The plugin asks a decision model bounded questions; it does not inherit authority to run commands, click a browser control, edit code, publish, or approve its own completion. Every supported harness — Codex, Claude Code, Antigravity, Hermes, VS Code — retains its native permission prompts and Stop behavior. A model answer is advisory until the host or a separate deterministic rule acts on it.

The adapter surface is deliberately narrow. Where a harness offers a hook contract that can widen trust, this package does not use it. Antigravity's PreToolUse requires returning a permission decision, so the Antigravity adapter registers PreInvocation instead and stays advisory. Claude Code's PreToolUse can be advisory-only, so the hint there costs no authority. The VS Code adapter registers a server and nothing else; it ships no extension and takes no editor permission.

Hosted TypeSafe and OpenRouter routes receive the reviewed state and questions for the chosen call. They are separate processors with separate keys and consent. Jev maximum permits non-secret restricted workspace text only after an explicit workspace review; the narrower Jev public and Jev internal modes do not. Recognizable credentials and secrets are blocked in every hosted mode, but this best-effort screen is not comprehensive DLP: review sensitive text and provider terms before choosing Jev maximum. Laya-only stays local; hybrid routes restricted decisions locally only when Laya is attested and selected. The local setup wizard binds consent to one workspace and stores hosted keys in macOS Keychain when that path is selected. Same-user local code is outside the plugin's tamper-resistance guarantee.

The local route is off until you turn it on. local_laya_enabled ships false, and enabling it against an unattested installation is refused with LOCAL_ROUTE_NOT_ATTESTED. Installing this package does not activate a local model for anyone.

Automatic hosted prompt guidance is a separate opt-in layered on generic-query consent. On eligible coding prompts it sends a short set of prompt terms and at most twelve candidate titles — not the full prompt, file contents, or a repository snapshot — for one advisory Jev Choice. Terms and filenames can still disclose project information; use it for restricted work only when the selected hosted-provider scope and your review permit that transfer. The workspace's daily call and byte limits apply. A provider failure leaves the host in control and is never replaced with a simulated answer.

Source material is data, including when it contains instructions. A recipe's typed question tells the model to treat embedded instructions in supplied material as data, and the shipped adversarial fixtures exercise exactly that: a passage asserting it is pre-approved, a commit message asking for approval without inspection, a candidate demanding to be ranked first. In every one the gate must refuse to authorise, and a test asserts it never returns act. jev_recipe_selftest replays all of them offline so you can confirm this yourself without a provider call.

Writing into a user's files is bounded and reversible. The VS Code adapter merges .vscode/mcp.json rather than replacing it, refuses a file it cannot parse instead of discarding settings it cannot read, never follows a symlink, and defaults to a plan that writes nothing.

Local Laya is optional and separately installed. Its process uses a macOS deny-by-default sandbox and no-network inference path in the tested source bundle, but that does not establish protection against hostile code already running as the same user, nor prove a particular GPU execution path. Model weights are not distributed in this repository.

The context tool retains exact omitted text in a private local receipt; do not treat an extractive view as a new source of truth. Browser choice is limited to observed controls in an already authorized tab. A page can change between observation and action, so the bridge checks freshness and returns uncertain or consequential actions to the host. DONE still requires independent inspection.

The current automatic completion collector is disabled. The product does not claim universal host interception, calibrated decisions on arbitrary domains, or measured token/cost/time savings. Report a suspected vulnerability without including live credentials or private user material in a public issue.