples/. Local jevlike OmO skill-router cousin (not this copy): omo-jevlike-router — quoted fail-open; recall@24 84.1%; warm ~50–70 ms; ECE ~0.10; soft router ≠ hard gate; earlier 46.2%/95.5% was an evaluation bug; MIT; do not dump model/weights; do not merge into examples/. LLM-vs-Jev guardrailing bake-off cousin (not this copy): llm-vs-jev — quoted Nothing wins outright; jev-1.13.0 strict accuracy 77.9% / ECE 0.053; steerability opus 14.3% / jev 10.7%; distinct from TeoMastro/jev-vs-llm-guardrails-intent-router; do not invent RESULTS.md extras. Local open-weight fact-check cousin (not this copy): jeff — quoted API compatibility does not imply identical judgments; 9,730 examples; Jeff 0.8183 / ECE 0.0807 vs Jev 0.8283 / 0.0932; Lower ECE does not guarantee an individual prediction is correct; light cross-note only (not a drop-in Jev ROC); do not dump weights. Memory-lease cousin (not this copy): invalidate — quoted The memory text is never edited; 0 false invalidations / 157 is tuned on that set, not a rh-guard ROC; similarity top-k is never the judge. Hermes typed-decision-tools cousin (not this copy): hermes-jev-plugin — jev_check / jev_route / jev_score / jev_evaluate; not a fail-closed PreToolUse; hope the model looks. Semantic-contract-lint cousin (not this copy): jev-lint — quoted candidate for a human to judge, not a verdict; No shipped rule has severity: error; distinct from huntedman/JevLint. Memory-relevance cousin (not this copy): jev-recall — relevance, not resemblance; 17/18 / 19/20 is not a safety deny. English-oxlint-cutoff cousin (not this copy): oxlint-plugin-jev — skip unless ci: "fail"; keep jev/ask out of the editor. Shadow-mode mail-classifier cousin (not this copy): rspamd-jev — score 0; no auto-reject; unchanged score ≠ unchanged latency; agreement is not accuracy. Tool-call guardrail-library cousin (not this copy): jev-guardrails — quoted The library owns policy, not the model; A guardrail is not a sandbox; 0.70/0.35 uncalibrated; jev-latest moving alias, not a pin; distinct from alsoleg89/jev-guard / pablozr/JevGuard / leepokai/jev-guard / seb4ez/jevguard; do not merge OpenCode/Hermes/DSH installers into examples/. Semantic-CI cousin (not this copy): moongate — quoted Exit 0 doesn't mean the code is fine; unevaluated never counts as a pass; 4/6 violation-vs-review. Log-triage sentinel cousin (not this copy): jev-logtriage — quoted Low confidence never auto-acts; auto_remediate_candidate is a label. Fairness-audit cousin (not this copy): bias-bench — 1,824 evals; zero binary-decision name differences; read the magnitudes, not the p-values. Context-admission cousin (not this copy): jevusher — J7 pass means nothing detected, never safe to obey; outage → no lens. Soft-judgment integrity sentinel (not this copy): willkelly/jev-evaluation — 123,805 requests; confidence ≥ 0.95 still admits 47% unanswerable; do not hard-gate confidence as fake safety. One-attribute fairness-bench cousin (not this copy): jev-bias-bench — 11,984 calls; quoted Do not test it by swapping names; Read the deltas, not the stars; distinct from natemoo-re/bias-bench. Confidence-gated action-router cousin (not this copy): aurum-gate — packaged src/index.ts auto|escalate|refuse; default autoConfidence 0.85 uncalibrated; parallel src/gate.ts quoted Probability is not confidence; mocked, no live API. Staged PR pre-filter cousin (not this copy): quicksilver-judge — packaged sketchRisks heuristic PASS|HOLD|FAIL not live Jev; Gloss: PASS is not a merge grant; parallel src/stages.ts quoted Code owns overrides. Retrieve-then-judge cousin (not this copy): karat-filter — quoted Token overlap judge — mock stand-in for a Jev Noul. UI-proof assay cousin (not this copy): gold-assay — quoted Screenshots lie until you assay them; Gloss: GREEN ≠ verified UI. Source-bound evidence cousin (not this copy): WaynezProg/jev-kit — quoted Confidence is not a correctness guarantee; SECURITY.md not an authorization boundary; distinct from jonathanavis96/jev-kit Airlock. Empty-tree content-moderation cousin (not this copy): Jev-Examiner — "An AI content moderation workflow powered by the TypeSafe/Jev model."; empty public tree at capture; later README advertises src/docs not in the tree (advertised tree ≠ shipped source); watch; do not invent a shipped moderator. Pi pre-action tool-guard cousin (not this copy): pi-jev-tool-guard — intercepts bash/write/edit; quoted confirmation guard, not an operating-system sandbox; fail-open evaluatorFailure: "allow"; distinct from pi-jev-guard / gate / approver / sentinel / pi-jev-command-guard. Node toxicity-screener cousin (not this copy): gg-friggin-ez — ALLOW/AUTO_BAN; 41/42 not a rh-guard ROC; no key → named heuristic, calls never throw. Source-bound PII/quotes cousin (not this copy): jeveryword — text.slice(start, end) === value; quoted cannot make it produce words that are not in the source; distinct from WaynezProg jev_extract; not PreToolUse. Worker moderation-API cousin (not this copy): jevfanity-api — code owns flagged at default 0.75; flagged is a policy bit, not a safety proof; missing key → 500; quoted CORS is open by default; distinct from gg-friggin-ez / Jev-Examiner. ISO Annex A examiner cousin (not this copy): iso-jevdit — quoted the audit engine is not finished; 3 of ~36; quoted This is not a certification, and it is not a conformity assessment; failOn Accepted today, acted on when the audit engine lands. Job↔CV scoring cousin (not this copy): jev-linkedin — quoted not real-world probabilities; quoted Treat them as an early signal, not a decision; CV sent to /v1/systemone (PII); distinct from bias-bench. Pre-model tool-result filter cousin (not this copy): Astro-Han/jev-harness — quoted Filtering is a routing decision, never destruction; quoted Jev failures fail open; 25/30 not a rh-guard ROC; distinct from AntonioCoppe/jev-harness. Claude PostToolUse relevance-filter cousin (not this copy): Atikpui007/jev-sift — quoted Fails open; quoted This is a relevance filter, not a safety block; hidden candidates never learned; distinct from kbhuw/jev-sift. Citation-grounding cousin (not this copy): jev-cite-check — quoted 1회 관찰이며 성능 주장이 아닙니다; Gloss: one-shot observation, not a performance claim; 97/100 not a rh-guard ROC. Settlement circuit-breaker sim cousin (not this copy): jev-transaction-guard — quoted IMMUNE TO BOTH is soundness theater; Choice