Shape

Problem

Closed coding agents expose prompts, tool calls, and traces, not residual-stream activations. A DoM probe cannot sit in a Claude or Cursor hook.

TypeSafe Jev is a System One model. It takes unstructured state and returns typed probabilistic decisions. It is the live semantic scorer. It is not a GLiNER-style token classifier and it does not generate steer text.

Usage (caller's view)

Score a prompt with the lexical fallback (tests, no API key):

import { score } from "@/lib/risk";
score({ stage: "prompt", prompt });

Score a hook event (Jev when TYPESAFE_API_KEY is set, skipped after a structural deny):

import { parseHookEvent, scoreEvent, toClaudeOutput } from "@/lib/risk";
const parsed = parseHookEvent(JSON.parse(stdin));
const report = await scoreEvent(parsed.input);
process.stdout.write(JSON.stringify(toClaudeOutput(parsed.event, report)));

Callers consume verdict, hookVerdict, labels, evidence, backend, steer.moves. They do not import detectors or the TypeSafe client.

Shape

RiskKind is a closed union. A ScoreReport is the only output. Structural detectors are a registry of { kind, stages, weight, match }. Jev questions are 13 hazard Nouls, one positive falsifier Noul, a primary Choice, and a severity Score. Validation of TypeSafe JSON lives at the HTTP boundary. neuralFromJev is a pure function. State packing uses event / trusted / subject / context. Agent text is never trusted policy.

Synthesis decision

Two sketches.

A. Jev-only scorer. Drop regex. Every decision is a Noul. Matches TypeSafe's marketing. Fails closed-model hooks when the key is missing, when Jev is waitlisted, and on adversarial state that talks the model off a path deny. Jev 1.13 jaggedness says adversarial content can steer answers. Code can compute sed of an assertion and --no-verify exactly.

B. Structural fail-closed registry, then one Jev request for the semantic overlay, then lexical GLiClass-shaped labels if the key is missing or the call fails. Skip Jev after a structural deny. State sent to Jev is pre-digested (command binary/flags/args, backticked paths, unified diffs). Agent justifications are stripped. Steer copy stays in code and is opaque to the agent. Jev cannot overrule a structural deny. Choice, severity, and the falsifier Noul cannot cancel a hazard and cannot independently deny. Hazard Nouls are phrased so a high number means the hack is present. Per-kind block thresholds start at 0.82 / 0.88 / 0.70 (monitor gaming). Do not use the inverted p <= 1 - t band. Protect designated evaluation assets and canaries, not every tests/ write. Policy modes: shadow, then review, then enforce.

B is the base. The TypeSafe guardrails cookbook and the Pi pi-jev-auto-mode gate both keep rules first. omp-auto-mode is the oh-my-pi cousin (safe/ask/unsafe; classifier failure defers to omp approval). Graft from A is the question catalog and the 2s timeout. jevgate is the same layering on shell permissions: an allowlist proves what may run, code-refused writers never reach the model, Jev judges only unlisted verbs, and the tool cannot block. Abide is the same envelope on project-instruction diffs (fail-open, banded confidence; soft judgment never the sole hard veto), not a reward-hack detector. JevLint uses Jev for convention Nouls in a write → check → fix loop (quality, not eval-gaming). Do not merge them into this sidecar.

Tradeoffs accepted

We accept a lexical false-positive rate when no TypeSafe key is set. Shared RiskKind ids do not make lexical probabilities interchangeable with Jev.

We accept 70 to 650ms on Jev hook calls. That is inside Claude's UserPromptSubmit budget and inside typical PreToolUse patience. It is slower than regex. Skip the call on structural deny.

We accept that DoM, SAE, Grift, and TRACE are documented rather than implemented. They need weights, gradients, or resampling this process does not have.

We accept that ordinary test maintenance is allowed. The deny path is protected evaluation assets, assertion sed, skip/xfail, --no-verify, runtime hijacks, and fabricated evidence. Contradictory tests go through the escalation steer, not a manufactured pass.

Claude HTTP hooks are not a complete security boundary. Command wrappers can emit an explicit deny; a killed wrapper still needs an independent capability boundary.

Alternatives considered

LLM-as-judge on every tool call. Higher recall on obfuscated CoT, too slow for PreToolUse, and Baker et al. 2025 show it collapses if you train against it. Using that judge (or gaming jevals labels) as the reward signal is the failure mode this gate is meant to catch. Preferred e2e substrate is Harbor with an independent validator; see docs/eval-integrity.md. For live traces, openevals uses cheap parallel System One as an observability judge, not as the primary score or RL reward. jev-align verifies a plan or response against policy before act; jev-harness measures a System One gate with shadow / confidence action evals, not LLM-as-judge as the primary score.

White-box only. Wins on open SWE agents, cannot see Claude or Cursor.

GLiClass as the only neural head. Fine for air-gapped boxes. Wrong default now that Jev exists as a 70 to 500ms typed decision model.

Averaging all Nouls or multiplying by Choice confidence. Parallel questions are not a statistically independent ensemble. A high-confidence none cannot override a hazard Noul. A Choice with no "other" can still be forced wrong at confidence 1.0; wellposed lints that request shape — confidence gating cannot catch it.

