@alex-dbs/coderuler 1.4.0 → 1.6.0

package/dist/infra/runtime.js

@@ -1,6 +1,7 @@
 import { stat } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
+import { createLspBackend, createRubyLspBackend, createTypescriptLspBackend } from '../adapter/lsp/backend.js';
 import { runProgram } from '../adapter/cli/program.js';
 import { terminalCapabilities } from '../adapter/cli/progress.js';
 import { createRedactor, escapeDiagnostic } from '../adapter/cli/text.js';
@@ -17,7 +18,7 @@ function loadEnvironment(cwd) {
     }
 }
 export function createServices(cwd, env) {
-    const redact = createRedactor([env.TYPESAFE_API_KEY, env.GITHUB_TOKEN]);
+    const redact = createRedactor([env.TYPESAFE_API_KEY, env.OPENAI_API_KEY, env.GITHUB_TOKEN]);
     let dependenciesPromise;
     let ruleServicesPromise;
     const getDependencies = (context) => dependenciesPromise ??= (async () => {
@@ -67,16 +68,25 @@ export function createServices(cwd, env) {
                     ...ruleServices,
                     createProject: project.createProject,
                     resolveTarget: project.resolveTarget,
-                    runRules: execution.executeRules,
+                    runRules: (rules, runContext) => execution.executeRules(rules, {
+                        ...runContext,
+                        createLspBackend: runContext.createLspBackend ?? createLspBackend,
+                        createRubyLspBackend: runContext.createRubyLspBackend ?? createRubyLspBackend,
+                        createTypescriptLspBackend: runContext.createTypescriptLspBackend ?? createTypescriptLspBackend,
+                    }),
                     decisionResolver: (thresholdOverride, pricingOverrides) => settings.createDecisionResolver(env, thresholdOverride, pricingOverrides),
-                    async changedFiles(root, base) {
-                        const { changedFiles } = await import('../adapter/git/changes.js');
-                        return changedFiles(root, base);
+                    async collectChanges(root, base) {
+                        const { collectChanges } = await import('../adapter/git/changes.js');
+                        return collectChanges(root, base);
                     },
                     async checkoutPullRequest(selector, baseBranch) {
                         const { createPullRequestCheckout } = await import('../adapter/github/pull-request.js');
                         return createPullRequestCheckout(cwd, env)(selector, baseBranch);
                     },
+                    async checkoutRuleRepository(selector) {
+                        const { createRuleRepositoryCheckout } = await import('../adapter/git/rules.js');
+                        return createRuleRepositoryCheckout(env)(selector);
+                    },
                     async commentOnPullRequest(root, comments, pullRequest) {
                         const { createGithubCommenter } = await import('../adapter/github/comments.js');
                         return createGithubCommenter(env)(root, comments, pullRequest);
@@ -94,7 +104,12 @@ export function createServices(cwd, env) {
                     ...ruleServices,
                     createProject: project.createProject,
                     resolveTarget: project.resolveTarget,
-                    runRules: execution.executeRules,
+                    runRules: (rules, runContext) => execution.executeRules(rules, {
+                        ...runContext,
+                        createLspBackend: runContext.createLspBackend ?? createLspBackend,
+                        createRubyLspBackend: runContext.createRubyLspBackend ?? createRubyLspBackend,
+                        createTypescriptLspBackend: runContext.createTypescriptLspBackend ?? createTypescriptLspBackend,
+                    }),
                     decisionResolver: (thresholdOverride, pricingOverrides) => settings.createDecisionResolver(env, thresholdOverride, pricingOverrides),
                 };
             },
@@ -103,7 +118,7 @@ export function createServices(cwd, env) {
                 const { runRuleTests } = await import('../adapter/filesystem/rule-tests.js');
                 return {
                     ...ruleServices,
-                    testRules: (rules, onResult, timeoutMs, concurrency, includeAI) => runRuleTests(rules, onResult, timeoutMs, concurrency, includeAI),
+                    testRules: (rules, onResult, timeoutMs, concurrency, includeAI) => runRuleTests(rules, onResult, timeoutMs, concurrency, includeAI, false, createLspBackend, createRubyLspBackend, createTypescriptLspBackend),
                 };
             },
             async update(_context) {
@@ -160,7 +175,11 @@ export async function runCli(argv) {
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        const redact = createRedactor([process.env.TYPESAFE_API_KEY, process.env.GITHUB_TOKEN]);
+        const redact = createRedactor([
+            process.env.TYPESAFE_API_KEY,
+            process.env.OPENAI_API_KEY,
+            process.env.GITHUB_TOKEN,
+        ]);
         process.stderr.write(`coderuler: ${redact(escapeDiagnostic(message))}\n`);
         return EXIT_FAILURE;
     }

