jevg 0.3.0__tar.gz

jevg-0.3.0/.github/ISSUE_TEMPLATE/false-positive.md

@@ -0,0 +1,14 @@
+---
+name: False positive
+about: jev-guard flagged safe code
+labels: false-positive
+---
+
+**Rule:** JG0__
+**Minimal code that triggers it:**
+
+```python
+# paste the smallest snippet that reproduces
+```
+
+**Why it's safe:**

jevg-0.3.0/.github/ISSUE_TEMPLATE/new-rule.md

@@ -0,0 +1,16 @@
+---
+name: New rule / guardrail failure
+about: Propose a detection, ideally backed by a measured Jev failure
+labels: rule
+---
+
+**The failure mode:**
+
+**Evidence (if measured):** state / config / decision / confidence
+
+**Suggested severity:**
+
+**Code pattern to detect:**
+
+```python
+```

jevg-0.3.0/.github/workflows/ci.yml

@@ -0,0 +1,20 @@
+name: ci
+on:
+  push:
+    branches: [main]
+  pull_request:
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v3
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: uv venv
+      - run: uv pip install -e ".[dev]"
+      - run: uv run ruff check .
+      - run: uv run pytest -q

jevg-0.3.0/.github/workflows/release.yml

@@ -0,0 +1,19 @@
+name: release
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+jobs:
+  pypi:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write            # trusted publishing; no API token needed
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v3
+        with:
+          python-version: "3.12"
+      - run: uv build
+      - run: uvx twine check dist/*
+      - uses: pypa/gh-action-pypi-publish@release/v1

jevg-0.3.0/.gitignore

@@ -0,0 +1,11 @@
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+*.egg-info/
+dist/
+build/
+.pytest_cache/
+.ruff_cache/
+.DS_Store
+.env

jevg-0.3.0/.jev-guard.toml.example

@@ -0,0 +1,11 @@
+# Copy to .jev-guard.toml at your repo root.
+[jev-guard]
+disable = []
+
+[jev-guard.severity]
+# JG004 = "HIGH"
+
+[jev-guard.extra]
+dangerous_tools = []
+import_roots = []
+guardrail_calls = []

jevg-0.3.0/.pre-commit-hooks.yaml

@@ -0,0 +1,8 @@
+- id: jev-guard
+  name: jev-guard
+  description: Audit Jev / TypeSafe guardrail usage.
+  entry: jev-guard scan
+  language: python
+  types: [python]
+  pass_filenames: false
+  args: ["."]

jevg-0.3.0/CHANGELOG.md

@@ -0,0 +1,45 @@
+# Changelog
+
+All notable changes to jev-guard are documented here. Versioning is semver.
+
+## [0.3.0] - 2026-09-22
+
+### Added
+- **Published to PyPI as `jevg`** (`pip install jevg`; the CLI command is
+  `jev-guard`, with `jevg` as an alias). The GitHub repo stays `jev-guard`.
+
+
+### Added
+- **SARIF output** (`--format sarif`) for GitHub code-scanning / the Security tab.
+- **`--output/-o`** to write a report to a file.
+- **Composite GitHub Action** (`ppradyoth/jev-guard@v0.3.0`) and a **pre-commit
+  hook** (`.pre-commit-hooks.yaml`) for one-line CI/local adoption.
+- `--version` flag.
+- Contributor docs: `CONTRIBUTING.md`, `docs/adding-a-rule.md`, issue templates.
+- Example consumer workflow that uploads SARIF to code scanning.
+
+### Note
+- Generalization beyond Jev is via `.jev-guard.toml` (`extra.import_roots`,
+  `extra.guardrail_calls`, `extra.dangerous_tools`) — point jev-guard at any
+  System One-style guardrail without a code change.
+
+## [0.2.0] - 2026-09-22
+
+### Added
+- Name-based **taint tracking** with fixed-point propagation: dangerous tools
+  and untrusted `state` are now caught through variable assignments and chains,
+  not just at the literal call site (JG002, JG004).
+- **JG006** — guardrail threshold set in an unsafe band (blocks only on
+  near-certain danger, or almost never escalates).
+- **JG007** — untrusted content interpolated into a question's `instructions`.
+- **`.jev-guard.toml`** config: disable rules, override severities, and extend
+  the dangerous-tool / import-root / guardrail-call sets. Discovered by walking
+  up from the scan path.
+- **Inline suppression**: `# jev-guard: ignore` (all) or `# jev-guard: ignore JG001,JG004`.
+- Findings are de-duplicated by (rule, line).
+
+## [0.1.0] - 2026-09-21
+
+### Added
+- Initial release: JG001–JG005, AST scanner, `scan`/`rules` CLI, text/JSON
+  output, CI gate via `--fail-on`, tests, docs, MIT license.

