approval-judge-bridge
OpenAI-compatible endpoint that answers an agent's command-approval call with APPROVE, DENY or ESCALATE from a Jev Choice, failing closed.
Overview
approval-judge-bridge sits behind hosts that gate flagged shell commands by asking an auxiliary model for a one-word verdict, with Hermes's smart approvals as the reference host. Reasoning models can burn their small token budget on hidden reasoning and return nothing, which maps to escalate, so every flagged command prompts the user; and prose verdicts have no confidence, so thresholds are guesses. The bridge adapts the call instead of patching the host.
It offers four judges behind one interface: Jev with one Choice question (approve, deny, escalate) and calibrated probabilities; any OpenAI-compatible chat model; a self-hosted Jev-style classify judge; or a deterministic rule file. It fails closed on missing keys, timeouts, errors or malformed answers, logs every decision, and includes a calibration harness for choosing thresholds. Only an approve winner can be auto-approved; deny and escalate always reach the human.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Choice | Should this flagged shell command run? | approve · deny · escalate |
How it works
- Host sends its approval-guardian call to the bridge
- Bridge asks the configured judge (Jev by default)
- Map result to APPROVE only if approve wins above threshold
- Anything else, or any error, returns ESCALATE or DENY
- Log the decision for calibration
Strengths
- No empty answers from token caps
- Fail-closed on every error path
- Calibration harness for thresholds
- Host upgrades cannot remove it
Caveats
- Requires a TypeSafe key for the default judge
- Designed around Hermes's approval protocol
Getting started
Clone the repo and run python3 -m judge_bridge (binds 127.0.0.1:3999; needs TYPESAFE_API_KEY in ~/.hermes/.env).At a glance
- Type
- Proxy
- Status
- beta
- Language
- Python
- Runtime
- local OpenAI-compatible proxy
- Has code
- yes
Use cases and integrations
How curated lists describe it
Agent safety: OpenAI-compatible /v1/chat/completions proxy that gates an agent's shell commands through a calibrated Jev Choice decision with fail-closed semantics.
yibie/awesome-jev
Frequently asked questions
Can it auto-approve a denied command at a low threshold?
No, only an approve winner can be auto-approved; deny and escalate always reach the human.
What happens on errors?
Every failure path returns ESCALATE.
Do I have to use Jev?
No, you can use any OpenAI-compatible model, a self-hosted classify judge or rules.
Related projects
Auto mode for Pi: deterministic policy first, then Jev judges escalated bash/write/edit calls, failing closed when undecidable.
ProjectbetaTypeScriptPre-execution hook for coding agents that lets shell commands run, asks a human, or blocks them, with optional Jev classification.
ProjectbetaJavaScriptHermes Agent approvals provider where one Jev request answers six typed questions and code derives APPROVE, DENY or ESCALATE.
HookprototypePythonAuditable Zig terminal agent pairing Codex for coding with Jev typed preflight and postflight checks under deterministic policy gates.
CLIproductionZigClaude Code PreToolUse layer where Jev answers YAML-defined questions about each tool call, with 19 hard rules and calibration runs.
ProjectbetaTypeScriptGateway that checks agent tool calls with policy plus Jev evidence, then binds approval to a single-use permit for that exact action.
MCP serverbetaTypeScript