r2r-jev
Rust governance layer that treats Jev's per-tool-call scope and destructiveness checks as evidence feeding persistent trust state.
Overview
r2r-jev is a small integration built on one rule: a probabilistic judgment should be evidence, not authority. For each agent tool call, Jev answers two Noul checks (is it beyond scope, is it destructive). An Evidence Admission step then decides whether each judgment is strong enough to enter governance at all, returning Accept, Hold or Reject based on confidence, configured source reliability, expiry and corroboration. Admitted evidence drives R2R relation state transitions across Trust, Delegation and Authorization, which persist so later calls inherit the history until a human override repairs the relation.
The contrast with ordinary guardrails is the question asked: not whether this call is risky right now, but what relationship now exists between the agent, task, resource and organisation given everything that has happened. A recorded fixture makes the whole path runnable without a key, and the repo includes a stateless-versus-stateful comparison and a scenario designed to be adversarial to persistence. The README explicitly does not claim R2R makes Jev more accurate.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Is this tool call beyond the agent's scope? | — |
| Yes / no | Is this tool call destructive? | — |
| Other | Should this judgment be admitted as evidence: Accept, Hold or Reject? | Accept · Hold · Reject |
How it works
- Agent proposes a tool call; Jev answers beyond_scope and destructive
- Evidence Admission accepts, holds or rejects each judgment
- Admitted evidence transitions Trust, Delegation and Authorization state
- Enforcement decision is taken from relation state; a human override can repair it
Strengths
- Keeps a probability from silently becoming permission
- Governance state is persistent and replayable
- Runs offline with a recorded fixture
Caveats
- Source reliability is configured metadata, not measured
- Small public integration; experiment covers four traces
Getting started
git clone https://github.com/Thneoly/r2r-jev.git && cd r2r-jev && cargo run -- fixture (set TYPESAFE_API_KEY for live Jev).At a glance
- Type
- Project
- Status
- prototype
- Language
- Rust
- Runtime
- CLI / MCP
- Has code
- yes
- License
- Apache-2.0
Use cases and integrations
How curated lists describe it
Agent governance: asks Jev two `Noul` checks per tool call (beyond scope, destructive) and admits each judgment as Evidence that can degrade Trust, Delegation, and Authorization until a human override repairs the relation, so later calls inherit the history; includes a stateless-vs-stateful comparison with a scenario adversarial to persistence.
yibie/awesome-jevJev turns unstructured state into typed probabilistic decisions. Evidence Admission decides which observations are eligible to enter governance. R2R turns admitted evidence and events into persistent, replayable relation state.
logicrw/awesome-jev-projects
Frequently asked questions
What does Jev decide here?
Two yes/no checks per tool call: beyond scope and destructive.
Does a high Jev score block the call?
Not directly; it becomes evidence that must pass admission and then changes persistent trust state that governs enforcement.
Can I run it without a key?
Yes, cargo run -- fixture uses a recorded Jev-style trace.
Related projects
Auditable Zig terminal agent pairing Codex for coding with Jev typed preflight and postflight checks under deterministic policy gates.
CLIproductionZigGateway that checks agent tool calls with policy plus Jev evidence, then binds approval to a single-use permit for that exact action.
MCP serverbetaTypeScriptMCP proxy and hooks that screen agent tool calls before they run and their results before the agent reads them, using Jev judgments.
MCP serverbetaTypeScriptXano backend template where Jev judges each agent tool call as safe, needs review or dangerous, and uncertain calls wait for a human.
ProjectbetaXanoScriptOpenAI-compatible endpoint that answers an agent's command-approval call with APPROVE, DENY or ESCALATE from a Jev Choice, failing closed.
ProxybetaPythonClaude Code plugin adding Jev judgments to Bash, Write and Edit calls and their outputs; a semantic guardrail, not a sandbox.
Pluginbeta