Does Jev control the agent?

No. Jev returns calibrated judgments about whether a trajectory should continue, pause or escalate; deterministic code owns blocklists, scope checks, budget caps, intervention execution and the signed receipt chain.

Can Edward run fully offline?

Yes, with the heuristic backend or a local scorer endpoint; rule-only and heuristic modes run without a GPU or API key, and a local 4B scorer keeps events on your own network.

How well does the Jev backend actually measure up?

On StepShield's 216 held-out trajectories the contract probe reaches EIR3 of 0.91 against 0.89 for the paper's GPT-4.1-mini judge, at roughly $0.0001 per batched decision, with 10.2% false positives on clean runs against 5.6%. Trajectory-level recall is 59.3%, and the project publishes that rather than claiming it away.

What do the deterministic rules cover?

Eight frozen trigger rules tuned on a dev split with seed 42 and frozen for held-out evaluation at seed 137: error rate over 40% across the last 8+ calls, 3+ retries of the same thing, more than 80% of the token budget consumed, a convergence stall past 600s and 5 turns, 12 consecutive reads with no writes, dangerous commands like rm -rf and curl piped to sh, writes outside the allowed path prefixes, and 10+ consecutive file writes with no shell verification.

How do interventions behave?

PAUSE exits with code 75, pins the agent session and resumes through `edward wrap --continue` picking the same session back up from the audit log. CANCEL and BLOCK exit 76. The audit, including an estimated avoided-spend per intervention, lands in ~/.edward/audit.jsonl with an Ed25519-signed receipt for every decision.

How do I install and run it?

pipx install edward-guard on Python 3.11+ with zero runtime dependencies. Then `edward init` for a starter policy, `edward doctor` for environment checks, and `edward wrap -- pi "task"` to supervise a run. It wraps any subprocess, with --agent auto|generic|pi choosing the adapter and a registry extensible through edward.adapters entry points.

What does a local scorer look like?

Pull qwen3.5:9b into Ollama, run edward-scorer-server against it with --style ollama, and point EDWARD_SCORER_URL at the result. That style is a direct readout over the option letters with no generated text, roughly 0.2s per decision, and on an 8 GB GPU it lands within noise of the tuned LAN service. The scorer is always advisory; if it goes down Edward logs a warning and runs rule-only.

CommunityJev Tools & CLIs

Edward

Supervisor for unattended coding agents: it tracks cross-turn state and asks one batched Jev Choice whether a trajectory should continue, pause or escalate, while deterministic code owns dangerous-command blocking, budget caps and Ed25519-signed receipts.

See highlights

Open github.com

Stars: 8
Language: Python
License: MIT
Published by: Community
Last verified: Oct 2026

VeridicalTech/Edward

Organization repository on GitHub

View on GitHub

The supervisor for coding agents that run when nobody's watching — deterministic guardrails + local semantic scorer + resumable interventions, every decision signed.

Forks: 2
Last pushed: Updated Oct 2026

Repo stats from the GitHub API, cached Oct 2026.Homepage

About this project

The supervisor for coding agents that run when nobody's watching. CI jobs, overnight runs, scheduled batches — unattended agents fail quietly: the same broken test retried 40 times, rm -rf on the wrong directory, budget burned at 3am with no one to hit stop. Edward watches the event stream, builds a picture of what the agent is actually doing across turns, and intervenes when the picture stops looking right — PAUSE (resumable), CANCEL, or BLOCK — with a signed receipt for every decision.

Quoted from the project's README. Read the full README.

Tagscommunity guardrails safety cli

Works forJev for Decision gating Jev for Verification

Used inJev for Software & DevTools Jev for Security & Privacy

Languages: Python
Platforms: CLI
Capabilities: Open sourceRuns locallyRequires API key

Highlights

On StepShield 216 held-out trajectories the Jev contract probe reaches EIR3 0.91 versus 0.89 for the paper GPT-4.1-mini judge, at ~$0.0001 per batched decision.
Eight frozen trigger rules cover error rate, retries, budget, stalls, dangerous commands, scope violations and silent corruption risk.
PAUSE exits 75 and resumes via `edward wrap --continue`; CANCEL and BLOCK exit 76; audit lands in ~/.edward/audit.jsonl.
Zero runtime dependencies on Python 3.11+, installable from PyPI as edward-guard.

