Jev in practice: typed decisions, scoped authority
3 hours ago
- safe-upgrade is an open-source dependency upgrade agent built with Jev, LangGraph, and Tenuo to automate and secure dependency upgrades.
- Jev turns repository evidence into typed probabilistic decisions through a Choice API, returning a selected option, confidence, and probabilities usable for programmatic routing.
- Trusted deterministic code first computes eligible actions; Jev then chooses among them, while low confidence or invalid responses fall back to deterministic routing.
- LangGraph carries decisions through a durable workflow with checkpoints, preserving repository facts, findings, attempts, and evidence across the run.
- Tenuo provides task-scoped authority: a parent run warrant sets the maximum ceiling, and child sessions narrow tools, paths, arguments, lifetime, and delegation ability for each worker.
- Duties are separated and enforced: test authors write tests, implementers write source, and verifiers read and run checks; unauthorized tool calls are denied before execution.
- In CI, GitHub Actions permissions limit workflow identity while Tenuo warrants bind each delegated task to the specific package, version, branch, and lifetime.
- Safety comes from closed decisions, scoped execution, separated duties, independent evidence, contained processes, and explicit uncertainty, forming a reusable pattern beyond upgrades.