Lookout: a second opinion on every turn.

A coding agent does not know when it is wasting your time. It runs the same failing test a third time. It asks to delete the folder it was told to edit. It says the tests pass when no test ran. You catch it only if you are watching.

Lookout watches for you. At three moments it reads the session, answers a fixed set of yes-or-no questions, and puts a card in front of you when an answer clears its bar. That is the whole job. The buttons stay yours.

It judges. It never writes.

Lookout runs on Jev, Venice's decision model. A chat model writes its answer token by token. Jev writes nothing. It takes the session as data plus typed questions and returns a probability for each. “Is the agent looping?” comes back as 0.97, not as a paragraph.

That is why it is fast and cheap, and why your agent never waits for it.

Before the turn

When you send a message, Lookout reads it with four questions. How big is the job? Is it too vague to start? Does it touch data, deployment, secrets or money? What one detail would help most? The agent starts regardless. If an answer clears its bar, a card lands above the composer a moment later.

A clear request gets silence. A vague one gets a pointed question. A big one gets Plan first, which switches the run to plan mode so the agent proposes before it edits.

After every turn

The recent turns go out with five questions.

• LoopingThe same command, edit or error, with no progress.
• DriftWork toward a goal you never asked for. The card quotes your request back.
• StuckRetrying an approach its own results already ruled out. The card offers Re-plan.
• UnbackedA claim no tool output shows: tests pass, file written, deployed.
• Looks finishedEverything you asked for is done. The card offers Review changes.

When a turn edits files, the change is also held to your project's own rules. Lookout splits the rule lines in CLAUDE.md and AGENTS.md into single questions and asks each one against the diff. A rule the change likely breaks gets a card that names it, with Ask to fix. The idea comes from pi-warden, an open-source guard where re-checking rules on every write cut violations from 12 runs in 50 to 4.

At an approval

When the agent asks permission, Lookout reads the pending call against your request. Does it reach outside the task? Can it be undone? Does it send something out? Each yes adds one line to the approval card, as in the second and third moments above. Allow, Deny and Cancel do not move.

What it cannot do

Lookout cannot approve a call, message the agent, change your model or hide an approval. When Venice does not answer, the check is skipped and the run carries on as if Lookout were off.

Two switches let it go further. Both are off until you turn them on. Set effort from the request sets how long the Claude engine thinks, never which model runs. Pause after three looping turns stops a run that keeps looping, the way Stop does.

What it sends

Only what the questions read: your request, the recent turns and tool output up to a fixed size, the paths a turn edited, and the pending call at an approval. The rules check adds the rule lines and the diff, with credentials masked. Files named like .env or a private key are never sent. Lookout sends nothing for an incognito chat or an end-to-end encrypted session, and nothing while it is off.

How the bars were set

A probability is useless without a bar. We wrote 160 labelled examples: sessions with a real problem, and sessions built to look like one without being one. Every example went to the live model, over eleven runs, for about three cents in total. Each bar sits between the two groups.

Three things the tuning taught us.

• The model answers the question you wrote. “Outside the task” flagged reading a docs page from the web until the question spelled out what counts as outside. Every gain came from writing the exact condition.
• Our labels were wrong as often as the model was. A command we filed as irreversible restored the files from git in the same line. Reading the misses fixed the examples before it fixed the questions.
• Facts that code can check stay in code. Whether a file already exists is read from disk and sent as one yes or no. That single fact took “cannot be undone” from catching under half its examples to catching all of them.

Two misses are known and stay missed: a finish claim from an agent that ran no check at all, and a new file created in a neighbouring project. Both sit just under their bars. Moving the bars to catch them would add false alarms everywhere else.

Try it

Open Settings, find Lookout, and turn on Watch each session. Every question has its own switch. A question you turn off is never sent.

If it flags something it should not, or misses something it should catch, tell us. That is how the next bar gets set.

Sources

• Create Decisions, Venice API reference: how Jev takes questions and returns probabilities.
• System One and Jev 1.13 jaggedness, TypeSafe: what a decision model is, where it fails, and why the exact condition matters.
• pi-warden, open source: re-checking a project's rules on every write, 12 runs in 50 with a violation down to 4.
• jev-belay, open source: gating an agent's “done” on what its transcript shows.