bare-agent 0.45.0 → 0.46.1

package/README.md

@@ -88,7 +88,7 @@ Every piece works alone — take what you need, ignore the rest. Two axes: **Act
 
 | Component | What it does |
 |---|---|
-| **Evaluator + refine** | Judge output by `predicate` (no tokens), `rubric` (an isolated adversarial grader), or `agentic` (a critic that exercises the live artifact). `refine` is the bounded generate→evaluate→regenerate loop |
+| **Evaluator + refine** | Judge output by `predicate` (no tokens), `rubric` (an isolated adversarial grader), `agentic` (a critic that exercises the live artifact), or `jev` (a cheap calibrated classifier tier). `refine` is the bounded generate→evaluate→regenerate loop |
 | **SkillRegistry** | Surface skills on demand: one meta-tool catalog; activating a skill injects its instructions and unlocks its tools |
 | **stash** | Compact finished work out of the live window (restorable), or auto-fold the middle under token pressure |
 

package/bareagent.context.md

@@ -51,7 +51,7 @@ Eight entry points:
 | Retry individual plan steps | runPlan({ stepRetry }) |
 | Use a CLI tool as an LLM provider | CLIPipe |
 | Health-check provider, store, and tools | Loop.validate() |
-| Verify an agent's output (judge / grade / critic) | Evaluator + refine — `predicate` / `rubric` / `agentic` criteria |
+| Verify an agent's output (judge / grade / critic) | Evaluator + refine — `predicate` / `rubric` / `agentic` / `jev` criteria |
 | Decisively judge "did this answer honor the request?" (return-time) | judge — verbatim request + one artifact → `honored`/`broke` + mechanical `where`; `calibrate` admits a tier vs a frozen floor |
 | Cheap yes/no, pick-one, or score classification (cheaper than judge/Evaluator.rubric) | JevProvider.classify — `noul`/`choice`/`score`; `calibrateJev` admits a Jev tier vs a frozen floor + injection battery |
 | Offer skills on demand without bloating context | SkillRegistry — `skill_use` meta-tool + `skills.activeTools` thunk |
@@ -254,9 +254,9 @@ const { answers, costUsd, raw } = await jev.classify('I was charged twice, pleas
 // raw → the full unmodified parsed Jev response (a request id / warnings beyond answers/usage/model, if any)
 ```
 
-Three question types, kept verbatim from Jev's own contract: `noul` (binary probability `0..1`), `choice` (pick one of `criteria`'s keys, plus untrusted `probabilities`/`confidence`), `score` (a position `0..N-1` on `criteria`'s legend). Jev's reply is **untrusted model output** — `classify()` schema-checks the discriminator field against the question that asked it (`ValidationError`, stamped `lib:'bare-agent'`, on a type mismatch or an out-of-range value) before returning it; `probabilities`/`confidence` pass through unvalidated.
+Three question types, kept verbatim from Jev's own contract: `noul` (binary probability `0..1`), `choice` (pick one of `criteria`'s keys, plus untrusted `probabilities`/`confidence`), `score` (a position `0..N-1` on `criteria`'s legend). Jev's reply is **untrusted model output** — `classify()` schema-checks the discriminator field against the question that asked it (`ValidationError`, stamped `lib:'bare-agent'`, on a type mismatch or an out-of-range value) before returning it; `probabilities`/`confidence` pass through unvalidated. A question's `instructions` can be a string, or the documented TypeSafe structured forms — an array or a plain object with named parts (e.g. `question`/`inspect`/`focus`/`ignore`) — for giving a question multiple named parts; empty `{}`/`[]`/non-plain values are rejected as missing instructions.
 
-**Injection hardening is on by default.** `state` is untrusted and can carry an embedded attack (`"you are now…"`, `"ignore previous instructions"`); `classify()` prepends a defensive preamble to every question's `instructions` (copy-on-write, never mutates your `questions` object) so the classifier treats `state` as data, not commands. Opt out with `harden: false` on the constructor or per call.
+**Injection hardening is on by default, and shape-aware.** `state` is untrusted and can carry an embedded attack (`"you are now…"`, `"ignore previous instructions"`); `classify()` wraps every question's `instructions` with a defensive preamble — prefixed onto a string, prepended as element 0 of an array, or added under a reserved `__hardening__` key on an object — so the classifier treats `state` as data, not commands (copy-on-write, never mutates your `questions` object; a caller-supplied `__hardening__` key is rejected so it can't overwrite the preamble). Opt out with `harden: false` on the constructor or per call.
 
 **Calibrate a tier before you trust it.** `calibrateJev` (exported from `bare-agent`, mirrors `calibrate`/judge's harness) grades a Jev model against a frozen clear-case battery (`noul`/`choice`/`score` + a false-positive trap) **and** a multi-style injection battery, admitting only if the clear-case floor clears with zero reds **and** every injection style is resisted:
 
@@ -824,12 +824,18 @@ const out = await recurse('Fix the failing function in calc.js', ctx, {
 ```javascript
 const { Evaluator, refine } = require('bare-agent');
 
-const evaluator = new Evaluator({ provider });   // provider REQUIRED for rubric/agentic; predicate needs none
+const evaluator = new Evaluator({ provider, jevProvider });   // provider REQUIRED for rubric/agentic; jevProvider REQUIRED for jev; predicate needs neither
 
