hermes-jev-skills

Hermes Jev Skills

Give your agent a fast, cheap second brain for the small decisions.

Your agent burns frontier-model tokens on things that are not thinking: which model should answer this turn, which of 377 skills to load, which retrieved passages matter, which turns survive a summary, which button comes next. Those are decisions, not prose. Hand them to something that costs a fraction of a cent and answers in about 0.4 seconds, and let the expensive model do the writing.

That is what Jev is. It is TypeSafe's decision model. It never writes text. You give it a state and typed questions (pick one, score this, yes or no) and it answers with a calibrated confidence. This repo wires that into an agent's day.

jev dashboard. The profiles, paths and decisions here are a demo home; the pools are a real working set. python3 scripts/demo_home.py builds a home where nothing is real, which is where the next one comes from. One switch for Jev routing, every pool as a tier-by-work-kind grid, and each decision as it happens (tier, work kind, model, which pool it came from, confidence, latency).

What Jev decides, and what it costs

Eleven skills ship as plain SKILL.md files, so they are not Hermes-only. The same folder works in Claude Code, Codex, or anything that reads a skill file.

jev mail --file inbox.json             # sort a mailbox into lanes
jev mail --file inbox.json --summary   # counts per lane, what was unsure, what it cost

Runnable design-choice example

Closed preset selection with deterministic rendering: two compatible layout/type/palette presets, local contrast and copy checks, offline fallbacks, and an optional real-browser QA script. Offline by default; no new skill or routing hook. This demonstrates the contract, not measured design-quality gains.

Try it in two commands

git clone https://github.com/kerpopule/hermes-jev-skills ~/hermes-jev-skills && python3 ~/hermes-jev-skills/install.py

jev setup-key   # paste your key into the one-time page it opens, then run: jev doctor

Python 3.9 or newer, no dependencies. Got it as a zip? Unzip it anywhere and run python3 install.py from that folder. Or point your agent at this repo and say "install Hermes Jev Skills": it will follow AGENTS.md.

The installer finds Hermes, Claude Code and Codex on the machine and installs for each one it finds. python3 install.py --check shows exactly what it would do without changing anything. --uninstall reverses it. For Claude Code it also adds four lane subagents (jev-lane-small … jev-lane-escalate, each with its own model and effort) and a short, delimited lanes block in ~/.claude/CLAUDE.md, backed up first (--no-claude-md leaves that file alone). See lanes.md.

Not sure yet? Run jev models suggest --write to draft routing pools from price bands, then /jev routing shadow for a day. Shadow mode decides and logs without switching anything, so a day of decisions costs almost nothing and risks nothing. Turn it on when the log looks right.

On Hermes

Built for Hermes. The dashboard has its own notes in router-dashboard/README.md.

Start in shadow mode. It is the honest way to see what Jev would do before it does anything.

/jev                         status
/jev routing shadow          decide and log, do not switch (start here)
/jev routing on              switch models per turn
/jev skills on               suggest the right skill per turn
/jev notice on               show "[Jev] hard · coding → kimi-k3 · confidence 0.92" on routed replies
/jev screen shadow           screen web_search / web_extract results for injected instructions, log only
/jev screen on               withhold the parts that carry them, with a notice in their place
/jev routing on all          make it the default for every profile (a profile's own setting still wins)

The agent gets five tools: jev_memory_filter, jev_compact_select, jev_choose_action, jev_supervise, jev_escalate.

The hermes-jev plugin uses only public plugin seams (pre_llm_call, transform_tool_result, the llm_request middleware, tools, a slash command), so hermes update does not break it and nothing in Hermes core is patched.

A plugin can swap the model, not the provider connection. On OpenRouter that still covers every vendor. If you run /model yourself, your choice wins.

Every model you have

jev models list              # everything this machine can call: price, context, vision, reasoning
jev models providers         # which providers you hold a key or login for
jev models suggest --write   # first-draft pools from price bands; then edit to taste

The catalog is models.dev, filtered to providers whose API-key name is set in your environment or Hermes .env, or that Hermes holds a login for. Only key names are read. Pools live in ~/.hermes/jev/routing.json (the default for every profile); ~/.hermes/profiles/<name>/jev/routing.json overrides it for one profile. Details in skills/jev-model-routing.

Your API key never touches the agent

jev setup-key opens a one-time page served only by your own computer. You paste your TypeSafe key there. It goes straight into the OS secret store (macOS Keychain, or secret-tool on Linux, or a 0600 file as a last resort) and, on a Hermes machine, into each profile's .env. The agent that ran the command sees one line: stored, verified, yes or no. Never the key, not even a prefix.

The page lives on an unguessable one-time URL, refuses requests with a foreign Host header (DNS rebinding), sends no referrer, logs nothing, and shuts down after one use or ten minutes. On a headless box, run jev setup-key --tty yourself for a hidden prompt.

Do not paste your key into a chat. If you already did, make a new one.

What leaves your machine

Jev is a cloud API, so this is spelled out rather than implied:

• Routing: the user's turn, redacted (emails, phones, tokens, long hex masked), capped at 2,500 characters (ask_chars), read as the opening and, mostly, the end. Never history, tool results, files or memory. Turns that look like they hold a secret, and any profile you list in private_profiles, send only coarse features: length, whether code is present, whether risk words appear.
• Memory: the query and up to 900 characters per passage, redacted. Your store's ids, paths and sources are replaced with P0, P1… and never sent. A passage that looks like a credential is not sent at all.
• Choosing turns (jev compact-select, or handoffs with HANDOFF_JEV=1): the first and last 350 characters of each turn, redacted. Turns that look sensitive are skipped. A default handoff sends Jev nothing.
• Skills: the turn, redacted, plus skill names and descriptions.
• Web screening (/jev screen on or shadow, Hermes only): each web_search result's title and description, and each page from web_extract in chunks of up to 900 characters, redacted. URLs and the query are not sent. A chunk that looks like a credential is not sent, and on a profile listed in private_profiles nothing is sent at all: the local pattern screen decides alone. Browser pages are never screened by this, because a logged-in page is the person's own data.
• Search (jev search): the date, the question, the queries already tried, and up to 900 characters of each shortlisted result (title, URL, snippet), redacted. Result ids stay local: Jev sees P0, P1… A result that looks like a credential is not sent, and neither is one carrying hidden instructions. A question that looks sensitive is not sent at all.
• Social research skill: no new request shape. Discovery ranking and final sufficiency use jev search, so the question, tried queries and candidate queries leave the machine only after a mandatory local gate clears them. Each all-clear social result is projected to an opaque id, a platform/evidence-level title without the account handle, its canonical public URL only when that complete URL is not person-marked, and at most 900 characters of source-grounded paraphrase and coverage tags without direct comment text, engagement counts or timestamps. The full local evidence row, screenshots and raw page data are not sent. A public URL whose path, slug or query identifies an account or person is person-marked. If the question, queries or any candidate field are private, person-marked or sensitive, the whole call is skipped; the ledger stays local and intact while selection uses only the locally screened head of the original order. Jev unavailability takes that same fail-open path and never restores a locally rejected entry.