package/dist/infra/settings.js

@@ -1,9 +1,13 @@
 import { JevAdapter } from '../adapter/decision/jev.js';
+import { OpenAIAdapter } from '../adapter/decision/openai.js';
 const DEFAULT_BACKEND = 'jev';
 const DEFAULT_MODEL = 'jev-latest';
 const DEFAULT_BASE_URL = 'https://api.typesafe.ai';
+const OPENAI_DEFAULT_MODEL = 'gpt-6-luna';
+const OPENAI_DEFAULT_BASE_URL = 'https://api.openai.com/v1';
 const DEFAULT_THRESHOLD = 0.4;
 const DEFAULT_INPUT_COST_PER_MILLION = 0.042;
+const OPENAI_DEFAULT_INPUT_COST_PER_MILLION = 0.10;
 const DEFAULT_OUTPUT_COST_PER_MILLION = 0;
 const THRESHOLD_MESSAGE = 'must be a number between 0 and 1';
 const DECIMAL = /^(?:[0-9]+(?:\.[0-9]+)?|\.[0-9]+)$/;
@@ -56,9 +60,10 @@ export function createDecisionResolver(env, thresholdOverride, pricingOverrides)
         validatePrice(outputOverride, '--output-cost-per-million');
     return settings => {
         const backend = settings.backend ?? setting(env, 'RK_BACKEND') ?? DEFAULT_BACKEND;
-        if (backend !== 'jev') {
-            throw new Error(`Unknown decision backend '${backend}'; supported backends: ${DEFAULT_BACKEND}`);
+        if (backend !== 'jev' && backend !== 'openai') {
+            throw new Error(`Unknown decision backend '${backend}'; supported backends: jev, openai`);
         }
+        const isOpenAI = backend === 'openai';
         let threshold;
         if (flagThreshold !== undefined) {
             threshold = flagThreshold;
@@ -77,14 +82,20 @@ export function createDecisionResolver(env, thresholdOverride, pricingOverrides)
             validatePrice(settings.outputCostPerMillion, 'rule.settings.outputCostPerMillion');
         }
         const pricing = {
-            inputCostPerMillion: price(inputOverride, settings.inputCostPerMillion, env, 'RK_INPUT_COST_PER_MILLION', DEFAULT_INPUT_COST_PER_MILLION),
+            inputCostPerMillion: price(inputOverride, settings.inputCostPerMillion, env, 'RK_INPUT_COST_PER_MILLION', isOpenAI ? OPENAI_DEFAULT_INPUT_COST_PER_MILLION : DEFAULT_INPUT_COST_PER_MILLION),
             outputCostPerMillion: price(outputOverride, settings.outputCostPerMillion, env, 'RK_OUTPUT_COST_PER_MILLION', DEFAULT_OUTPUT_COST_PER_MILLION),
         };
-        const model = settings.model ?? setting(env, 'TYPESAFE_DEFAULT_MODEL') ?? DEFAULT_MODEL;
-        const baseUrl = setting(env, 'TYPESAFE_BASE_URL') ?? DEFAULT_BASE_URL;
-        const apiKey = setting(env, 'TYPESAFE_API_KEY');
-        if (apiKey === undefined) {
-            throw new Error('No decision API key: set TYPESAFE_API_KEY');
+        const model = settings.model ??
+            setting(env, isOpenAI ? 'OPENAI_DEFAULT_MODEL' : 'TYPESAFE_DEFAULT_MODEL') ??
+            (isOpenAI ? OPENAI_DEFAULT_MODEL : DEFAULT_MODEL);
+        const baseUrl = setting(env, isOpenAI ? 'OPENAI_BASE_URL' : 'TYPESAFE_BASE_URL') ??
+            (isOpenAI ? OPENAI_DEFAULT_BASE_URL : DEFAULT_BASE_URL);
+        const apiKeyName = isOpenAI ? 'OPENAI_API_KEY' : 'TYPESAFE_API_KEY';
+        const apiKey = setting(env, apiKeyName);
+        if (apiKey === undefined)
+            throw new Error(`No decision API key: set ${apiKeyName}`);
+        if (isOpenAI) {
+            return { backend: new OpenAIAdapter({ model, baseUrl, apiKey }), threshold, pricing };
         }
         return { backend: new JevAdapter({ model, baseUrl, apiKey }), threshold, pricing };
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alex-dbs/coderuler",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "license": "Apache-2.0",
   "keywords": [
     "ai",
@@ -90,10 +90,12 @@
     "jsonpath-plus": "11.2.1",
     "npm-install-checks": "9.0.0",
     "npm-package-arg": "14.0.0",
+    "openai": "7.45.1",
     "pacote": "22.0.0",
     "skills": "1.7.2",
     "ssri": "14.0.0",
     "string-width": "8.3.0",
+    "vscode-languageserver-protocol": "3.18.5",
     "yaml": "^2.9.1"
   },
   "devDependencies": {

