I built jevx after one too many close calls watching AI coding agents confidently hallucinate terminal commands and immediately try to run them. The panic of rushing to hit Ctrl+C made me realize that letting the exact same AI generate a script and then authorize its own execution is a disaster waiting to happen. When a model is generating, it’s optimizing to finish the task, not to secure your machine. If you rely on an LLM to grant itself permissions via free-form text, a single hallucination bypasses your entire system prompt because there are no hard edges.

To fix this, I separated the concerns entirely: Codex generates, Jev evaluates, and Zig decides. Codex handles the creative coding, but before anything touches your system, Jev steps in strictly as a typed evaluator. It doesn't return text, only bounded signals like `choice`, `noul`, and `score`. Finally, the Zig CLI takes those signals and runs them through hard-coded, deterministic policy. An AI cannot sweet-talk a compiled threshold.

I’ll be upfront that this is an early release, and the platform binaries are currently OS-unsigned. The installer verifies SHA-256 and you can check GitHub provenance, but I know that adds friction. For the developers and security teams messing with agents right now, I'd love to know which part of this boundary you most want to inspect—the deterministic policy thresholds, the encrypted audit evidence, or the recovery states? I’m not looking for upvotes today. I want your most brutal, specific criticism. Tear the architecture apart and tell me exactly how you’d bypass the split between Jev and Codex.

Product: https://supratimsircar05.github.io/jev-zig-cli/

jevx

A typed decision layer for Codex, built in Zig

A typed decision layer for Codex, built in Zig