@aiwayds/dsh-topics-memory 0.18.2 → 0.19.0

package/lib/quality.d.ts

@@ -5,8 +5,12 @@
  *   1. intent-query build over the observer's last-K ring buffer — kills
  *      verbatim priming at the root (the query is what the model needs, not
  *      what the user typed);
- *   2. lexical candidate band (hits + near-misses, recall-oriented) then an
- *      LLM rerank that releases 0-2 picks, each with a one-line why.
+ *   2. lexical candidate band (hits + near-misses, recall-oriented) then a
+ *      rerank that releases 0-2 picks, each with a one-line why. With
+ *      `jevEnabled` on (design 2026-09-25 §2) the rerank is a batched System
+ *      One noul request, probability-band gated; any failure fails open to the
+ *      legacy LLM rerank below. The same trigger also runs the fastgate
+ *      SHADOW (zero behavior, decisions.jsonl only).
  *
  * Picks rest in a per-session pending slot and inject at the NEXT spliced
  * (steer message), then the slot is gone (消费即清). Hard bounds: per-call
@@ -28,8 +32,32 @@ export declare const CALL_TIMEOUT_MS = 20000;
 export declare const PIPELINE_TIMEOUT_MS = 45000;
 /** qualityLane 'sampled' runs on every Nth turn (design default 1/3). */
 export declare const SAMPLED_EVERY = 3;
+/** Fastgate shadow cap (design §2 row 3): topK hits + near-misses, ≤8 questions. */
+export declare const FASTGATE_MAX_QUESTIONS = 8;
 export declare const QUERY_BUILD_PROMPT: string;
 export declare const RERANK_PROMPT: string;
+/**
+ * §6.2 state for one batch: the round's query plus the task frame. Shared by
+ * the rerank and the fastgate shadow so both seams speak ONE batch protocol —
+ * the calibrated bands are protocol-bound (design §5), a second state shape
+ * would need its own sweep.
+ */
+export declare function jevState(query: string): string;
+/** The lexical disposition the fast lane recorded for one candidate — the
+ *  agree-reconciliation key (§6.2; retrieval.ts hits/nearMisses split). */
+export type FastGateDisposition = 'hit' | 'nearFloor' | 'gate-blocked';
+export interface FastGateCandidate {
+    slug: string;
+    disposition: FastGateDisposition;
+}
+export interface FastGateShadowInput {
+    /** The fast-lane round's query (the claimed text), captured at spliced. */
+    query: string;
+    /** hits + near-misses of that round, with their lexical dispositions. */
+    candidates: readonly FastGateCandidate[];
+    /** Observer turn count at the trigger — the sampled-cadence clock. */
+    turnId: number;
+}
 export interface PendingInjection {
     items: {
         slug: string;
@@ -64,6 +92,8 @@ export declare function parseJsonObject(raw: string): Record<string, unknown>;
 export declare class SlowLane {
     private pending;
     private inFlight;
+    /** Same-session shadow serialization — a second trigger never overlaps. */
+    private shadowInFlight;
     private readonly service;
     private readonly caller;
     /**
@@ -81,6 +111,19 @@ export declare class SlowLane {
     hasInFlight(sessionId: string): boolean;
     /** Drop the pending slot (session teardown, restore boundary). */
     clear(sessionId: string): void;
+    /**
+     * Fastgate shadow (design §2 row 3): fire-and-forget on the SAME sampled
+     * turn-end trigger as the slow lane, zero behavior — verdicts land only in
+     * decisions.jsonl, reconciled against the lexical disposition. Needs no LLM
+     * caller, so it also runs on turns where the slow lane itself yields (distill
+     * in flight, no model configured). `dispatch()`'s own guards (lane mode,
+     * sampled cadence) are mirrored here so both seams share one cadence.