jevg-0.3.0/CONTRIBUTING.md

@@ -0,0 +1,36 @@
+# Contributing to jev-guard
+
+Thanks for helping map how Jev-based guardrails fail. This is a young tool for a
+young model class; rules will change as the real failure modes get measured.
+
+## Setup
+
+```bash
+git clone https://github.com/ppradyoth/jev-guard && cd jev-guard
+uv venv && . .venv/bin/activate
+uv pip install -e ".[dev]"
+pytest -q && ruff check .
+```
+
+## Ground rules
+
+- **Every rule ships with fixtures.** A vulnerable fixture that triggers it and a
+  safe fixture that must not. No fixture, no merge.
+- **Prefer evidence over intuition.** If a rule is motivated by an observed Jev
+  failure, link it. If it's a pattern heuristic, say so in the rule's remediation
+  text — we are honest about what is measured vs. reasoned.
+- **No false-positive land mines.** A rule that fires on idiomatic safe code is
+  worse than no rule; people stop trusting the whole tool.
+- Keep the scanner offline. jev-guard never calls the model or the network.
+- Match the existing style: `ruff` clean, no comments unless the *why* is
+  non-obvious.
+
+## Adding a rule
+
+See [`docs/adding-a-rule.md`](docs/adding-a-rule.md) for the step-by-step.
+
+## Reporting a Jev guardrail failure you measured
+
+Open an issue with the empirical evidence (state, config, decision, confidence).
+Measured failures are how we grow the ruleset — they're the most valuable
+contribution you can make.

