@mutagent/evaluator 0.1.0-alpha.5 → 0.1.0-alpha.6

package/.claude/skills/mutagent-evaluator/scripts/code-quality-verdict.ts

@@ -4,7 +4,7 @@
  * A JUDGE mode that scores a CODE subject's QUALITY (the amended/scaffolded
  * implementation of a `code`-kind subject) and emits a binary PASS/FAIL quality
  * verdict with a critique-before-verdict per criterion. It is the (b) half of the
- * ⑤ IMPROVE loop's code-target BOTH-gate: "converged" for a `code` subject = the
+ * ⑤ OPTIMIZE loop's code-target BOTH-gate: "converged" for a `code` subject = the
  * subject's OWN test suite green (a deterministic gate the session records as
  * `testsGreen`) AND this code-quality verdict PASSes. Neither alone converges.
  *
@@ -28,6 +28,9 @@
  *   - PURE renderer + a thin injected-seam run wrapper. No clock, no random, no
  *     network; the LLM call is the injected `JudgeInvoke` seam so tests drive it.
  */
+import { readFileSync } from "node:fs";
+import { fileURLToPath, URL } from "node:url";
+import { parse as parseYaml } from "yaml";
 import { parseCritiqueVerdict, type JudgeInvoke } from "./determine-outcome.ts";
 import type { JudgePin } from "./build-evals.ts";
 import type { CritiqueVerdict } from "./contracts/eval-types.ts";
@@ -56,76 +59,65 @@ export interface CodeQualityCriterion {
 }
 
