vangrail 0.1.0 → 0.2.0

data/lib/vangrail/providers/gateway.rb

@@ -16,13 +16,15 @@ module Vangrail
     # So a gateway is registered by the application that has one:
     #
     #   Vangrail::Providers.register_gateway(
-    #     name: 'hub',
-    #     base_url: 'https://gateway.example/api/v0',
-    #     models: { judge: 'some/instruct-model', guard: 'some/guard-model' },
-    #     guard_preset: :apriel_guard,
-    #     key_env: 'HUB_API_KEY',
-    #     key_file: File.join(Dir.home, '.config', 'hub', 'api_key'),
-    #     pass_entry: 'hub/token'
+    #     Vangrail::Providers::Gateway::Spec.new(
+    #       name: 'hub',
+    #       base_url: 'https://gateway.example/api/v0',
+    #       models: { judge: 'some/instruct-model', guard: 'some/guard-model' },
+    #       guard_preset: :apriel_guard,
+    #       key_env: 'HUB_API_KEY',
+    #       key_file: File.join(Dir.home, '.config', 'hub', 'api_key'),
+    #       pass_entry: 'hub/token'
+    #     )
     #   )
     #
     # or by environment, so a deployment needs no code at all:
@@ -56,7 +58,7 @@ module Vangrail
           guard_preset: spec.guard_preset,
           key_resolver: lambda do
             tokens[spec.name] ||= token(spec, env)
-          end
+          end,
         )
       end
 
@@ -94,10 +96,9 @@ module Vangrail
         return nil unless $?&.success?
 
         present(out.to_s.lines.first)
-      # A missing `pass`, a locked keyring, a refused pinentry: none of them are
-      # this method's problem, and all of them mean the same thing here, which is
-      # that no credential came from this source.
-      rescue StandardError
+      # A missing `pass` binary, or one that cannot be executed. A failing
+      # lookup is already `$?` not succeeding; anything else is a bug.
+      rescue Errno::ENOENT, Errno::EACCES
         nil
       end
 
@@ -111,14 +112,14 @@ module Vangrail
           base_url: base,
           models: {
             judge: present(env["#{ENV_PREFIX}_JUDGE_MODEL"]) || present(env["#{ENV_PREFIX}_MODEL"]),
-            guard: present(env["#{ENV_PREFIX}_GUARD_MODEL"])
+            guard: present(env["#{ENV_PREFIX}_GUARD_MODEL"]),
           }.compact,
           guard_preset: present(env["#{ENV_PREFIX}_GUARD_PRESET"])&.to_sym,
           key_env: "#{ENV_PREFIX}_API_KEY",
           file_env: "#{ENV_PREFIX}_KEY_FILE",
           pass_env: "#{ENV_PREFIX}_PASS_ENTRY",
           key_file: present(env["#{ENV_PREFIX}_KEY_FILE"]),
-          pass_entry: present(env["#{ENV_PREFIX}_PASS_ENTRY"])
+          pass_entry: present(env["#{ENV_PREFIX}_PASS_ENTRY"]),
         )
       end
 

data/lib/vangrail/providers/llmlite.rb

@@ -11,8 +11,8 @@ module Vangrail
     # It is the right default for guardrails specifically. Rails run on every
     # turn, so their latency and their failure modes are the application's; a
     # local endpoint keeps both on this machine, needs no shared credential, and
-    # cannot bill anyone. It also means a laptop with the proxy running has
-    # working rails with nothing configured.
+    # cannot bill anyone. It also means a laptop with the proxy running, and a
+    # model named, has working rails with no shared credential to configure.
     #
     # The proxy serves an instruct model, not a safety classifier, so
     # `model(:guard)` is nil and the builder puts a policy rail on the input
@@ -21,8 +21,10 @@ module Vangrail
     module Llmlite
       HOST = '127.0.0.1'
       DEFAULT_PORT = 8760
-      DEFAULT_KEY = 'grok-inside'
-      DEFAULT_MODEL = 'grok-4.5'
+      LISTEN_ERRORS = [
+        Errno::ECONNREFUSED, Errno::EHOSTUNREACH, Errno::ENETUNREACH,
+        Errno::ECONNRESET, Errno::ETIMEDOUT, Errno::EADDRNOTAVAIL, SocketError
+      ].freeze
 
       module_function
 
@@ -44,28 +46,41 @@ module Vangrail
         socket = TCPSocket.new(host(env), port(env))
         socket.close
         true
-      rescue StandardError
+      rescue *LISTEN_ERRORS
         false
       end
 