jevg-0.3.0/GUIDE.md

@@ -0,0 +1,84 @@
+# jev-guard: usage guide
+
+A practical guide to what this tool is for, when it helps, when it doesn't, what to use instead, and how much to trust it.
+
+## The one idea
+
+Jev's headline safety property is that it **cannot hallucinate and cannot emit a type error**. Both are true and both are about *structure*. Neither says the answer is *right*.
+
+A guardrail's job is to be right about "is this action dangerous?" A type-safe wrong answer is still a wrong answer — and because it's well-formed, your code will act on it without hesitation. The failure is quieter than an LLM going off the rails, which makes it more dangerous in a system with latency guarantees or buried several layers deep.
+
+`jev-guard` finds the places in your code where a well-formed-but-possibly-wrong decision is trusted more than it should be.
+
+## When to use it
+
+- You use `langchain_typesafe`, `AutoModeMiddleware`, or `TypeSafeClassifier` anywhere a decision leads to an action — routing, tool gating, auto-approval, content moderation.
+- A Jev decision sits on the path to something irreversible: shell, SQL, HTTP, money movement, sending mail, writing files.
+- You're adding Jev to an agent and want a checklist before it ships.
+- You want a cheap CI gate that fails the build when someone wires a dangerous tool behind a default-threshold guardrail.
+- You're reviewing someone else's agent and want a fast map of where the trust boundaries are.
+
+## When NOT to use it
+
+- **You want proof you're exploitable.** This tool points at code smells. It does not run the model or demonstrate a bypass. Use a live probe harness for that (see below).
+- **You want to measure Jev's actual calibration.** That needs a labeled adversarial dataset and real API calls, not static analysis.
+- **Your guardrail isn't in Python**, or is assembled dynamically / behind heavy abstraction. AST matching will miss it. A miss here is not a clean bill of health.
+- **You're using Jev for non-safety classification** (analytics, feature extraction, map-reduce over data) where a wrong answer is a data-quality issue, not a security event. jev-guard's severities assume a security context; here they'll over-alarm.
+- **As your only control.** A linter is a smoke detector, not a sprinkler. Passing jev-guard means "no obvious footguns," not "safe."
+
+## How to read the findings
+
+- **JG002 (CRITICAL)** — a dangerous tool with no guardrail at all. Fix first; this is the unguarded case.
+- **JG001 (HIGH)** — a guardrail exists but blocks on the model's default decision with no threshold. Set an explicit block threshold *and* an escalate-below-confidence path.
+- **JG003 (MEDIUM)** — you're acting on the point estimate and throwing away the confidence, which is the entire reason to use Jev over a coin flip. Gate the branch on confidence.
+- **JG004 (MEDIUM)** — untrusted text flows into `state`. If content in `state` can override the question `instructions`, the guardrail is injectable by the input it's inspecting. Keep untrusted state structurally separate and sanitized.
+- **JG005 (INFO)** — informational marker that a security decision runs through Jev. Not a defect; a prompt to validate thresholds on *your* adversarial workload, because the published evals are self-graded on non-adversarial distributions.
+
+## Fixing the common case
+
+The default `AutoModeMiddleware(tools=["bash"])` (JG001) becomes defensible when you make the decision boundary explicit and add an escalation path for low confidence:
+
+```python
+guardrail = AutoModeMiddleware(
+    tools=["bash"],
+    block_threshold=0.2,       # block generously; err toward blocking
+    escalate_below=0.85,       # low confidence -> human, not silent allow
+)
+```
+
+And consume decisions with the confidence, not without it:
+
+```python
+decision = resp.nouls["danger"]
+if decision.confidence < 0.85:
+    return escalate_to_human()
+return "block" if decision.noul > 0.2 else "allow"
+```
+
+## Alternatives and complements
+
+`jev-guard` is a narrow static linter. Reach for these depending on what you actually need:
+
+| Need | Use |
+|------|-----|
+| Prove a specific bypass exists | A live probe harness: send known-dangerous states through your real guardrail config and measure block rate. jev-guard tells you where; this tells you whether. |
+| Measure calibration under attack | A labeled adversarial dataset + reliability diagram (clean vs. adversarial). This is research, not linting. |
+| General agent/tool security review | OWASP Top 10 for Agentic Applications, MAESTRO threat modeling, or a manual review of the whole trust boundary — not just the Jev call. |
+| Prompt-injection coverage for an LLM in the loop | A dedicated injection test suite. jev-guard only checks the *guardrail's* input surface (JG004), not the primary model's. |
+| Broad Python security patterns | Semgrep / CodeQL. jev-guard is Jev-specific and deliberately shallow; general SAST catches the rest. |
+| Runtime enforcement | jev-guard is build-time only. Pair it with a runtime allow/deny layer that doesn't depend on a probabilistic classifier for hard-stop actions. |
+
+A defensible design uses Jev for *soft* routing and triage, and keeps a deterministic, non-probabilistic hard stop in front of anything irreversible. jev-guard is one check in that stack, not the stack.
+
+## Self-assessment: how much to trust this tool
+
+Honest limitations, so you calibrate your own confidence in *it*:
+
+- **It's heuristic, not sound.** It matches names and shapes in the AST. Rename a variable or wrap the call and it goes blind. Absence of findings is not evidence of safety.
+- **It can raise false positives.** JG004 keys off variable names that *look* untrusted (`user_`, `message`, `payload`). A safe file that happens to use those names will alarm. Read every finding; don't auto-fail blindly on MEDIUM.
+- **It can raise false negatives.** Dynamic construction, indirection, non-literal tool lists, config-driven wiring, and any non-Python guardrail are invisible to it.
+- **The rules encode a point of view, not a standard.** There is no published secure-usage spec for Jev yet — it's a week old. These rules are one security engineer's reading of two blog posts and the documented API, and they will change as the real failure modes get mapped.
+- **The severities assume a security context.** In a non-safety use of Jev, they over-state risk.
+- **It does not touch the model.** Every claim about calibration and hallucination in this repo is reasoning about the vendor's own marketing, not independent measurement. Treat it as a hypothesis to test, not a result.
+
+Use it as a fast first pass and a CI tripwire. Do not use it as the thing that lets you sign off.