 /**
- * ⚠️ FLAGGED-FOR-OPERATOR-SIGN-OFF (Wave-2 W2I1). This is the DRAFT default set of
- * acceptance criteria that define "code quality-pass" BEYOND tests-green. It is
- * implemented behind this clearly-named default so the operator can confirm/adjust
- * the criteria + their severities WITHOUT a code change to the loop. The picks
- * below are a conservative, subject-agnostic starting point — NOT a final contract.
+ * ⚠️ FLAGGED-FOR-OPERATOR-SIGN-OFF (Wave-2 W2I1). The DRAFT default set of acceptance
+ * criteria that define "code quality-pass" BEYOND tests-green.
  *
- * The five drafted criteria (each BINARY, critique-before-verdict):
- *   Q1 spec-faithful  (critical) — the impl realizes the agentspec DEFINITION the
- *                                  amend targeted; no dropped tool / JTBD / silently
- *                                  altered system_prompt (def→impl cascade held).
- *   Q2 addresses-diagnosis (high) — the change actually targets the diagnosed
- *                                  root-cause locus, not an adjacent symptom.
- *   Q3 no-regression  (high)    — no unrelated behavior removed/broken; scope stayed
- *                                  on what the remedy named (scope discipline).
- *   Q4 error-handling (high)    — failure paths are handled, not silently dropped
- *                                  (recovery/observability preserved).
- *   Q5 maintainable   (medium)  — readable, framework-idiomatic, no dead code /
- *                                  copy-paste / obvious footgun introduced.
+ * The rubric itself now lives in `../assets/code-quality-criteria.yaml` — a versioned,
+ * operator-editable ARTIFACT — so the criteria + severities can be tuned WITHOUT a code
+ * change (FU-61.1). This module only LOADS and VALIDATES it; the shape/aggregation stay
+ * in code. Ids/statements/severities are unchanged from the original inline set.
  *
- * Aggregation (also FLAGGED): the gate is severity-gated — a `fail` OR `uncertain`
- * on any CRITICAL/HIGH criterion blocks the quality-pass; MEDIUM is advisory. The
- * operator may instead choose strict-all-pass or a different severity map.
+ * Aggregation (also FLAGGED, still in code): severity-gated — a `fail` OR `uncertain`
+ * on any CRITICAL/HIGH criterion blocks the quality-pass; MEDIUM is advisory.
+ *
+ * Fail-loud: a malformed/missing rubric THROWS at import. There is no silent fallback —
+ * a broken rubric must never quietly degrade the gate.
  */
-export const DEFAULT_CODE_QUALITY_CRITERIA: readonly CodeQualityCriterion[] = [
-  {
-    id: "Q1-spec-faithful",
-    statement: "The implementation realizes the agentspec definition the amend targeted.",
-    passDefinition:
-      "PASS: every spec-declared tool / job-to-be-done is present and the operative system_prompt is unchanged except where the amend intended; the def→impl cascade held.",
-    failDefinition:
-      "FAIL: a spec-declared tool or JTBD is missing, or the system_prompt was altered beyond the amend intent (the impl forked from the SSoT).",
-    severity: CodeQualitySeverity.Critical,
-  },
-  {
-    id: "Q2-addresses-diagnosis",
-    statement: "The change targets the diagnosed root-cause locus, not an adjacent symptom.",
-    passDefinition:
-      "PASS: the edit is at (or directly causes a fix at) the RCA-named locus / the failing-case root.",
-    failDefinition:
-      "FAIL: the change edits an unrelated place or patches a symptom while the root cause remains.",
-    severity: CodeQualitySeverity.High,
-  },
-  {
-    id: "Q3-no-regression",
-    statement: "The change introduces no unrelated regression and stays in scope.",
-    passDefinition:
-      "PASS: only the remedy-named surface changed; no unrelated behavior was removed or broken.",
-    failDefinition:
-      "FAIL: unrelated code was changed/removed, or a previously-working path was broken.",
-    severity: CodeQualitySeverity.High,
-  },
-  {
-    id: "Q4-error-handling",
-    statement: "Failure paths are handled, not silently dropped.",
-    passDefinition:
-      "PASS: error/failure branches surface, recover, or log per the subject's contract; no new silent drop.",
-    failDefinition:
-      "FAIL: a failure is swallowed with no recovery/notify/observability (a silent-drop regression).",
-    severity: CodeQualitySeverity.High,
-  },
-  {
-    id: "Q5-maintainable",
-    statement: "The code is readable, framework-idiomatic, and free of obvious footguns.",
-    passDefinition:
-      "PASS: clear structure, idiomatic to the target framework, no dead code / copy-paste / obvious footgun introduced.",
-    failDefinition:
-      "FAIL: unreadable/duplicated/dead code or an obvious maintainability footgun was introduced.",
-    severity: CodeQualitySeverity.Medium,
-  },
-] as const;
+const CODE_QUALITY_CRITERIA_PATH = fileURLToPath(
+  new URL("../assets/code-quality-criteria.yaml", import.meta.url),
+);
+
+const VALID_SEVERITIES: readonly string[] = Object.values(CodeQualitySeverity);
+
+/** Parse + validate the rubric artifact. PURE given the file; THROWS on any defect. */
+export function parseCodeQualityCriteria(raw: string, source = CODE_QUALITY_CRITERIA_PATH): readonly CodeQualityCriterion[] {
+  // NOTE: a function DECLARATION (not a const arrow) so TS narrows through the
+  // never-returning calls below — control-flow analysis requires this form.
+  function bad(msg: string): never {
+    throw new Error(`code-quality rubric invalid (${source}): ${msg}`);
+  }
+  const doc = parseYaml(raw) as { version?: unknown; criteria?: unknown } | null;
+  if (doc === null || typeof doc !== "object") bad("not a YAML mapping");
+  if (typeof doc.version !== "number") bad("`version` must be a number");
+  if (!Array.isArray(doc.criteria) || doc.criteria.length === 0) bad("`criteria` must be a non-empty list");
+
+  const seen = new Set<string>();
+  const out = (doc.criteria as unknown[]).map((c, i) => {
+    const at = `criteria[${i}]`;
+    if (c === null || typeof c !== "object") return bad(`${at} is not a mapping`);
+    const r = c as Record<string, unknown>;
+    for (const k of ["id", "statement", "passDefinition", "failDefinition", "severity"]) {
+      if (typeof r[k] !== "string" || (r[k] as string).trim() === "") bad(`${at}.${k} must be a non-empty string`);
+    }
+    const id = r.id as string;
+    if (seen.has(id)) bad(`${at}.id "${id}" is duplicated`);
+    seen.add(id);
+    if (!VALID_SEVERITIES.includes(r.severity as string)) {
+      bad(`${at}.severity "${String(r.severity)}" must be one of ${VALID_SEVERITIES.join(" | ")}`);
+    }
+    return {
+      id,
+      statement: r.statement as string,
+      passDefinition: r.passDefinition as string,
+      failDefinition: r.failDefinition as string,
+      severity: r.severity as CodeQualitySeverityValue,
+    } satisfies CodeQualityCriterion;
+  });
+  return Object.freeze(out);
+}
+
+export const DEFAULT_CODE_QUALITY_CRITERIA: readonly CodeQualityCriterion[] =
+  parseCodeQualityCriteria(readFileSync(CODE_QUALITY_CRITERIA_PATH, "utf8"));
 