+     */
+    dispatchFastGateShadow(sessionId: string, input: FastGateShadowInput): void;
+    /** Shadow body: resolve candidate content from the roster, one batched noul
+     *  request, verdict rows only. A jevAsk failure leaves just its auto-written
+     *  call row — there is no legacy path to fall back to, and nothing to gate. */
+    private fastGateShadow;
     /**
      * Produce a pending slot for the session's next steer message. Fire-and-
      * forget; every guard failure is silent. Policy gates live here (config,
@@ -89,6 +132,21 @@ export declare class SlowLane {
      */
     dispatch(sessionId: string, input: DispatchInput): void;
     private produce;
+    /** One pending slot per settled pipeline (the 0-2 picks + lane metadata). */
+    private settlePending;
+    /**
+     * The jev rerank (design §2 row 1): one batched noul request over the whole
+     * candidate band; per-candidate verdict rows (agree: 'n/a' — no lexical
+     * disposition applies on this seam). Gate: adopt band (≥ 0.60) ranked by
+     * probability, top 2 (the 0-2 picks semantics); record band only logs;
+     * fallback band (< 0.10) is a hard veto.
+     *
+     * Returns undefined on ANY failure — jevAsk !ok (timeout / network / gate /
+     * bad shape) or an unparseable probability (坏答案) — so the caller fails
+     * open to the legacy LLM rerank (red line ②; the call-layer row already
+     * carries fallback=true via jevAsk's flag).
+     */
+    private jevRerank;
     /**
      * Consumption point (the next spliced). Returns the pending exactly once
      * (消费即清) or an expiry reason; `turnId` is the CURRENT observer turn

package/lib/quality.js

@@ -5,8 +5,12 @@
  *   1. intent-query build over the observer's last-K ring buffer — kills
  *      verbatim priming at the root (the query is what the model needs, not
  *      what the user typed);
- *   2. lexical candidate band (hits + near-misses, recall-oriented) then an
- *      LLM rerank that releases 0-2 picks, each with a one-line why.
+ *   2. lexical candidate band (hits + near-misses, recall-oriented) then a
+ *      rerank that releases 0-2 picks, each with a one-line why. With
+ *      `jevEnabled` on (design 2026-09-25 §2) the rerank is a batched System
+ *      One noul request, probability-band gated; any failure fails open to the
+ *      legacy LLM rerank below. The same trigger also runs the fastgate
+ *      SHADOW (zero behavior, decisions.jsonl only).
  *
  * Picks rest in a per-session pending slot and inject at the NEXT spliced
  * (steer message), then the slot is gone (消费即清). Hard bounds: per-call
@@ -18,6 +22,9 @@
  * @module quality
  */
 import { searchTopics } from "./retrieval.js";
+import { jevAsk } from "./jev/client.js";
+import { band as jevBand } from "./jev/thresholds.js";
+import { digestFor, logVerdicts } from "./jev/log.js";
 export const PENDING_TTL_MS = 10 * 60_000;
 /** Hard drift bound: a pending older than this many turn-ends expires. */
 export const TURN_LAG_LIMIT = 2;
@@ -31,6 +38,8 @@ const RING_CHARS = 6000;
 const CANDIDATE_LIMIT = 6;
 /** Over-fetch before the exclude filter, so excluded slugs don't thin the band. */
 const CANDIDATE_OVERFETCH = 6;
+/** Fastgate shadow cap (design §2 row 3): topK hits + near-misses, ≤8 questions. */
+export const FASTGATE_MAX_QUESTIONS = 8;
 export const QUERY_BUILD_PROMPT = [
     '你是检索查询构建器。输入是最近几轮对话。任务：判断「模型此刻需要什么背景知识」，输出一个用于关键词检索的 query。',
     '只输出一个 JSON 对象，不要任何其他文字：{"needs": true, "query": "3-8 个检索词加一句意图", "ignore": ["被你忽略的内容类型"]}',
@@ -47,6 +56,48 @@ export const RERANK_PROMPT = [
     '- why 面向模型自己读：说清这条记忆能帮上当前哪一步。',
     '- slug 必须逐字取自候选列表，禁止编造。',
 ].join('\n');
+/**
+ * §6.2 state for one batch: the round's query plus the task frame. Shared by
+ * the rerank and the fastgate shadow so both seams speak ONE batch protocol —
+ * the calibrated bands are protocol-bound (design §5), a second state shape
+ * would need its own sweep.