jevg-0.3.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pradyoth P.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

jevg-0.3.0/PKG-INFO

@@ -0,0 +1,149 @@
+Metadata-Version: 2.5
+Name: jevg
+Version: 0.3.0
+Summary: Static auditor for code that uses Jev / TypeSafe System One models as a security guardrail.
+Project-URL: Homepage, https://github.com/ppradyoth/jev-guard
+Project-URL: Issues, https://github.com/ppradyoth/jev-guard/issues
+Author: Pradyoth P.
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ai-security,guardrail,jev,llm,red-team,static-analysis,typesafe
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Requires-Dist: tomli>=2.0; python_version < '3.11'
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# jev-guard
+
+[![ci](https://github.com/ppradyoth/jev-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/ppradyoth/jev-guard/actions/workflows/ci.yml) [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) ![python](https://img.shields.io/badge/python-3.10%2B-blue)
+
+**A static code scanner (SAST-style linter).** It reads your Python source and flags insecure usage of [Jev / TypeSafe "System One" models](https://typesafe.ai) when they're used as a security guardrail.
+
+> jev-guard is **not** a guardrail and it does **not** run at runtime, call the model, or touch the network. It is a build-time analysis tool — think `ruff`/`bandit`, scoped to Jev guardrail patterns. It tells you where your guardrail *code* is misconfigured; it does not do any guarding itself.
+
+**Thesis: type-safe is not the same as correct.** Jev can't emit a type error and it can't hallucinate a field — but "no hallucination" is a guarantee about *shape*, not about *truth*. A guardrail that returns a confidently wrong `noul: 0.02` for a `rm -rf /` still lets the call through. If you gate `bash` on that number, the type safety bought you nothing.
+
+`jev-guard` scans your code for the ways a Jev-based guardrail fails open. It runs entirely offline — it reads your source, not the model — so it needs no API key and costs nothing.
+
+## Why this exists
+
+Two things shipped in September 2026:
+
+- TypeSafe released **Jev**, marketed for "score, judge, verify, guardrail, and detect jailbreaks."
+- LangChain shipped **`AutoModeMiddleware`**, which uses Jev to classify tool calls as dangerous and block them before they run — the classifier pattern that used to live inside the closed-source parts of Claude Code / Codex / Cursor, now open to every agent.
+
+The documented example is literally `AutoModeMiddleware(tools=["bash"])` — a shell gate with **no threshold set**, relying on the model's default point decision. That is the exact shape `jev-guard` was built to catch.
+
+## Install
+
+```bash
+pip install jevg           # PyPI package name (the CLI command is still `jev-guard`)
+# or, from source:
+git clone https://github.com/ppradyoth/jev-guard && cd jev-guard
+pip install -e .
+```
+
+## Use
+
+```bash
+jev-guard scan path/to/agent.py        # scan a file
+jev-guard scan src/                     # scan a tree
+jev-guard scan src/ --format json       # machine-readable
+jev-guard scan src/ --fail-on HIGH      # CI gate (default): exit 1 on HIGH+
+jev-guard rules                         # list what it checks
+```
+
+Exit code is non-zero when any finding is at or above `--fail-on`, so it drops straight into CI:
+
+```yaml
+- run: jev-guard scan src/ --fail-on HIGH