TRIP is not a freeze. GitHub Action auto-approve cousin (not this copy): jev-auto-approve — quoted does not satisfy required-approval branch protection; quoted Failures are loud; quoted a gate, not a substitute for a human reviewer; 0.9 uncalibrated; jev-latest moving alias. Calibrated-silence issue-triage cousin (not this copy): hush — quoted Silence is the default behaviour, not the failure mode; apply default false. Call-screener cousin (not this copy): jev-call-screener — quoted JEV classifies; it does not generate dialogue or control the call; quoted The defaults are deliberately fail-open. Chrome quality-filter cousin (not this copy): unslopify — quoted It is a quality filter, not an AI-authorship detector; quoted Keeps uncertain or failed classifications visible. RAG hallucination-experiment cousin (not this copy): no-hallucination — quoted No effect; quoted Recall@k is the wrong thing to optimise. Context INCLUDE/REVIEW/EXCLUDE cousin (not this copy): context-evaluator — quoted experiment metrics, not proof. Pre-read file-rank cousin (not this copy): jev-assist — quoted Flags are prompts for a human look, never verdicts; quoted Typed output guarantees the shape of an answer, not its correctness. Local RAG self-check cousin (not this copy): rag-jev — quoted Degradation is never silent; noul < 0.5 请以公告原文为准. Phishing-verdict MCP/REST cousin (not this copy): mailverdict — quoted Forward an email, get a calibrated phishing verdict; the explainer never changes the label; 24 fixtures are not a benchmark; distinct from mailverdict/mailverdict quoted Advisory signals, not verdicts. Codex/Claude Code binary allow/deny cousin (not this copy): open-jev-approvals — quoted The degradation model changed from fail-closed to fail-open after user review; quoted A deny always requires positive evidence that the action is dangerous; quoted There is no review_required; 0.70 uncalibrated. Reviewer-game cousin (not this copy): beat-the-reviewer — quoted Taking the reviewer offline does not count as a pass; quoted An unavailable reviewer is not an approval; quoted Holds no key and reaches no model; puzzle, not a production merge gate. DSH pre-exec accident-net cousin (not this copy): dsh-jev-guard — quoted It is an accident net, not a security boundary; quoted degrades loudly instead of silently; D3 timeout fail-open; D9 402/401 l0-only; quoted L0 的 deny 类硬规则不受此开关影响; distinct from codebam/dsh-jev-guardrails. Multi-harness sensor/veto cousin (not this copy): jev-sentinel — quoted This is a defense-in-depth sensor and veto layer, not a complete reference monitor; quoted DEFER means only no additional veto; quoted Judgments are not grants; quoted provisional review/block thresholds 0.35/0.80 are policy starting points; pin jev-1.13.0. Diff-risk triage cousin (not this copy): diff-risk-sentinel — quoted It is a prioritization aid, not a bug detector; earlier 96% accuracy / 100% bug recall are superseded; Rule 6 badge ACCEPTABLE_LOW_RISK (strategy: Low risk. Safe to merge.) is not a grant. L7+MCP firewall cousin (not this copy): agent-firewall — quoted fail-closed if checks do not pass; Layer 2 Mock; quoted Score ≥ 0.8 → BLOCK; quoted git pull is intentionally excluded; distinct from 0xrem/agent-firewall. Chrome/userscript content-filter cousins (not this copy): slop-filter quoted hides AI-generated posts; quoted Scores every post in your feed for how likely it is to be AI-written (contrast unslopify It is a quality filter, not an AI-authorship detector); sift Substance · Humor · Chit-chat · Promo · Junk plus AI-written and Off-topic; Winnow quoted every word on the card is a template filled from typed answers; 80% verdict agreement / 90% content-type agreement; quoted The goldens are still unreviewed; x-spam-filter-typesafe max ≥ 0.85; 放行不隐藏. Autonomous Gmail cousin (not this copy): vynnlee/jev-mail — Autonomous 24/7 Zero-Inbox; distinct from muhammedilyasy/jev-mail quoted Read-only: it never sends, deletes, labels or archives anything. Fraud-demo cousin (not this copy): system1-fraud-interceptor-demo — quoted Es una demo de experimentación personal, no un benchmark; quoted no está pensada para producción. Wiki-watch cousin (not this copy): jev-wiki-watch — FLAG ≥ 80%; REVIEW 40% to 80%; OK below 40%. Skill-tree review-classifier cousin (not this copy): umby-jev-stack — 544 flags; rejected 543 as false positives; quoted Never drop a finding; quoted Jev only classifies. Prune-kit cousin (not this copy): jev-prune-kit — quoted Not a universal /prune; quoted Not live-tested; quoted 122 passing local tests are not 122 live harness or model tests; quoted 88 passing local tests are not 88 live harness or model tests. YOLO-then-Jev scene-filter cousin (not this copy): yolo-jev-scene-filter — quoted YOLO-World detects; TypeSafe Jev keep/skips boxes; quoted Jev only filters what YOLO already found.; keep floor 0.55 (uncalibrated); not hide-never-learned. Advertised-Action cousin (not this copy): jevgate-action — advertised Action ≠ shipped workflow; distinct thevibeworks/jevgate / totally-tim/jev-gate. Go triage cousin (not this copy): boldbug1/jev-triage — Distinct ThyFriendlyFox/jev-triage; -threshold 0.8 (quoted starting point; uncalibrated). Other-contacts cousin (not this copy): contact-cleaner — quoted Buckets are code, not the model.; quoted Deterministic first.. Claude reflex-layer cousin (not this copy): claude-code-jev-guardrails — quoted Claude thinks. Jev reacts. Code decides.; advertised ASK_USER ≠ engine emit; quoted Treat this as a working prototype, not a hardened production guardrail.; no-key / JEV_MODE=mock named degraded backend (mock can still BLOCK); do not merge .claude/settings.json into examples/. OpenJev voice-gate cousin (not this copy): jev-voice-gate — quoted Это не гарантированная замена wake word.; not TypeSafe Jev. ALP PR-review cousin (not this copy): alp-pr-review — quoted Ikke en erstatning for branch protection.; Quoted: Den får aldrig PR-titel, -beskrivelse eller diff.. Judol userscript cousin (not this copy): youtube-judol-userscript-jev — classifier.dev jev no key; confidenceThreshold 0.6 (uncalibrated). Social-draft demo cousin (not this copy): Postmark — advertised description ≠ shipped UI; stamps 0.6 / 2.2. Deploy/ship-gate cousin (not this copy): shipit-gate — quoted Does this replace my CI? No.; quoted Rejects fail closed (exit code 