+ */
+export function jevState(query) {
+    return `检索 query：${query}\n任务背景：模型正在推进当前会话的工作，需要判断哪些长期记忆 topic 值得注入上下文作参考。`;
+}
+/** Per-candidate question: full candidate inline (title/tags/conclusion
+ *  excerpt), RERANK_PROMPT's rendering style but compact. */
+function candidateInstructions(c) {
+    const tags = c.tags !== undefined && c.tags.length > 0 ? `，标签: ${c.tags.join('/')}` : '';
+    const desc = c.description !== undefined && c.description.trim() !== '' ? ` ${c.description.trim().slice(0, 80)}` : '';
+    return `候选 topic「${c.title}」（slug: ${c.slug}，状态: ${c.status}${tags}）。${desc}结论摘录：${c.conclusion.slice(0, 160)}。该候选与当前 query 对应的工作真的相关、值得注入模型上下文吗？`;
+}
+/** Two-sided criteria built from the candidate content (calibration protocol:
+ *  single-sided instructions measurably degrade). */
+function candidateCriteria(c) {
+    return {
+        true: `相关——「${c.title}」的记忆对当前工作有实质帮助，应该注入作参考`,
+        false: `无关——「${c.title}」与当前工作没有实质交集，注入只是噪音，不应该注入`,
+    };
+}
+/** The noul probability of one answer; undefined when the answer is not a
+ *  usable number in [0,1] (a 坏答案 — fail-open for the caller). */
+function noulProbability(answer) {
+    if (answer === null || typeof answer !== 'object')
+        return undefined;
+    const p = answer.noul;
+    return typeof p === 'number' && Number.isFinite(p) && p >= 0 && p <= 1 ? p : undefined;
+}
+/** The config slice jevAsk needs, tolerating bare harnesses (§4: consumers
+ *  treat undefined as the documented default). */
+function jevConfigOf(cfg) {
+    return {
+        jevBackend: cfg.jevBackend ?? 'zen',
+        jevModel: cfg.jevModel ?? '',
+        jevTimeoutMs: typeof cfg.jevTimeoutMs === 'number' && cfg.jevTimeoutMs > 0 ? cfg.jevTimeoutMs : 3000,
+        jevSecretFile: cfg.jevSecretFile ?? '',
+    };
+}
 /** Race `p` against a timeout; `onTimeout` fires so callers can abort upstream work. */
 function withTimeout(p, ms, onTimeout) {
     return new Promise((resolve, reject) => {
@@ -107,6 +158,8 @@ export function parseJsonObject(raw) {
 export class SlowLane {
     pending = new Map();
     inFlight = new Map();
+    /** Same-session shadow serialization — a second trigger never overlaps. */
+    shadowInFlight = new Map();
     service;
     caller;
     /**
@@ -133,6 +186,95 @@ export class SlowLane {
     /** Drop the pending slot (session teardown, restore boundary). */
     clear(sessionId) {
         this.pending.delete(sessionId);
+        this.shadowInFlight.delete(sessionId);
+    }
+    /**
+     * Fastgate shadow (design §2 row 3): fire-and-forget on the SAME sampled
+     * turn-end trigger as the slow lane, zero behavior — verdicts land only in
+     * decisions.jsonl, reconciled against the lexical disposition. Needs no LLM
+     * caller, so it also runs on turns where the slow lane itself yields (distill
+     * in flight, no model configured). `dispatch()`'s own guards (lane mode,
+     * sampled cadence) are mirrored here so both seams share one cadence.
