Score account activity risk and decide whether to escalate for manual security review.
When not
Not a standalone fraud system; do not auto-lock accounts solely from one Score without your own policy and review path.
3 · Question stem
How risky does this account activity appear? Should this account be escalated for manual security review?
4 · Options
risk_level Score (Low / Moderate / High risk descriptions)
escalate (noul)
5 · Criteria
risk_level
Low risk: activity is consistent with the account history; Moderate risk: some unusual activity needs monitoring; High risk: multiple strong indicators of account compromise
escalate.true
The activity warrants immediate human review
escalate.false
The activity can be handled with normal automated controls
6 · Example in → out
In
account_age_days: 12; events: five failed logins, password reset from new country, successful login from usual device; account_verified: true
Vercel changelog example use cases bullet: “Choosing the next tool or subagent in an agent loop” and “Deciding whether to continue, retry, ask the user, or stop”. Full question stem / criteria not published on that page — summary + source only. Secondary: Vercel AI Gateway Evaluation docs.
1 · Title
#10 Verify model outputs / enforce guardrails
2 · When to use / When not
When to use
After a generative model writes or acts, run typed checks to verify outputs and enforce guardrails before side effects.
When not
Does not replace schema validation or deterministic policy checks code can do exactly.
Vercel changelog bullet: “Verifying model outputs and enforcing guardrails.” No full stem or option set on that page — summary + source only. Related: Flavio mentions claim-check Nouls against transcripts as a proposed workflow. Secondary: Evaluation docs + Flavio claim-check Noul mention.
Flavio: Choice over read_only / reversible / irreversible; separate Nouls may check delete / git history / deploy / outside-repo. Per-option criteria prose not fully enumerated — do not invent. T4 on this site is related preview scaffolding.
1 · Title
#14 Staged code review (jev-review)
2 · When to use / When not
When to use
Stage PR review judgments: risk matrix, file profiles, evidence, severity, then conditional routing — keep arithmetic and routing in code.
When not
Launch-week artefact (DEV “first 48 hours”); not a production case study. Figures self-reported by authors.
DEV cites devagrawal09/jev-review: “Noul risk matrix, then Choice/Score file profiles, evidence selection, severity, conditional routing.” Full stems not reproduced in the article — summary + source only.
1 · Title
#N1 Agent shell probability gate (Jev + Pi)
2 · When to use / When not
When to use
Put a Jev probability gate in front of a coding agent’s shell / write / edit tools: rules for known-safe or hard-deny paths, Jev for everything else.
When not
Not a sandbox or syscall filter. Default “unclear → allow” still lets ambiguous commands through — tighten uncertain policy if you need fail-closed. Not a CMD Guard product.
3 · Question stem
Evaluate safe-phrased Noul conditions on the proposed tool call (command/path + recent user prompt + policy notes)
4 · Options
intent_coverage (noul)
no_secret_egress (noul)
no_irreversible_damage (noul)
local_scope (noul)
path_not_protected (noul)
no_fetched_code_execution (noul)
prompt_injection_absent (noul)
policy_compliance (noul)
no_outward_effect (noul)
5 · Criteria
intent_coverage
Requested action matches user intent (author default threshold t=0.60; bimodal gap observed in article)
no_secret_egress
Absence-of-hazard detector — clear violations when p <= 1-t (author default t=0.97; raising t can shrink the reject band)
_bands
Per condition: satisfied p>=t; violated p<=1-t; unclear in between. Author notes unclear defaults to allow unless configured otherwise.
6 · Example in → out
In
Unvouched curl posting @$HOME/.ssh/id_ed25519 (fixture in article); also unrequested rm -rf / git reset --hard
LangChain “Building a Harness with Jev” — Auto Mode section. Full per-tool stem/criteria not published — summary + source; do not invent option text beyond the article’s middleware example.
Drive a headless browser with Jev choosing one page action per step, plus independent goal-done and stuck Nouls; code owns budgets, recovery, and stop gates.
When not
Early software — rough on hard sites. Jev never generates typed text (a small typing model or heuristic fills fields). Not a sandbox; treat the trace as evidence, not proof.