 /** The code subject under quality review (minimal, subject-agnostic). */
 export interface CodeQualitySubject {

package/.claude/skills/mutagent-evaluator/scripts/config/schema.ts

@@ -235,9 +235,9 @@ export type GlobalSource = Static<typeof GlobalSourceSchema>;
 
 /**
  * A precise link to an Agent / Tooling definition file in a code target.
- * RESERVED — consumed by Build/Improve (future). The evaluator is JUDGE-ONLY (EV-051)
+ * RESERVED — consumed by Build/Optimize (future). The evaluator is JUDGE-ONLY (EV-051)
  * and never writes a target; `targets[].code_refs` is ported for shape parity only and
- * has NO evaluator consumer today. PURPOSE (future): tells BUILD/IMPROVE which files
+ * has NO evaluator consumer today. PURPOSE (future): tells BUILD/OPTIMIZE which files
  * realize the agent so a fix lands on the right def.
  */
 export const CodeRefSchema = Type.Object(
@@ -253,7 +253,7 @@ export type CodeRef = Static<typeof CodeRefSchema>;
  * HOW a fix is applied for a target. `kind` gates the report-only branch.
  * CONSUMER: the diagnostics APPLY path (not the evaluator — judge-only). PURPOSE:
  * selects the write mechanism for a fix.
- *   versioning / pr — RESERVED, consumed by Build/Improve (future). No evaluator
+ *   versioning / pr — RESERVED, consumed by Build/Optimize (future). No evaluator
  *                     consumer; ported for parity. PURPOSE (future): toggle spec-bump /
  *                     open-a-PR on apply.
  */

package/.claude/skills/mutagent-evaluator/scripts/contracts/eval-matrix.ts

@@ -184,6 +184,41 @@ export type SubjectProfileProvenanceValue =
  *  harness/skill marked UNKNOWN, never confabulated). */
 export const PROFILE_UNKNOWN = "unknown" as const;
 