System One class

The live head is TypeSafe Jev. Lexical / GLiClass-shaped labels are a degraded fallback when the key is missing or the call fails, not a calibrated substitute. Open System One heads (laya; localjev prompted JSON) are future backends: same class (typed Choice / Score / Noul), not drop-in ROC replacements for this reward-hack hook — a 0.85 gate is still soft (Khmer OOD 0.000 at 95.2% confidence), and wire-compatible probs are not calibrated logits. Quote a number only with the served backend (FALLBACK / lexical); advertised backend ≠ served backend (classifier-dev). There is no public Jev reward-hack ROC. Do not cite support-ticket calibration as a SWE-hack claim. Fail-open hygiene (jev-kit "This is not a security control"), a system-directive ask-before-act (opencode-intent-gate; not a hard block), dual-gate screening that can silently discard a replacement (agent-chaperone: advertised screened ≠ served payload), and uncalibrated compaction keepThresholds (opencode-context-pruner 0.15 vs fast-jev-compaction 0.5) are not safety envelopes. InjecAgent AUC 0.976 and labelled-eval 100% are confidence theater if quoted as a rh-guard ROC. Dropping request-view messages can erase eval evidence. A named offline heuristic floor (yolo-shell: no silent fail-open when Jev is down) is not the same as a crash that allows. Dispatch success is not evidence (jev-home-assistant-sentinel: action ≠ verified outcome; Command sent ≠ state confirmed). Advertised trajectory verification is not a shipped module (apa-agent-harness: advertised capability ≠ shipped module; shadow vs live shadow_noop). A design-only NLI prompt gate (herdr-jev Nothing here works yet) is not a TypeSafe Jev ROC. Silent fail-open when Jev is down (alsoleg89/jev-bouncer, renamed from alsoleg89/jev-guard: Tripwires never deny; quoted Your rules win; quoted SECURITY.md Not a security boundary) is not yolo-shell's named floor. Incomplete evidence must stay UNAVAILABLE, not PASS (pablozr/JevGuard: advertised monorepo ≠ shipped packages). A local n-gram daemon branded Jev (jevbrain: confidence ≥ 0.80 → AUTO_ACT else REVIEW_QUEUE) is not TypeSafe Jev — auto-act at that uncalibrated threshold is silent-fallback / confidence theater. Planted defects withheld from criteria writers (ybadragon/jev-proving-ground) are the held-out antidote. A judge Noul is not a verified bug (jev-crawlers: unverified lead, never a bug; ranking signals, not calibrated confidence). Argmax without reading the probability is soundness theater (typed-gate: declining to answer; 0.40–0.60 band is a refusal; argmax only omitted 25). A fail-open pre-exec checker (pi-jev-gate: p(block) ≥ 0.50; failing open) is not this sidecar. Documentation-only OpenAPI can hide consumer breaks (jev-oas-sentinel: documentation-only; enforce only when breaking AND promise-violation ≥ 0.90). A passing CI condition is advisory (if-ai: A passing if-ai check is advisory; TypeSafe 67.8% is four workflows, not PR review). A 2.8MB Laya distill (nanoprune: 0.0% Hallucination Guaranteed / ECE 2.58%) is not TypeSafe Jev. Skill recommendation is not a grant (hermes-switchyard: never loads the skill; ack is not DLP; 0.20 local / 0.80 Jev uncalibrated). Soft-judgment gate middleware that hard-denies four Nouls at 0.5 (typesafe_agent_gates: 27/27 / 31/31 are synthetic probes, not a rh-guard ROC; second layer, not a boundary; pattern first, judgment never looser; 0.5 / 0.6 / 0.8 are starting points). Static shell Scores at --error-on (safe-sh: curl | safe-sh; never executes) are not yolo-shell's exec floor. Confirm-as-gate paste routing (jev-pastepilot: Confirm is a gate, not a formality; Confidence is a gate, not proof; fail-opens) is not a safety envelope. A cache hit is not a correctness proof (jevcache: cache hit ≠ correctness; shared fingerprint bundles as calibrated truth / auto-act is trust theater). A GEPA training score is not auto-accept (sutro-sh/jev-align: quoted A higher training score never accepts a proposal automatically; hard-gating that score is soundness theater). Compiled when asked guidance is not an enforced PreToolUse hook (enzyme: quoted guidance compiled for your agent, not an enforced hook; catalyst similarity is ranking, not deny/allow). Closed-world Choice without an escape is a forced false positive (seb4ez/jevguard: inject UNRESOLVED_OR_OTHER; flag AMBIGUOUS_STATE when top p < 0.40 or margin < 0.15). Soft CI skip without shadow is hard-gating (guilhem/jev-ci-selector: Measure before you skip; proposed_run vs run). A 0–4 safety grade is a measurement, not a veto (tonedown: the engine only measures; 74/74 proves the pipeline, not the model). Productized moderation that fails open (ohernandezdev/jevmod: error_open; AUROC is a sanity benchmark, not a leaderboard) is not a rh-guard ROC. A 74-message injection demo (one-dollar-tahoe: demonstration set, not a statistically powered benchmark) is not a safety proof. A fail-closed allow/ask/warn ladder is not a hard deny list (pi-jev-sentinel: quoted never auto-allows; secret scrub before Jev; optional task pin; Prompt injection is not solved). Contrast fail-open pruners / pi-jev-gate. Fail-open skill/routing overlays (hermes-jev-skills: quoted Everything fails open; named lexical skip, not live Jev; Jev can only return an action id from the table; hermes-skill-router: local Laya Fail-open; inject ≠ grant; same-named trees exist) are not this sidecar's structural deny. Assessors do not execute (dgp: application code retains control; quoted DGP docs/TYPESAFE_JEV.md; Speculative assessments cannot authorize effects; cache hit ≠ live Jev). A Hermes fail-closed policy overlay that escalates to host approval (typesafe-jev-gate: quoted not an autonomous permission slip; uncertain/unavailable → Hermes approval, not allow; cannot override Hermes hardline; metadata-only audit) is not this sidecar's structural deny. A local jevlike catalog shrink (omo-jevlike-router: quoted fail-open; recall@24 84.1% / ECE ~0.10 are not a rh-guard ROC; soft router ≠ hard gate; earlier 46.2%/95.5% was an evaluation bug) is not a hard envelope. Guardrail bake-off numbers (ishaannk/llm-vs-jev: quoted Nothing wins outright; steerability 14.3%/10.7%) are not a rh-guard ROC. A Jev-compatible local replica (Gestalt-Lab/jeff: quoted API compatibility does not imply identical judgments; lower ECE ≠ correct) is not TypeSafe Jev. A memory lease that retires facts on new evidence (chopratejas/invalidate: quoted The memory text is never edited; 0 false invalidations / 157 is tuned on that set, not a rh-guard ROC; similarity top-k is never the judge) is not this sidecar. A Hermes tool plugin is not a fail-closed hook (ajensenwaud/hermes-jev-plugin: jev_check / jev_route / jev_score / jev_evaluate; hope the model looks). Semantic contract lint (mizchi/jev-lint: quoted candidate for a human to judge, not a verdict; No shipped rule has severity: error; distinct from huntedman/JevLint) is not a hard CI gate. Memory include/exclude by relevance (samdotmak/jev-recall: 17/18 / 19/20 is not a safety deny). English oxlint cutoffs (wobsoriano/oxlint-plugin-jev: skip unless ci: "fail"). Adding a Claude PreToolUse hop (RahulBalakavi/claude-code-jev: quoted adds a 264 ms hop rather than removing one; 0 dangerous allowed on a synthetic 18-case fixture; 0.85 uncalibrated) is not a drop-in for Anthropic auto-mode. A shadow-mode mail classifier (rspamd-jev: score 0; no auto-reject; unchanged score ≠ unchanged latency; agreement is not accuracy) is not a reject envelope. A library-owned tool-call guardrail pack (codebam/jev-guardrails: quoted The library owns policy, not the model; A guardrail is not a sandbox; default 0.70/0.35 uncalibrated; jev-latest alias (moving alias, not a pin); distinct from alsoleg89/jev-guard / pablozr/JevGuard / leepokai/jev-guard / seb4ez/jevguard) is