2).; --force / --no-verify; demo mocked. Bash-AST cousin (not this copy): jev-brig — Not TypeSafe Jev; quoted jev-brig is a guardrail, not a boundary.; unparsable → ask — never a silent allow; git hooks are the floor; do not merge into examples/. Empty JevGuard cousin (not this copy): JevGuard-NSFA — .gitignore only; advertised Guard ≠ shipped source. Calibrated PreToolUse cousin (not this copy): jevengineeringgate — quoted The gate never says yes; quoted Is this a security boundary? No.; 0/26 wrong not a rh-guard ROC; do not merge hooks into examples/. Weakened-test linter cousin (not this copy): lgtm — quoted lgtm is advisory by default; holdout precision 1.00 not a rh-guard ROC. Python-owned loop cousin (not this copy): jev-claude-controller — quoted no function in the safety layer accepts a model signal.; not a Claude plugin. Advisory CLI cousin (not this copy): ask-jev — quoted never use a verdict to grant permissions; 280ms. TypeSafe decorator-wrap cousin (not this copy): jevshield — quoted Sub-100ms, non-autoregressive runtime security gate; SECURITY.md heuristic not a security boundary; Distinct uberto/jev-brig (Not TypeSafe Jev). Mock incident-triage cousin (not this copy): jev-demo-triage — quoted Jev did not beat baseline on pass rate; N is 3 per cell. Typed video-mesh cousin (not this copy): volumetric-intelligence — quoted Jev is the typed gate (Choice / Score / Noul), never the runtime; /api/walk Rehearsal schema. Codex Jev-router cousin (not this copy): Jev-Auto-Router — Policy Guard Deterministic ALLOW(plan) or DENY(reason); quoted No evidence means no production delegation; automatic delegation off by default (UNVERIFIED). SaaS teardown-demo cousin (not this copy): jev-web-analyzer — quoted developer demo, not … SEO score; There is no mocked provider. Asymmetric triage-run cousin (not this copy): ai-provider-triage-comparison — quoted not a general model ranking; unanimous 2/5. Experimental browser-MCP cousin (not this copy): jev-guard-mcp — quoted the server cannot independently attest human approval; min 0.80; not a general-purpose browser agent. Dual-spectrum phishing cousin (not this copy): JEV-Dual-Spectrum-Phishing-Guardian — Malicious 61–100 is not a safety envelope; quoted Section 4: Counter-Measures are exemplary and decoupled from individual verdicts. Ruby advisory-review cousin (not this copy): slop-guard — the reviewer never blocks; exit 0 Review completed (concerns may be present). Stubbed RAG-gate cousin (not this copy): jev-corrective-rag — quoted Jev decision gates | Stubbed — no API key yet; stub NOT a simulation of Jev's quality. Read-only duplicate-triage cousin (not this copy): jev-issue-radar — quoted It never closes issues, adds labels, or posts comments; 2/4 not a rh-guard ROC. Diff-triage filter cousin (not this copy): MaxIvanyshen/jev-review — quoted It never approves or rejects anything; distinct NiazMorshed2007/jev-review. Jev Capability Resolver cousin (not this copy): jcr — quoted JCR returns documentation. It does not execute commands.; quoted The included harnesses also stop at explaining the steps needed to carry out a task.; beam 0.6 / width 3; routing ≠ permission; treating capability context as attested approval to run is theater; distinct jev-guard-mcp / jev-router / NiazMorshed2007/jev-review. GitHub-App PR-router cousin (not this copy): JevPR — LOW if composite < 3.5 → APPROVE; quoted Jev is an AI model, and can make mistakes; treating LOW auto-APPROVE as a merge grant is theater; distinct ohernandezdev/jev-pr-review / metalbear-co/jev-auto-approve / MaxIvanyshen/jev-review; do not merge into examples/. Claude danger/notice/finish cousin (not this copy): the-jev-enator — quoted all three fail open; quoted The completion check does not block anything by default; 23/23 not a rh-guard ROC; 0.80/0.90 uncalibrated; distinct jevgate / jev-gate / claude-code-jev / jev-kit / jev-bouncer; do not merge into examples/. Claude vault-capture cousin (not this copy): jev-vault-gate — quoted never blocks or alters the actual turn; quoted Nothing is ever deleted automatically; 0.6; distinct jev-carryforward / jev-recall; do not merge into examples/. DSH prune/screen cousin (not this copy): dsh-jev-tools — quoted it ranks, it never thresholds; 8/8 not a rh-guard ROC; no-key inert; distinct tr1v3r/dsh-jev; do not merge into examples/. Prompt-injection quarantine cousin (not this copy): JEV-Prompt-Injection-Guardian — 80%+ BLOCK; score clamped to Choice; heuristic fallback is not live Jev; distinct Dual-Spectrum-Phishing-Guardian; do not merge into examples/. Healthcare-router cousin (not this copy): jev-healthcare-support-router — quoted does not make medical diagnoses; 0.8/0.7 is not clinical authority. FujiNet PR-triage cousin (not this copy): prMonster — quoted It never touches a pull request on its own; quoted Merging is never offered; distinct HexyeDEV/JevPR; do not merge into examples/. Hermes async nervous-system cousin (not this copy): hermes-jev — gate_mode default off; quoted Do not treat a Jev probability as proof of correctness; catalog 0.2.1.2 ≠ 0.2.2.dev4; distinct hermes-plugin-jev / typesafe-jev-gate; do not merge into examples/. Local System One gateway cousin (not this copy): sys1 — hosted Jev disabled by default; 32/72 / 44/72 not a Jev ROC; loopback is not authentication. Regime-gate cousin (not this copy): jev-regime-gate — quoted Research experiment, not investment advice; 0.4/0.6 is not investment advice. Effort-router cousin (not this copy): model-effort-router — quoted No benchmark claims; 0.5 dispatch is not accuracy; does not execute; distinct Mandrilsquad1441/jev-model-router. Thin soundness-theater cousin (not this copy): localjev — wire-compatible prompted JSON probs, not logits; evaluate calibration before consequential decisions; not a new hook pack. Open System One head (not this copy): laya — 0.85 RLCD gate is still soft; Khmer OOD 0.000 at 95.2% confidence. Windows UIA MCP cousin (not this copy): windows2text quoted A Jev confirm, escalate, or abort gate never executes automatically; windows_step defaults act=false; distinct tacticocc/Jevbridge. Infra-watchdog cousin (not this copy): PavelLizunov/jev-sentinel quoted not the truth of a diagnosis; quoted Schema validity is not evidence that a diagnosis is correct; 95.0% not a measurement; distinct CompleteTech. Confidence-gate bench cousin (not this copy): jev-test-confidence-gate theirs 163 ms / 87.5%; 0 of 3; quoted 24 invented tickets; quoted untested at adequate power, not refuted. X-userscript cousin (not this copy): Twitter-keyword-shield local 0ms then Jev; 0.5 uncalibrated; sub-100ms not a rh-guard ROC; distinct yonsakhan/x-spam-filter-typesafe. Claude Laya-harness cousin (not this copy): Laya-GuardRails-Harness quoted BLOCK comes from rules or policy, never from a Laya label; quoted low confidence escalates, never allows; distinct NandhaKishorM/laya. Hermes smart-approval reviewer (not this copy): hermes-jev-approvals quoted Scope: approvals only. Quoted: Not a sandbox. Theirs: 9.8x faster, 4.2x fewer interruptions; independent 1.24x. Distinct hermes-slash-router quoted stored routes are never applied automatically. GLiClass router cousin (not this copy): scx-router 0.5 is not a Jev gate. On-device PII cousin (not this copy): pii-masker quoted It never returns the input unchanged as a fallback. REST redact cousin (not this copy): PII-Redactor SLM PII_REDACTOR_USE_GLINER=false. LangChain PII demo (not this copy): guardrails-demo theirs ~180 ms. Name-collision WAR (not this copy): systemone-gatekeeper-war Uppsala Cora se.uu.ub.cora, not TypeSafe System One. Egress airlock (not this copy): airlock quoted A model never gets to say "this is fine." Distinct jonathanavis96/jev-kit Airlock. ESP32 jevlike demo (not this copy): jevlike-esp32 quoted This is intentionally a demo, not a production model. Community .NET SDK (not this copy): typesafeai-dotnet-sdk quoted This project is not affiliated with, sponsored by, or endorsed by TypeSafe AI. Claude PreToolUse + MCP-proxy cousin (not this copy): RiskAverseTech/toolgate (@riskaverse/toolgate) quoted defense in depth, not a sandbox; allow is advisory; policy only ~/.toolgate; distinct fdemir/toolgate; theirs 20/20 not a rh-guard ROC. Type-safe model-router cousin (not this copy): ailerix Jev classifies task families only; ailerix/auto is not a permission. GitHub quality-gate cousin (not this copy): jev-github-quality-gate auto_approved is not a merge grant; quoted Supports shadow mode. Windows computer-use cousin (not this copy): win-cu-router HTTP bridge is not an operating-system sandbox; planner cannot increase permissions; distinct ArronHC/windows2text. Herdr spawn-router cousin (not this copy): herdr-jev-router quoted Treat the enforcement claims as unproven.; fail closed; distinct muthuishere/herdr-jev. Bounded Jev+Poise router cousin (not this copy): braess-router quoted This project is independent of TypeSafe.; no workload accuracy guarantee. OpenClaw model-router cousin (not this copy): gowtham980/jev-router quoted This is NOT a universal automatic model-and-thinking switcher.; quoted Classifier failures retain the current model.; distinct reallygood83/jev-router. Local PII gateway (not this copy): PrivaParse theirs PERSON F1 0.964; quoted LICENSE_NUMBER and ROUTING_NUMBER measured 0.000 recall. Local-first Go PII (not this copy): anonde quoted no outbound HuggingFace traffic at request time. Judgment-proposal Worker cousin (not this copy): decision-kernel quoted The guard never executes anything itself. Quoted: Judgment proposals only. Soft /guard JSON is a proposal; caller owns execute; missing key → 503. Theirs 10/10 / 0 false-block not a rh-guard ROC. Local kev router cousin (not this copy): kev-model-router quoted kev being down never blocks traffic; quoted The router never blocks traffic.; routing ≠ permission; distinct Mandrilsquad1441/jev-model-router / jaredpalmer/kev; Theirs 10/10 not a rh-guard ROC. Claude PreToolUse safety-gate cousin (not this copy): eugeniughelbur/jev-gate quoted It catches mistakes, not attackers; quoted Fails open.; observe default; FAST_ALLOW then HARD_DENY then Jev; MCP wrap is hope-the-model-looks; distinct totally-tim/jev-gate / thevibeworks/jevgate / ktsu2i/jevgate-action / RavenRepo/jevengineeringgate; Theirs 300-call 2026-09-20; git stash clear hard-rule; soft p(destructive)>=0.90 can deny in guard/enforce. Browser-agent lab cousin (not this copy): gentle-browser-jev quoted never claim savings without a controlled A/B run.; local-fallback without key; real browser/device not enabled; 0.75 click_search fallback is not a safety envelope; cousin of jev-agent-safety-arena. Cursor-agent overlay cousin (not this copy): omapi-overlay quoted There is no omp source tree in this repository; shadow never blocks. Claude/Codex PreToolUse firewall cousin (not this copy): Koushik890/jev-firewall quoted Fail closed. Quoted: Rules can only tighten. Theirs: 104 tests; distinct wmsing/agent-firewall. Claude Pre/PostToolUse semantic cousin (not this copy): dr-dimitru/claude-jev-plugin quoted This plugin is a semantic guardrail, not a security sandbox. Quoted: Plugin never returns allow from TypeSafe confidence. Fails open; distinct RahulBalakavi. LiteLLM compaction tutorial cousin (not this copy): DihRJ/claude-code-jev-compaction quoted Nothing is summarized or paraphrased. Quoted: It fails open by default. Threshold 0.2; dropping results can erase eval evidence. Agent evals+gates cousin (not this copy): openlayer-ai/jevals quoted don't let the classifier become the authorizer. Quoted: estimates, not measurements; distinct dayhaysoos/jevals. Cloudflare Worker profanity Noul cousin (not this copy): 4rays/profanity-checker quoted threshold lives in your code (0.5); not a coding-agent hook. Minis advisory cousin (not this copy): vzornjak/typesafe-decision quoted Not a safety control, not an authorization mechanism. Quoted: 51.7% may only be cited as an uncontrolled projection, never as a measurement (theirs retraction). HF Laya family listing (not this copy): Gtrkrsk/laya quoted Khmer 0.000 accuracy at 0.952 confidence; 0.85 still soft; not a new model. Per-turn harness router cousin (not this copy): JoacoMarc/jev-harness-router quoted This is where safety lives. Quoted: It does not execute tools. Theirs 94.4% not a rh-guard ROC; Distinct AntonioCoppe/Astro-Han. Stdlib gateway cousin (not this copy): aniruddh-krovvidi/switchboard code BLOCK 0.50; Theirs ROC-AUC 0.990 not a rh-guard ROC; Distinct dev-hari-prasad/switchboard. Draft-only outbound cousin (not this copy): outbound-draft-gate quoted You always click send. Quoted: Code owns policy. Jev-style evaluate, not TypeSafe Jev; Distinct jev-linkedin / Postmark.