package/skills/coderuler-new-rule/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: coderuler-new-rule
-description: Create CodeRuler rules, including custom selection, filters and checks, inline tests, and inspection.
+description: Create CodeRuler rules, including custom selection, filters and checks, inline or companion tests, and inspection.
 ---
 
 # Create a CodeRuler rule
@@ -29,10 +29,14 @@ Start the name with its language or technology prefix, such as `go-`, `ts-`, or
 
 Keep rules short, with only a few lines of policy code. Reuse built-in selectors, evaluators, and standard libraries before writing custom logic. Add helpers only for real reuse.
 
-For a deterministic rule, add a named `tests` export with `.passes()` and `.violates()` cases. For an AI rule, put every test case in `aiTests` and do not add a separate `tests` export. Omit `.skips()` assertions when creating a rule: skipped inputs never reach the check and provide no evidence of policy behavior.
+Test cases can live in the rule module or in a sibling `.test` module. For example, `sample.rule.ts` pairs with `sample.test.ts`; keep the same extension for `.mts`, `.js`, and `.mjs`. The `test` command combines exports from both modules. It runs ordinary `tests` by default; include `--ai` to run `aiTests`.
+
+For a deterministic rule, export named `tests` with `.passes()` and `.violates()` cases. For an AI rule, put every test case in `aiTests` and do not add a separate `tests` export. Omit `.skips()` assertions when creating a rule: skipped inputs never reach the check and provide no evidence of policy behavior.
 
 For an AI rule, use `instruction` to state what compliant code does, beginning with a direct requirement. Add only applicability boundaries or real exceptions needed to define the policy; keep one policy per rule. Keep reporting language in `violationMessage`, examples in `examples`, and test cases in `aiTests`—not in the instruction. See [AI instruction style](reference.md#ai-instruction-style).
 
+Keep Jev's input to the smallest scope that still supports a correct decision. For function-local code rules, use `scopes.astGrep` to select one function or method per scope and filter for relevant syntax, such as pointer dereferences.
+
 Run the relevant cases before the policy change and require an assertion mismatch for the intended violation, not a loading error. Implement the policy, then require every case to pass.
 