+```
+
+## In CI (GitHub Action)
+
+```yaml
+- uses: ppradyoth/jev-guard@v0.3.0
+  with:
+    path: src/
+    fail-on: HIGH
+```
+
+Surface findings in the **Security** tab by emitting SARIF and uploading it —
+see [`examples/github-workflow.yml`](examples/github-workflow.yml).
+
+## Pre-commit
+
+```yaml
+repos:
+  - repo: https://github.com/ppradyoth/jev-guard
+    rev: v0.3.0
+    hooks:
+      - id: jev-guard
+```
+
+## What it flags
+
+| Code  | Severity | What |
+|-------|----------|------|
+| JG001 | HIGH     | Jev guardrail gates actions with no configured confidence threshold (blocks on the model default). |
+| JG002 | CRITICAL | A dangerous tool (`bash`/`sql`/`http`/...) is wired into an agent with no `AutoModeMiddleware` present. |
+| JG003 | MEDIUM   | A `.noul`/`.choice`/`.score` decision is used to branch without ever reading a confidence field. |
+| JG004 | MEDIUM   | Attacker-influenceable content flows straight into a guardrail's `state` (injection surface). |
+| JG005 | INFO     | Jev is being used as a security control — reminder to validate thresholds against your own adversarial data. |
+| JG006 | MEDIUM   | Threshold set in an unsafe band (blocks only near-certain danger / almost never escalates). |
+| JG007 | HIGH     | Untrusted content interpolated into a question's `instructions` — the inspected text can rewrite the question. |
+
+Full rationale and remediation for each: [`GUIDE.md`](GUIDE.md).
+
+## Example
+
+```
+$ jev-guard scan examples/vulnerable_agent.py
+examples/vulnerable_agent.py:5  [HIGH] JG001  Jev guardrail gates actions with no configured confidence threshold
+    ↳ Set an explicit threshold and escalate below it.
+examples/vulnerable_agent.py:11 [MEDIUM] JG004  Untrusted content flows into a Jev guardrail's state
+    ↳ Separate and sanitize untrusted state.
+...
+```
+
+## Configuration
+
+Drop a `.jev-guard.toml` at your repo root (jev-guard walks up to find it):
+
+```toml
+[jev-guard]
+disable = ["JG005"]            # rules to silence entirely
+
+[jev-guard.severity]
+JG004 = "HIGH"                 # bump a rule's severity
+
+[jev-guard.extra]
+dangerous_tools = ["wire_transfer", "post_tweet"]   # your own high-impact tools
+import_roots    = ["my_typesafe_wrapper"]           # if you wrap the SDK
+guardrail_calls = ["MyGuardrail"]                   # your own guardrail factory
+```
+
+Silence a single line inline:
+
+```python
+guardrail = AutoModeMiddleware(tools=["bash"])  # jev-guard: ignore JG001
+another = AutoModeMiddleware(tools=["bash"])     # jev-guard: ignore
+```
+
+jev-guard follows assignments, so indirection is caught — `tools = ["bash"]; create_agent(tools=tools)` and `s = user_msg; classifier.invoke({"state": s})` both flag.
+
+## Scope and honesty
+
+This is a **heuristic linter, not a prover.** It reads Python, matches the LangChain `langchain_typesafe` surface, and reasons about obvious patterns. It will miss guardrails assembled dynamically, wrapped in your own abstractions, or written in another language, and it can raise false positives on safe code that names a variable `user_config`. It does not test the model, measure real calibration, or prove exploitability. It tells you *where to look*, not *that you're owned*.
+
+For what it can and can't do, and when to reach for something else, read [`GUIDE.md`](GUIDE.md).
+
+## License
+
+MIT. Not affiliated with TypeSafe AI or LangChain.