3 · Question stem
Which single action best advances the task on the current page? + The task's goal has been achieved: the current page and history show the sought outcome + The actions so far are not making progress toward the task (repeats, loops, or no change)
4 · Options
action Choice over page interactive elements + scroll/back/done (dynamic)
goal_done (noul)
stuck (noul)
select option Choice (second stage when select_* chosen)
5 · Criteria
action
Which single action best advances the task on the current page? (criteria = live element/control labels)
goal_done.true
The page being viewed is the sought destination or shows the sought information
goal_done.false
The goal is not yet achieved
stuck.true
Recent actions repeat or nothing changes; a different strategy is needed
stuck.false
Progress is visible or the first steps are still reasonable
6 · Example in → out
In
task: Search Wikipedia for Ristretto and stop on the article; start_url: en.wikipedia.org/wiki/Main_Page
Out
click search → type “Ristretto” → done; goal/stuck Nouls scored each step (README live trace)
Runnable MCP/CLI/library (@jkudish/jev-browser). Stop gates in code: done, goal_done>0.85, stuck>0.85, step/time budgets. Self-reported Wikipedia timings/costs in README — verify on your sites. Related browser agent: case #13 browser-use/jev-ultrafast on Other.
Before an agent executes a tool call, run a Jev recipe that classifies risk, checks policy, scores blast radius, and chooses continue / ask_user / escalate / abort — with harness confidence gate + shadow mode.
When not
Not a sandbox or syscall filter. Library is not affiliated with TypeSafe. Calibrate minConfidence; low confidence should review/suppress, not invent a safer action.
3 · Question stem
What risk class is this tool call? + Do the args match policy / allowlist intent? + Would the side effect be expensive or impossible to undo? + If this goes wrong, how wide is the blast radius? + How should the agent proceed with this tool call?
From AntonioCoppe/jev-harness recipes/agent-comm-harness tool-gate (verify-gate). Many other recipes ship in-repo (alert gate, row filter, etc.) — this card is the agent tool-call pattern. README timing proof is author-measured.
1 · Title
#N7 pi-heed: conversation constraints before side effects
2 · When to use / When not
When to use
In a pi coding agent, enforce user-stated constraints (read-only, no tests, no deps, protected paths, free-text) before mutating tool calls; rebuild constraints after compaction from the session, not model memory.
When not
Shadow mode by default; fails open on Jev error/timeout. Not a sandbox. Shell side-effect detection is pattern-based — exotic commands can slip. Reads are never checked.
3 · Question stem
Would executing pending_tool_call break any of the user's explicit constraints? Judge only against the constraints listed; necessary investigation or unrelated work is not a violation. + Do the user messages since the constraint was stated (including the one that stated it) explicitly permit this specific pending call, for example by making an exception for this file or this command?
Nyarlathoteppppp/pi-heed. Author-reported live Jev latency/cost figures — verify yourself. Mode: off | shadow | enforce.
1 · Title
#N8 fast-jev-compaction: keep call / keep result Nouls
2 · When to use / When not
When to use
Replace LLM transcript summaries with Jev keep/drop decisions on tool calls and results so kept text stays verbatim (Claude Code plugin or npm library).
When not
Only tool calls/results are candidates; user/assistant text is not removed in the output. Failures throw — caller chooses fallback. Probability ≠ proof a result is safe to delete.
3 · Question stem
Tool call ${call.id} (${call.tool}) should stay in the history: knowing this call was made, with its input, still matters for what the assistant does next + The full output of tool call ${call.id} (${call.tool}, ${call.resultChars} chars) should stay in the history verbatim: the assistant still needs its contents and re-running the tool would not do
4 · Options
keepCall (noul)
keepResult (noul)
5 · Criteria
keepCall
Knowing this call was made, with its input, still matters for what the assistant does next
keepResult
The assistant still needs its contents and re-running the tool would not do
tamaratran/fast-jev-compaction. Optional merge note: iefnaf/pi-jev also does selective tool-call/result compaction for the pi agent (plus difficulty Score routing) — related idea, different host; not a duplicate long card.