       def model(env = ENV)
-        env['LLMLITE_MODEL'] || env['GROK_LLMLITE_MODEL'] || DEFAULT_MODEL
+        present(env['LLMLITE_MODEL'] || env['GROK_LLMLITE_MODEL'])
+      end
+
+      # No default. Which embedding model a proxy serves, if any, is deployment
+      # knowledge, and a guessed name costs a 404 on every check while looking
+      # like a rail that ran.
+      def embed_model(env = ENV)
+        present(env['LLMLITE_EMBED_MODEL'] || env['GUARDRAILS_EMBED_MODEL'])
       end
 
       def key(env = ENV)
-        env['LLMLITE_API_KEY'] || DEFAULT_KEY
+        present(env['LLMLITE_API_KEY'])
       end
 
       def provider(env = ENV)
+        resolved = key(env)
         Provider.new(
           name: 'llmlite',
           base_url: base_url(env),
-          models: { judge: model(env), guard: nil },
-          key_resolver: -> { key(env) },
+          models: { judge: model(env), guard: nil, embed: embed_model(env) },
+          key_resolver: resolved && -> { resolved },
           local: true,
-          probe: -> { listening?(env) }
+          probe: -> { listening?(env) },
         )
       end
+
+      def present(value)
+        s = value.to_s.strip
+        s.empty? ? nil : s
+      end
     end
   end
 end

data/lib/vangrail/providers.rb

@@ -18,7 +18,8 @@ module Vangrail
   # somebody's secrets live. A shared gateway is therefore registered by the
   # application that has one, or described by environment:
   #
-  #   Vangrail::Providers.register_gateway(name: 'hub', base_url: '...', ...)
+  #   Vangrail::Providers.register_gateway(Gateway::Spec.new(name: 'hub', base_url: '...'))
+  #   Vangrail::Providers.register_gateway(name: 'hub', base_url: '...')
   #   GUARDRAILS_GATEWAY_API_BASE=...  GUARDRAILS_GATEWAY_API_KEY=...
   #
   # An endpoint needed for a single run needs no registration at all:
@@ -41,13 +42,10 @@ module Vangrail
 
     # Registers a shared gateway and returns its Provider. Registering a name
     # twice replaces it, so reloading an application is not a duplicate.
-    def register_gateway(name:, base_url:, models: {}, guard_preset: nil, key_env: nil,
-                         file_env: nil, pass_env: nil, key_file: nil, pass_entry: nil, env: ENV)
-      spec = Gateway::Spec.new(
-        name: name.to_s, base_url: base_url, models: models, guard_preset: guard_preset,
-        key_env: key_env, file_env: file_env, pass_env: pass_env,
-        key_file: key_file, pass_entry: pass_entry
-      )
+    #
+    # Preferred: a Gateway::Spec. The 0.1.0 keywords still work and become one.
+    def register_gateway(spec = nil, env: ENV, **kwargs)
+      spec = spec.is_a?(Gateway::Spec) ? spec : Gateway::Spec.new(**(spec || kwargs))
       registered_specs.reject! { |s| s.name == spec.name }
       registered_specs << spec
       Provider.register(Gateway.provider(spec, env))

data/lib/vangrail/rail.rb

@@ -6,7 +6,7 @@ module Vangrail
   # The whole rail protocol: a name, the sides it applies to, and `call`.
   #
   #   class ShoutRail < Vangrail::Rail
-  #     def call(text, _context)
+  #     def decide(text, _context)
   #       return pass if text == text.downcase
   #
   #       modify(text.downcase, reason: 'lowered')
@@ -15,7 +15,8 @@ module Vangrail
   #
   # Deliberately not a DSL. A rail is an object with one method, so a Ruby
   # application can write one in five lines, test it without a network, and put
-  # it in the same ordered list as the model-backed ones.
+  # it in the same ordered list as the model-backed ones. Subclasses implement
+  # `#decide`; `#call` scrubs the bytes first so every rail sees readable text.
   class Rail
     # Three sides, not two. `:context` is text the application retrieved and is
     # about to put in a prompt: a wiki page, a search result, a file. It is the
@@ -43,14 +44,37 @@ module Vangrail
 