 This complete example requires at least two replicas whenever `spec.replicas` is an integer:
@@ -92,7 +96,7 @@ coderuler validate
 coderuler test
 ```
 
-`validate` checks the module contract, not policy behavior or TypeScript semantics. `check` and `validate` do not execute inline tests. `test` with no selected cases is an error, not success.
+`validate` checks the module contract, not policy behavior or TypeScript semantics. `check` and `validate` do not run test cases or load sibling `.test` modules. `test` with no selected cases is an error, not success.
 
 Useful test options:
 

package/skills/coderuler-new-rule/reference.md

@@ -173,18 +173,23 @@ The rule name is `proto-route-version`, saved as `.coderuler/proto-route-version
 The public shapes are:
 
 ```ts
-import type { Awaitable, JsonValue, SourceFile, ScopeMatch } from '@alex-dbs/coderuler';
+import type { Awaitable, JsonValue, LineRange, ProjectContext, SourceFile, ScopeMatch } from '@alex-dbs/coderuler';
 
 type ScopeSelector<T = JsonValue> =
-  (file: SourceFile) => Awaitable<readonly ScopeMatch<T>[]>;
+  (file: SourceFile, context?: ProjectContext) => Awaitable<readonly ScopeMatch<T>[]>;
 // SourceFile: { readonly filepath: string; readonly source: string }
 // ScopeMatch<T>: { readonly id: string; readonly source: string;
 //   readonly data?: T;
 //   readonly captures?: Readonly<Record<string, string | readonly string[]>>;
-//   readonly lines?: { readonly start: number; readonly end: number } }
+//   readonly lines?: LineRange }
 ```
 
-Return a dense array; `[]` means no matches. Use stable nonempty IDs and actual source text; line spans are 1-based inclusive. `data` must be finite, acyclic, JSON-compatible (including `null`, `false`, `0`, and `''`); captures contain only strings/string arrays.
+For `--diff` and `--pr`, CodeRuler selects changed files for the rule. It does not narrow custom scopes to changed lines. Your custom selector must use `changedLines` if it needs line-level filtering. A selector that ignores line ranges still checks every selected scope in each changed file.
+
+The engine passes `ProjectContext`; direct calls can omit it. Use stable nonempty IDs and actual source text. Line spans are 1-based and inclusive. `data` must be finite, acyclic, JSON-compatible (including `null`, `false`, `0`, and `''`); captures contain only strings/string arrays.
+When a selector reads diff fields, annotate its `context` parameter as `ProjectContext`. This lets direct callers omit the optional parameter.
+
+`changedFiles` and `changedLines` are `undefined` outside diff/PR checks. In those checks, an empty `changedFiles` set means no files changed. An empty `changedLines` map means there are no entries with line data. `changedLines.get(filepath)` returns added or replaced lines in that file. The ranges are 1-based and inclusive. A missing entry means line data is unavailable, for example for binary or conversion-attributed files. An entry with `[]` means the file changed but has no added lines.
 
 `Selection<T>` is `{ readonly files: readonly string[]; readonly exclude?: readonly string[]; readonly scope?: ScopeSelector<T> }`. `context.select<T>(selection)` returns `Promise<readonly ScopeSubject<T>[]>`. A scope subject adds `kind: 'scope'` and `filepath` to its match. Custom `select` returns flattened scope subjects, not group subjects.
 
@@ -197,14 +202,21 @@ import type {
   ScopeSubject, SelectionContext,
 } from '@alex-dbs/coderuler';
 
-const owners: ScopeSelector<string> = ({ source }) =>
-  source.split('\n').flatMap((line, index) => {
+const owners: ScopeSelector<string> = ({ filepath, source }, context: ProjectContext) => {
+  const candidates = source.split('\n').flatMap((line, index) => {
     const owner = /^# owner: (\S+)\s*$/.exec(line)?.[1];
     return owner === undefined ? [] : [{
       id: `owner:${index + 1}`, source: line, data: owner,
       lines: { start: index + 1, end: index + 1 },
     }];
   });
+  if (context.changedFiles === undefined) return candidates;
+  if (!context.changedFiles.has(filepath)) return [];
+  const ranges = context.changedLines?.get(filepath);
+  if (ranges === undefined) return candidates;