+     */
+    dispatchFastGateShadow(sessionId, input) {
+        try {
+            const cfg = this.service.cfg;
+            if (cfg.jevEnabled !== true)
+                return;
+            if (cfg.qualityLane !== 'sampled' && cfg.qualityLane !== 'always')
+                return;
+            if (cfg.qualityLane === 'sampled' && input.turnId % SAMPLED_EVERY !== 0)
+                return;
+            if (input.query.trim() === '' || input.candidates.length === 0)
+                return;
+            if (this.shadowInFlight.has(sessionId))
+                return; // never overlap shadows
+            // Serialize behind a same-session produce pipeline (rerank 完成后);
+            // standalone when no pipeline is running (无慢道任务时独立跑).
+            const prior = this.inFlight.get(sessionId) ?? Promise.resolve();
+            const run = prior.then(() => this.fastGateShadow(input)).finally(() => {
+                this.shadowInFlight.delete(sessionId);
+            });
+            this.shadowInFlight.set(sessionId, run);
+            void run.catch(() => undefined);
+        }
+        catch {
+            // contained — the shadow must never break the event handler
+        }
+    }
+    /** Shadow body: resolve candidate content from the roster, one batched noul
+     *  request, verdict rows only. A jevAsk failure leaves just its auto-written
+     *  call row — there is no legacy path to fall back to, and nothing to gate. */
+    async fastGateShadow(input) {
+        const roster = await this.service.roster().catch(() => []);
+        const bySlug = new Map(roster.map((r) => [r.slug, r]));
+        const state = jevState(input.query);
+        const questions = {};
+        const metas = [];
+        for (const cand of input.candidates.slice(0, FASTGATE_MAX_QUESTIONS)) {
+            const meta = bySlug.get(cand.slug);
+            if (meta === undefined)
+                continue; // vanished between retrieval and the shadow
+            const qid = `c${metas.length + 1}`;
+            const instructions = candidateInstructions(meta);
+            questions[qid] = { type: 'noul', instructions, criteria: candidateCriteria(meta) };
+            metas.push({ qid, slug: cand.slug, instructions, disposition: cand.disposition });
+        }
+        if (metas.length === 0)
+            return;
+        const result = await jevAsk({
+            state,
+            questions,
+            config: jevConfigOf(this.service.cfg),
+            lane: 'fastgate-shadow',
+            fallback: false, // pure shadow — no behavior to fall back
+        });
+        if (!result.ok)
+            return;
+        const at = new Date().toISOString();
+        const recs = [];
+        for (const m of metas) {
+            const probability = noulProbability(result.answers[m.qid]);
+            if (probability === undefined)
+                continue; // unparseable answer: no fabricated row
+            const b = jevBand(probability, 'rerank');
+            // agree reconciliation (§6.2): the ilog disposition, with wouldBlock for
+            // the reverse disagreement (lexical let it through, jev lands in the veto
+            // band — the other half of the calibration goldmine).
+            const agree = m.disposition === 'hit' && b === 'fallback' ? 'wouldBlock' : m.disposition;
+            recs.push({
+                at,
+                lane: 'fastgate-shadow',
+                questionId: m.qid,
+                qtype: 'noul',
+                ref: `slug:${m.slug}`,
+                digest: digestFor(state, m.qid, m.instructions),
+                probability,
+                band: b,
+                agree,
+            });
+        }
+        await logVerdicts(recs);
     }
     /**
      * Produce a pending slot for the session's next steer message. Fire-and-
@@ -237,6 +379,19 @@ export class SlowLane {
             });
             if (payload.length === 0)
                 return;
+            // ---- jev batch rerank (design §2 row 1) — replaces the LLM rerank ----
+            // One batched noul request over the whole band; the calibrated bands
+            // decide the picks. A settled jev round is FINAL here (picks or none) —
+            // only a jev FAILURE (jevRerank → undefined) falls open to the legacy
+            // LLM rerank below (§3.2: 本轮回退旧 LLM rerank, picks 照常产出).
