Pi Jev Auto Mode

Least privilege is reasonably designed: the gate covers only bash, write, and edit and distinguishes read-only operations, in-project writes, protected paths, and hard denials. It still permits high-impact commands without per-call confirmation when auto mode is enabled, so this scores 2. Confirmation is available through the ask setting and fails closed without a UI, but it is not the default path; moreover, the README says the uncertain band defaults to blocking while the test explicitly expects default allowance, limiting this to 1. Data-flow disclosure earns full marks because it identifies the TypeSafe endpoint, transmitted fields, exclusions, truncation, and context boundaries. Sensitive-data handling has tested redaction, no file-content transmission, key verification, and 0600 storage, but pattern-based redaction cannot cover every secret format and commands, paths, working directory, user messages, and policy notes still leave the machine, so it scores 2. Dependency security scores 1 because the runtime dependency set is small, but no lockfile, audit, immutable pinning, or vulnerability-response evidence is supplied. External effects are categorized, recorded, and escalated, yet the semantic engine can approve commands such as git reset --hard and matched scope bypasses judgment for unmatched calls, so this scores 2. Configuration can be disabled or cleared and thresholds reset, but completed shell and file effects have no transactional rollback, scoring 1. Attribution earns 3 because the README names the adapted project, Qwen Code influence, official SDK, and MIT basis, consistently with LICENSE and package metadata; publisher identity remains unknown as required.

The documentation, offline CI, and tests cover hard-deny precedence, missing credentials, timeouts, cancellation, thrown errors, and headless operation. However, a security-critical contradiction remains: the README says the uncertain band defaults to deny, while the extension test explicitly describes and asserts default allowance. Self-consistency therefore scores 1. Dependency availability scores 2 because Node and Pi requirements, optional peer dependencies, Jev early access, and no-key degradation are documented, but semantic decisions depend on a remote waitlisted service with no offline substitute. Failure messages score 3: tests show actionable distinctions for disconnection, timeout, cancellation, engine error, and user rejection, along with recorded sources and reasons.

Audience and scenarios score 3 because the material clearly targets Pi users and covers interactive development, CI, ordinary work, risky commands, inside/outside-project writes, and missing API credentials. Capability boundaries score 3 because covered tools, fast paths, hard rules, semantic escalation, outbound data, and undecidable states are explicit. Trigger precision scores 2: ordering and rules are extensively described and tested, but wildcard and shape matching can miss cases, safeCommands can outrank dangerous matches, and matched scope intentionally leaves unknown calls unjudged. Environment fit scores 2 due to global and trusted-project configuration, environment overrides, headless handling, and Linux/macOS CI, offset by the Node 22.19, Pi, and remote Jev requirements and absence of Windows evidence.

The README is well organized around installation, usage, tuning, configuration, data flow, release, development, and source responsibilities, so information architecture and installation notes score 3. Naming is generally coherent, but only one revision is available and the documented default uncertain policy conflicts with tests, so naming stability scores 2. Examples are extensive but there is no full FAQ, and referenced design, calibration, and detailed security documents are absent from the supplied evidence, yielding 2. Latency, early access, pattern limits, missing-key behavior, and some known risks are disclosed, but the disputed default weakens the limitations account, yielding 2. The complete MIT license matches metadata and scores 3. A release and Unreleased workflow plus version 0.4.1 are shown, but no CHANGELOG contents or tag history are supplied, so versioning scores 2. The author, repository, issue tracker, and private advisory path identify an update channel, but no team, response target, or maintenance commitment is shown and publisher identity is unverified, so maintenance responsibility scores 2.

Status indicators, commands, expandable decision records, probability tables, explicit block reasons, and live configuration make outputs directly usable, earning 3. The deterministic-plus-semantic gate adds clear value to a Pi environment described as lacking built-in permissions, with fail-closed handling and bounded disclosure, earning 3 for marginal value. Fast paths reduce cost and measured latency is disclosed, but the external early-access API adds delay and availability friction, ordinary work may be blocked, and the uncertain-default contradiction clouds the trade-off, so cost-benefit scores 2.

Many claims map to named components and supplied tests, including redaction, intent extraction, hard-deny precedence, failure handling, and records. However, the 171-test count, calibration probabilities, latency figures, and threshold basis rely on omitted material, while the uncertain-default claim conflicts with a test; claim traceability therefore scores 2. README, SECURITY.md, package metadata, CI, and tests corroborate several safety and installation claims, but implementation files, a lockfile, design/calibration/security detail, and the changelog are not supplied, so cross-source corroboration scores 2. The documentation often distinguishes measurements, configurable policy, and design claims and warns that thresholds are not truth, but the broad fail-closed/default-deny account is contradicted by the test and some measurements cannot be independently checked here, so fact/inference separation scores 2.