+// ── EV-5 — tool reversibility (does a tool take an IRREVERSIBLE EXTERNAL action?) ─
+//
+// A routing failure that only READS is materially less severe than one that also
+// sends an email or mutates a live system — but nothing surfaced "this session could
+// take irreversible external actions." This classifies each subject tool so the judge
+// preamble can flag it. HONEST: `unknown` when the tool's effect can't be established
+// (never confabulated), never coerced to a false "reversible".
+export const ToolReversibility = {
+  /** a pure/no-op tool (no external effect). */
+  None: "none",
+  /** an external action that can be undone / re-run safely (a read, an idempotent write). */
+  Reversible: "reversible",
+  /** an external action that CANNOT be undone (send/email/charge/delete/deploy/post). */
+  IrreversibleExternal: "irreversible-external",
+  /** the tool's effect can't be established from the inputs — flagged, never guessed. */
+  Unknown: "unknown",
+} as const;
+export type ToolReversibilityValue =
+  (typeof ToolReversibility)[keyof typeof ToolReversibility];
+
+/** One tool's reversibility classification (EV-5). */
+export const ToolReversibilitySchema = Type.Object(
+  {
+    name: Type.String({ minLength: 1 }),
+    reversibility: Type.Union([
+      Type.Literal(ToolReversibility.None),
+      Type.Literal(ToolReversibility.Reversible),
+      Type.Literal(ToolReversibility.IrreversibleExternal),
+      Type.Literal(ToolReversibility.Unknown),
+    ]),
+  },
+  { additionalProperties: false },
+);
+export type ToolReversibilityEntry = Static<typeof ToolReversibilitySchema>;
+
 export const SubjectProfileSchema = Type.Object(
   {
     /** what the agent IS (name / role identity). */
@@ -195,6 +230,10 @@ export const SubjectProfileSchema = Type.Object(
     purpose: Type.String({ minLength: 1 }),
     /** the tools the agent wields (GIVEN inventory or reconstructed from the trace batch). */
     tools: Type.Array(Type.String({ minLength: 1 })),
+    /** EV-5 — per-tool reversibility (none · reversible · irreversible-external · unknown)
+     *  so the judge sees which tools take IRREVERSIBLE EXTERNAL actions BEFORE it weighs a
+     *  failure. ADDITIVE/OPTIONAL: absent ⇒ the judge reads the bare tool list. */
+    toolReversibility: Type.Optional(Type.Array(ToolReversibilitySchema)),
     /** the skill the agent runs under, when known (`unknown` ≠ confabulated). */
     skill: Type.Optional(Type.String()),
     /** the agent's responsibility boundary / scope. */

package/.claude/skills/mutagent-evaluator/scripts/determine-outcome.ts

@@ -39,6 +39,14 @@ import {
 export type JudgeInvoke = (
   systemPrompt: string,
   userPrompt: string,
+  /**
+   * INF-3 — an OPTIONAL session/trace id the DETERMINER passes so its verdict is
+   * keyed per-trace: two sessions with an identical (e.g. empty) determiner prompt
+   * never collapse onto one verdict file. Absent for the per-criterion judges (their
+   * prompts are already distinct; keying salt-free keeps their hashes byte-identical,
+   * C-PIN). Both agent-dispatch seams forward it to `verdictFileName(system,user,keyId)`.
+   */
+  keyId?: string,
 ) => Promise<string>;
 
 // ── Event classification (the intended-goal half of the read) ───────────────

package/.claude/skills/mutagent-evaluator/scripts/edd/change-request.ts

@@ -149,7 +149,7 @@ export interface EddLoopDecision {
  *   1. FULL GREEN   — varianceStable AND accuracyMet ⇒ DONE (success).
  *   2. MAX SWINGS   — swing ≥ budget.maxSwings ⇒ STOP (report delta).
  *   3. MAX WALLCLOCK— elapsedMs ≥ budget.maxWallclockMs ⇒ STOP.
- *   4. NO-IMPROVE   — noImprovementStreak ≥ budget.noImprovementStreakLimit ⇒ STOP.
+ *   4. NO-OPTIMIZE   — noImprovementStreak ≥ budget.noImprovementStreakLimit ⇒ STOP.
  *   else CONTINUE — keep swinging; the next phase is variance until it's stable,
  *   then accuracy (F19 ordering is preserved by `nextPhaseAfterVariance`, but the
  *   loop controller mirrors it: not-stable ⇒ variance, stable ⇒ accuracy).

package/.claude/skills/mutagent-evaluator/scripts/edd/edd-types.ts

@@ -1,10 +1,10 @@
 /**
  * scripts/edd/edd-types.ts
  * ---------------------------------------------------------------------------
- * Shared categorical constants + TypeBox contracts for the ADL IMPROVE stage —
+ * Shared categorical constants + TypeBox contracts for the ADL OPTIMIZE stage —
  * the Eval-Driven-Development (EDD) loop (F18 closure + F19 variance-first).
  *
- * EDD is the ③ IMPROVE stage of the ADL: after the initial *build, the loop
+ * EDD is the ③ OPTIMIZE stage of the ADL: after the initial *build, the loop
  * drives spec ↔ impl ↔ eval to full green. Two findings live here:
  *
  *   F19 — VARIANCE-FIRST. The FIRST focus after the build is eliminating per-case