+            if (this.service.cfg.jevEnabled === true) {
+                const jevItems = await this.jevRerank(query, payload);
+                if (jevItems !== undefined) {
+                    if (jevItems.length > 0)
+                        this.settlePending(sessionId, input, jevItems, queryBuild, started);
+                    return;
+                }
+            }
             const rerankRaw = await withTimeout(caller({
                 system: RERANK_PROMPT,
                 user: [
@@ -279,15 +434,7 @@ export class SlowLane {
             }
             if (items.length === 0)
                 return;
-            const route = this.service.cfg;
-            this.pending.set(sessionId, {
-                items,
-                computedAt: new Date().toISOString(),
-                turnId: input.turnId,
-                queryBuild,
-                model: `${route.distillProvider}/${route.distillModel}`,
-                ms: Date.now() - started,
-            });
+            this.settlePending(sessionId, input, items, queryBuild, started);
         }
         catch {
             // timeouts, aborts, model errors — I3: the async product is simply absent
@@ -296,6 +443,78 @@ export class SlowLane {
             clearTimeout(deadline);
         }
     }
+    /** One pending slot per settled pipeline (the 0-2 picks + lane metadata). */
+    settlePending(sessionId, input, items, queryBuild, started) {
+        const route = this.service.cfg;
+        this.pending.set(sessionId, {
+            items,
+            computedAt: new Date().toISOString(),
+            turnId: input.turnId,
+            queryBuild,
+            model: `${route.distillProvider}/${route.distillModel}`,
+            ms: Date.now() - started,
+        });
+    }
+    /**
+     * The jev rerank (design §2 row 1): one batched noul request over the whole
+     * candidate band; per-candidate verdict rows (agree: 'n/a' — no lexical
+     * disposition applies on this seam). Gate: adopt band (≥ 0.60) ranked by
+     * probability, top 2 (the 0-2 picks semantics); record band only logs;
+     * fallback band (< 0.10) is a hard veto.
+     *
+     * Returns undefined on ANY failure — jevAsk !ok (timeout / network / gate /
+     * bad shape) or an unparseable probability (坏答案) — so the caller fails
+     * open to the legacy LLM rerank (red line ②; the call-layer row already
+     * carries fallback=true via jevAsk's flag).
+     */
+    async jevRerank(query, payload) {
+        const state = jevState(query);
+        const questions = {};
+        const metas = [];
+        for (const [i, c] of payload.entries()) {
+            const qid = `c${i + 1}`;
+            const instructions = candidateInstructions(c);
+            questions[qid] = { type: 'noul', instructions, criteria: candidateCriteria(c) };
+            metas.push({ qid, slug: c.slug, instructions });
+        }
+        const result = await jevAsk({
+            state,
+            questions,
+            config: jevConfigOf(this.service.cfg),
+            lane: 'slowlane-rerank',
+            fallback: false,
+            // fallback stays FALSE here: jevAsk writes the row before the caller
+            // knows the outcome, so a constant true would poison the rollback-rate
+            // stat. Fail-open occurrence = outcome !== 'ok' (this lane's fallback
+            // to the legacy LLM rerank is deterministic per ADR 0018).
