System One
The local checker that looks at shell commands before they run, and at every one in Guarded mode. On by default, one shared copy per machine, and how to turn it off.
Update to get this
System One on by default, and the shared judge, need a current release. Run 8gent update; see Install.
System One looks at a shell command before the agent runs it and answers allow, block, or ask you. It runs on your machine. It is on in every permission mode, and it is what makes Guarded work.
How a command is checked
In order, first match wins:
- Safety rules. Deterministic rules catch destructive commands (recursive deletes, disk wipes, force pushes,
git reset --hard, remote code piped into a shell, reading a secret and sending it over the network, and more), including insidebash -c,ssh host '...',xargs,find -execand heredocs. A block rule is final. - Read-only allowlist. Commands that are plainly read-only (
ls,cat,git status,git log, a tool's--version) or only additive (mkdir -pinside the project) run without asking the model. - The judge. Everything else goes to a small local model that estimates whether the command would delete, overwrite or leak data, or change the system irreversibly.
A command whose text tries to talk to the judge ("ignore the previous question", a fake Answer: line) is blocked by rule without asking the model. System One is an extra layer after the others, not a sandbox.
The judge model: about 5 GB, optional
The judge is Selene 1 Mini, an 8B evaluator model, about 5 GB on disk. It is not installed for you. Install it with Ollama:
ollama pull hf.co/AtlaAI/Selene-1-Mini-Llama-3.1-8B-Q4_K_M-GGUF- Without it, nothing loads. 8gent says once that shell commands are checked by the safety rules and the read-only allowlist only, and carries on. In Guarded, anything the rules do not settle comes to you on the card.
- With it, the first command that needs the judge prints one line naming the model, where it loads and its size, so a multi-GB load is never a surprise.
Without Ollama, put the judge's GGUF file in ~/.8gent/models/decide/, or point at it with EIGHT_DECIDE_GGUF=/path/to/model.gguf.
One shared judge per machine
Every 8gent process, tab and child agent on a machine uses one copy of the judge, served by your local Ollama, instead of loading one each. Same model, same answers. Measured with three processes on one Mac: about 5.7 GB in total instead of about 16.9 GB, and 0 of 120 verdicts differed.
If the shared server stops answering mid-session, that session loads its own copy and carries on. It never falls back to a different server or model.
Settings
| Variable | What it does | Default |
|---|---|---|
EIGHT_SYSTEM_ONE | 0 (or false, off, no) turns System One off outside Guarded. 1 makes it strict everywhere: anything the judge cannot answer comes to you | on |
EIGHT_S1_SHARED_JUDGE | 0 gives each process its own copy of the judge | on |
EIGHT_DECIDE_OLLAMA_HOST | Which server holds the shared judge. Never your chat model's OLLAMA_HOST | http://localhost:11434 |
EIGHT_S1_ALLOWLIST | 0 sends read-only commands to the judge too, and loads it at startup | on |
EIGHT_DECIDE_GGUF | Path to a judge GGUF file, loaded in-process | unset |
Turn it off
export EIGHT_SYSTEM_ONE=0Guarded still uses it, because Guarded is defined by it. In other modes, commands then go straight to your allow rules and the approval card.