package/.claude/skills/mutagent-evaluator/scripts/judge-prompt-template.ts

@@ -48,20 +48,94 @@ function promptOf(trace: EvalTrace): string {
 
 // ── Determiner (EV-042) prompt — MIRRORS assets/agents/error-analyst.md ──────
 
+/**
+ * EV-1 — the compact SUBJECT FRAME the determiner reads so it derives THIS subject's
+ * expected outcome (identity · purpose · tools + reversibility), instead of judging
+ * against a hardcoded email-agent signal block. Trajectory-LIGHT by design — it never
+ * carries the full step-by-step trajectory (that is the per-criterion judge's job).
+ */
+export interface SubjectFrame {
+  identity: string;
+  purpose: string;
+  tools: string[];
+  toolReversibility?: { name: string; reversibility: string }[];
+}
+
+/** The distinct tool names actually invoked in a trace, in first-seen order (compact summary). */
+function keyToolsUsed(trace: EvalTrace, limit = 8): string[] {
+  const seen: string[] = [];
+  for (const o of trace.observations) {
+    if (o.type === "TOOL" && typeof o.name === "string" && !seen.includes(o.name)) {
+      seen.push(o.name);
+      if (seen.length >= limit) break;
+    }
+  }
+  return seen;
+}
+
+/** Render the subject frame block for the determiner (EV-1). Trajectory-light. */
+function subjectFrameBlock(subject: SubjectFrame | undefined): string[] {
+  if (subject === undefined) {
+    return [
+      "SUBJECT: not supplied — RECONSTRUCT what the agent is from the input event + the",
+      "tools it called, and derive the expected outcome from that. Do NOT assume any",
+      "particular domain (e.g. email).",
+      "",
+    ];
+  }
+  const rev = new Map((subject.toolReversibility ?? []).map((t) => [t.name, t.reversibility]));
+  const toolLine =
+    subject.tools.length > 0
+      ? subject.tools
+          .map((n) => {
+            const r = rev.get(n);
+            return r !== undefined && r !== "unknown" ? `${n} [${r}]` : n;
+          })
+          .join(", ")
+      : "(none)";
+  const irreversible = (subject.toolReversibility ?? [])
+    .filter((t) => t.reversibility === "irreversible-external")
+    .map((t) => t.name);
+  return [
+    "SUBJECT (derive the EXPECTED outcome for THIS subject before you judge):",
+    `  identity: ${subject.identity}`,
+    `  purpose:  ${subject.purpose}`,
+    `  tools:    ${toolLine}`,
+    ...(irreversible.length > 0
+      ? [`  ⚠ irreversible-external tools: ${irreversible.join(", ")} — a failure that also fired one is materially worse.`]
+      : []),
+    "",
+  ];
+}
+
 /**
  * Render the determiner judge prompt for the in-house/export substrate. The
  * AUTHORITATIVE "inaction can be success" rubric is `error-analyst.md`; this is
  * its provider-callable mirror. No decision is made here.
+ *
+ * EV-1 — subject-aware: given a `subject` frame the determiner derives the expected
+ * outcome from the subject's identity/purpose/tools (not a fixed email-agent signal
+ * block), and reads a COMPACT outcome summary (event · did-it-act · key tools ·
+ * terminal state) — deliberately NOT the full trajectory (the per-criterion judge's
+ * job). The domain-specific signals (send / guard / recovery) render ONLY when the
+ * subject vocab actually defines them, so a non-email subject no longer sees dead lines.
  */
 export function buildOutcomePrompt(
   trace: EvalTrace,
   signals: OutcomeSignals,
   vocab: SubjectVocab,
+  subject?: SubjectFrame,
 ): { system: string; user: string } {
   const system = [
     "You are a success/failure determiner for an autonomous agent session.",
     "Decide whether the session REACHED THE GOAL implied by its input event.",
     "",
+    "Derive the EXPECTED outcome from the SUBJECT (its identity · purpose · tools) +",
+    "the input event — do NOT assume any particular domain (e.g. email). This is a",
+    "FAST input→output outcome check: read the goal (input), the result (output/self-",
+    "summary) and the compact summary below — NOT the full step-by-step trajectory",
+    "(that is the per-criterion judge's job).",
+    "",
     "CRITICAL RULE — inaction can be success. Holding (sending nothing, calling",
     "no tool) is the CORRECT outcome when the event is a restraint directive",
     "(e.g. a guard/hold directive) or when acting would be wrong. You MUST NOT",
@@ -74,23 +148,39 @@ export function buildOutcomePrompt(
     "Reason first in `critique`, then commit to `result`.",
   ].join("\n");
 