+  return candidates.filter(scope => scope.lines !== undefined && ranges.some(range =>
+    range.start <= scope.lines.end && scope.lines.start <= range.end));
+};
 
 export default class AssignedOwner extends Rule<string> {
   files = ['src/**/*.txt'];
@@ -316,13 +328,68 @@ Results validate; supplied messages survive reporting. Violations without a mess
 
 | Context                                                | Available members                                                                 |
 | ------------------------------------------------------ | --------------------------------------------------------------------------------- |
-| `ProjectContext`                                       | `readonly project: Project`; `trace(message: string, details?: JsonValue): void`. |
+| `ProjectContext`                                       | `project`; optional `changedFiles: ReadonlySet<string>` and `changedLines: ReadonlyMap<string, readonly LineRange[]>`; `trace(message, details?)`. |
 | `SelectionContext extends ProjectContext`              | `select<T>(selection: Selection<T>): Promise<readonly ScopeSubject<T>[]>`.        |
 | `CheckContext<T = JsonValue> extends SelectionContext` | `readonly ruleName: string`; `ai(options: AiOptions<T>): Promise<CheckResult>`. |
 
+`changedFiles` contains paths that changed in the project. `changedLines` maps changed paths to added or replaced lines. These values are absent outside `--diff` and `--pr` runs. In those runs, an empty set means no changed files. An empty map means no exact line ranges are available. A missing entry for a path means line data is unavailable, for example for binary or conversion-attributed files. An entry with `[]` means the file changed but has no added lines.
+
+`isDiffMode(context)` returns `true` when either `changedFiles` or `changedLines` is defined, even if empty; it returns `false` when both are absent. `isInDiff(subject, context)` returns `true` when the subject's line span overlaps a known changed range; a missing span or range returns `false`.
+
+Use both helpers to keep full scans outside diff mode:
+
+```ts
+import {
+  Rule,
+  isDiffMode,
+  isInDiff,
+  type ProjectContext,
+  type ScopeSubject,
+} from '@alex-dbs/coderuler';
+
+export default class Local extends Rule {
+  filter = (subject: ScopeSubject, context: ProjectContext) =>
+    !isDiffMode(context) || isInDiff(subject, context);
+}
+```
 
 Use `trace` for decision evidence visible during inspection; keep normal execution free of ad-hoc console output. AI/regex projection callbacks receive only `ProjectContext`, not the full check context.
 
+`context.goLsp` provides Go-to-definition, declaration, type-definition, implementation, reference, hover, document-symbol, workspace-symbol, caller, and callee queries. `context.rubyLsp` provides Ruby definitions, references, hover, document symbols, and workspace symbols. `context.typescriptLsp` provides TypeScript definitions, type definitions, implementations, references, hover, document symbols, workspace symbols, callers, and callees; declaration lookup is not supported. LSP use is optional. Install Go and `gopls`, Shopify Ruby LSP (`ruby-lsp`), or native TypeScript 7's `tsc` on `PATH` only when a rule uses that language's helpers. CodeRuler does not install these servers. An unsupported operation rejects with a capability error; for example, gopls v0.24.0 does not support declaration lookup.
+
+Pass file paths and positive, 1-based line and UTF-16 column coordinates. A column counts UTF-16 code units. Navigation and hover use column 1 when omitted. Caller and callee queries (Go and TypeScript) use the enclosing named function or method when the column is omitted. Their required `depth` is a nonnegative integer; depth 1 returns direct neighbors. Set `includeDependencies: true` to include available dependency or standard-library source outside the project; the default is `false`. Ruby dependency definitions are excluded by default and can be requested with `includeDependencies: true`.
+
+Caller and callee results are a static call graph. They can omit dynamic calls and do not load every possible package consumer. Use them as the server's known call relationships, not as a complete runtime graph.