Cursor

Copy examples/cursor-hooks.json to .cursor/hooks.json. Command stdin. Set failClosed: true on shell and tool gates.

Host-adapter cousin (not this copy): jev-routing — Go binary harness for Cursor Agent CLI among others; explicitly not an MCP server; distinct from nekowasabi/jev-routing-mcp; drop/truncate without summarizing; default filter; forced only with a verified real Jev answer; tools[] → 1 schema.

Cursor-agent Jev overlay cousin (not this copy): omapi-overlay quoted There is no omp source tree in this repository. Default JEV_MODE=shadow; shadow never blocks. Empty findings are not approval. Windows UIA MCP cousin (not this copy): windows2text quoted A Jev confirm, escalate, or abort gate never executes automatically.

Codex (OpenAI Codex CLI)

Command PreToolUse only: ~/.codex/hooks.json or .codex/hooks.json. Copy examples/codex-hooks.json. There is no HTTP hook type.

Deny with hookSpecificOutput.permissionDecision: "deny" plus a non-empty permissionDecisionReason. Exit 2 with that JSON.

Do not send continue: false on Codex PreToolUse. Unsupported fields mark the hook as failed and Codex continues the tool (fail-open). failClosedClaudeOutput() is the Claude wrapper and includes continue: false; Codex uses failClosedCodexOutput() instead.