     # Returns a Result. `context` is a hash the engine threads through:
     # :side, :user_input, :passages, :history, plus anything a caller adds.
-    def call(_text, _context)
-      raise NotImplementedError, "#{self.class} must implement #call"
+    #
+    # Scrubs here so `rail.call(page, side: :context)` (the shape the README
+    # and the tutorial teach) never hands a subclass bytes it cannot read.
+    def call(text, context = {})
+      decide(Rail.usable(text), context)
     end
 
+    # UTF-8 or something that can be read as it. A body off a socket arrives
+    # tagged ASCII-8BIT whatever is in it, so the tag is corrected before the
+    # bytes are judged; only genuinely broken sequences are scrubbed, and the
+    # scrub leaves a replacement character where the byte was, which
+    # Rails::Obfuscation then treats as the evasion it is.
+    def self.usable(text)
+      body = text.to_s
+      body = body.dup.force_encoding(Encoding::UTF_8) unless body.encoding == Encoding::UTF_8
+      body.valid_encoding? ? body : body.scrub
+    end
+
+    # Subclasses implement this. `text` is already readable UTF-8.
+    def decide(_text, _context)
+      raise NotImplementedError, "#{self.class} must implement #decide"
+    end
+
+    def cache_key(_text, _context) = nil
+
+    def quantifies? = false
+
     # Does this rail need the network. Used to report a posture and to let a
-    # caller build a model-free engine on purpose.
+    # caller build a model-free engine on purpose. The rare case is networked.
     def offline?
-      false
+      true
     end
 
     # A rail that stands in for one that could not be built, rather than a rail
@@ -61,6 +85,20 @@ module Vangrail
       false
     end
 
+    # True when this rail's job is to say whether the other rails apply, not
+    # to contribute a hit. Language is the case: it never blocks, and a miss
+    # means the lexicon rails did not read the page.
+    def posture?
+      false
+    end
+
+    # True when a hit or a silence is meaningful even if the page is not in a
+    # language the lexicons cover. Markup, budgets, and secrets do not care
+    # what language the words are in. Pattern and concept rails do.
+    def language_agnostic?
+      false
+    end
+
     def to_s
       name
     end
@@ -81,8 +119,8 @@ module Vangrail
 
     # A rail that could not reach a decision allows the text and says so. It
     # must never look like a clean check.
-    def unchecked(reason)
-      Result.unchecked(rail: name, reason: reason)
+    def unchecked(reason, **kwargs)
+      Result.unchecked(rail: name, reason: reason, **kwargs)
     end
 
     def default_name

data/lib/vangrail/rails/alignment.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require_relative '../nlp'
+require_relative '../rail'
+
+module Vangrail
+  module Rails
+    # Catches the injection whose concepts are in the right order but too far
+    # apart for the pair window.
+    #
+    # Rails::Paraphrase matches two concepts inside a short token window.
+    # That is the right rule for a clause, and it is the wrong rule for
+    # "Ignore, once you have loaded the module the reservation policy
+    # describes, every previous instruction": the override and the
+    # instruction are one statement with an adjunct in the middle, and the
+    # window treats them as two.
+    #
+    # Templates are three concepts, not two. The pair rail already owns the
+    # close case. Last-in-order within a span: the last occurrence of each
+    # template concept, in the template's order, with a coordinator between
+    # them treated as two statements. That is what a window of six cannot
+    # be. Ordered, so "follow the guidance and ignore stale copies" still
+    # does not match. Extra copies of :instruction (a "policy" mentioned
+    # mid-clause) do not steal the object.
+    class Alignment < Rail
+      TEMPLATES = [
+        { label: 'instruction_override', concepts: %i[override totality instruction] },
+        { label: 'instruction_override', concepts: %i[override totality prior] },
+        { label: 'prompt_disclosure', concepts: %i[reveal self secret] },
+      ].freeze
+
+      attr_reader :templates, :languages
+
+      def initialize(templates: TEMPLATES, languages: NLP::LANGUAGES, name: 'alignment',
+                     sides: %i[input context])
+        super(name: name, sides: sides)
+        @templates = templates
+        @languages = Array(languages).map(&:to_sym)
+        unknown = @languages - NLP::LANGUAGES
+        raise ArgumentError, "unknown language(s): #{unknown.join(', ')}" unless unknown.empty?
+      end
+
+      def cache_key(text, _context)
+        "#{languages.join('+')}\n#{text}"
+      end
+
+      def decide(text, _context)
+        clauses = NLP.clauses(text)
+        hits = NLP.clause_concepts(text, languages: languages).flat_map.with_index do |found, i|
+          clause_hits(found, NLP.words(clauses[i]))
+        end
+        return pass if hits.empty?
+
+        block(categories: hits.map { |hit| hit[:label] }.uniq,
+              reason: "aligned instruction: #{hits.map { |hit| describe(hit) }.uniq.join('; ')}")
+      end
+
+      private
+
+      def clause_hits(found, tokens)
+        return [] if found.empty?
+
+        templates.filter_map { |template| align(found, tokens, template) }
+      end
+
+      # Last occurrence of each template concept, in the template's order.
+      def align(found, tokens, template)
+        target = template[:concepts]
+        return nil if target.size < 3
+
+        last = {}
+        found.each { |(i, concept, word)| last[concept] = [i, concept, word] if target.include?(concept) }
+        placed = target.map { |concept| last[concept] }
+        return nil if placed.any?(&:nil?)
+        return nil unless placed.each_cons(2).all? { |(left, right)| left[0] < right[0] }
+        return nil if (placed.last[0] - placed.first[0]) > 20
+        return nil if coordinated?(tokens, placed.first[0], placed.last[0])
+
+        { label: template[:label], words: placed.map { |(_, _, word)| word } }
+      end
+
+      def coordinated?(tokens, start_at, stop_at)
+        tokens[(start_at + 1)...stop_at].any? { |word| NLP::COORDINATOR_STEMS.include?(NLP.stem(word)) }
+      end
+
+      def describe(hit)
+        "#{hit[:label]} (#{hit[:words].join(' ... ')})"
+      end
+    end
+  end
+end

