telltale-systemone
Reference Telltale analyzer extension that asks Jev typed questions from configurable guard packs about coding-agent actions.
Overview
telltale-systemone is a reference analyzer extension for Telltale, a tool that observes AI agent activity. It sends narrow, typed questions about agent actions to TypeSafe's Jev, with the questions defined in configurable guard packs. The model only supplies probabilities; the pack supplies the Telltale category, severity, risk points and every threshold, and Telltale's deterministic rules remain in place.
The core pack has five checks, including autostart persistence changes, control tampering such as setenforce 0, history -c or --no-verify, and the source of package installs (registry, pinned, URL/VCS or piped script). The README is explicit about status: the plugin is built and tested here, but the host side is a proposed Telltale extension and not integrated; live calls were validated only on eight synthetic inputs; and the core thresholds are drafts not tuned on labelled sessions. A fail-closed egress guard blocks requests that appear to contain credentials. It is written in Rust.
What the decision model decides
| Type | Question | Answers |
|---|---|---|
| Yes / no | Does this action change an autostart location? | — |
| Yes / no | Does this action tamper with security controls or history? | — |
| Choice | Where is this package being installed from? | registry · pinned · direct_url_or_vcs · piped script · unclear |
How it works
- Telltale observes an agent action and produces analysis input.
- The extension applies guard pack questions and calls Jev.
- Pack thresholds turn probabilities into findings with category and severity.
- Uncertain answers become review leads; credentials trigger a fail-closed egress block.
Strengths
- Model adds coverage beyond regex rules while code keeps policy.
- Thresholds and categories are configurable per pack.
- Credential egress guard before any API call.
Caveats
- Not integrated into Telltale; host side is a proposal.
- Validated only on synthetic inputs; thresholds are drafts.
- Sends redacted action text to TypeSafe.
Getting started
cargo build, then configure examples/config.typesafe.yaml with TYPESAFE_API_KEY for live use.At a glance
- Type
- Plugin
- Status
- prototype
- Language
- Rust
- Runtime
- Telltale analyzer plugin
- Has code
- yes
- Has tests
- yes
- Stars
- 0
Use cases and integrations
How curated lists describe it
Reference Telltale analyzer.v1 extension that evaluates guard packs with a System One model
wh000wh000/awesome-jev-live
Frequently asked questions
What does Jev check?
Agent actions against guard pack questions such as persistence changes, control tampering and package install source.
Does it replace Telltale's rules?
No, it sits beside the deterministic rules and only adds probabilities.
Is it production ready?
No, the README labels it an experiment with draft thresholds and no host integration yet.
Related projects
Hackathon agent monitor that scores chains of sandboxed agent actions with Jev and escalates through a fixed L1-L5 containment ladder.
AppprototypePython- jev-usecases★ 22
Collection of production-shaped Python harnesses implementing most of TypeSafe's listed Jev decisions with confidence-gated logic.
ProjectbetaPython Go CLI for managing WordPress sites at scale, with typesafe commands that ask Jev questions and a scan --triage that ranks malware findings.
ProjectproductionGoLarge catalog of Claude Code agents, commands, hooks and MCPs, listed with community Jev mods for guardrails and subagent models.
CLIproductionJavaScriptPython/TypeScript/Go chatbot safety library checking user input and bot replies with Jev and returning one actionable verdict per message.
LibraryproductionPythonAuditable Zig terminal agent pairing Codex for coding with Jev typed preflight and postflight checks under deterministic policy gates.
CLIproductionZig