rsi/docs/02-jev-in-the-pi-harness.md

Jev in the pi (Oh My Pi) harness

Use cases for a decision model inside a coding-agent harness. Every claim below is grounded in the harness's own docs (omp://); Jev facts come from 01-what-is-jev.md. The mental filter for each idea: Jev answers bounded questions ("is this X?", "which bucket?", "how severe?") in ~100-500 ms for ~$0.0002. The harness's LLM does the thinking and the writing.

Where the harness can host a decision model

Surface	Mechanism	File location
Hooks / extensions	event bus with tool_call, tool_result, context, before_agent_start, session_* handlers	<cwd>/.omp/hooks/pre/*.ts, ~/.omp/agent/hooks/pre/*.ts
Custom tools	model-callable functions, Zod/arktype schemas	~/.omp/agent/tools, .omp/tools
Skills	SKILL.md capability packs	~/.omp/agent/skills/<name>/ (also managed-skills via autolearn.enabled)
Context files	AGENTS.md (user + project), RULES.md (sticky)	~/.omp/agent/AGENTS.md, .omp/AGENTS.md
System prompt	SYSTEM.md (replace), APPEND_SYSTEM.md (add), PERSONALITY.md	~/.omp/agent/...
Memory pipeline	two-phase extraction+consolidation over past sessions	memory.backend: local, phases run on default / smol model roles
Raw material	persisted sessions (JSONL), prompt history (SQLite FTS5)	~/.omp/agent/sessions/.../*.jsonl, ~/.omp/agent/history.db
Model routing	models.yml, roles (smol, tiny, task, advisor, ...)	~/.omp/agent/models.yml

Jev is not a model provider in models.yml — it cannot chat, stream, or hold a conversation, so it cannot be a session model. It plugs in through hooks, custom tools, and batch jobs (see 03-dreaming-with-jev.md).

Use cases, ranked by fit

1. Pre-flight tool guardrail (tool_call hook)

The documented hook example blocks bash commands containing rm -rf by string match. Jev upgrades this to a semantic risk gate: state = the command + cwd context; questions = Noul "destroys or exfiltrates data", Score "blast radius", Choice over {allow, confirm, block}. Confidence-gate it: auto-allow when safe > 0.9, ask the user in between, hard-block above a destruction threshold. Same shape applies to write/edit paths (protected files) and to bash chains that look innocent but end in a push.

Caveat: the model reads literally; keep the deterministic regex checks too — Jev is the fuzzy layer on top, not the replacement.

2. Prompt-injection screen on tool results (tool_result hook)

Web pages, issue bodies, and arbitrary repo files can contain text engineered to steer the agent. A tool_result handler can ask Jev: Noul "contains instructions attempting to steer the agent or exfiltrate secrets", and if it fires, annotate or redact the content before it enters context. Cost per screening ~$0.0002 — cheap enough to run on every external read. Note the docs' own warning cuts both ways: injection-shaped state can also move Jev's answer, so treat the verdict as a tripwire for human-visible annotation, not an autonomous veto.

3. Verification of agent output (the "verify everything" pattern)

An agent_end hook or a verify custom tool that scores the turn's outcome: Noul per acceptance criterion ("the reported fix actually reproduces-and-tests the changed path"), Score "evidence quality", Choice over {complete, partial, off-track}. This is the System One workflow shape TypeSafe built its evals around, and it plugs directly into the harness's verify-before- yield discipline: an independent cheap judge over the transcript before the turn is declared done.

4. Memory pipeline pre-filter (cheap Phase 1)

The local memory pipeline runs per-session extraction on the default-role model for every changed session (cap: 64 sessions/startup, 4k-token inputs). A Jev pre-pass over each session could ask: Noul "contains durable signal" (decisions, constraints, resolved failures), Score "density of signal", Noul "worth burning an LLM extraction on" — so the expensive extractor only runs on sessions Jev rates. At 64 sessions x ~4k tokens the LLM pass is a few cents; Jev's version is ~1% of that and ~100x faster, which is what makes scanning every session every cycle affordable instead of capped.

5. Task routing / cascade (which agent, which model)

The task tool takes an agent choice (scout / task / reviewer / security-reviewer) and workpool spreads items. A Jev front-end classifies each item: Choice over agent types, Score "difficulty", Noul "read-only research" — routing cheap items to scout, reserving expensive models. Same cascade logic TypeSafe demos on support tickets, applied to subagent spawn. This is advisory: a wrapper (custom tool or hook around task) makes the call; the harness still owns control flow.

6. Config-drift guard on self-edits

When an agent writes to AGENTS.md, RULES.md, or a skill (the dreaming pipeline in doc 03 does exactly this), a hook can gate the write: Noul "this change encodes a one-off incident as a permanent rule", Noul "this rule contradicts an existing rule in state". Cheap insurance against an agent slowly cluttering its own configuration — the failure mode auto-learn systems drift into.

7. Batch triage over history: the RSI dreaming loop

The biggest one gets its own document: replaying past sessions to mine improvement opportunities (new skills, AGENTS.md/RULES.md edits, system-prompt updates, new tools). Jev is what makes scanning all past interactions economical. See 03-dreaming-with-jev.md.

Not Jev-shaped (do not force it)

• Session titles, commit messages, summaries, compaction — these are string generation; the harness routes them to tiny/smol LLM roles for good reason. Jev has no decoder; it cannot write them.
• Code generation, refactors, reviews that need new text — bounded-output scoring can rank candidates but cannot produce them.
• Anything needing knowledge outside the state you send — Jev has no world knowledge beyond state; no lookups. Retrieve first, judge second.
• Image/screens understanding — text-only state (as of Jev 1.13).

Honest limits before betting on any of this

• Early access product; jev-latest currently resolves to jev-1.13.0 and moving GPU capacity means rate limits (250k tok/s, 1200 req/min) and behavior can shift. Pin the version and log the response's model field.
• All performance numbers are TypeSafe's own, launch-week, unreproduced.
• Calibration ≠ correctness: validate every threshold against local outcomes before letting it act autonomously.
• State ceiling: 64k tokens per call. Whole sessions don't fit; segment first (doc 03 does).