data/lib/vangrail/rails/bayes.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+require_relative '../bayes_data'
+require_relative '../nlp'
+require_relative '../rail'
+
+module Vangrail
+  module Rails
+    # A naive Bayes classifier over word n-grams, which is the oldest working
+    # text classifier there is and the only rail here that says how sure it is.
+    #
+    # Every other rail answers yes or no, so it hands the evidence arithmetic
+    # exactly one bit of information however certain it was. This one computes a
+    # log-likelihood ratio directly, which is the quantity that arithmetic
+    # actually wants: a clause scoring twelve bits and a clause scoring three
+    # both "fire", and they are not the same observation. A rail that puts
+    # `bits` in its result's `raw` is read that way by Engine#assess, and this is
+    # the first rail to do it.
+    #
+    # Scored clause by clause, taking the worst. The same dilution problem the
+    # containment rail hit applies here with force: an attack document is
+    # ordinary documentation with one injected sentence in it, and a bag of
+    # features over the whole page is mostly evidence about the handbook.
+    #
+    # The shipped weights are a demonstration, and the honest number says so.
+    # Cross-validated over five folds on 48 attack clauses and 56 benign ones,
+    # at a threshold no held-out benign document reached, it catches 15 of 48
+    # attacks: worse than the lexicon rails, which catch three quarters. The
+    # reason is the corpus rather than the method. Forty-eight training clauses
+    # written to be varied share almost no vocabulary with the held-out ones, and
+    # the junk-mail filters this borrows from were fitted on millions of
+    # examples.
+    #
+    # So it is off by default, and what it is for is the retraining path: a
+    # deployment with its own traffic runs script/train_bayes.rb against its own
+    # corpus and gets a rail fitted to the attacks it actually receives, with a
+    # cross-validated number attached rather than a promise.
+    class Bayes < Rail
+      def initialize(weights: BayesData::WEIGHTS, threshold: BayesData::THRESHOLD,
+                     calibration: BayesData::CALIBRATION, name: 'bayes', sides: %i[input context])
+        super(name: name, sides: sides)
+        @weights = weights
+        @threshold = threshold
+        @calibration = calibration
+      end
+
+      attr_reader :weights, :threshold, :calibration
+
+      def quantifies?
+        true
+      end
+
+      def cache_key(text, _context)
+        "#{threshold}\n#{text}"
+      end
+
+      def decide(text, _context)
+        score = score_for(text)
+        evidence = bits_for(score)
+        payload = { 'bits' => evidence, 'score' => score }
+        # The middle calibration band has both classes in it (22 attacks and
+        # 8 ordinary pages between 0 and the threshold). A score there is
+        # not a decision. Above the threshold no held-out benign document
+        # landed, and at or below 0 no held-out attack did.
+        return unchecked('score sits in a band the calibration cannot separate', raw: payload) if overlap?(score)
+        return pass(raw: payload) if score <= threshold
+
+        block(categories: ['bayes'], raw: payload,
+              reason: format('scores %<score>+.1f, worth %<bits>+.1f bits of evidence', score: score,
+                                                                                        bits: evidence))
+      end
+
+      def overlap?(score)
+        score.positive? && score <= threshold
+      end
+
+      # The worst clause's raw naive Bayes score. Not a likelihood ratio and not
+      # to be added to one: the features are counted as independent and are not,
+      # so this number is confidently wrong about its own size. It decides the
+      # block, because a threshold only needs an ordering.
+      def score_for(text)
+        clauses = NLP.clauses(text)
+        return clause_score(text.to_s) if clauses.empty?
+
+        clauses.map { |clause| clause_score(clause) }.max
+      end
+
+      # What that score is actually worth, from the calibration fitted on
+      # held-out folds and read at the 95% bound. This is the number that goes
+      # into a posterior, and it is bounded by what 48 attack clauses can
+      # demonstrate rather than by how loudly the classifier scored.
+      def bits(text)
+        bits_for(score_for(text))
+      end
+
+      def bits_for(score)
+        band = calibration.reverse.detect { |floor, _| score > floor }
+        band ? band.last : calibration.first.last
+      end
+
+      private
+
+      def clause_score(text)
+        features(text).sum { |feature| weights[feature] || 0.0 }
+      end
+
+      # Word stems and adjacent stem pairs, through the same stemmer the lexicon
+      # rails use, so both read the text the same way.
+      def features(text)
+        words = NLP.words(text).map { |word| NLP.stem(word) }
+        (words + words.each_cons(2).map { |pair| pair.join(' ') }).uniq
+      end
+    end
+  end
+end