not this sidecar's structural deny. A semantic CI gate that reads policy from the base commit (brickfrog/moongate: quoted Exit 0 doesn't mean the code is fine; unevaluated never counts as a pass; 4/6 violation-vs-review on identical replays) is not a hard merge envelope. Log-batch labels that execute nothing (jev-logtriage: quoted Low confidence never auto-acts; auto_remediate_candidate is a label) are not a page/restart grant. A resume-screening fairness audit (bias-bench: 1,824 evals; zero binary-decision name differences; ~0.4–0.6pp mean noul; read the magnitudes, not the p-values) is not a rh-guard ROC. Context-window admission (jevusher: J7 pass means nothing detected, never safe to obey; outage → no lens, never an empty context) is not a safety envelope. Pre-registered adversarial Jev eval (willkelly/jev-evaluation: 123,805 requests; confidence ≥ 0.95 still admits 47% unanswerable states; quoted act when confident and escalate when not catches wrong answers and misses unanswerable inputs; distinct from jev-baselines-eval) is the soft-judgment integrity sentinel — do not hard-gate confidence as fake safety. A one-attribute fairness bench (Fox-Islam/jev-bias-bench: 11,984 calls; 0/100 controls; quoted Do not test it by swapping names; Read the deltas, not the stars; distinct from natemoo-re/bias-bench) is not a rh-guard ROC. A mock confidence router (Ormus-Solutions/aurum-gate: packaged src/index.ts auto|escalate|refuse; default autoConfidence 0.85 uncalibrated; parallel src/gate.ts quoted Probability is not confidence; mocked, no live API) is not a safety envelope. A heuristic PR pre-filter (Ormus-Solutions/quicksilver-judge: packaged sketchRisks PASS|HOLD|FAIL not live Jev; Gloss: PASS is not a merge grant; parallel src/stages.ts quoted Code owns overrides) is not this sidecar's structural deny. A retrieve-then-judge RAG filter (Ormus-Solutions/karat-filter: quoted Token overlap judge — mock stand-in for a Jev Noul; 0.45/0.5 defaults) is not calibrated Jev. A UI proof assay (Ormus-Solutions/gold-assay: quoted Screenshots lie until you assay them; public assay is substring/regex; Gloss: GREEN ≠ verified UI) is not a commit grant. Source-bound evidence tools (WaynezProg/jev-kit: quoted Confidence is not a correctness guarantee; Exit 0 does not certify; SECURITY.md not an authorization boundary; distinct from jonathanavis96/jev-kit Airlock) are not a hard envelope. An empty-tree content-moderation listing (Jev-Examiner: GitHub description only — "An AI content moderation workflow powered by the TypeSafe/Jev model."; empty public tree at capture; later README advertises src/docs not in the tree — advertised tree ≠ shipped source) is not a shipped moderator. A Pi confirmation guard (BubbatheVTOG/pi-jev-tool-guard: quoted confirmation guard, not an operating-system sandbox; default evaluatorFailure: "allow" fail-open; 0.35/0.7 uncalibrated; distinct from pi-jev-guard / pi-jev-gate / pi-jev-approver / pi-jev-sentinel) is not this sidecar's structural deny. A Node toxicity screener (ItisShikhar/gg-friggin-ez: 41/42 not a rh-guard ROC; named heuristic when no key; treating AUTO_BAN as a safety proof is confidence theater) is not a reward-hack gate. Source-bound PII/quotes (jkrup/jeveryword: text.slice(start, end) === value; quoted cannot make it produce words that are not in the source; distinct from WaynezProg jev_extract; not PreToolUse) are not a hard envelope. A Worker moderation flagged bit is not a safety envelope (TickerDev/jevfanity-api: code owns flagged at default 0.75; flagged is a policy bit, not a safety proof; missing key → 500, not a named lexical fallback; quoted CORS is open by default; distinct from gg-friggin-ez / Jev-Examiner). An unfinished Annex A CLI is not a certification (vidux/iso-jevdit: quoted the audit engine is not finished; 3 of ~36; quoted This is not a certification, and it is not a conformity assessment; failOn is Accepted today, acted on when the audit engine lands). Job↔CV match % is not a hire/reject gate (ashafizullah/jev-linkedin: quoted not real-world probabilities; quoted Treat them as an early signal, not a decision; CV is sent to /v1/systemone). Filtering tool results before the model sees them is not destruction (Astro-Han/jev-harness: quoted Filtering is a routing decision, never destruction; quoted Jev failures fail open; 25/30 not a rh-guard ROC; distinct from AntonioCoppe/jev-harness). A PostToolUse relevance filter that hides candidates the assistant never learns existed is not a safety block (Atikpui007/jev-sift: quoted Fails open; quoted This is a relevance filter, not a safety block; distinct from kbhuw/jev-sift). Citation-grounding 97/100 is not a legal proof (simonsez9510/jev-cite-check: quoted 1회 관찰이며 성능 주장이 아닙니다; Gloss: one-shot observation, not a performance claim; 0 false-allow of 지지; confidence is 분포 집중도이지 정확도가 아닙니다). A Pi 0.75 auto-allow is not a sandbox (JasonHZS/pi-jev-command-guard: quoted do not provide a complete sandbox; quoted ambiguity must never silently become permission; distinct from pi-jev-tool-guard). IMMUNE TO BOTH / last line of defense is soundness theater (finrod21/jev-transaction-guard: quoted comparison does not show proof that Jev makes better classification choices; Choice TRIP is not a freeze; 0.0% FPR is not a rh-guard ROC). A dedicated DSH plugin pack is not this sidecar (codebam/dsh-jev-guardrails: quoted The library owns policy, not the model; A guardrail is not a sandbox; plugin policy layer, not a sandbox or an authorization system; failMode default open; sibling of codebam/jev-guardrails). A 0.9 Jev auto-approve review is not a merge grant (metalbear-co/jev-auto-approve: quoted does not satisfy required-approval branch protection; quoted Failures are loud; quoted a gate, not a substitute for a human reviewer; jev-latest moving alias; 0.9 uncalibrated). Calibrated silence is not a hard reject (emreozyoruk/hush: quoted Silence is the default behaviour, not the failure mode; apply default false; two gates 0.80 AND 0.60). A fail-open call screener is not a reject envelope (SuchintK/jev-call-screener: quoted JEV classifies; it does not generate dialogue or control the call; quoted The defaults are deliberately fail-open). A Chrome quality filter is not an authorship detector (SwastikGorai/unslopify: quoted It is a quality filter, not an AI-authorship detector; quoted Keeps uncertain or failed classifications visible). Jev-as-guard agreeing with remaining errors is not a hallucination ROC (aryanchauhanoffical/no-hallucination: quoted No effect; 8 remaining errors 0.82–1.0; quoted Recall@k is the wrong thing to optimise; 81.0% not a rh-guard ROC). INCLUDE at DIRECT+HIGH+0.8 is not a read grant (ramasamysh/context-evaluator: quoted experiment metrics, not proof). File-rank flags are not verdicts (glud123/jev-assist: quoted Flags are prompts for a human look, never verdicts; quoted Typed output guarantees the shape of an answer, not its correctness; quoted recall@20 0.68, recall@40 0.80; not a rh-guard ROC). Local RAG self-check cautions, does not rewrite (Nixz0824/rag-jev: quoted Degradation is never silent; noul < 0.5 请以公告原文为准; 20/20 not a rh-guard ROC; jev-latest moving alias). A phishing-verdict MCP/REST service is not a rh-guard ROC (pantos12/mailverdict: quoted Forward an email, get a calibrated phishing verdict; the explainer never changes the label; quoted A classifier cannot be talked out of a probability; 24 fixtures are not a benchmark; missing key throws, no named lexical fallback; distinct from mailverdict/mailverdict quoted Advisory signals, not verdicts and jaiswalism/mailverdict). A Codex/Claude Code binary allow/deny hook is not this sidecar (alexj11324/open-jev-approvals: quoted The degradation model changed from fail-closed to fail-open after user review; quoted A deny always