+        });
+        if (!result.ok)
+            return undefined;
+        const scored = [];
+        for (const m of metas) {
+            const probability = noulProbability(result.answers[m.qid]);
+            if (probability === undefined)
+                return undefined; // 坏答案 → fail-open (§1)
+            scored.push({ ...m, probability, band: jevBand(probability, 'rerank') });
+        }
+        const at = new Date().toISOString();
+        await logVerdicts(scored.map((m) => ({
+            at,
+            lane: 'slowlane-rerank',
+            questionId: m.qid,
+            qtype: 'noul',
+            ref: `slug:${m.slug}`,
+            digest: digestFor(state, m.qid, m.instructions),
+            probability: m.probability,
+            band: m.band,
+            agree: 'n/a',
+        })));
+        return scored
+            .filter((m) => m.band === 'adopt')
+            .sort((a, b) => b.probability - a.probability)
+            .slice(0, 2)
+            .map((m) => ({ slug: m.slug, why: `jev 判定相关（p=${m.probability.toFixed(2)}）` }));
+    }
     /**
      * Consumption point (the next spliced). Returns the pending exactly once
      * (消费即清) or an expiry reason; `turnId` is the CURRENT observer turn

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwayds/dsh-topics-memory",
-  "version": "0.18.2",
+  "version": "0.19.0",
   "description": "dsh-plugin: quality-first topic memory for dsh — a topic keeps the starting question, conclusion, impact and dependencies, not the process; local-first git-traced OKF bundle, budgeted LLM-free injection",
   "type": "module",
   "main": "lib/index.js",
@@ -42,7 +42,7 @@
     "build": "tsc -p tsconfig.json",
     "check": "tsc --noEmit -p tsconfig.json",
     "pretest": "tsc -p tsconfig.json",
-    "test": "node --test test/yaml.test.mjs test/okf.test.mjs test/retrieval.test.mjs test/digest.test.mjs test/ilog.test.mjs test/store.test.mjs test/paths.test.mjs test/git.test.mjs test/sync.test.mjs test/tools.test.mjs test/dedup.test.mjs test/commands.test.mjs test/onboard.test.mjs test/delegation.test.mjs test/observer.test.mjs test/distill.test.mjs test/consolidate.test.mjs test/viz.test.mjs test/corpus.test.mjs test/llm-scope.test.mjs test/quality.test.mjs test/replay-gate.test.mjs test/depends-repair.test.mjs test/skill.test.mjs test/fast-lane.test.mjs test/legacy-import.test.mjs",
+    "test": "node --test test/yaml.test.mjs test/okf.test.mjs test/retrieval.test.mjs test/digest.test.mjs test/ilog.test.mjs test/store.test.mjs test/paths.test.mjs test/git.test.mjs test/sync.test.mjs test/tools.test.mjs test/dedup.test.mjs test/commands.test.mjs test/onboard.test.mjs test/delegation.test.mjs test/observer.test.mjs test/distill.test.mjs test/consolidate.test.mjs test/viz.test.mjs test/corpus.test.mjs test/llm-scope.test.mjs test/quality.test.mjs test/replay-gate.test.mjs test/depends-repair.test.mjs test/skill.test.mjs test/fast-lane.test.mjs test/legacy-import.test.mjs test/jev-config.test.mjs test/jev-gate.test.mjs test/jev-client.test.mjs test/jev-log.test.mjs test/jev-fastgate.test.mjs",
     "smoke": "node scripts/smoke-boot.mjs"
   },
   "dependencies": {},

package/src/commands.ts

@@ -16,6 +16,7 @@ import type { ConsolidateResult } from './consolidate.ts'
 import { serializeTopicDoc, slugify, firstParagraph } from './okf.ts'
 import { buildGraph, renderGraphHtml } from './viz.ts'
 import { CONFIG_KEYS, displayKey, type ConfigKey, type TopicsConfigValue, parseConfigValue } from './config.ts'
+import { reloadSecrets } from './jev/gate.ts'
 import { aggregateStats } from './ilog.ts'
 import {
   askDistillSingle,
@@ -630,5 +631,6 @@ async function doSet(
   if (typeof parsed === 'object' && parsed !== null && 'error' in parsed) return fail(parsed.error)
   await mutate([{ op: 'set', path: [key], value: parsed }])