+
+Call graph helpers from an async custom check:
+
+```ts
+import { Rule, pass, scopes, violation } from '@alex-dbs/coderuler';
+import type { Evaluator } from '@alex-dbs/coderuler';
+
+export default class CallGraphCheck extends Rule {
+  files = ['**/*.go'];
+  scope = scopes.astGrep({
+    language: 'go',
+    rule: { any: [{ kind: 'function_declaration' }, { kind: 'method_declaration' }] },
+  });
+
+  check: Evaluator = async (subject, context) => {
+    if (subject.kind !== 'scope' || subject.lines === undefined) return pass();
+    const target = { filepath: subject.filepath, line: subject.lines.start };
+    const [callers, callees] = await Promise.all([
+      context.goLsp.callers(target, { depth: 2 }),
+      context.goLsp.callees(target, { depth: 2, includeDependencies: true }),
+    ]);
+    return callers.length + callees.length === 0
+      ? pass()
+      : violation('Review callers and callees');
+  };
+}
+```
+
+The example assumes `pass` and `violation` are imported from the SDK.
+
 ## Regex: matching means passing
 
 `regex<T = JsonValue>(options: RegexOptions<T>): Evaluator<T>` takes `{ readonly pattern: RegExp; readonly violationMessage?: string; readonly input?: (subject: ScopeSubject<T>, context: ProjectContext) => Awaitable<string> }`.
@@ -347,12 +414,12 @@ Default input is `String(data)` for scalar/null data, otherwise source text. `in
 `ai<T = JsonValue>(options: AiOptions<T>): Evaluator<T>` accepts exactly one of `rule` or `instruction`:
 
 - `rule: string`: nonempty policy text. This option is deprecated; use `instruction` for new rules.
-- `instruction: string`: nonempty text describing the expected behavior of the selected code. Write a direct requirement that Jev can judge as respected or broken.
+- `instruction: string`: nonempty text describing the expected behavior of the selected code. Write a direct requirement that the selected provider can judge as respected or broken.
 - `examples?: { readonly good?: readonly string[]; readonly bad?: readonly string[] }`: conditioning examples, dense arrays of nonempty strings; omitted/empty lists are valid.
 - `violationMessage?: string`: nonempty reporting-only message, not sent as instructions.
 - `input?: (subject: Subject<T>, context: ProjectContext) => Awaitable<JsonValue>`: replace the default projection; output validates as JSON-compatible.
 
-Jev uses the fixed question "Is the rule respected?" Yes/true means no problems. No/false means at least one violation. The configured threshold decides pass or violation.
+Jev and OpenAI use the fixed question "Is the rule respected?" A higher probability means the rule is respected. The configured threshold decides pass or violation.
 
 ### AI instruction style
 
@@ -362,7 +429,7 @@ Weak: "Report a violation when a Go pointer is dereferenced without a nil check.
 
 Better: "Check each Go pointer for nil before dereferencing it." For nested fields, add the needed boundary: "Check every pointer in the field path before dereferencing the field."
 
-Keep reporting language in `violationMessage`, conditioning examples in `examples`, and test fixtures in `aiTests`; they do not belong in the instruction. Use selectors and filters for deterministic applicability, and include enough input for the semantic decision.
+Keep reporting language in `violationMessage`, conditioning examples in `examples`, and test fixtures in `aiTests`; they do not belong in the instruction. Use selectors and filters for deterministic applicability. Keep provider input to the smallest scope that still supports a correct decision. For function-local code policies, use `scopes.astGrep` to select one function or method per scope, then filter for relevant syntax such as pointer dereferences. Include surrounding context only when needed to judge the policy.
 
 Compare wording with the policy and dataset held fixed:
 
@@ -372,7 +439,7 @@ Compare wording with the policy and dataset held fixed:
 4. Compare compliant scores toward `1` and violation scores toward `0` separately. Inspect individual regressions and the weakest score in each group, not just averages.
 5. Keep wording that improves separation without changing the policy or introducing wrong decisions. Repeat a close comparison before treating a small gain as reliable.
 