-  // Generic guard-counter label — the attribute NAME comes from the subject vocab.
-  const guardLabel = vocab.guardCounterAttr ?? "guard counter";
+  const responseText = typeof trace.output?.response === "string" ? trace.output.response : "";
+  const keyTools = keyToolsUsed(trace);
+
+  // EV-1 — domain signals render ONLY when the subject vocab defines them (else they
+  // were email-agent noise for every subject). honest-null preserved.
+  const conditionalSignals: string[] = [];
+  if (vocab.guardCounterAttr !== null) {
+    conditionalSignals.push(`  Guard ${vocab.guardCounterAttr}: ${signals.guardConsecutive ?? "n/a"}`);
+  }
+  if (vocab.sendTool.length > 0) {
+    conditionalSignals.push(
+      `  Sent a message: ${signals.sentMessage === null ? "unknown" : signals.sentMessage}`,
+      `  Send succeeded: ${signals.sendSucceeded ?? "n/a (no send)"}`,
+    );
+  }
+  if (vocab.recoveryTools.length > 0) {
+    conditionalSignals.push(`  Recovery tool present: ${signals.recoveryPresent}`);
+  }
+
   const user = [
-    `Event kind: ${signals.eventKind}`,
-    `Guard ${guardLabel}: ${signals.guardConsecutive ?? "n/a"}`,
-    `Tools called: ${signals.toolCount}`,
-    // EV-049 honest-null: render UNKNOWN as "unknown" (the subject's send tool is
-    // unset/uninferred) — never coerce it to "false", which would lie to the judge.
-    `Sent a message: ${signals.sentMessage === null ? "unknown" : signals.sentMessage}`,
-    `Send succeeded: ${signals.sendSucceeded ?? "n/a (no send)"}`,
-    `Recovery tool present: ${signals.recoveryPresent}`,
+    ...subjectFrameBlock(subject),
+    "OUTCOME SUMMARY (compact — NOT the full trajectory):",
+    `  Event kind: ${signals.eventKind}`,
+    `  Tools called: ${signals.toolCount}${keyTools.length > 0 ? ` · key tools: ${keyTools.join(", ")}` : ""}`,
+    `  Did the agent act: ${signals.toolCount > 0 ? "yes (called tools)" : "no (no tool calls)"}`,
+    `  Terminal state: ${responseText.length > 0 ? "produced a self-summary/response" : "no self-summary"}`,
+    ...conditionalSignals,
     "",
     "Input event prompt:",
     promptOf(trace),
     "",
     "Agent self-summary (output.response):",
-    typeof trace.output?.response === "string" ? trace.output.response : "(none)",
+    responseText.length > 0 ? responseText : "(none)",
   ].join("\n");
 
