--- title: "Warning receipts: what we checked behind each warning" type: community source_tier: community tags: [community, warnings, verification, key-safety, provenance] created: 2026-09-25 updated: 2026-09-25 confidence: medium sources: - raw/x-repos/chigwell__typesafe.pro.md - raw/x-repos/chigwell__typesafe.pro__docs-admission.md - raw/community/classifier-dev-about.md - raw/community/classifier-dev-pricing.md - raw/community/classifier-dev-terms.md - raw/community/classifier-dev-privacy.md - raw/community/classifier-dev-benchmark.md - raw/x-repos/francesco0242__matchcn.md - raw/x-repos/andrelandgraf__safer-with-jev.md - raw/x-repos/andrelandgraf__safer-with-jev__design.md - raw/x-repos/ktaletsk__jevframe.md - raw/x-repos/anpicasso__hermes-jev-approvals.md - raw/x-repos/vinilana__jev-gateway.md - raw/partner/opencode-ai__docs__zen.md - raw/community/huggingface-co-datasets-sargedev-jev-distill-corpus-v3.md - raw/x-repos/HITsz-TMG__JevEmbed.md - raw/x-repos/bladedevoff__stuntd.md - raw/x-repos/razorback16__openjev.md - raw/x-repos/githubnext__localjev.md - raw/x-repos/logan-markewich__jeff.md - raw/x-repos/0xBakeer__arbiter.md - raw/x-repos/choxos__jev-reviewer.md - raw/x-repos/kylemclaren__jevql.md - raw/x-repos/higress-group__HiRoute__decision-extensions-extensions-jev-decider-readme.md - raw/x-repos/Brainwires__jevwire.md - raw/x-repos/ikermoel__open-alternative-jev.md - raw/x-repos/chengyongru__fastjev.md - raw/x-repos/yoheinakajima__glance.md - raw/x-repos/emnlmn__snap.md - raw/site/typesafe-ai-legal_mca.txt jev_version: "jev-1.13.0" summary: "The check behind each item in the wiki's Warnings block: date, upstream URL and commit, file, what we observed, what we infer, and what is still unresolved. No exploit steps." --- # Warning receipts: what we checked behind each warning > **TL;DR** Every item in the Warnings block on [[ideas/warnings]] (on [[ideas/open-replicas]] until 2026-09-25) has a receipt here, so a reader with no access to our internal records can see what "our check" rests on and re-check it. Each receipt gives the date, the upstream URL with a commit where one was recorded ("commit not recorded" otherwise), the file where known, what we observed, what we infer, and what is unresolved. Observations tagged *(author)* come from the project's own text captured in raw/; *(our check)* means our own vetting, recorded in our private sweep notes (docs/sweep/2026-09-24-awesome-jev, docs/sweep/2026-09-25-mrjev) and verification records (docs/verification), not captured. Receipts describe behaviour; they do not accuse anyone, and they carry no exploit steps. The exclusion policy and the contract text live only in the Warnings block, part (iii). URLs are written as code, not links, on purpose. A receipt can go stale the day after its check date: re-run the check before relying on it. Owner decisions of 2026-09-25: public receipts, and no outreach to the SiliconLabAI project. ## (a) Keyless or public Jev on someone else's key | Item | Checked · upstream · file | Observed | We infer | Unresolved | |---|---|---|---|---| | typesafe.pro | 2026-09-25 · `github.com/chigwell/typesafe.pro` (README, commit not recorded; `docs/admission.md` at `2d381cf`, last changed in `360e648`) · limits in `proxy/config.py` (per admission.md); site `typesafe.pro` | Anonymous access with no token, 30 requests/minute per IP; free and paid tokens 120 and 1,000 requests/minute; forwards `POST /v1/systemone` to TypeSafe over master keys `TYPESAFE_MASTER_API_TOKEN_N`, 1,200 requests/minute and 250,000 tokens/second each, each master "dedicated to this proxy"; retention differs between its files: the README keeps activity and error events, including real client IPs, seven days; `docs/admission.md` keeps error events three days plus cleanup lag, with client/IP identity hashed (author). AGPL-3.0. Its site calls it an independent gateway (our check; site not captured) | A public front door to Jev on its operator's keys; state passes through the operator | Whose accounts and Orders the master keys sit under; any TypeSafe agreement | | classifier.dev | 2026-09-25 · pages `/about`, `/pricing`, `/terms`, `/privacy`, `/benchmark`, `/llms.txt` fetched with curl (no version on the pages) · matchcn calls its `/v1/classify` with no key in `src/runtime/classify.ts` (our check, commit not recorded) | No key or account: 3,000 fast requests/minute and 20,000/day per IP; paid workspaces; fast tier is Jev, packed a thousand items to a request; smart tier re-asks a reasoning model; texts go to TypeSafe directly or via Vercel AI Gateway, smart items via OpenRouter; public requests not stored with their text; partner keys under separate written terms; /about names Michael Ryaboy, an independent developer, as operator (author) | Public Jev on its operator's key | Any TypeSafe agreement; the linked source repository was not reviewed | | safer-with-jev | 2026-09-25 · `github.com/andrelandgraf/safer-with-jev` (`DESIGN.md` at `b4fb82b`, last changed in `846bde1`; README commit not recorded) · Jev call in `src/lib/judge.ts` (our check) | A personal developer-relations demo; no caller auth; Jev on a server key that, per the design, another project (`typesafe-on-neon`) already holds; `/ask-jev` is an open yes/no Noul over text; 10 requests/minute per IP, 1,000 Jev attempts/day deployment-wide; forwards only after a pass, to the caller's URL with the caller's credentials; declines a hosted default model as an open paid proxy; logs no bodies or keys (author). No licence | Public Jev on one owner's key; callers' upstream keys transit its server | Whether the owner's TypeSafe terms cover public use; whose account the shared key is on; we did not call the live API | | jevframe's sponsored gateway | 2026-09-25 · `github.com/ktaletsk/jevframe` (README, commit not recorded) · notebook `examples/reviews.py`; gateway host `jev-api-wrapper-production.up.railway.app` (README) | Used only by the example notebook when no key is set; edited questions and larger samples share 2,000 new row requests per UTC day across visitors; caches and shares inputs and answers ("use public data only"); the library itself needs your own key (author). The notebook carries a shared demo key (our check; value not repeated here) | Public Jev on an unnamed operator's key; inputs visible to other visitors | Operator; whether the gateway answers requests from outside the notebook; which model answers | ## (b) Jev answers published or used as training data | Item | Checked · upstream · file | Observed | We infer | Unresolved | |---|---|---|---|---| | SargeDev jev-distill-corpus-v3 | 2026-09-25 · `huggingface.co/datasets/SargeDev/jev-distill-corpus-v3`, card at revision `fc99c63` (main, modified 2026-09-21) | Stream `yuri_v3`, 498,010 of 740,957 rows, "Labels distilled from Jev 1.13 (TypeSafe) via OpenRouter"; licence metadata apache-2.0; not gated (author) | A published set of Jev Output as training labels; OpenRouter's terms, and whatever TypeSafe's agreement with it passes down, apply to how the labels were bought | What has been trained on it | | JevEmbed-Data (HIT-TMG) | 2026-09-25 · dataset `HIT-TMG/JevEmbed-Data` via the Hugging Face API (revision not recorded) · `github.com/HITsz-TMG/JevEmbed` README (commit not recorded) | 37,663 train + 877 test rows carry the SargeDev corpus's domain names (our check); the dataset has 1.67 million questions; JevEmbed's own LoRA runs use the `release-v2-redistributable` subset of Open-Jev (author) | Those rows are the Jev-labelled stream (inferred from domain names); the item is the published dataset, not JevEmbed's models | Exactly which SargeDev stream the rows came from | | laya-jev-GraphRAG | 2026-09-25 · `github.com/bodepudimuneendra-netizen/laya-jev-GraphRAG` (commit not recorded; not captured) · Jev client `graphrag/models/jev.py` | "Ablation" mode runs Laya and Jev and writes paired answers to JSONL; the README pitches them as training data for Laya; the Jev client uses the undocumented ID `jev-1.13`, reads the wrong response fields and turns errors into fallback scores (our check) | A stated intent to train on Jev answers; its Jev calls may not return usable answers | Whether any training happened | | stuntd | 