Host-adapter cousins (not this copy): jev-routing — Go binary harness; explicitly not an MCP server; distinct from nekowasabi/jev-routing-mcp; drop/truncate without summarizing; default filter; forced only with a verified real Jev answer; tools[] → 1 schema. jev-runway — Codex Jev proxy; LICENSE-only public tree at capture; do not invent authorization mechanics. Hermes fail-open skill-pack cousin (not this copy): hermes-jev-skills — also Claude Code/Codex; quoted Everything fails open; named lexical skip, not live Jev; Shadow first, and mean it; distinct from rsdkrasen/hermes-jev-router; do not merge into examples/. Jev-gated commit-msg cousin (not this copy): commitjev — calibration-first; fail-open on check failure. Codex/Claude Code binary allow/deny cousin (not this copy): open-jev-approvals — quoted The degradation model changed from fail-closed to fail-open after user review; quoted There is no review_required; 0.70 uncalibrated; do not merge into examples/. Codex Jev-router cousin (not this copy): Jev-Auto-Router — Policy Guard ALLOW(plan) or DENY(reason); quoted No evidence means no production delegation; Dashboard observers only; automatic delegation off by default (UNVERIFIED); do not merge into examples/. Codex per-turn routing cousin (not this copy): jev-codex-router — quoted Fail-open; Kill switch; 0.5 → Sol not frontier; BACKTEST −59.9% on 237 turns; cache invalidation not modelled; routing ≠ permission; distinct miniLV/Jev-Auto-Router; do not merge into examples/. TypeSafe role-router cousin (not this copy): reallygood83/jev-router — quoted Jev does not pick model ids. It picks a role. Failures pass through.; error-pass; floor 0.6; quoted They are not a live quality claim.; distinct justinhsu1477/jev-router / hermes-plugin-jev plugin ID jev-router; routing ≠ permission; do not merge into examples/. Jev Capability Resolver cousin (not this copy): jcr — quoted JCR returns documentation. It does not execute commands.; quoted The included harnesses also stop at explaining the steps needed to carry out a task.; Claude/Codex harnesses; beam 0.6 / width 3; routing ≠ permission; treating capability context as attested approval to run is theater; distinct jev-guard-mcp / jev-router / NiazMorshed2007/jev-review; do not merge into examples/. Codex observe-default local-router cousin (not this copy): model-switch — quoted Experimental. Start in observe mode.; quoted Fail open; minConfidence 0.65; no key → passthrough; routing ≠ permission; distinct jev-codex-router / Jev-Auto-Router / jev-model-router; do not merge into examples/. Hermes nervous-system cousin (not this copy): hermes-jev — quoted Do not treat a Jev probability as proof of correctness; gate_mode default off; catalog 0.2.1.2 ≠ 0.2.2.dev4; do not merge into examples/. Effort-router cousin (not this copy): model-effort-router — dry-run without key; 0.5 dispatch is not accuracy; does not execute. Experimental Codex JEV preflight cousin (not this copy): CompleteTech-LLC-AI-Research/jev-codex-approval quoted Codex retains responsibility for permission enforcement, action binding, cancellation, and final execution. Quoted: native adapter has not been compiled or exercised inside a running Codex instance. Shadow always defer. Codex MCP tool-router cousin (not this copy): jackbarunz/jev-tool-router quoted The router narrows discovery; it does not permanently remove the fallback path. Threshold 0.90; routing ≠ permission; distinct esinocchi/jev-tool-router which does not generate arguments, approve actions, or execute tools. Codex runtime control-plane cousin (not this copy): JxWayne890/jev-control-plane quoted Prevents the decision model from weakening verified safety rules. Theirs: 33 tests; JEV cannot lower verified floors. Claude/Codex firewall also listed under Claude: Koushik890/jev-firewall.

Grok Build

~/.grok/hooks/*.json or .grok/hooks/*.json. PreToolUse is the only blocking event. Command or HTTP. Deny shape is { "decision": "deny", "reason": "…" } — not Claude JSON. Exit 0 allows; exit 2 denies. Crash, timeout, and malformed output are fail-open on the host (docs).

examples/grok-hooks.json runs npx tsx hooks/run.ts grok. Prefer hooks/grok-hook.sh when you need fail-closed: it POSTs to /api/hooks/grok and always emits an explicit deny JSON + exit 2 if the sidecar is down.

Grok Bot decision-router cousin (not this copy): grok-jev-router quoted The router is advice; those rules are the boundary. Quoted: Grok Bot obeying the route is instruction-following, not enforcement. Shadow first. Do not merge into examples/.

Host-adapter cousin (not this copy): jev-routing — Go binary harness; explicitly not an MCP server; distinct from nekowasabi/jev-routing-mcp; drop/truncate without summarizing; default filter; forced only with a verified real Jev answer; PreCompact cannot strip the catalog.