   return { system, user };
@@ -107,10 +197,13 @@ export async function determineOutcome(
   trace: EvalTrace,
   judge: JudgeInvoke,
   vocab: SubjectVocab,
+  subject?: SubjectFrame,
 ): Promise<OutcomeResult> {
   const signals = extractOutcomeSignals(trace, vocab);
-  const { system, user } = buildOutcomePrompt(trace, signals, vocab);
-  const raw = await judge(system, user);
+  const { system, user } = buildOutcomePrompt(trace, signals, vocab, subject);
+  // INF-3 — pass the trace id so the determiner verdict is keyed PER-TRACE (two
+  // sessions with an identical determiner prompt never share one verdict).
+  const raw = await judge(system, user, trace.id);
   const verdict = parseCritiqueVerdict(raw);
   return {
     traceId: trace.id,
@@ -153,7 +246,8 @@ function profilePreamble(profile?: SubjectProfile): string[] {
     `  identity: ${profile.identity}`,
     `  purpose:  ${profile.purpose}`,
     `  scope:    ${profile.scope}`,
-    `  tools:    ${(profile.tools ?? []).join(", ") || "(none observed)"}`,
+    `  tools:    ${renderToolLine(profile)}`,
+    ...reversibilityCallout(profile),
     profile.skill !== undefined ? `  skill:    ${profile.skill}` : "",
     `  harness:  ${profile.harness}`,
     `  provenance: ${profile.provenance}${profile.version !== undefined ? ` · version ${profile.version}` : ""}`,
@@ -161,6 +255,36 @@ function profilePreamble(profile?: SubjectProfile): string[] {
   ].filter((l) => l !== "");
 }
 
+/** Render the tools line, annotating each tool with its EV-5 reversibility when known. */
+function renderToolLine(profile: SubjectProfile): string {
+  const tools = profile.tools ?? [];
+  if (tools.length === 0) return "(none observed)";
+  const rev = new Map((profile.toolReversibility ?? []).map((t) => [t.name, t.reversibility]));
+  return tools
+    .map((name) => {
+      const r = rev.get(name);
+      return r !== undefined && r !== "unknown" ? `${name} [${r}]` : name;
+    })
+    .join(", ");
+}
+
+/**
+ * EV-5 — a one-line callout naming the tools that take IRREVERSIBLE EXTERNAL actions,
+ * so a failure that ALSO fired one weighs heavier than a read-only failure. Absent
+ * reversibility data ⇒ no callout (the judge still reads the bare tool list).
+ */
+function reversibilityCallout(profile: SubjectProfile): string[] {
+  const irreversible = (profile.toolReversibility ?? [])
+    .filter((t) => t.reversibility === "irreversible-external")
+    .map((t) => t.name);
+  if (irreversible.length === 0) return [];
+  return [
+    `  ⚠ irreversible-external tools: ${irreversible.join(", ")} — a failure that ALSO`,
+    "    fired one of these (an email sent, a live system mutated) is MATERIALLY WORSE",
+    "    than a read-only failure; weigh that in your critique.",
+  ];
+}
+
 /**
  * Render the 4-component per-criterion judge prompt for the in-house/export
  * substrate. The AUTHORITATIVE 4-component / binary / critique-before-verdict
@@ -227,6 +351,11 @@ export async function runJudge(
   subjectTrace: EvalTrace,
   judge: JudgeInvoke,
   pin: JudgePin,
+  // EV-5 CUT WIRE 1 — the M1 subject profile the judge reads in its preamble (tools +
+  // reversibility). Pre-fix runJudge called buildJudgePrompt WITHOUT it, so the export
+  // path always hit the "profile not supplied — reconstruct" branch and never saw the
+  // reversibility flags. The pipeline now builds it once (buildSubjectProfile) and passes it.
+  subjectProfile?: SubjectProfile,
 ): Promise<CriterionVerdict> {
   if (typeof pin.modelId !== "string" || pin.modelId.length === 0) {
     throw new Error(
@@ -240,7 +369,7 @@ export async function runJudge(
         "MODEL INTENT IS SACRED: reruns must be byte-identical (C-PIN); refusing.",
     );
   }
-  const { system, user } = buildJudgePrompt(spec, subjectTrace);
+  const { system, user } = buildJudgePrompt(spec, subjectTrace, subjectProfile);
   const raw = await judge(system, user);
   const verdict = parseCritiqueVerdict(raw);
   return {

package/.claude/skills/mutagent-evaluator/scripts/memory/append.ts

@@ -37,7 +37,7 @@ export const Lifecycle = {
   Build: "build",
   Evaluate: "evaluate",
   Diagnose: "diagnose",
-  Improve: "improve",
+  Optimize: "optimize",
   General: "general",
 } as const;
 export type LifecycleValue = (typeof Lifecycle)[keyof typeof Lifecycle];