Watch out

MIT licensed. Trajectory-level recall is 59.3%, so misdetections remain; the Jev backend needs TYPESAFE_API_KEY, and the optional local 4B scorer trades different recall and false-positive rates.

Questions about this entry

Short answers drawn from the linked project or page.

Reactions & coverage

Posts, threads, and videos about this entry from around the web.

X: Agent Handoff Gate: agents verify what they hand off

X: Jev as an LLM guardrail inside Agentgateway

X: Vercel's fx safety reviewer, measured at 18× faster

Reddit: Early experiments wiring Jev into Pi as a safety layer and model router.

Related terms

Glossary definitions related to this entry.

More Jev resources like this

jev-secret-guard

A Claude Code PreToolUse hook that blocks known key formats locally and sends only masked unknown high-entropy strings to Jev for a Noul judgment, blocking at 0.80 and asking the human from 0.30 or whenever Jev is unavailable.

Jev Tools & CLIs#community#security#claude-code

Community

BasmaAbouzied0/jev-secret-guardPython

approval-judge-bridge

OpenAI-compatible /v1/chat/completions proxy that answers an agent host's approval-guardian call with APPROVE, DENY or ESCALATE. Jev answers one Choice question with a calibrated distribution; missing keys, timeouts and malformed answers all fail closed to ESCALATE.

Jev Tools & CLIs#community#agent-safety#guardrails

Community

oppih/approval-judge-bridgePython

Skill Scanner

2.6k

Cisco's security scanner for agent skills added a System One analyzer: it sends the full skill text to POST /v1/systemone as one advisory Noul question and records the probability, while being deliberately unable to emit a finding or change a severity.

Jev Tools & CLIs#community#security#agent-skills

Community

cisco-ai-defense/skill-scannerPython

dsh-jev-interceptor

A DeepSeek Harness plugin where Jev Choice and Noul checks gate every non-read-only tool call - deny confident high-risk calls, escalate ambiguous ones, auto-approve clearly granted reversible ones - and optionally score session messages so valuable context survives instead of being dropped oldest-first.

Jev Tools & CLIs#community#plugin#guardrails

Community

AskTheWay/dsh-jev-interceptorTypeScript

pi-verdict

Permission gate extension for the pi coding agent: deterministic allow/deny rules and protected paths settle clear cases first, then gray-zone tool calls get one structured classify() verdict; Jev is an optional native classifier via TypeSafe direct, OpenRouter, or other gateways, failing closed on error.

Jev Tools & CLIs#community#guardrails#permissions

Community

jesset/pi-verdictTypeScript

Ring Zero Security

Kernel-enforced runtime security for AI agents with eBPF/LSM: policy decides file, exec, package-install and MCP operations at the syscall, while Jev can run as an optional checks provider whose verdict can only raise severity. The Jev checks layer is off by default.

Jev Tools & CLIs#community#security#ebpf

Community

ringzerosec/jev-runtime-securityRust

From the Jev guides

Original write-ups on what this entry is for.

Jev on the Gateways: Vercel, Workers AI, and OpenRouter

Oct 12, 2026

The request shape barely changes across surfaces; the surrounding contract does. When to call the API directly and when a gateway, a Worker binding, or a router entry earns its extra hop.

Jev Tools & CLIs#gateway#vercel#cloudflare

Read article

Exporting Decision Models: GGUF, ONNX, and Device Runtimes

Oct 10, 2026

Taking a decision checkpoint out of Python: what the GGUF and browser WebGPU exports preserve, what they change, and the parity evidence the model cards publish.

Jev Tools & CLIs#open-models#local#onnx

Read article

Records at Rest: Documents, Inboxes, and Risk Queues

Sep 28, 2026

Jev labels a record that already exists. Code moves, flags, or holds it. How the document, mail, and transfer tools keep the action out of the model.

Jev Tools & CLIs#classification#email#security

Read article

Back to all resources

From the Jev community

Posts from builders shipping with Jev right now.

Follow @typesafeai