Jev Auto Router

Wait. The README calls it a validation prototype and says explicitly not to read it as a production install guide: the plan A runtime is implemented and passes deterministic HTTP tests, but rerunnable real-machine A-to-B-to-A sessions, standalone cancellation evidence and the preregistered paired evaluation are still outstanding, so it claims no general saving.

You supply the baseline yourself, because JEV_BASELINE has no generic default. Candidates are exact model and reasoning-effort pairs that actually succeeded on your authenticated caller edge, startup sends no paid probes, and without a proven baseline an automatic request fails before the upstream call. Active mode refuses to start if any candidate is unproven.

Only whitelisted compact routing facts go to Jev: step type, current model, tool name, exit code and a fixed-length error summary. Sensitive content is refused outright rather than truncated, and raw prompts and tool outputs are not written to routing logs by default. The router never holds upstream credentials; an authenticated caller edge does, and it must not recurse back.

No, and the design keeps them apart. Acceptance is judged at task boundaries against the original requirements using changes, tests, run results and necessary semantic conclusions, and the executing model reporting success is not evidence. Model switching can also cost prompt cache, so the project measures that price instead of claiming routing is inherently cheaper.

M1 accepts Responses requests and builds a CallContext; M2 derives candidates and applies privacy constraints; M3 makes one bounded Jev Choice; M4 validates and applies only model and reasoning effort; M5 forwards through the authenticated caller edge; and M6 passively records proposals, applied routes, and upstream actuals without storing raw text.

JEV_MODE defaults to shadow, which records the would-be route while execution uses the fixed baseline. Active mode requires an explicit candidate whitelist, a paired-evaluation evidence file, a matching release id, and explicit confidence floor and deadline values, and it refuses to start if any candidate on the caller edge is unproven.

It records every call's Jev choice, the model and effort actually used, usage, cache, latency, and any fallback reason, then links that to the task's acceptance result. Unknown usage stays UNKNOWN rather than being read as zero, and because switching can lose the prompt cache, version one measures the real switching cost instead of claiming a saving.