jevg-0.3.0/README.md

@@ -0,0 +1,128 @@
+# jev-guard
+
+[![ci](https://github.com/ppradyoth/jev-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/ppradyoth/jev-guard/actions/workflows/ci.yml) [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) ![python](https://img.shields.io/badge/python-3.10%2B-blue)
+
+**A static code scanner (SAST-style linter).** It reads your Python source and flags insecure usage of [Jev / TypeSafe "System One" models](https://typesafe.ai) when they're used as a security guardrail.
+
+> jev-guard is **not** a guardrail and it does **not** run at runtime, call the model, or touch the network. It is a build-time analysis tool — think `ruff`/`bandit`, scoped to Jev guardrail patterns. It tells you where your guardrail *code* is misconfigured; it does not do any guarding itself.
+
+**Thesis: type-safe is not the same as correct.** Jev can't emit a type error and it can't hallucinate a field — but "no hallucination" is a guarantee about *shape*, not about *truth*. A guardrail that returns a confidently wrong `noul: 0.02` for a `rm -rf /` still lets the call through. If you gate `bash` on that number, the type safety bought you nothing.
+
+`jev-guard` scans your code for the ways a Jev-based guardrail fails open. It runs entirely offline — it reads your source, not the model — so it needs no API key and costs nothing.
+
+## Why this exists
+
+Two things shipped in September 2026:
+
+- TypeSafe released **Jev**, marketed for "score, judge, verify, guardrail, and detect jailbreaks."
+- LangChain shipped **`AutoModeMiddleware`**, which uses Jev to classify tool calls as dangerous and block them before they run — the classifier pattern that used to live inside the closed-source parts of Claude Code / Codex / Cursor, now open to every agent.
+
+The documented example is literally `AutoModeMiddleware(tools=["bash"])` — a shell gate with **no threshold set**, relying on the model's default point decision. That is the exact shape `jev-guard` was built to catch.
+
+## Install
+
+```bash
+pip install jevg           # PyPI package name (the CLI command is still `jev-guard`)
+# or, from source:
+git clone https://github.com/ppradyoth/jev-guard && cd jev-guard
+pip install -e .
+```
+
+## Use
+
+```bash
+jev-guard scan path/to/agent.py        # scan a file
+jev-guard scan src/                     # scan a tree
+jev-guard scan src/ --format json       # machine-readable
+jev-guard scan src/ --fail-on HIGH      # CI gate (default): exit 1 on HIGH+
+jev-guard rules                         # list what it checks
+```
+
+Exit code is non-zero when any finding is at or above `--fail-on`, so it drops straight into CI:
+
+```yaml
+- run: jev-guard scan src/ --fail-on HIGH
+```
+
+## In CI (GitHub Action)
+
+```yaml
+- uses: ppradyoth/jev-guard@v0.3.0
+  with:
+    path: src/
+    fail-on: HIGH
+```
+
+Surface findings in the **Security** tab by emitting SARIF and uploading it —
+see [`examples/github-workflow.yml`](examples/github-workflow.yml).
+
+## Pre-commit
+
+```yaml
+repos:
+  - repo: https://github.com/ppradyoth/jev-guard
+    rev: v0.3.0
+    hooks:
+      - id: jev-guard
+```
+
+## What it flags
+
+| Code  | Severity | What |
+|-------|----------|------|
+| JG001 | HIGH     | Jev guardrail gates actions with no configured confidence threshold (blocks on the model default). |
+| JG002 | CRITICAL | A dangerous tool (`bash`/`sql`/`http`/...) is wired into an agent with no `AutoModeMiddleware` present. |
+| JG003 | MEDIUM   | A `.noul`/`.choice`/`.score` decision is used to branch without ever reading a confidence field. |
+| JG004 | MEDIUM   | Attacker-influenceable content flows straight into a guardrail's `state` (injection surface). |
+| JG005 | INFO     | Jev is being used as a security control — reminder to validate thresholds against your own adversarial data. |
+| JG006 | MEDIUM   | Threshold set in an unsafe band (blocks only near-certain danger / almost never escalates). |
+| JG007 | HIGH     | Untrusted content interpolated into a question's `instructions` — the inspected text can rewrite the question. |
+
+Full rationale and remediation for each: [`GUIDE.md`](GUIDE.md).
+
+## Example
+
+```
+$ jev-guard scan examples/vulnerable_agent.py
+examples/vulnerable_agent.py:5  [HIGH] JG001  Jev guardrail gates actions with no configured confidence threshold
+    ↳ Set an explicit threshold and escalate below it.
+examples/vulnerable_agent.py:11 [MEDIUM] JG004  Untrusted content flows into a Jev guardrail's state
+    ↳ Separate and sanitize untrusted state.
+...
+```
+
+## Configuration
+
+Drop a `.jev-guard.toml` at your repo root (jev-guard walks up to find it):
+
+```toml
+[jev-guard]
+disable = ["JG005"]            # rules to silence entirely
+
+[jev-guard.severity]
+JG004 = "HIGH"                 # bump a rule's severity
+
+[jev-guard.extra]
+dangerous_tools = ["wire_transfer", "post_tweet"]   # your own high-impact tools
+import_roots    = ["my_typesafe_wrapper"]           # if you wrap the SDK
+guardrail_calls = ["MyGuardrail"]                   # your own guardrail factory
+```
+
+Silence a single line inline:
+
+```python
+guardrail = AutoModeMiddleware(tools=["bash"])  # jev-guard: ignore JG001
+another = AutoModeMiddleware(tools=["bash"])     # jev-guard: ignore
+```
+
+jev-guard follows assignments, so indirection is caught — `tools = ["bash"]; create_agent(tools=tools)` and `s = user_msg; classifier.invoke({"state": s})` both flag.
+
+## Scope and honesty
+
+This is a **heuristic linter, not a prover.** It reads Python, matches the LangChain `langchain_typesafe` surface, and reasons about obvious patterns. It will miss guardrails assembled dynamically, wrapped in your own abstractions, or written in another language, and it can raise false positives on safe code that names a variable `user_config`. It does not test the model, measure real calibration, or prove exploitability. It tells you *where to look*, not *that you're owned*.
+
+For what it can and can't do, and when to reach for something else, read [`GUIDE.md`](GUIDE.md).
+
+## License
+
+MIT. Not affiliated with TypeSafe AI or LangChain.

