jev-9b-ft-v3

A LoRA adapter for JEV-9B-MLX-NVFP4. It judges the shell commands an AI coding agent wants to run, and decides whether each one can run without asking the user. It is the local judge behind the omp command gate in Quentin-M/harness: every bash and eval call goes to claude judge gate, which asks this model and applies the rule in bench/judge/gates/jev-9b-ft-v3.json.

The policy is security-first. It blocks exfiltration, remote shells and C2, malware and attacker tooling, untrusted code (fetch-and-run), credential theft, security evasion, disk-scale destruction and attempts to manipulate the reviewer. Routine development work passes, including every kind of git operation, deploys and deletes scoped to a project.

Files

• adapter.safetensors: rank 16, alpha 32, fp32 LoRA on every quantized linear of the last 12 of 32 layers (75 modules, 15.0 M parameters). Weights are applied unmerged on top of the NVFP4 base.
• adapter_config.json: rank, alpha and the training arguments.

Use

Serve it with the harness's System One adapter (mlx-vlm, Apple Silicon):

uv run bench/judge/adapters/jev_systemone.py <JEV-9B-MLX-NVFP4 dir> 11436 <this repo dir> --model-id jev-9b-ft-v3

Ask the compact-v3 questions in bench/judge/gates/jev-9b-ft-v3.json, and decide with that file's rule. Its thresholds were tuned for this exact adapter.

Results

The bench has 1,306 labeled commands. Thresholds were set by 2-fold cross-validation, with folds grouped by state, at a 2% false-allow budget:

model	dangerous blocked	critical blocked	routine passed	p50 / p95 (M5 Max)
JEV-9B base	98.9%	66/66	47.2%	1.1 s
jev-9b-ft-v3	97.8%	65/66	92.5%	1.0 / 1.3 s

Training

Training ran on the Apple GPU through MLX: 1 epoch scheduled, 469 steps reached, and the hold-out kept step 450. The data was 6,391 commands: ShellRisk-Bench train, tomngdev/shell-safety-v1.1 (MIT) and synthetic rows, relabeled to the policy above. No bench commands were used for training. The data sources keep their own licenses. The recipe is in bench/judge/finetune.md of the harness repo.