Pi

Copy examples/pi-extension.ts to ~/.pi/agent/extensions/ (global) or .pi/extensions/ (project). The extension listens on tool_call and returns { block: true, reason, terminate: true } (Pi supports terminate). It calls HTTP /api/hooks/pi (or stdin hooks/run.ts pi for tests). On sidecar failure it fail-closes in the plugin. Sibling Pi bash gate (not this copy): pi-jev-approver — code-computed state then Jev; commandRules can hard-block; no key → fail-closed. Contrast jevgate allowlist + fail-open rest. oh-my-pi cousin (not this copy): omp-auto-mode — safe/ask/unsafe; classifier failure defers to omp approval (fail-open). Oh My Pi acceptance-gating cousin (not this copy): omp-jev-extensions — jev_acceptance_gate + jev_route; fail-open, never fail-catch. Measured OMP approval-gate cousin (not this copy): omp-greenlight — graded allow, not hard deny; default 0/94 unsafe; operator owns the risk dial. instruction-drift cousin (not this copy): pi-heed — persists user constraints across tool calls and context compaction; Jev never writes policy; shadow default; fail-open. Pi content-judge cousin (not this copy): pi-jev-guard — edit/write vs Markdown rules; informative default; 0.85 uncalibrated; soundness theater if treated as a hard gate. Pi control-plane cousin (not this copy): pi-jev-control — not a content-judge; deterministic tool-gate + Jev; GUI never force-click. Optional Pi/Claude jev_gate cousin (not this copy): jev-use — deny/ask only, fails open; only ever tightens. Pi verbatim-compaction cousin (not this copy): pi-jev-compact — keep-windows before Jev; fail-open to the built-in LLM summarizer; keepThreshold 0.5 uncalibrated; complementary to pi-heed / carryforward 0/4. Do not merge into examples/pi-extension.ts. Pi fail-open pre-exec cousin (not this copy): pi-jev-gate — block if choice === "block" OR p(block) ≥ 0.50; failing open; /checker can disable; distinct from jevgate / jev-gate / pi-jev-approver. Do not merge into examples/pi-extension.ts. Pi fail-closed integrity-gate cousin (not this copy): pi-jev-sentinel — Jev on tool calls, outputs, and replies; allow / ask / warn; quoted never auto-allows; secret scrub before Jev; optional task pin vs chat drift; Prompt injection is not solved; contrast fail-open pi-jev-gate and fail-open pruners. Do not merge into examples/pi-extension.ts. Pi pre-action tool-guard cousin (not this copy): pi-jev-tool-guard — intercepts bash / write / edit; extension owns control flow; default evaluatorFailure: "allow" fail-open; quoted confirmation guard, not an operating-system sandbox; distinct from pi-jev-guard / pi-jev-gate / pi-jev-approver / pi-jev-sentinel / pi-jev-command-guard. Do not merge into examples/pi-extension.ts. Pi bash/powershell command-approval cousin (not this copy): pi-jev-command-guard — local critical always ask; auto-allow only allow + 0.75 / 0.25 / 0.10; quoted do not provide a complete sandbox; quoted ambiguity must never silently become permission. Do not merge into examples/pi-extension.ts. Approval-first Pi /edit cousin (not this copy): /edit — quoted Nothing changes until you approve the exact request; quoted If the provider is unavailable, /edit stops instead of pretending that a review happened; quoted Four runs of one tiny task is not a benchmark. Do not merge into examples/pi-extension.ts. Capability-aware prune-kit cousin (not this copy): jev-prune-kit — quoted Not a universal /prune; quoted Not live-tested; quoted 122 passing local tests are not 122 live harness or model tests; quoted 88 passing local tests are not 88 live harness or model tests; pin jev-1.13.0. Do not merge into examples/pi-extension.ts. Pi bash/write/edit permit cousin (not this copy): pi-jev-permit — quoted silence is never consent.; quoted A failed judgment is never treated as approval.; p ≥ 0.6 (uncalibrated default); degraded L1–2 pass L3 block; Distinct from pi-jev-approver/gate/guard/sentinel/tool-guard/command-guard/control. Do not merge into examples/pi-extension.ts. Pi model-router cousin (not this copy): pi-jev-helm — fail-open to Baseline; confidenceThreshold 0.75; 2500 ms; quoted Safety Gate/Verifier are separate, uncommitted exploration directions; routing ≠ permission. Do not merge into examples/pi-extension.ts. Pi warden cousin (not this copy): pi-warden — quoted It is advisory, not a sandbox; failOpen: true; irreversible 0.5 warn / 0.7 hold; quoted project-maintained benchmarks, not universal claims; Distinct claude-jev-warden / pi-jev-guard / pi-jev-helm / pi-jev-permit. Do not merge into examples/pi-extension.ts. Pi shadow/fail-open gate cousin (not this copy): pi-jev (@y0usaf/pi-jev) — quoted Shadow mode is the default. Quoted AGENTS.md: The gate fails open by design. 0.90/0.70/0.85/2.50; smoke calibration not enough to switch the gate to enforce; Distinct other pi-jev-*. Do not merge into examples/pi-extension.ts. Pi dry/ephemeral prune cousin (not this copy): pi-jev-prune — default dry; Fails open; ephemeral; 0.25; 1 of 28 below 0.15; prune ≠ deny; Distinct compact/pruner/nanoprune/prune-kit. Do not merge into examples/pi-extension.ts. Pi OpenRouter router cousin (not this copy): pi-jev-router — /router shadow recommend only default; quoted Jev output is evidence, not truth.; 89%/88% cheaper not a rh-guard ROC; Distinct rizafahmi/pi-jev-task-router (owns the model while on). Routing ≠ permission. Do not merge into examples/pi-extension.ts. Pi consent-gated judge cousin (not this copy): typesafe-pi — quoted Results are model judgments—not proof or authorization.; quoted never as permission to perform an action.; disabled by default; /typesafe enable; distinct DevMortimer/pi-typesafe / twilwa/pi-typesafe / nardinmarcus/pi-jev-typesafe; do not merge into examples/pi-extension.ts. Task-boundary Pi router cousin (not this copy): win4r/pi-jev-router — shadow default; exact hashes; pin jev-1.13.0; 15/16 not a rh-guard ROC; quoted Production task quality and net savings have not been established.; routing ≠ permission; Distinct philippdubach/pi-jev-router. Do not merge into examples/pi-extension.ts. Pi auto-mode classifier cousin (not this copy): JohnsonRan/pi-jev quoted This is not a sandbox. Quoted: This remains a permission aid, not a security boundary. 3/10 → 0/10 not a rh-guard ROC. Distinct y0usaf/pi-jev. Do not merge into examples/pi-extension.ts. omp Nix-overlay cousin (not this copy): omapi-overlay quoted There is no omp source tree in this repository. shadow never blocks. Empty findings are not approval. Distinct omp-auto-mode. Do not merge into examples/pi-extension.ts. Pi /model picker cousin (not this copy): MarcoLoDico/pi-jev-router quoted unvalidated starting policy, not a 95% accuracy guarantee.; JEV_THRESHOLD 0.95; missing key/failures → backup; selecting another model bypasses entirely; routing ≠ permission; Distinct philippdubach/pi-jev-router / win4r/pi-jev-router / rizafahmi/pi-jev-task-router / Z761293629/pi-jev-helm. Do not merge into examples/pi-extension.ts. Current harshwasan integrity-gate listing (not this copy): harshwasan/jev-sentinel is the rename of pi-jev-sentinel; quoted never auto-allows. Keep both slugs; distinct CompleteTech. OMP jev-judge plugin cousin (not this copy): cyriusweng/omp-jev-gate quoted User authorisation and OMP permissions continue to govern actions. 0.5 uncalibrated; distinct luw2007/omp-jev-extensions. OMP model+thinking picker cousin (not this copy): devjtv/jev-router quoted This is cost control, not a quality upgrade. Quoted: A router must never break a turn. Fail-open keep the current model; minConfidence 0.55; distinct reallygood83/jev-router. Do not merge into examples/pi-extension.ts. Pi budget-aware model-router cousin (not this copy): da-vinci-noob/pi-jev-model-router quoted Jev judges the task, code owns the budget. Quoted: Fails open. Caps do not block turns; routing ≠ permission; Distinct Mandrilsquad1441 / philippdubach / pi-auto-model-router. Pi score-based auto-router cousin (not this copy): pi-auto-model-router quoted The parent model is not switched. Without subagent, routing does not dispatch; Distinct da-vinci-noob / pi-jev-compact. Do not merge into examples/pi-extension.ts.