jevg-0.3.0/RELEASING.md

@@ -0,0 +1,31 @@
+# Releasing jev-guard
+
+Publishing is automated via **PyPI Trusted Publishing** — no API token is ever
+stored in the repo or entered by hand. GitHub authenticates to PyPI over OIDC.
+
+## One-time setup (maintainer, ~2 min)
+
+1. Create the project on PyPI (or reserve the name) at https://pypi.org.
+2. On PyPI → the `jev-guard` project → **Publishing** → add a trusted publisher:
+   - Owner: `ppradyoth`
+   - Repository: `jev-guard`
+   - Workflow: `release.yml`
+   - Environment: `pypi`
+3. In the GitHub repo → Settings → Environments → create an environment named
+   `pypi` (optionally add a required reviewer for a manual gate).
+
+## Cutting a release
+
+1. Bump the version in `pyproject.toml` and `src/jev_guard/__init__.py`, and add
+   a `CHANGELOG.md` entry. Commit.
+2. Tag and push: `git tag -a vX.Y.Z -m vX.Y.Z && git push origin main --tags`.
+3. Create the GitHub Release for that tag (`gh release create vX.Y.Z --latest ...`).
+   Publishing the release triggers `release.yml`, which builds, `twine check`s,
+   and uploads to PyPI.
+4. Verify: `pipx run jev-guard==X.Y.Z --version`.
+
+## Local build (for inspection only)
+
+```bash
+uv build && uvx twine check dist/*
+```

jevg-0.3.0/action.yml

@@ -0,0 +1,31 @@
+name: jev-guard
+description: Audit code that uses Jev / TypeSafe System One models as a security guardrail.
+branding:
+  icon: shield
+  color: red
+inputs:
+  path:
+    description: File or directory to scan.
+    required: false
+    default: "."
+  fail-on:
+    description: Exit non-zero when a finding is at or above this severity.
+    required: false
+    default: "HIGH"
+  format:
+    description: "Output format: text, json, or sarif."
+    required: false
+    default: "text"
+  output:
+    description: Optional file to write the report to (e.g. results.sarif).
+    required: false
+    default: ""
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        python -m pip install --quiet "jevg==0.3.0"
+        args=(scan "${{ inputs.path }}" --fail-on "${{ inputs.fail-on }}" --format "${{ inputs.format }}")
+        if [ -n "${{ inputs.output }}" ]; then args+=(--output "${{ inputs.output }}"); fi
+        jev-guard "${args[@]}"