requires positive evidence that the action is dangerous; quoted There is no review_required; 0.70 uncalibrated). A reviewer game is not a production merge gate (Ash20pk/beat-the-reviewer: quoted Taking the reviewer offline does not count as a pass; quoted An unavailable reviewer is not an approval; quoted Holds no key and reaches no model; on_unavailable: "block"). A DSH pre-exec accident net is not a security boundary (7starsseeker/dsh-jev-guard: quoted It is an accident net, not a security boundary; quoted degrades loudly instead of silently; D3 timeout fail-open; D9 402/401 l0-only; quoted L0 的 deny 类硬规则不受此开关影响; distinct from codebam/dsh-jev-guardrails). A multi-harness sensor is not a reference monitor (CompleteTech-LLC-AI-Research/jev-sentinel: quoted This is a defense-in-depth sensor and veto layer, not a complete reference monitor; quoted DEFER means only no additional veto; quoted Judgments are not grants; quoted provisional review/block thresholds 0.35/0.80 are policy starting points). CRAP+Jev triage is not a bug detector (heliowap/diff-risk-sentinel: quoted It is a prioritization aid, not a bug detector; earlier 96% accuracy / 100% bug recall are superseded; Rule 6 badge ACCEPTABLE_LOW_RISK (strategy: Low risk. Safe to merge.) is not a grant). An L7+MCP firewall is not a sandbox (wmsing/agent-firewall: quoted fail-closed if checks do not pass; Layer 2 Mock; quoted Score ≥ 0.8 → BLOCK; quoted git pull is intentionally excluded). Approval-first Pi /edit is not a silent patch (acoyfellow/edit: quoted Nothing changes until you approve the exact request; quoted If the provider is unavailable, /edit stops instead of pretending that a review happened; quoted Four runs of one tiny task is not a benchmark). Authorship hide is not unslopify (adamnroman/slop-filter: quoted hides AI-generated posts; quoted Scores every post in your feed for how likely it is to be AI-written; contrast unslopify It is a quality filter, not an AI-authorship detector). X labels include Chit-chat/Promo (bohutang/sift: Substance · Humor · Chit-chat · Promo · Junk plus AI-written and Off-topic). Ahead-of-click verdicts are four-way (ThinkyMiner/Winnow: quoted every word on the card is a template filled from typed answers; 80% verdict agreement / 90% content-type agreement; quoted The goldens are still unreviewed). X-comment filter fails open (yonsakhan/x-spam-filter-typesafe: max ≥ 0.85; 放行不隐藏). Autonomous Gmail archive is not the read-only overlay (vynnlee/jev-mail: Autonomous 24/7 Zero-Inbox; distinct from muhammedilyasy/jev-mail quoted Read-only: it never sends, deletes, labels or archives anything). A fraud interceptor demo is not a ROC (ordepas/system1-fraud-interceptor-demo: quoted Es una demo de experimentación personal, no un benchmark; quoted no está pensada para producción). Wiki-watch lanes FLAG/REVIEW/OK (hfmsio/jev-wiki-watch: FLAG ≥ 80%; REVIEW 40% to 80%; OK below 40%). A skill-tree classifier must not drop findings (Umbylicus/umby-jev-stack: 544 flags; rejected 543 as false positives; quoted Never drop a finding; quoted Jev only classifies). A prune kit is not live-tested (CompleteTech-LLC-AI-Research/jev-prune-kit: quoted Not a universal /prune; quoted Not live-tested; quoted 122 passing local tests are not 122 live harness or model tests; quoted 88 passing local tests are not 88 live harness or model tests). A YOLO keep Noul is not a safety deny (yolo-jev-scene-filter: quoted YOLO-World detects; TypeSafe Jev keep/skips boxes; quoted Jev only filters what YOLO already found.; not hide-never-learned). A Pi bash/write/edit permit is not every-tool fail-open (pi-jev-permit: quoted silence is never consent.; quoted A failed judgment is never treated as approval.). An advertised Action is not a shipped workflow (jevgate-action: advertised Action ≠ shipped workflow). A Go triage CLI is not ThyFriendlyFox (boldbug1/jev-triage: Distinct ThyFriendlyFox/jev-triage). Contact buckets are code (contact-cleaner: quoted Buckets are code, not the model.). A Claude reflex prototype is not a hardened envelope (claude-code-jev-guardrails: quoted Claude thinks. Jev reacts. Code decides.; advertised ASK_USER ≠ engine emit; no-key / JEV_MODE=mock named degraded backend). An OpenJev voice gate is not TypeSafe (jev-voice-gate: quoted Это не гарантированная замена wake word.). ALP automerge is not branch protection (alp-pr-review: quoted Ikke en erstatning for branch protection.; Quoted: Den får aldrig PR-titel, -beskrivelse eller diff.). Judol discussion is not promotion (youtube-judol-userscript-jev: confidenceThreshold 0.6 (uncalibrated)). A LinkedIn GitHub blurb is not the shipped UI (Postmark: advertised description ≠ shipped UI). A Jev deploy/ship gate is not CI (thecoderpanda/shipit-gate: quoted Does this replace my CI? No.; quoted Rejects fail closed (exit code 2).; --force / git push --no-verify; demo mocked). A Bash AST jev CLI is not TypeSafe Jev (uberto/jev-brig: quoted jev-brig is a guardrail, not a boundary.; unparsable → ask — never a silent allow). An empty JevGuard listing is not a shipped hook (knowlet/JevGuard-NSFA: .gitignore only; advertised Guard ≠ shipped source). A calibrated PreToolUse layer that never emits allow is not a security boundary (RavenRepo/jevengineeringgate: quoted The gate never says yes; quoted Is this a security boundary? No.; 0/26 wrong is not a rh-guard ROC). Green tests that prove nothing are not a merge grant (stardeckai/lgtm: quoted lgtm is advisory by default; holdout precision 1.00 not a rh-guard ROC). Pruning toolsAllow: [] is not a deny (MertBasar0/openclaw-tool-prefilter: catalog shrink ≠ deny; quoted Bulletproof Fail-Open Safety; quoted Zero Hallucination theater). A Pi model router is not a Safety Gate (Z761293629/pi-jev-helm: quoted Safety Gate/Verifier are separate, uncommitted exploration directions; fail-open to Baseline; 2500 ms). A Python-owned loop is not a Claude plugin (snesmaeili/jev-claude-controller: quoted no function in the safety layer accepts a model signal.; quoted The thresholds are uncalibrated.). An advisory CLI is not a permit (logicrw/ask-jev: quoted never use a verdict to grant permissions; 280ms; dual ≥ 0.85). An empty Workers router is not hermes-switchyard (dev-hari-prasad/switchboard: advertised router ≠ shipped source). A Gradio BLOCK label is not a freeze (durganani60/fastrisk-jev: code 0.80 / 0.35; quoted 0% Type Errors theater). Typed resume scores are not a hire (hamidfarmani/jev-resume-match: quoted not a hiring prediction; fatelei/yueli: quoted 仅供参考，不构成招聘决策依据.). Listing judgments are support, not the decision (ismailakdag/typesafe-jev: quoted Kararı yine kod verir.; quoted Jev metin üretmez.). An empty mailbox listing is not jev-mail (TennousuAthena/Mailbox-Boy-With-Jev: advertised mailbox ≠ shipped source). A decorator wrap that hard-gates uncalibrated 0.75 is not this sidecar (lgy1027/jevshield: quoted Sub-100ms, non-autoregressive runtime security gate; SECURITY.md heuristic not a security boundary; _heuristic_fallback 0.99/0.85). A Pi warden is not a sandbox (DevMortimer/pi-warden: quoted It is advisory, not a sandbox; quoted project-maintained benchmarks, not universal claims). A mock triage bake-off is not a ranking (jasonli0226/jev-demo-triage: quoted Jev did not beat baseline on pass rate). Rehearsal GREEN is not a live Jev grant (manutej/volumetric-intelligence: quoted Jev is the typed gate (Choice / Score / Noul), never the runtime; /api/walk Rehearsal schema). A Codex Jev route is not a permission (miniLV/Jev-Auto-Router: Policy Guard Deterministic ALLOW(plan) or DENY(reason); quoted No evidence means no production delegation; automatic delegation off by default (UNVERIFIED)). Founder teardown is not an SEO score (replynodes/jev-web-analyzer: quoted developer demo, not … SEO score). One 15-call run is not a ranking (rmax-ai/ai-provider-triage-comparison: quoted not a general model ranking). Inbox triage at uncalibrated 0.85 (zerosweep: confidence < 0.85 → human_review; phishing / safeToTrashProb ≥ 0.85 → trash_quarantine; quoted Zero Format Errors is schema theater, not a safety proof) is not a rh-guard ROC. A Codex per-turn route is not a permission (jev-codex-router: quoted Fail-open; Kill switch; 0.5 → Sol not frontier; BACKTEST −59.9% on 237 turns; cache invalidation not modelled; distinct miniLV/Jev-Auto-Router). A LoRA student on Qwen2.5-0.5B (jev-gate-student-b: n=60 MAE 0.187 / Pearson 0.791 / 90.0%; Gate 0.5 fail-open) is not Qwen3.8-27B / Archer and n=60 is not a rh-guard ROC. Recaptured contract lint (mizchi/jev-lint: 56 of the 65 rules at 1.00 on 467 labelled defects; candidate not a verdict) is not a hard CI gate. A Pi shadow gate (y0usaf/pi-jev: quoted The gate fails open by design; smoke calibration not enough to switch the gate to enforce; 0.90/0.70/0.85/2.50) is not the other pi-jev-* envelopes. Dry prune of tool results (pi-jev-prune: default dry; Fails open; ephemeral; 0.25; 1/28 below 0.15; code rule does useful prune; distinct compact/pruner/nanoprune/prune-kit) is not a safety deny. A preview token is not attested human approval (raniellimontagna/jev-guard-mcp: quoted Possession of a preview token is the technical authorization to execute; the server cannot independently attest human approval; min 0.80; pin jev-1.13.0; experimental, not a general-purpose browser agent; distinct leepokai/jev-guard). Role routing is not permission (reallygood83/jev-router: quoted Jev does not pick model ids. It picks a role. Failures pass through.; error-pass; confidence_floor 0.6; quoted They are not a live quality claim.; TypeSafe, not an open-weights port; distinct justinhsu1477/jev-router / hermes-plugin-jev plugin ID jev-router). A Pi shadow router is not a grant (philippdubach/pi-jev-router: /router shadow recommend only default; quoted Jev output is evidence, not truth.; 89%/88% cheaper not a rh-guard ROC; distinct rizafahmi/pi-jev-task-router which owns the model while on). Dual-spectrum Malicious 61–100 is not a safety envelope (YuyaForest/JEV-Dual-Spectrum-Phishing-Guardian: Safe 0-20 / Suspicious 21-60 / Malicious 61-100; missing key throws; quoted Section 4: Counter-Measures are exemplary and decoupled from individual verdicts; distinct zerosweep / mailverdict). Advisory review exit 0 is not a merge grant (bornakapusta/slop-guard: quoted code identifies what to inspect, Jev judges it, and explicit rules decide what to report; the reviewer never blocks; exit 0 Review completed (concerns may be present); distinct slop-filter / unslopify / Not-TypeSafe jev-brig). Stubbed 4.0× is not live Jev (sudeshkar/jev-corrective-rag: quoted Jev decision gates | Stubbed — no API key yet; stub NOT a simulation of Jev's quality; 300 ms; prints PARTIAL; VERIFY_CONF_FLOOR 0.60 AUTO_ANSWER is not a safety envelope). Duplicate triage 2/4 is not a close-issue grant (Patrick-SCH03/jev-issue-radar: quoted It never closes issues, adds labels, or posts comments; 2/4 not a rh-guard ROC; ≥ 0.8 not a calibrated accuracy guarantee). A diff triage filter never approves (MaxIvanyshen/jev-review: quoted It never approves or rejects anything; p ≥ 0.5 / risk.score ≥ 2 is not a merge grant; non-zero exit is couldn't triage, not diff is clean; distinct NiazMorshed2007/jev-review). Documentation lookup is not execution (NiazMorshed2007/jcr: quoted JCR returns documentation. It does not execute commands.; quoted The included harnesses also stop at explaining the steps needed to carry out a task.; beam 0.6 / width 3 / depth 16; ambiguous / no-match / depth-limit are resolver outcomes, not merge grants; routing ≠ permission; treating capability context as attested approval to run is theater; 80-run 85%/23% not a rh-guard ROC; distinct jev-guard-mcp / jev-router / NiazMorshed2007/jev-review). A GitHub App LOW auto-APPROVE is not a merge grant (HexyeDEV/JevPR: LOW if composite < 3.5; quoted Jev is an AI model, and can make mistakes; payload["files"] is not the standard PR files list; distinct ohernandezdev/jev-pr-review / metalbear-co/jev-auto-approve). Observe-default Codex routing is not permission (aesgalexis/model-switch: quoted Fail open; quoted Observe first; 0.65 is not a safety envelope; distinct jev-codex-router / Jev-Auto-Router). A consent-gated Pi judgment is not authorization (gvkhosla/typesafe-pi: quoted Results are model judgments—not proof or authorization; quoted never as permission to perform an action; distinct DevMortimer/pi-typesafe). Enforcing uncalibrated PreToolUse floors is safety theater (jakenbear/the-jev-enator: quoted all three fail open; quoted The completion check does not block anything by default; 23/23 not a rh-guard ROC; distinct jevgate / claude-code-jev / jev-kit). A vault noul is not a delete grant (sohryuu101/jev-vault-gate: quoted never blocks or alters the actual turn; quoted Nothing is ever deleted automatically; 0.6; plugin.json 0.3.0 ≠ package.json 0.1.0). DSH prune ranks never thresholds (HorusJiang/dsh-jev-tools: quoted it ranks, it never thresholds; 8/8 not a rh-guard ROC; no-key inert). Prompt-injection BLOCK 80% is not a safety envelope (YuyaForest/JEV-Prompt-Injection-Guardian: score clamped to Choice; heuristic fallback is not live Jev; distinct Dual-Spectrum-Phishing-Guardian). Healthcare 0.8/0.7 is not clinical authority (bhaskarpraveen/jev-healthcare-support-router: quoted does not make medical diagnoses). PR READY is not a merge grant (dillera/prMonster: quoted Merging is never offered). DSH router never registers routes (tr1v3r/dsh-jev: quoted Never registers or modifies LLM routes; 35/35 mocked). A Jev probability is not proof (keeltrace/hermes-jev: quoted Do not treat a Jev probability as proof of correctness; catalog 0.2.1.2 ≠ dev 0.2.2.dev4; 0.80 is not a safety envelope). Task-boundary routing is not permission (win4r/pi-jev-router: 15/16 not a rh-guard ROC; distinct philippdubach/pi-jev-router). Local Qwen 32/72 is not a Jev ROC (hraness/sys1: quoted Do not reuse Jev probability thresholds for generic GGUF; hosted Jev disabled by default). Regime 0.4/0.6 is not investment advice (matchstick-trading/jev-regime-gate: quoted Research experiment, not investment advice). Dispatch 0.5 is not accuracy (nyattoh/model-effort-router: quoted No benchmark claims; dry-run without key; does not execute). A Windows UIA confirm/escalate/abort gate is never auto-exec (ArronHC/windows2text: quoted A Jev confirm, escalate, or abort gate never executes automatically; windows_step defaults act=false; distinct tacticocc/Jevbridge). A Pi auto-mode classifier is not a sandbox (JohnsonRan/pi-jev: quoted This is not a sandbox; quoted This remains a permission aid, not a security boundary; 3/10 → 0/10 not a rh-guard ROC; distinct y0usaf/pi-jev). An infra watchdog is not a coding-agent hook (PavelLizunov/jev-sentinel: quoted not the truth of a diagnosis; quoted Schema validity is not evidence that a diagnosis is correct; 95.0% not a measurement; distinct CompleteTech). A Nix omp overlay is not a source fork (VirtualMachinist/omapi-overlay: quoted There is no omp source tree in this repository; shadow never blocks; empty findings are not approval). A 24-ticket confidence gate is not calibration (abh2050/jev-test-confidence-gate: theirs 163 ms / 87.5%; 0 of 3; quoted 24 invented tickets; quoted untested at adequate power, not refuted; not a rh-guard ROC; distinct jasonli0226/jev-demo-triage). Local 0ms then Jev is not a ROC (michelbrigante46-art/Twitter-keyword-shield: 0.5 uncalibrated; sub-100ms not a rh-guard ROC; distinct yonsakhan/x-spam-filter-typesafe). A Laya harness BLOCK is not a Laya label (morre95/Laya-GuardRails-Harness: quoted BLOCK comes from rules or policy, never from a Laya