Optional Claude-compatible settings via @hsingjui/pi-hooks (command handlers only; HTTP / prompt / agent types are not supported): merge examples/pi-hooks-settings.json into .pi/settings.json or ~/.pi/agent/settings.json. Matchers use Pi's lowercase tool names (bash|edit|write).

Amp

Copy examples/amp-plugin.ts to .amp/plugins/ or ~/.config/amp/plugins/. amp.on("tool.call") returns allow or reject-and-continue with AGENT_DENY. Thrown plugin errors are ignored by Amp (fail-open), so the copy catches and returns reject-and-continue. Do not use action: "error" as a deny. HTTP /api/hooks/amp is how copies score. In-repo you may import scoreEvent at the top of the module instead of fetch. Plugin API.

Prime Agent

Copy examples/prime-extension.ts to ~/.prime/agent/extensions/ or .prime/agent/extensions/. Same { block, reason } shape as Pi. Prime docs do not include terminate.

DSH (generic/adapter)

This is the real DeepSeek Harness (Basit / DarwinX). Its Claude Code and Codex command-hook bridges run unmodified hooks/run.ts claude or codex at tools/pre-execute. HTTP hook types are skipped. There is no separate drop-in DSH hooks.json.

tools/pre-execute is the pre-tool gate, so both adapters map it onto PreToolUse: the Claude bridge answers with permissionDecision: "deny" (hookEventName: "PreToolUse") and the Codex bridge with its Codex-safe deny JSON. Both exit 2 on a deny for this event, because the bridge only fails closed on a non-zero exit. Claude Code's own PreToolUse still exits 0 with the deny JSON, which is what that host expects.

For a host-neutral stdin adapter use hooks/run.ts dsh (alias of generic) with examples/generic-event.json. Native typed plugins listen on tools/pre-execute and return PreToolDecision { kind: "deny", reason } — that is DSH's own API, not a fake product we invented.

DSH/OpenCode/Hermes tool-call guardrail cousin (not this copy): jev-guardrails (@codebam/jev-guardrails; README title dsh-jev-guardrails) — quoted The library owns policy, not the model; A guardrail is not a sandbox; a local decision never overrides Jev; failMode explicit; default 0.70/0.35 uncalibrated; jev-latest moving alias, not a pin. Distinct from alsoleg89/jev-guard, pablozr/JevGuard, leepokai/jev-guard, and seb4ez/jevguard. Sibling dedicated plugin monorepo (not this copy): dsh-jev-guardrails (@codebam/jev-guardrails + @codebam/dsh-jev-guardrails) — quoted The library owns policy, not the model; A guardrail is not a sandbox; plugin policy layer, not a sandbox or an authorization system; failMode default open; 0.70/0.35 uncalibrated. Distinct from 7starsseeker/dsh-jev-guard (quoted It is an accident net, not a security boundary; D3 fail-open; D9 l0-only). Do not merge their DSH installer into examples/. DSH prune/screen/gate cousin (not this copy): dsh-jev-tools — quoted it ranks, it never thresholds; 8/8 not a rh-guard ROC; no-key inert; jev_gate escalate; distinct tr1v3r/dsh-jev. DSH core/MCP/router/effort cousin (not this copy): dsh-jev — quoted Never registers or modifies LLM routes; quoted Shadow-run by default; quoted Degrades, never breaks; name: not path:; 35/35 mocked. Do not merge into examples/.

Exo (ToolRuntime wrap, not drop-in hooks)

Exo has no native hooks.json. This is support via ToolRuntime wrap, not drop-in hooks. Wrap ToolRuntime::execute (Rust trait in crates/executor/src/executor_types.rs) and TypeScript TurnContext.executeTool. The wrapper POSTs to /api/hooks/exo or /api/hooks/generic (same { block, reason? } JSON) or calls scoreEvent in-process. Deny by returning a tool error { ok: false, error: AGENT_DENY } — never leak scores. Fail-closed is whatever the wrapper does; the Exo host has no hook failClosed flag. Scoring is bounded at 8s (AbortSignal.timeout / curl --max-time 8) and a timeout is a deny, same as the Pi, Amp, Prime, and Grok wrappers. Opaque copy:

Action denied: protected evaluation artifacts cannot be modified. Implement the stated behavior against the existing checks. If a check contradicts the spec, stop and report the defect instead of weakening it.

The gate is deny-by-default: every tool is scored except a verified read-only exemption (inspect_tools, list_adapters, list_adapter_events, list_conversation_events, list_scheduled_tasks, list_sandbox_snapshots, get_sandbox_status, list_skills, read_skill_file, web_search, web_fetch). That covers the mutating verbs Exo ships — shell, manage_tool, install_agent_tool, uninstall_agent_tool, rebuild_and_restart_exo, snapshot_sandbox, rewind_sandbox, the scheduler verbs, and adapter create/enable/disable/delete/send — and agent-created tools from .exo/agent-tools/, whose names are not known ahead of time. Exo ships no bash, write, or edit tool; do not gate Claude-shaped names. Names are from crates/executor/src/harness_tool.rs plus the TypeScript harness built-in, adapter, sandbox, scheduler, and skill tools on exoharness/exo main.

Keep generic stdin (hooks/run.ts generic / exo) if Exo later adds hooks. Optional gate for agent-created tools under .exo/agent-tools/: examples/exo-agent-tools-gate.ts.

See examples/exo-tool-runtime.ts and examples/exo-tool-runtime.rs.