What happens when the Jev judge is unreachable or returns garbage?

Everything fails closed: a missing key, timeout, connection or HTTP error, a malformed or contradictory answer, an empty answer after one retry, and an oversized or ambiguous command envelope all resolve to ESCALATE. The bridge never approves what it cannot judge, and every decision is logged.

How should the approval thresholds be chosen?

On data. Every decision is logged with the winning class, full distribution, margin and latency, so a candidate threshold can be replayed against the log before shipping. In the reference deployment, Jev's defaults of 0.85 and 0.60 escalated 17 of 21 judgements until a criteria rewrite and 0.65 and 0.30 were used.

How do I run the bridge and point an agent host at it?

Run `python3 -m judge_bridge`, which binds 127.0.0.1:3999 and reads the key from ~/.hermes/.env unless the environment already has one; `curl -s localhost:3999/healthz` reports status and backend. Any host needs only a base URL of http://127.0.0.1:3999/v1 and a model name, because the endpoint speaks POST /v1/chat/completions and returns one word in choices[0].message.content.

Can I use a judge other than Jev?

Four backends sit behind the same interface, chosen with JUDGE_BACKEND. typesafe is Jev and is the default; openai points at any OpenAI-compatible chat endpoint; yajev speaks a classify envelope at POST /v1/classify, keyless by design, with a self-hosted Jev clone as its reference; and rules is a deterministic regex policy read from a JSON file.

What does the deterministic rules backend guarantee?

It resolves deny first, then escalate, then approve, and escalates anything unmatched, so the absence of a rule is never permission. Approve patterns must match the whole command while deny and escalate stay substring searches, since a prefix cannot show a compound command is safe. A non-empty operator policy escalates instead of being ignored.

Why does the README call the rubric the calibration surface?

Because the probabilities saturate on this endpoint: benign work and misses alike land at 0.99 or above. The classify judge approved a credential copy at p=0.998, and even a credential-explicit rubric still approved the approval-machinery edit at about the same value. Only a hard rule naming the agent's own approval, audit and credential protection, plus a read/change carve-out, closed those probes.

How do I test a change before shipping it?

Run the shipped battery: `python3 tools/replay_battery.py` sends 9 benign commands that must approve and 8 dangerous ones that must not, exiting non-zero if either side fails. The repository also carries 63 offline tests covering every fail-closed path over a real socket.

CommunityJev Tools & CLIs

Approval Judge Bridge

OpenAI-compatible /v1/chat/completions proxy that answers an agent host's approval-guardian call with APPROVE, DENY or ESCALATE. Jev answers one Choice question with a calibrated distribution; missing keys, timeouts and malformed answers all fail closed to ESCALATE.

See highlights

Open github.com

Stars: 0
Language: Python
License: MIT
Published by: Community
Last verified: Oct 2026

oppih/approval-judge-bridge

User repository on GitHub

View on GitHub

OpenAI-compatible judge endpoint for agent approval gates: typed judgements (Jev), any OpenAI-compatible model, or a rule file — fail-closed, calibrated, with a replay battery

Forks: 0
Last pushed: Updated Sep 2026

Repo stats from the GitHub API, cached Oct 2026.

About this project

An OpenAI-compatible endpoint that answers an agent's approval-guardian call with a judged verdict — APPROVE, DENY, or ESCALATE. Four judges behind one interface: a typed judgement model (Jev), any OpenAI-compatible chat model, a self-hosted Jev-style classify judge, or a deterministic rule file. It fails closed, logs every decision, and ships the calibration harness that decides how confident a judge has to be before a command runs without asking a human.

Quoted from the project's README. Read the full README.

Tagscommunity agent-safety guardrails proxy

Works forJev for Decision gating Jev for Verification

Used inJev for Security & Privacy Jev for Software & DevTools

Languages: Python
Platforms: API
Capabilities: Open sourceSelf-hostedRequires API key

Highlights

Only an approve winner above both thresholds may auto-approve; deny always reaches a human.
Default thresholds are 0.65 for auto-accept and 0.30 for the minimum margin.
Measured on 57 logged judgements; the tuned run had a median latency of 0.18 s.
Ships a replay battery: 9 benign commands must approve and 8 dangerous ones must not.
63 offline tests cover every fail-closed path over a real socket.