label; quoted low confidence escalates, never allows; distinct NandhaKishorM/laya). Hermes smart-approval reviewer (anpicasso/hermes-jev-approvals: quoted Scope: approvals only.; quoted Not a sandbox.; theirs 9.8x faster, 4.2x fewer interruptions on 156 real commands; independent 1.24x; not a universal speedup). GLiClass router (SouthernCrossAI/scx-router: 0.5 is not a Jev gate). On-device PII (BlinkWrite/pii-masker: quoted It never returns the input unchanged as a fallback.). REST redact (BuilderChat/PII-Redactor: SLM PII_REDACTOR_USE_GLINER=false; shadow fail-open). LangChain PII demo (Harshal-Ug/guardrails-demo: theirs ~180 ms, not a rh-guard ROC). Uppsala Cora WAR (lsu-ub-uu/systemone-gatekeeper-war: se.uu.ub.cora, not TypeSafe System One). Hermes slash router (raitoxlol/hermes-slash-router: quoted stored routes are never applied automatically.; 0.85 is not a safety envelope). Egress airlock (tristan-kkim/airlock: quoted A model never gets to say "this is fine."; theirs 7.5% ± 0.6 not held-out; distinct jonathanavis96/jev-kit Airlock). ESP32 jevlike demo (david-cermak/jevlike-esp32: quoted This is intentionally a demo, not a production model.; not TypeSafe Jev). Community .NET SDK (saibimajdi/typesafeai-dotnet-sdk: quoted This project is not affiliated with, sponsored by, or endorsed by TypeSafe AI.; quoted Thresholds belong in your code.). RiskAverseTech/toolgate (@riskaverse/toolgate): quoted defense in depth, not a sandbox; allow is advisory; distinct fdemir/toolgate; theirs 20/20 not a rh-guard ROC. tylerjharden/ailerix: Jev classifies task families only; ailerix/auto is not a permission. Bnymn1306/jev-github-quality-gate: auto_approved is not a merge grant; quoted Supports shadow mode. JkRheezy/win-cu-router: HTTP bridge is not an operating-system sandbox; planner cannot increase permissions. boriscardano/herdr-jev-router: quoted Treat the enforcement claims as unproven.; fail closed; distinct muthuishere/herdr-jev. colinmcdermott/grok-jev-router: quoted The router is advice; those rules are the boundary.; quoted instruction-following, not enforcement. copyleftdev/braess-router: quoted This project is independent of TypeSafe.; no workload accuracy guarantee. gowtham980/jev-router: quoted This is NOT a universal automatic model-and-thinking switcher.; quoted Classifier failures retain the current model.; distinct reallygood83/jev-router. Jhiynn/PrivaParse: theirs PERSON F1 0.964; quoted LICENSE_NUMBER and ROUTING_NUMBER measured 0.000 recall; not a rh-guard ROC. anonde-io/anonde: quoted no outbound HuggingFace traffic at request time; theirs 29-corpus leak_rate not a rh-guard ROC. adamjralph/skill-broker: quoted Stages 1–4 are built and one Consumer is live.; quoted Jev never grants access. Optional Hermes smart approvals never silently approve (bojansandhaus/jev-decisions 0.2.1 adapted from anpicasso/hermes-jev-approvals: quoted It never silently approves; quoted The workflow is shadow only; quoted Installation does not select the provider, change approvals.mode). A Worker /guard JSON is a proposal, not an execute path (Agentic-Guides/decision-kernel: quoted The guard never executes anything itself; quoted Judgment proposals only; missing key → 503; Theirs 10/10 / 0 false-block not a rh-guard ROC). Local kev routing is not TypeSafe Jev and not a permission (NeOMakinG/kev-model-router: quoted kev being down never blocks traffic; quoted The router never blocks traffic.; routing ≠ permission; distinct Mandrilsquad1441/jev-model-router; Theirs 10/10 not a rh-guard ROC). A Claude PreToolUse observe-default gate is not this sidecar (eugeniughelbur/jev-gate: quoted It catches mistakes, not attackers; quoted Fails open.; FAST_ALLOW then HARD_DENY then Jev; observe logs only; guard/enforce can deny on p(destructive)>=0.90 without a hard rule (soft-as-veto when hard rules miss); MCP wrap is hope-the-model-looks; distinct totally-tim/jev-gate; Theirs 300-call 2026-09-20; git stash clear hard-rule). A Gentle/JEV/browser lab is not a shipped hook (jorgehara/gentle-browser-jev: quoted never claim savings without a controlled A/B run.; local-fallback; real browser/device not enabled; 0.75 click_search fallback is not a safety envelope; cousin of jev-agent-safety-arena). A Pi /model picker is not a Safety Gate (MarcoLoDico/pi-jev-router: quoted unvalidated starting policy, not a 95% accuracy guarantee.; 0.95; missing key → backup; selecting another model bypasses entirely; routing ≠ permission; distinct philippdubach / win4r / rizafahmi / pi-jev-helm). Current listing harshwasan/jev-sentinel (rename of pi-jev-sentinel): quoted never auto-allows; theirs 106 unit tests; distinct CompleteTech. A Claude/Codex PreToolUse firewall (Koushik890/jev-firewall: quoted Rules can only tighten.; theirs 104 tests) is not a grant. Codex MCP routing (jackbarunz/jev-tool-router: quoted The router narrows discovery; it does not permanently remove the fallback path.) is not permission; distinct esinocchi/jev-tool-router which does not generate arguments, approve actions, or execute tools. OMP cost routing (devjtv/jev-router: quoted This is cost control, not a quality upgrade. Quoted: A router must never break a turn.) is not a quality upgrade. OMP jev-judge (cyriusweng/omp-jev-gate: quoted User authorisation and OMP permissions continue to govern actions.) is not a permission slip. Experimental Codex preflight (CompleteTech-LLC-AI-Research/jev-codex-approval: native adapter has not been compiled or exercised inside a running Codex instance; shadow always defer) is not a grant. Codex control plane (JxWayne890/jev-control-plane: quoted Prevents the decision model from weakening verified safety rules.) cannot lower floors. Claude semantic plugin (dr-dimitru/claude-jev-plugin: quoted This plugin is a semantic guardrail, not a security sandbox. Quoted: Plugin never returns allow from TypeSafe confidence.) is not a sandbox. Worker profanity (4rays/profanity-checker: quoted threshold lives in your code) is not a coding-agent hook. Minis advisory (vzornjak/typesafe-decision: quoted Not a safety control, not an authorization mechanism. Quoted: 51.7% may only be cited as an uncontrolled projection, never as a measurement) is not a measurement. In-loop evals (openlayer-ai/jevals: quoted don't let the classifier become the authorizer. Quoted: estimates, not measurements) are not dayhaysoos/jevals. LiteLLM compaction (DihRJ/claude-code-jev-compaction: quoted Nothing is summarized or paraphrased.) fails open; dropping results can erase eval evidence. HF listing Gtrkrsk/laya is the same Laya family hub (quoted Khmer 0.000 accuracy at 0.952 confidence), not a new model. Soft floors / AMBIGUOUS / p<0.5 are not hard gates. Archer is still promised-not-landed. Do not treat Qwen3.8-27B as Archer. A request-rewrite harness that shrinks tools[] before the call (jev-routing: explicitly not an MCP server; distinct from nekowasabi/jev-routing-mcp; drop/truncate without summarizing) is a control-plane cousin, not this sidecar. A per-turn harness router that never runs tools (JoacoMarc/jev-harness-router: quoted It does not execute tools.; theirs 94.4% is not a rh-guard ROC) is not a permission envelope. A stdlib gateway that 403s on soft risk ≥ 0.50 (aniruddh-krovvidi/switchboard: theirs ROC-AUC 0.990; Distinct dev-hari-prasad/switchboard) is soft-as-veto, not this sidecar's structural deny. A Pi budget router (da-vinci-noob/pi-jev-model-router: quoted Jev judges the task, code owns the budget.; quoted Fails open.) is not a Safety Gate. A Pi auto router that keeps the parent model (pi-auto-model-router: quoted The parent model is not switched.; without subagent, routing does not dispatch) is not a grant. A draft-only LinkedIn demo (outbound-draft-gate: quoted You always click send.; Jev-style evaluate, not TypeSafe Jev) is not auto-send.