data/lib/vangrail/rails/budget.rb

@@ -40,7 +40,7 @@ module Vangrail
         @max_context = max_context
       end
 
-      def offline?
+      def language_agnostic?
         true
       end
 
@@ -48,7 +48,7 @@ module Vangrail
         "#{context[:side]}:#{text.to_s.length}"
       end
 
-      def call(text, context)
+      def decide(text, context)
         limit = context[:side] == :context ? max_context : max_characters
         return pass if limit.nil?
 

data/lib/vangrail/rails/canary.rb

@@ -44,7 +44,7 @@ module Vangrail
         raise ArgumentError, 'a canary rail needs at least one token' if @tokens.empty?
       end
 
-      def offline?
+      def language_agnostic?
         true
       end
 
@@ -52,7 +52,7 @@ module Vangrail
         text
       end
 
-      def call(text, context)
+      def decide(text, context)
         body = text.to_s
         # Formatting is not concealment, but a model that writes the token with
         # a line break or a backtick in it has still leaked it, so the

data/lib/vangrail/rails/colang_flow.rb

@@ -20,14 +20,22 @@ module Vangrail
       def initialize(flow_name:, program:, actions:, name: nil, sides: Rail::SIDES)
         super(name: name || flow_name, sides: sides)
         @flow_name = flow_name
+        raise ColangError, "no flow named #{flow_name.inspect}" unless program.flow(flow_name)
+
         @interpreter = Colang::Interpreter.new(program: program, actions: actions)
       end
 
+      # Actions registered on the flow can hit the network. The default
+      # offline? is true; this rail is not that case.
+      def offline?
+        false
+      end
+
       def cache_key(_text, _context)
         nil
       end
 
-      def call(text, context)
+      def decide(text, context)
         outcome = interpreter.run(flow_name, context.merge(text: text))
         case outcome.status
         when :blocked then block(content: outcome.content, reason: outcome.reason || flow_name)

data/lib/vangrail/rails/escalation.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative '../nlp'
 require_relative '../rail'
 
 module Vangrail
@@ -43,7 +44,11 @@ module Vangrail
         \A[^.?!]{0,60}\b(?:as\s+i\s+(?:said|asked|mentioned)|like\s+i\s+(?:said|asked)|
            (?:the|my)\s+(?:previous|last|earlier)\s+(?:question|request|message)|
            try\s+again|answer\s+(?:it|that|the\s+question)\s+anyway|
-           just\s+(?:answer|tell|say)|come\s+on|continue|go\s+on|please\s+continue)\b
+           just\s+(?:answer|tell|say)|come\s+on|continue|go\s+on|please\s+continue|
+           zoals\s+ik\s+(?:zei|vroeg|al\s+zei)|
+           (?:de|mijn)\s+(?:vorige|eerdere|laatste)\s+(?:vraag|verzoek|bericht)|
+           probeer\s+opnieuw|beantwoord\s+(?:het|die\s+vraag)\s+gewoon|
+           ga\s+(?:gewoon\s+)?(?:door|verder)|alsjeblieft\s+doorgaan)\b
       /xi
 