-`PASS` in test output means the expected result matched. A passing violation test still needs a low Jev score. Do not lower the threshold, relabel fixtures, or copy test cases into the instruction to improve the comparison. Results on a tuning dataset do not prove performance on unseen code.
+`PASS` in test output means the expected result matched. A passing violation test still needs a low AI score. Do not lower the threshold, relabel fixtures, or copy test cases into the instruction to improve the comparison. Results on a tuning dataset do not prove performance on unseen code.
 
 
 This rule checks Go pointer dereferences, including nested fields:
@@ -472,9 +539,9 @@ Default AI input is `{ filepath, scope: { id, data, captures? } }` when data exi
 
 Inside a custom check, `return context.ai({ instruction: '...' })` evaluates its current subject with effective settings and preserves AI result metadata. The deprecated `rule` option remains accepted for existing rules. Replacing that result requires intentionally preserving probability/model/threshold metadata; token accounting is automatic across all `context.ai` calls, even when returning a different result. `ai(...)` validates options when constructed but performs no loading-time network I/O.
 
-`RuleSettings` supports backend `'jev'`, model (default `'jev-latest'`), finite threshold in `[0, 1]` (default `0.4`), and finite nonnegative `inputCostPerMillion` / `outputCostPerMillion` prices (USD per million tokens; defaults `0.042` / `0`). Threshold precedence is CLI override → rule setting → `RK_THRESHOLD` → default; backend/model use rule setting → environment (`RK_BACKEND` / `TYPESAFE_DEFAULT_MODEL`) → default. AI passes only when probability is **strictly greater** than threshold; equality violates. Results include the effective threshold. Provider environment/key resolution is lazy at the first AI call; deterministic/skipped/filtered paths need no key. Live calls require `TYPESAFE_API_KEY`; use release configuration guidance for transport setup.
+`RuleSettings.backend` supports `'jev'` and `'openai'`; Jev is the default. Set `model`, threshold, `inputCostPerMillion`, or `outputCostPerMillion` in `settings` to override defaults. Both providers use a threshold of `0.4`; AI passes only when probability is **strictly greater** than threshold, and equality violates. Threshold precedence is CLI override → rule setting → `RK_THRESHOLD` → `0.4`. Backend precedence is rule setting → `RK_BACKEND` → `jev`. Model precedence is rule setting → selected provider's model variable → provider default. Jev uses `TYPESAFE_DEFAULT_MODEL` (default `jev-latest`) and `TYPESAFE_API_KEY`; OpenAI uses `OPENAI_DEFAULT_MODEL` (default `gpt-6-luna`) and `OPENAI_API_KEY`. The base URL variables are `TYPESAFE_BASE_URL` and `OPENAI_BASE_URL`, defaulting to `https://api.typesafe.ai` and `https://api.openai.com/v1`. Provider configuration and credentials are read only when an AI call selects that backend. Deterministic, skipped, and filtered paths need no key.
 
-Inspection reports per-verification `usage: AiUsage` and a final recap: `calls`, `unreportedCalls`, `inputTokens`, `outputTokens`, `inputCost`, and `outputCost` (USD). Counts come from provider responses; missing counts remain unreported and totals cover reported calls only. Configure prices through rule settings or `RK_INPUT_COST_PER_MILLION` / `RK_OUTPUT_COST_PER_MILLION`; inspect flags `--input-cost-per-million` / `--output-cost-per-million` override both. Prices change estimates, not decisions.
+Inspection reports per-verification `usage: AiUsage` and a final recap: `calls`, `unreportedCalls`, `inputTokens`, `outputTokens`, `inputCost`, and `outputCost` (USD). Counts come from provider responses; missing counts remain unreported and totals cover reported calls only. Default input prices are `$0.042` per million tokens for Jev and `$0.10` for OpenAI; both output prices default to `$0`. Price precedence is inspection override → rule setting → `RK_INPUT_COST_PER_MILLION` / `RK_OUTPUT_COST_PER_MILLION` → selected provider default. Prices change estimates, not decisions.
 
 
 ## Project readers