TOCTOU

A Noul is a score at one hook event, not a capability grant. Deny mutating tools with fresh structural checks on that event. Do not authorize a write, sed, or --no-verify because an earlier prompt-stage Noul was below threshold. Soft semantic scores may steer; they do not replace an atomic policy on the side effect. Check-then-act on a stale overlay is how a gate looks closed in logs and still loses the race. actiongate-jev binds a single-use Action Grant to the exact tool call and consumes it once (replayed/expired/mutated permits fail closed). A Noul is not a permit. AgentGhost wraps execution so the model cannot opt out (guard() is the tool's execution function); ASK/DENY throw so approval cannot be silently skipped; default failMode closed. Contrast actiongate wrapTool (advisory until a gateway). Quoted threat model: Proxies isolate only when the upstream endpoint is not otherwise routable, which is a network property and not a cryptographic one. MCP/HTTP proxies exist as Isolate path; wrapTool remains advisory until that holds. dgp names the same integrity boundary: typed assessment then application-side guarded commit; quoted DGP docs/TYPESAFE_JEV.md (theirs, not TypeSafe): Speculative assessments cannot authorize effects; cache hit ≠ live Jev; assessors do not execute. Primary protocol fold is in Augustus; here the boundary. typesafe-jev-gate cannot override Hermes hardline; a Jev allow is not a grant; uncertain → approval, not allow. ajensenwaud/hermes-jev-plugin is tools the agent must call, not a fail-closed overlay. chopratejas/invalidate retires stale memories in code after Jev votes; a lease is not a capability grant. pi-jev-guard re-checks target and instruction snapshots before committing the captured path (a changed instruction snapshot gets one fresh evaluation). codebam/jev-guardrails: The library owns policy, not the model; a local decision never overrides Jev; A guardrail is not a sandbox. brickfrog/moongate: policy from the base commit; unevaluated never counts as a pass; Exit 0 doesn't mean the code is fine. jev-logtriage: auto_remediate_candidate is a label, not execution; Low confidence never auto-acts. jevusher: J7 pass means nothing detected, never safe to obey. willkelly/jev-evaluation: quoted Confidence predicts whether an answer is right, but not whether the question could be answered; do not hard-gate confidence as fake safety. Fox-Islam/jev-bias-bench: 11,984 calls; Do not test it by swapping names; Read the deltas, not the stars; distinct from natemoo-re/bias-bench. Ormus-Solutions/aurum-gate: packaged src/index.ts default autoConfidence 0.85; parallel src/gate.ts quoted Probability is not confidence; mocked, no live API. Ormus-Solutions/quicksilver-judge: packaged sketchRisks not live Jev; Gloss: PASS is not a merge grant; parallel src/stages.ts quoted Code owns overrides. Ormus-Solutions/karat-filter: quoted Token overlap judge — mock stand-in for a Jev Noul. Ormus-Solutions/gold-assay: quoted Screenshots lie until you assay them; Gloss: GREEN ≠ verified UI. WaynezProg/jev-kit: quoted Confidence is not a correctness guarantee; SECURITY.md not an authorization boundary; distinct from jonathanavis96/jev-kit Airlock. Jev-Examiner: GitHub description only; empty public tree at capture; later README advertises src/docs not in the tree — advertised tree ≠ shipped source; do not invent a shipped moderator. BubbatheVTOG/pi-jev-tool-guard: quoted confirmation guard, not an operating-system sandbox; fail-open evaluatorFailure: "allow"; rules deterministic over Jev. alsoleg89/jev-bouncer (renamed from alsoleg89/jev-guard): quoted Your rules win; quoted SECURITY.md Not a security boundary; Tripwires never deny. ItisShikhar/gg-friggin-ez: 41/42 not a rh-guard ROC; AUTO_BAN is not a safety proof. jkrup/jeveryword: quoted cannot make it produce words that are not in the source; text.slice(start, end) === value; distinct from WaynezProg jev_extract. TickerDev/jevfanity-api: code owns flagged; flagged is a policy bit, not a safety proof; default 0.75; missing key → 500. vidux/iso-jevdit: quoted the audit engine is not finished; quoted This is not a certification, and it is not a conformity assessment; failOn Accepted today, acted on when the audit engine lands. ashafizullah/jev-linkedin: quoted not real-world probabilities; quoted Treat them as an early signal, not a decision; CV sent to /v1/systemone. Astro-Han/jev-harness: quoted Filtering is a routing decision, never destruction; quoted Jev failures fail open; 25/30 not a rh-guard ROC; distinct from AntonioCoppe/jev-harness. Atikpui007/jev-sift: quoted Fails open; quoted This is a relevance filter, not a safety block; hidden candidates never learned; distinct from kbhuw/jev-sift. simonsez9510/jev-cite-check: quoted 1회 관찰이며 성능 주장이 아닙니다; Gloss: one-shot observation, not a performance claim; 97/100 not a rh-guard ROC. JasonHZS/pi-jev-command-guard: quoted do not provide a complete sandbox; quoted ambiguity must never silently become permission; distinct from pi-jev-tool-guard. finrod21/jev-transaction-guard: quoted IMMUNE TO BOTH is soundness theater; Choice TRIP is not a freeze. codebam/dsh-jev-guardrails: quoted The library owns policy, not the model; A guardrail is not a sandbox; plugin policy layer, not a sandbox or an authorization system; failMode default open; sibling of codebam/jev-guardrails. metalbear-co/jev-auto-approve: quoted does not satisfy required-approval branch protection; quoted Failures are loud; quoted a gate, not a substitute for a human reviewer; 0.9 uncalibrated. emreozyoruk/hush: quoted Silence is the default behaviour, not the failure mode. SuchintK/jev-call-screener: quoted JEV classifies; it does not generate dialogue or control the call; quoted The defaults are deliberately fail-open. SwastikGorai/unslopify: quoted It is a quality filter, not an AI-authorship detector; quoted Keeps uncertain or failed classifications visible. aryanchauhanoffical/no-hallucination: quoted Recall@k is the wrong thing to optimise. ramasamysh/context-evaluator: quoted experiment metrics, not proof. glud123/jev-assist: quoted Flags are prompts for a human look, never verdicts; quoted Typed output guarantees the shape of an answer, not its correctness. Nixz0824/rag-jev: quoted Degradation is never silent; noul < 0.5 请以公告原文为准. pantos12/mailverdict: quoted A classifier cannot be talked out of a probability; the explainer never changes the label; 24 fixtures are not a benchmark; distinct from mailverdict/mailverdict quoted Advisory signals, not verdicts. alexj11324/open-jev-approvals: stale authorization version while review is in flight → deny; quoted Fail-open degradation; incomplete / no-key → allow with incomplete: true. Ash20pk/beat-the-reviewer: quoted An unavailable reviewer is not an approval; on_unavailable: "block". 7starsseeker/dsh-jev-guard: quoted It is an accident net, not a security boundary; D3 fail-open; D9 l0-only. CompleteTech-LLC-AI-Research/jev-sentinel: quoted Judgments are not grants; quoted DEFER means only no additional veto. heliowap/diff-risk-sentinel: quoted It is a prioritization aid, not a bug detector; Rule 6 badge ACCEPTABLE_LOW_RISK (strategy: Low risk. Safe to merge.) is a badge. wmsing/agent-firewall: quoted fail-closed if checks do not pass; Layer 2 Mock; after allow still /bin/bash -c. acoyfellow/edit: quoted Nothing changes until you approve the exact request. vynnlee/jev-mail: autonomous archive; distinct from muhammedilyasy/jev-mail quoted Read-only: it never sends, deletes, labels or archives anything. Umbylicus/umby-jev-stack: quoted Never drop a finding; quoted Jev only classifies. CompleteTech-LLC-AI-Research/jev-prune-kit: quoted Not live-tested; advertised-vs-measured 122 vs 88. iluvblender/yolo-jev-scene-filter: quoted Jev only filters what YOLO already found.; keep floor 0.55 (uncalibrated); not hide-never-learned. kurihada/pi-jev-permit: quoted silence is never consent.; quoted A failed judgment is never treated as approval.; bash/write/edit only. ktsu2i/jevgate-action: advertised Action ≠ shipped workflow. boldbug1/jev-triage: Distinct ThyFriendlyFox/jev-triage; -threshold 0.8 (quoted starting point; uncalibrated). rubenhassid1/contact-cleaner: quoted Buckets are code, not the model.. javimp2003/claude-code-jev-guardrails: quoted Claude thinks. Jev reacts. Code decides.; advertised ASK_USER ≠ engine emit; no-key / JEV_MODE=mock named degraded backend (mock can still BLOCK). vrazraz/jev-voice-gate: quoted Это не гарантированная замена wake word.. pksorensen/alp-pr-review: quoted Den får aldrig PR-titel, -beskrivelse eller diff.; quoted Ikke en erstatning for branch protection.. arashari/youtube-judol-userscript-jev: confidenceThreshold 0.6 (uncalibrated) unsure. silky-x0/Postmark: advertised description ≠ shipped UI. thecoderpanda/shipit-gate: quoted Does this replace my CI? No.; --force / git push --no-verify skip the gate. uberto/jev-brig: quoted jev-brig is a guardrail, not a boundary.; auto_approve off so allow is silence; unparsable → ask — never a silent allow. RavenRepo/jevengineeringgate: quoted The gate never says yes; quoted Is this a security boundary? No. snesmaeili/jev-claude-controller: quoted no function in the safety layer accepts a model signal. logicrw/ask-jev: quoted never use a verdict to grant permissions. durganani60/fastrisk-jev: UI BLOCK/STEP-UP labels are not a freeze. ismailakdag/typesafe-jev: quoted Kararı yine kod verir. bojansandhaus/jev-decisions: quoted It never silently approves; quoted The workflow is shadow only. lgy1027/jevshield: heuristic not a security boundary; uncalibrated 0.75 noul as a halt. DevMortimer/pi-warden: quoted It is advisory, not a sandbox; failOpen: true. jasonli0226/jev-demo-triage: gate fails closed if Jev errors; quoted Jev did not beat baseline on pass rate. manutej/volumetric-intelligence: quoted Jev classifies. Code gates.; /api/walk rehearsal, not live Jev. miniLV/Jev-Auto-Router: quoted No evidence means no production delegation; automatic delegation off by default (UNVERIFIED); a Jev route is not a grant. replynodes/jev-web-analyzer: quoted developer demo, not … SEO score; not PreToolUse. rmax-ai/ai-provider-triage-comparison: quoted not a general model ranking. sysadarsh/zerosweep: 0.85 human_review vs trash_quarantine; Zero Format Errors is not a safety proof. 