       # The openers that exist to relabel a refused request as something else.
@@ -52,7 +57,10 @@ module Vangrail
            educational\s+purposes|academic\s+purposes)|purely\s+(?:academic|hypothetical)|
            what\s+if\s+i\s+(?:told\s+you|said)|imagine\s+(?:that\s+)?you|
            let\s+me\s+rephrase|to\s+(?:re)?phrase\s+(?:it|that)\s+differently|
-           you\s+misunderstood|that\s+is\s+not\s+what\s+i\s+(?:meant|asked))\b
+           you\s+misunderstood|that\s+is\s+not\s+what\s+i\s+(?:meant|asked)|
+           hypothetisch|in\s+theorie|voor\s+(?:een\s+vriend|onderzoek|een\s+paper)|
+           puur\s+(?:academisch|hypothetisch)|stel\s+dat|laat\s+me\s+(?:het\s+)?herformuleren|
+           je\s+hebt\s+me\s+verkeerd\s+begrepen|dat\s+is\s+niet\s+wat\s+ik\s+(?:bedoelde|vroeg))\b
       /xi
 
       STOP = %w[
@@ -60,6 +68,9 @@ module Vangrail
         from by as it its this that these those i you he she they we me my your do
         does did how what why when where can could would should will shall may
         might must not no yes if then than so about into over under please
+        de het een van en of maar is zijn was waren te in op aan voor met tot
+        bij als dan dat die dit deze ik je we zij jij u uw mijn niet geen ja
+        nee hoe wat waarom wanneer waar kan zou moet zal wel nog
       ].freeze
 
       attr_reader :overlap, :window, :tolerance
@@ -78,17 +89,13 @@ module Vangrail
         @tolerance = tolerance
       end
 
-      def offline?
-        true
-      end
-
       # Not memoizable: the same question means different things depending on
       # what came before it, which is the entire premise of the rail.
       def cache_key(_text, _context)
         nil
       end
 
-      def call(text, context)
+      def decide(text, context)
         # A caller that never passes :history is not threading a dialogue, and
         # this rail has not checked anything: say so. A caller that passes an
         # empty one is threading a dialogue that has just started, which is a
@@ -166,7 +173,7 @@ module Vangrail
       end
 
       def content_words(text)
-        text.to_s.downcase.scan(/[a-z0-9_-]{2,}/) - STOP
+        NLP.words(text).reject { |word| STOP.include?(word) }
       end
 
       def user?(turn)

data/lib/vangrail/rails/exfiltration.rb

@@ -67,7 +67,7 @@ module Vangrail
         @max_query = max_query
       end
 
-      def offline?
+      def language_agnostic?
         true
       end
 
@@ -75,7 +75,7 @@ module Vangrail
         text
       end
 
-      def call(text, _context)
+      def decide(text, _context)
         body = text.to_s
         found = []
         cleaned = strip_all(body, found)

data/lib/vangrail/rails/grounding.rb

@@ -33,25 +33,28 @@ module Vangrail
         end
       end
 
+      def offline?
+        false
+      end
+
       # Not memoizable. Stated rather than left to a default so the reason is
       # visible where the decision is.
       def cache_key(_text, _context)
         nil
       end
 
-      def call(text, context)
+      def decide(text, context)
         passages = Array(context[:passages])
         return unchecked('no passages supplied') if passages.empty?
 
         answer = chat.ask([
                             { 'role' => 'system', 'content' => policy },
-                            { 'role' => 'user', 'content' => Policies.grounding_prompt(text, passages) }
+                            { 'role' => 'user', 'content' => Policies.grounding_prompt(text, passages) },
                           ])
         parsed = Parsers.policy(answer.text)
         unless parsed[:decided]
-          return Result.new(status: :passed, rail: name, certain: false, model: model,
-                            latency_ms: answer.latency_ms, raw: answer.raw,
-                            reason: "unparsed judge response: #{parsed[:reason]}")
+          return unchecked("unparsed judge response: #{parsed[:reason]}",
+                           model: model, latency_ms: answer.latency_ms, raw: answer.raw)
         end
 
         return pass(model: model, latency_ms: answer.latency_ms, raw: answer.raw) unless parsed[:violated]