2026-09-25 · `github.com/bladedevoff/stuntd` (README, commit not recorded; pushed 2026-09-24) | Three modes: local Jev on base Laya (no key), in front of OpenAI, and in front of the paid Jev API, where it "learns from the provider's own answers" and answers locally once a head reaches `training.target_agreement` (default 0.99); 2% of live requests still go to the provider (author) | The paid-Jev mode trains a local model on Jev Output; the other modes do not | Whether anyone has published a head trained on Jev | ## (c) Key safety | Item | Checked · upstream · file | Observed | We infer | Unresolved | |---|---|---|---|---| | SiliconLabAI/OpenJev | 2026-09-25 · `github.com/SiliconLabAI/OpenJev` (shallow clone; commit not recorded; not captured) · `src/lib/evaluate.ts` | The way the server uses the keys it holds (TypeSafe, decider or OpenAI) lets a web page open in the developer's browser obtain them while the server runs (our check; mechanism withheld on purpose) | Any key configured there is exposed; not listed as a tool | Not re-checked since; the project was not contacted (owner decision 2026-09-25) | | razorback16/openjev and Codiv | 2026-09-25 · `github.com/razorback16/openjev` (README, commit not recorded) | The quick start sets `TYPESAFE_BASE_URL=https://api.codiv.ai` and puts a Codiv key (`sk-codiv-...`) in `TYPESAFE_API_KEY`; Codiv hosts this replica free, 100M input tokens (author) | Pointing the base URL at Codiv while `TYPESAFE_API_KEY` still holds a TypeSafe key sends that key to Codiv | Codiv's own terms (not captured) | | Replicas answering `jev-latest` | 2026-09-25 · READMEs of `githubnext/localjev`, `razorback16/openjev`, `logan-markewich/jeff`, `0xBakeer/arbiter` (commits not recorded) | localjev and openjev accept `jev-latest` and `jev-preview`; jeff's `JEFF_MODEL_ALIASES` default is `jev-latest,jev`; arbiter's router takes `"jev-latest"` (author). fastjev rejects `jev-latest` (our check) | An SDK pointed at one gets local answers with no error; only the response `model` tells | Replicas we have not checked | | jev-reviewer's hosted copies | 2026-09-23 capture · `github.com/choxos/jev-reviewer` (README, commit not recorded) · `server.js` | Both hosted copies go through `server.js`, which adds a shared TypeSafe key, caps requests per address and stops after `DAILY_TOKEN_BUDGET` input tokens a day; files stay in the browser, their text and your questions go to TypeSafe; a pasted key uses your own quota (author) | Study text passes through the author's server; a pasted key travels through it too | Whether the relay answers anything other than the app's own requests; not probed | | askjev, hosted mode | 2026-09-25 · `github.com/pZacca/askjev` (commit not recorded; not captured) · `src/jev.ts` | Hosted mode sends your TypeSafe key to the author's Cloudflare Worker at `jev.zacca.dev`, with Worker observability on; npm `askjev` 0.2.0, publisher matches (our check) | The author's Worker can see and spend the key | What the Worker logs | | jev-explained, hosted site | 2026-09-25 · `github.com/davila7/jev-explained` (commit not recorded; not captured) · `src/lib/providers.ts` | The live site's bundle posts your key in `x-jev-api-key` to its own `/api/jev`; the route source forwards only to `api.typesafe.ai` or Vercel AI Gateway and does not store the key (our check) | The key passes through the author's Vercel function | Whether the deployed build matches the source | | jevql `serve --insecure` | 2026-09-25 capture · `github.com/kylemclaren/jevql` (README, commit not recorded) | `--insecure` (or `JEVQL_INSECURE=1`) drops the token for an open demo node, fenced by `--cors`, `--rate-limit`, `--max-rows` and a read-only role (author) | Anyone who reaches an open node spends its operator's key | — | | jev-gateway `/router/decide` | 2026-09-25 capture · `github.com/vinilana/jev-gateway` (README, commit not recorded) | A launcher-started gateway has no key of its own, so any process on the machine can use it, including asking Jev on your key through `/router/decide`; not reachable from other machines; server mode can require `ROUTER_API_KEY` (author) | Local processes can spend your key | — | | HiRoute jev-decider | 2026-09-25 · `github.com/higress-group/HiRoute`, `decision-extensions/extensions/jev-decider/README.md` at `22ab3c7` (last changed in `d21c5bf`) | Listens on `HOST` `127.0.0.1`, `PORT` 8080 by default; the inbound auth header pair is unset by default; calls OpenRouter's Decisions API with `typesafe/jev-1.13` (author) | Binding it beyond loopback without the header lets others spend your key | — | ## (d) Install names and name collisions Checked 2026-09-25 by querying PyPI's JSON API and the npm registry directly (our check); the READMEs named are captured. | Name | Observed (our check) | Why it matters | |---|---|---| | PyPI `open-alternative-jev` | does not exist, although the README says `pip install` | anyone can claim it | | PyPI `deepopen` | does not exist | anyone can claim it | | PyPI `llm2jev` | 0.6.1 belongs to tic-top/llm2jev, not Yinsongxu/LLM2Jev | wrong project | | PyPI `openjev` | 0.0.1 is balys/openjev, none of the four OpenJevs | wrong project | | npm `fastjev` | unrelated to chengyongru/fastjev, which publishes PyPI `fastjev` 0.2.0 | wrong project | | PyPI `reflex`, `glance`, `snap` | unrelated; Glance installs as `glance-vlm` (README), SNAP builds a `snap` binary (README) | wrong project | | npm `jevwire` | 404, although the README says `npx -y jevwire` | anyone can claim it | | npm `pi-jev-guard` | 0.7.2 is another publisher's, with no repo link; zszz3's 0.2.1 is unpublished | wrong project | | npm `pi-jev-router` | mejiasd3v's, not philippdubach's repo; sugarforever's is the scoped `@sugarforever/pi-jev-router` | wrong project | ## Other receipts | Item | Checked · upstream | Observed | Unresolved | |---|---|---|---| | OpenCode Zen (a route since 2026-09-25, [[ideas/platforms-and-gateways]]; kept here as the receipt for our reachability check) | 2026-09-25 · OpenCode's docs page `opencode.ai/docs/zen/` (captured 2026-09-25) · our 100 Choice requests to `opencode.ai/zen/v1/systemone`, model `jev-1.13-free` (docs/verification/choice-argmax-2026-09-25, two scripts) · READMEs of `anpicasso/hermes-jev-approvals` and `vinilana/jev-gateway` | Docs: Jev 1.13 (`jev-1.13`, $0.042 per 1M input tokens, output free) and Jev 1.13 Free (`jev-1.13-free`, limited time) at that endpoint, a key from logging in to Zen, US hosting, providers zero-retention and no training on your data (author). Our requests were sent with no key and got HTTP 200, `"cost":"0"`, Jev's own request validation, and every `choice` the top probability (our check). hermes-jev-approvals: keyless HTTP 200 with typed answers; jev-gateway: live key check of both IDs on 2026-09-24 (author) | No TypeSafe source we hold names the arrangement; whether the weights equal `jev-1.13.0`; how long the free ID lasts; whether keyless access is intended | | aowang-ai/jev-trade (unlisted, [[ideas/repos-apps]]) | 2026-09-24 · `github.com/aowang-ai/jev-trade` (commit not recorded; not captured) · `src/model.ts` | Takes wallet private keys for live Hyperliquid orders, testnet by default and mainnet by a flag; credits jev-trader (our check) | Unchanged on 2026-09-25 by metadata only | ## Related - [[ideas/warnings]] — the Warnings block these receipts back (parts (i)-(iii)); [[ideas/open-replicas]] — the replicas themselves - [[ideas/platforms-and-gateways]] — vendor routes to Jev; points to the Warnings - [[ideas/tools-and-integrations]] — Key safety for community tools - [[reference/legal-and-data]] — the contract text behind the exclusion policy - [[syntheses/glossary]] — "route", "not a route (wiki policy)", "key safety", "look-alike", "name collision" ## Sources Raw captures in frontmatter (READMEs, design and docs files, dataset card and classifier.dev pages captured 2026-09-23 to 2026-09-25; URLs and commits in raw/MANIFEST.json and in each capture's header). Items marked "our check" rest on our internal vetting records (docs/sweep/2026-09-24-awesome-jev/part1.md, docs/sweep/2026-09-25-mrjev/parta.md, partb.md, partc.md) and on docs/verification/choice-argmax-2026-09-25; those records are not published.