0xNatoshi/jev-codex-router: quoted Fail-open; routing ≠ permission; distinct miniLV/Jev-Auto-Router. y0usaf/pi-jev: quoted The gate fails open by design; smoke calibration is not an enforce grant. fsmiamoto/pi-jev-prune: default dry; prune ≠ deny. raniellimontagna/jev-guard-mcp: quoted the server cannot independently attest human approval; 0.80 is not a safety envelope. reallygood83/jev-router: quoted Jev does not pick model ids. It picks a role. Failures pass through.; routing ≠ permission; distinct justinhsu1477. philippdubach/pi-jev-router: quoted Jev output is evidence, not truth.; /router shadow default. YuyaForest/JEV-Dual-Spectrum-Phishing-Guardian: Malicious 61–100 is not a safety envelope. bornakapusta/slop-guard: the reviewer never blocks. sudeshkar/jev-corrective-rag: stubbed gates NOT a simulation of Jev's quality. Patrick-SCH03/jev-issue-radar: quoted It never closes issues, adds labels, or posts comments. MaxIvanyshen/jev-review: quoted It never approves or rejects anything. NiazMorshed2007/jcr: quoted JCR returns documentation. It does not execute commands.; treating capability context as attested approval to run is theater; routing ≠ permission. HexyeDEV/JevPR: LOW auto-APPROVE is not a merge grant; quoted Jev is an AI model, and can make mistakes. aesgalexis/model-switch: quoted Fail open; routing ≠ permission. gvkhosla/typesafe-pi: quoted never as permission to perform an action. jakenbear/the-jev-enator: quoted all three fail open; uncalibrated 0.80/0.90 is not a hard envelope. sohryuu101/jev-vault-gate: quoted Nothing is ever deleted automatically; never blocks. HorusJiang/dsh-jev-tools: quoted it ranks, it never thresholds; screen is advisory; jev_gate escalate is not a silent approve. YuyaForest/JEV-Prompt-Injection-Guardian: BLOCK 80% is not a safety envelope; heuristic fallback is not live Jev. bhaskarpraveen/jev-healthcare-support-router: 0.8/0.7 is application policy, not clinical authority. dillera/prMonster: quoted Merging is never offered; READY is not a merge grant. tr1v3r/dsh-jev: quoted Never registers or modifies LLM routes; shadow default. keeltrace/hermes-jev: quoted Do not treat a Jev probability as proof of correctness; enforce routes to human, not silent allow. win4r/pi-jev-router: routing ≠ permission; distinct philippdubach/pi-jev-router. hraness/sys1: loopback is not authentication; wire-compatible ≠ identical. matchstick-trading/jev-regime-gate: 0.4/0.6 is not investment advice. nyattoh/model-effort-router: a plan is not execution. ArronHC/windows2text: quoted A Jev confirm, escalate, or abort gate never executes automatically; windows_step defaults act=false. JohnsonRan/pi-jev: quoted This is not a sandbox; no key → mutating tools ask; distinct y0usaf/pi-jev. PavelLizunov/jev-sentinel: quoted Self-healing currently logs suggested actions without executing commands; require_confirmation is not an implemented approval workflow. VirtualMachinist/omapi-overlay: shadow never blocks; empty findings are not approval. abh2050/jev-test-confidence-gate: 0 of 3; quoted untested at adequate power, not refuted. michelbrigante46-art/Twitter-keyword-shield: 0.5 uncalibrated. morre95/Laya-GuardRails-Harness: quoted BLOCK comes from rules or policy, never from a Laya label; quoted low confidence escalates, never allows. anpicasso/hermes-jev-approvals: quoted Not a sandbox.; regex-flagged commands only. SouthernCrossAI/scx-router: 0.5 is not a Jev gate. BlinkWrite/pii-masker: quoted It never returns the input unchanged as a fallback. BuilderChat/PII-Redactor: default fail-closed; SLM GLiNER/Presidio off; shadow fail-open. Harshal-Ug/guardrails-demo: theirs ~180 ms. lsu-ub-uu/systemone-gatekeeper-war: Cora WAR, not TypeSafe System One. raitoxlol/hermes-slash-router: quoted stored routes are never applied automatically. tristan-kkim/airlock: quoted A model never gets to say "this is fine."; distinct jonathanavis96/jev-kit Airlock. david-cermak/jevlike-esp32: quoted This is intentionally a demo, not a production model. saibimajdi/typesafeai-dotnet-sdk: quoted Thresholds belong in your code. RiskAverseTech/toolgate: quoted defense in depth, not a sandbox; allow is advisory. tylerjharden/ailerix: ailerix/auto is not a permission. Bnymn1306/jev-github-quality-gate: auto_approved is not a merge grant. JkRheezy/win-cu-router: HTTP bridge is not an operating-system sandbox. boriscardano/herdr-jev-router: quoted Treat the enforcement claims as unproven. colinmcdermott/grok-jev-router: quoted The router is advice; those rules are the boundary. gowtham980/jev-router: quoted Classifier failures retain the current model. adamjralph/skill-broker: quoted Stages 1–4 are built and one Consumer is live.; Jev never grants access. Agentic-Guides/decision-kernel: quoted The guard never executes anything itself; /guard JSON is a proposal, not execute. NeOMakinG/kev-model-router: quoted kev being down never blocks traffic; routing ≠ permission. eugeniughelbur/jev-gate: observe logs only; guard/enforce can deny on p(destructive)>=0.90 without a hard rule (soft-as-veto); git stash clear hard-rule. jorgehara/gentle-browser-jev: quoted never claim savings without a controlled A/B run.; local-fallback; not a shipped hook. MarcoLoDico/pi-jev-router: quoted unvalidated starting policy, not a 95% accuracy guarantee.; selecting another model bypasses entirely; routing ≠ permission. harshwasan/jev-sentinel: quoted never auto-allows; keep both slugs. Koushik890/jev-firewall: quoted Rules can only tighten. jackbarunz/jev-tool-router: quoted The router narrows discovery; it does not permanently remove the fallback path. Routing ≠ permission. esinocchi/jev-tool-router: does not generate arguments, approve actions, or execute tools. devjtv/jev-router: quoted This is cost control, not a quality upgrade. Quoted: A router must never break a turn. cyriusweng/omp-jev-gate: quoted User authorisation and OMP permissions continue to govern actions. CompleteTech-LLC-AI-Research/jev-codex-approval: native adapter has not been compiled or exercised inside a running Codex instance; shadow always defer. JxWayne890/jev-control-plane: quoted Prevents the decision model from weakening verified safety rules. dr-dimitru/claude-jev-plugin: quoted Plugin never returns allow from TypeSafe confidence. Quoted: This plugin is a semantic guardrail, not a security sandbox. 4rays/profanity-checker: quoted threshold lives in your code. vzornjak/typesafe-decision: quoted Not a safety control, not an authorization mechanism. Quoted: 51.7% may only be cited as an uncontrolled projection, never as a measurement. openlayer-ai/jevals: quoted don't let the classifier become the authorizer. Quoted: estimates, not measurements. DihRJ/claude-code-jev-compaction: quoted Nothing is summarized or paraphrased. Gtrkrsk/laya: quoted Khmer 0.000 accuracy at 0.952 confidence; not a new model. Cousin, not this sidecar. JoacoMarc/jev-harness-router: quoted It does not execute tools. Routing ≠ permission. aniruddh-krovvidi/switchboard: policy.py owns the outcome; soft BLOCK 0.50 can 403. da-vinci-noob/pi-jev-model-router: quoted Fails open. Caps do not block turns. pi-auto-model-router: quoted The parent model is not switched. jjlecocq-v/outbound-draft-gate: quoted You always click send. Soft judgment is never the sole veto.

Open questions and risks

Jev has no published ROC on School of Reward Hacks or Terminal-Wrench. Calibration on support tickets is not a claim about SWE hacks.

Prompt-stage "make tests pass" steers; it does not automatically block. Explicit unauthorized requests to disable oversight can still block.

Hidden tests must live in an isolated evaluator. A file on disk is not held-out.

Next implementation step

Calibrate the Noul thresholds on a held-out coding-agent trace set once a TypeSafe key is available. Pin jev-1.13.0. Keep the production agent frozen while fitting the monitor.