dsh-jev

dsh-jev

> [!WARNING]

> Development of dsh-jev has been discontinued (October 2026).

> There will be no further releases of @buberlo/dsh-jev or @buberlo/jev-core;

> 0.1.4 is the last version. The code was only ever tested against

> DeepSeek Harness 0.1.6-alpha.x (verified on 0.1.6-alpha.2) and may not work

> with newer DSH releases. Issues and pull requests will no longer be worked on.

>

> **For Jev in DeepSeek Harness or any MCP host, please use

> [jevcore](https://github.com/PerryLink/jevcore) by PerryLink.** It is maintained,

> more widely used, offline by default, and Apache-2.0 licensed:

> jevcore (harness-independent core), jevcore-dsh (DSH plugin) and

> jevcore-mcp (MCP stdio server).

Ideas others are welcome to adopt

This repository stays available under the MIT licence. If any of these ideas are

useful to you, please take them — in jevcore or anywhere else:

• Monotone permission narrowing. Jev may only restrict, never widen:

tool selection intersects with existing restrictions, and call assessments

compose as deny > hold > ask > allow after calling next(), so later

policies are never skipped. Errors, timeouts and stale snapshots fail closed

(ask/hold, never allow).

See [docs/policy.md](docs/policy.md).

• Shadow mode and an offline mock as the default. provider: mock +

mode: shadow logs decisions without changing behaviour, so operators can

observe before enforcing.

• Measured benchmarks and regression sets. Versioned evaluation fixtures,

an on-prem support assessment regression set, and with/without-Jev

benchmarks (e.g. a protected audit trail blocked in 10/10 runs) with method

and limits documented in [docs/benchmark.md](docs/benchmark.md) and

[docs/evaluation.md](docs/evaluation.md).

Thank you

Thanks to everyone who tried dsh-jev, reported problems, or contributed —

in particular [@Daltonganger](https://github.com/Daltonganger) and

[@autox-my](https://github.com/autox-my) for their pull requests — and to

PerryLink for building and maintaining jevcore.

---

The original README follows for reference.

The Jev decision layer for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH).

DSH runs the agent. [TypeSafe Jev](https://docs.typesafe.ai/) makes the small,

fast decisions. Your code decides what the answers mean.

Watch the 66-second Kubernetes troubleshooting demo: healthy pods, broken connections after a

rollout. The agent traces Ingress → Service → pods and repairs the network path.

Jev's site policy gates a broad “allow all traffic” shortcut, so the portal can

recover while PostgreSQL stays isolated. The same freshly recorded model calls

run through both harnesses against a real, disposable Kubernetes cluster, with

live Jev assessments. Clearly labeled replay with neural narration; no live

replanning in this comparison.

[Video](docs/assets/kubernetes-comparison.mp4) · [Captions](docs/assets/kubernetes-comparison.srt) ·

[Method, all runs and limits](docs/benchmark.md#kubernetes-networking-support-2026-09-21).

The replay also shows one harmless reset being blocked—a documented false positive.

   user task
       │
       ▼
 ┌───────────────────────────────────────────────────────────┐
 │  DeepSeek Harness agent loop                              │
 │  planning · tools · execution · sessions                  │
 │                                                           │
 │   pre-step ──▶ Jev: which tools are relevant?   → restrict│
 │   tool call ──▶ Jev: is this call safe to run?  → ask/hold│