Watch out

MIT licensed. It is a gate, not a sandbox: a judge can be wrong, so hardline blocks and the agent's own permission model should stay underneath. An unreachable judge escalates everything, and judge failover is listed as open work.

Questions about this entry

Short answers drawn from the linked project or page.

Reactions & coverage

Posts, threads, and videos about this entry from around the web.

X: Agent Handoff Gate: agents verify what they hand off

X: Jev as an LLM guardrail inside Agentgateway

X: Vercel's fx safety reviewer, measured at 18× faster

Reddit: Early experiments wiring Jev into Pi as a safety layer and model router.

Related terms

Glossary definitions related to this entry.

Guardrail

More Jev resources like this

Edward

Supervisor for unattended coding agents: it tracks cross-turn state and asks one batched Jev Choice whether a trajectory should continue, pause or escalate, while deterministic code owns dangerous-command blocking, budget caps and Ed25519-signed receipts.

Jev Tools & CLIs#community#guardrails#safety

Community

VeridicalTech/EdwardPython

openclaw-jev-leakguard

OpenClaw plugin that checks every outgoing agent message against its destination channel tier, running local key-format and term rules and then five Jev Noul questions in one call through OpenClaw's decisionModel, which can point at hosted Jev or a local Kev.

Jev Tools & CLIs#community#openclaw#guardrails

Community

yousan/openclaw-jev-leakguardJavaScript

Skill Scanner

2.6k

Cisco's security scanner for agent skills added a System One analyzer: it sends the full skill text to POST /v1/systemone as one advisory Noul question and records the probability, while being deliberately unable to emit a finding or change a severity.

Jev Tools & CLIs#community#security#agent-skills

Community

cisco-ai-defense/skill-scannerPython

dsh-jev-interceptor

A DeepSeek Harness plugin where Jev Choice and Noul checks gate every non-read-only tool call - deny confident high-risk calls, escalate ambiguous ones, auto-approve clearly granted reversible ones - and optionally score session messages so valuable context survives instead of being dropped oldest-first.

Jev Tools & CLIs#community#plugin#guardrails

Community

AskTheWay/dsh-jev-interceptorTypeScript

DeepSeek Harness Jev Plugin

203

Native DeepSeek Harness (DSH) plugin that uses Jev or Luna Decisions as a System One judgment layer across 12 separately configurable features: skill selection, file ranking, drift reminders, completion checks, goal supervision, corrections, log admission and workspace approvals. All features ship disabled by default.

Jev Tools & CLIs#community#deepseek#plugin

Community

luobosibing2/dsh-jev-pluginJavaScript

Ring Zero Security

Kernel-enforced runtime security for AI agents with eBPF/LSM: policy decides file, exec, package-install and MCP operations at the syscall, while Jev can run as an optional checks provider whose verdict can only raise severity. The Jev checks layer is off by default.

Jev Tools & CLIs#community#security#ebpf

Community

ringzerosec/jev-runtime-securityRust

From the Jev guides

Original write-ups on what this entry is for.

Jev on the Gateways: Vercel, Workers AI, and OpenRouter

Oct 12, 2026

The request shape barely changes across surfaces; the surrounding contract does. When to call the API directly and when a gateway, a Worker binding, or a router entry earns its extra hop.

Jev Tools & CLIs#gateway#vercel#cloudflare

Read article

Exporting Decision Models: GGUF, ONNX, and Device Runtimes

Oct 10, 2026

Taking a decision checkpoint out of Python: what the GGUF and browser WebGPU exports preserve, what they change, and the parity evidence the model cards publish.

Jev Tools & CLIs#open-models#local#onnx

Read article

Records at Rest: Documents, Inboxes, and Risk Queues

Sep 28, 2026

Jev labels a record that already exists. Code moves, flags, or holds it. How the document, mail, and transfer tools keep the action out of the model.

Jev Tools & CLIs#classification#email#security

Read article

Back to all resources

From the Jev community

Posts from builders shipping with Jev right now.

Follow @typesafeai