Rate pending shell commands on a color-coded safety rubric

01 · Role in the system

What Jev does here

Running with the opt-in advise and assisted-shell features, kamchatka sends every shell call its standing rules were already going to allow to Jev as a fitted state, together with the three rubric levels. Jev answers one score locating the command on the rubric plus a confidence from 0 to 1. Code maps the score to the nearest band, never to a safer one, and a low-confidence answer is drawn at least yellow, with the confidence printed beside the band so a person can tell whether a line is yellow because the command changes something or because nobody could tell. The rating exists for the person at the keys: it is never returned to the model, while the sibling verdict question is folded in strictest-wins so the advisor can only tighten a decision.

A rubric of outcomes, not adjectives

The three levels are written as what a command does - it only looks; it changes something that could be put back; it destroys something that cannot be got back, or sends something off the machine - rather than as safe or unsafe. The source comments give the reason: a rubric of adjectives is answered from how a command feels, while a rubric of outcomes is answered from what the command says. The bands are ordered and deliberately only three, because the question a color answers is coarse, and the three map onto the green, yellow, and red a terminal has had since before anyone had to be told what they meant.

The rating enum is owned by the module that asks the question, not by the screen that draws it. The comment is explicit about why: a color worked out at the other end from a number it does not own is a second opinion about what a rating means, and the two drift the first time the rubric is reworded. The UI maps the band to a color and to nothing else, so the words and the color cannot disagree.

Uncertainty never rounds down to green

A score lands on the nearest band, but the confidence is kept apart and drawn beside it, because a command the advisor could not place is a different thing from one it placed low. Below a certainty threshold an answer is never drawn on a safer band than it scored - an uncertain reads-and-reports is shown as changes-something - and the code comments the principle: a spread distribution over a safety rubric is not evidence that a command is safe, and green is the one color that would say it was.

The rating is also not a verdict. It lives in its own queue, never reaches the verdict fold, and is never shown to the model; it exists for the person deciding the permission prompt. In the sibling verdict path the advisor's opinion is folded in strictest-wins, so a second opinion can tighten a decision but never loosen one.

Opt-in because the question leaves the machine

Neither feature is in the default build, and the reason is written into the Cargo manifest: advise is the one thing in the program that sends a tool's arguments to a third party - which for a write is the text being written - and that is a decision somebody has to make rather than inherit from a build. A session asked for with --advise that cannot reach the advisor is refused outright instead of quietly running with its permissions decided by heuristics alone.

Those two choices make the integration easy to evaluate honestly. The privacy boundary is a compile-time feature and a command-line flag rather than a buried settings toggle, and the failure mode is fail-closed. It also bounds the claim: for callers who never opted in, the colored rubric simply is not there, and the standing rules decide alone.

02 · Control boundary

Where Jev sits

Standing rules decide first; only calls they would allow reach Jev as a fitted state with an ordered three-level rubric; one score-plus-confidence answer comes back, and deterministic code owns band mapping, conservative rounding, and rendering.

Code owns the loop, permissions, thresholds, validation, and side effects. Jev owns only the bounded judgments described above.

03 · Known limits

What this evidence does not prove

• The rubric rating is display-only for the human at the prompt; it is never returned to the model and cannot by itself allow or refuse a call.
• Opt-in twice over: the advise and assisted-shell features must be compiled in and the session started with --advise, or no rating is drawn.
• Ratings are model judgments of command text, not a sandbox; the standing rules decide first and the advisor can only tighten a verdict.

04 · Attribution

Public sources

This is a Community record: the project was published by a third-party community author.

• ljedrz ↗Community · github · public · checked 2026-09-18