   if (key === 'repo' || key === 'autoInject') service.invalidate()
+  if (key === 'jevSecretFile') reloadSecrets(String(parsed)) // hot-swapped list: force re-read
   return ok(`✅ topics.${displayKey(key)} = ${String(parsed)}`)
 }

package/src/config.ts

@@ -74,6 +74,23 @@ export const TopicsConfig = z.object({
   usageBoost: z.number().default(0.15).volatile(),
   /** Debounced push delay in GitHub mode. */
   pushDebounceSeconds: z.number().default(45).volatile(),
+  /** System One decision-model integration (design 2026-09-25), default-off
+   *  master switch: false means zero behavior change anywhere (the fast lane
+   *  never calls out regardless — hard guard); the usage stats stop with it. */
+  jevEnabled: z.boolean().default(false).volatile(),
+  /** Decision backend: zen (free, opencode.ai) | native (typesafe
+   *  first-party) | openrouter (decisions protocol). */
+  jevBackend: z.string().default('zen').volatile(),
+  /** Pinned model id; '' = resolve the backend default at call time
+   *  (distillProvider sentinel pattern): jev-1.13-free / jev-1.13.0 /
+   *  typesafe/jev-1.13 — an upgrade is a deliberate act. */
+  jevModel: z.string().default('').volatile(),
+  /** Single-request timeout in ms; one AbortSignal, NO retry (the calling
+   *  lane's next cadence is the natural retry, fail-open hard-coded). */
+  jevTimeoutMs: z.number().default(3000).volatile(),
+  /** External secret list for the outbound secret gate (JEV_SECRET_FILE
+   *  semantics, design §3.3); swapping the path hot reloads the list. */
+  jevSecretFile: z.string().default('').volatile(),
 })
 
 export type TopicsConfigValue = {
@@ -103,6 +120,15 @@ export type TopicsConfigValue = {
   deprecatedTtlDays: number
   usageBoost: number
   pushDebounceSeconds: number
+  /** System One integration keys (design 2026-09-25 §4). Optional in this TS
+   *  view only: index.ts's bare-harness DEFAULTS literal predates them and
+   *  schemastery applies the runtime defaults on real hosts — consumers must
+   *  treat undefined as the documented default. */
+  jevEnabled?: boolean
+  jevBackend?: 'zen' | 'native' | 'openrouter'
+  jevModel?: string
+  jevTimeoutMs?: number
+  jevSecretFile?: string
 }
 
 export const CONFIG_KEYS = [
@@ -132,6 +158,11 @@ export const CONFIG_KEYS = [
   'deprecatedTtlDays',
   'usageBoost',
   'pushDebounceSeconds',
+  'jevEnabled',
+  'jevBackend',
+  'jevModel',
+  'jevTimeoutMs',
+  'jevSecretFile',
 ] as const
 
 export type ConfigKey = (typeof CONFIG_KEYS)[number]
@@ -155,11 +186,16 @@ export function parseConfigValue(key: ConfigKey, raw: string): boolean | number
     case 'suppressEcho':
     case 'autoObserve':
     case 'distillOnSessionEnd':
-    case 'includeSubagents': {
+    case 'includeSubagents':
+    case 'jevEnabled': {
       if (raw === 'on' || raw === 'true') return true
       if (raw === 'off' || raw === 'false') return false
       return { error: `${key} 取值 on|off` }
     }
+    case 'jevBackend': {
+      if (raw === 'zen' || raw === 'native' || raw === 'openrouter') return raw
+      return { error: 'jev-backend 取值 zen|native|openrouter' }
+    }
     case 'topK':
     case 'perTopicBudget':
     case 'totalBudget':
@@ -170,7 +206,8 @@ export function parseConfigValue(key: ConfigKey, raw: string): boolean | number
     case 'distillBatchSize':
     case 'distillMaxModelCalls':
     case 'deprecatedTtlDays':
-    case 'pushDebounceSeconds': {
+    case 'pushDebounceSeconds':
+    case 'jevTimeoutMs': {
       const n = Number(raw)
       if (!Number.isFinite(n) || n < 0 || !Number.isInteger(n)) return { error: `${key} 需要非负整数` }
       return n
@@ -196,6 +233,8 @@ export function parseConfigValue(key: ConfigKey, raw: string): boolean | number
     }
     case 'distillProvider':
     case 'distillModel':
+    case 'jevModel':
+    case 'jevSecretFile':
       return raw
   }
 }