-// Three criteria types — pass EXACTLY ONE:
+// Four criteria types — pass EXACTLY ONE:
 const v1 = await evaluator.evaluate(goal, result, { predicate: (r) => r.includes('DONE') });       // deterministic, 0 tokens
 const v2 = await evaluator.evaluate(goal, result, { rubric: 'Cites a source for every claim.' });  // isolated adversarial LLM grader
 const v3 = await evaluator.evaluate(goal, url,    { agentic: 'Open the page, click Submit, check the console for errors.' }); // tool-running critic that EXERCISES the artifact
+const v4 = await evaluator.evaluate(goal, result, {
+  jev: {
+    question: { type: 'noul', instructions: 'Does the result satisfy the goal?' },
+    toVerdict: (a) => (a.noul >= 0.5 ? 'satisfied' : 'failed'), // caller owns the threshold/band mapping
+  },
+});                                                              // cheap calibrated classifier tier (~100-1000x cheaper than rubric)
 
 // Verdict: { status: 'satisfied' | 'needs_revision' | 'failed', pass, score, critique, suggestions }
 //   pass = (status === 'satisfied');  needs_revision is retryable;  failed is terminal (stop spending).
@@ -839,7 +845,8 @@ if (!v2.pass) console.log(v2.critique, v2.suggestions);
 Key invariants:
 - The **rubric path runs an isolated adversarial grader** — a separate context window with a harsh, independent prompt, never the generator's transcript. That isolation (not a feedback knob) is what defeats the self-evaluation trap; the grader treats the RESULT as untrusted DATA (judge prompt-injection defence).
 - **`agentic`** (the third type) spins up a fresh Loop with scoped tools (set on the Evaluator, or per-call `opts.tools`) that **exercises** the live artifact — clicks, reads console/network — rather than reading text. Each critic round forwards to `onLlmResult`; a governance `HaltError` re-throws clean.
-- **`contract`** (a definition of done) is graded against instead of the loose goal: `evaluate(goal, result, { rubric, contract })`. Judge tokens forward to the gate via `onLlmResult` (`kind:'evaluate'`) so verification spend is visible to the budget.
+- **`jev`** (the fourth type) composes `JevProvider` for a cost tier BELOW rubric — `question` is the SOLE criterion sent to the classifier (no layered prompt), and the caller-supplied `toVerdict(answer)` maps jev's `noul`/`choice`/`score` answer shape to the tri-state status (the Evaluator stays agnostic to jev's answer shapes). A `toVerdict` return outside the tri-state set is a broken arbiter (BA-15 family): thrown as `ValidationError` naming the type only, never the value. Requires a `jevProvider` (on the Evaluator or per-call `opts.jevProvider`). `score` is always `null`.
+- **`contract`** (a definition of done) is graded against instead of the loose goal: `evaluate(goal, result, { rubric, contract })`. Judge tokens forward to the gate via `onLlmResult` (`kind:'evaluate'`) so verification spend is visible to the budget. For `jev`, `contract` is used only as the failed/needs-revision critique string — never folded into `question`.
 
 **`refine`** drives a caller-supplied `attempt`/`evaluate` until a satisfied verdict, a terminal `failed`, or `maxIterations` (the real bound is bareguard maxTurns/budget). It threads the latest `critique` into the next attempt (fresh-feedback, not anchoring on a failed answer) and a shared `contract` to both sides.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bare-agent",
-  "version": "0.45.0",
+  "version": "0.46.1",
   "files": [
     "index.js",
     "index.d.ts",

package/primitives.json

@@ -175,7 +175,7 @@
     {
       "name": "Evaluator",
       "category": "evaluation",
-      "when": "you need to judge an output against a goal or contract — deterministically (predicate), by LLM rubric, or with a tool-running critic that exercises the live artifact",
+      "when": "you need to judge an output against a goal or contract — deterministically (predicate), by LLM rubric, with a tool-running critic that exercises the live artifact, or by a cheap calibrated classifier (jev)",
       "import": "import { Evaluator } from 'bare-agent'",
       "signature": "new Evaluator(options?: EvaluatorOptions)",
       "fails": "never throws for a bad grade — returns a Verdict {status: satisfied|needs_revision|failed}; a provider HaltError propagates clean. Judge tokens forward via onLlmResult.",

package/src/evaluator.d.ts

@@ -56,6 +56,12 @@ export type EvaluatorOptions = {
      * `EvaluateOptions.tools`. Ignored by predicate/rubric.
      */
     tools?: import("../types").ToolDef[] | undefined;
+    /**
+     * - REQUIRED for the `jev` path — a cheap
+     * calibrated classifier tier (~100-1000x cheaper than a rubric LLM round for classification-shaped verdicts).
+     * Overridable per call via `EvaluateOptions.jevProvider`. Ignored by predicate/rubric/agentic.
+     */
+    jevProvider?: import("./provider-jev").JevProvider | undefined;
 };
 export type Criteria = {
     /**
@@ -75,9 +81,28 @@ export type Criteria = {
      * `tools`. The strongest verification — catches what only running the thing reveals. Exactly one of the three.
      */
     agentic?: string | undefined;
+    /**
+     * -
+     * Cheap calibrated classifier door (composes `JevProvider`, the cost tier below `rubric`). `question` is
+     * ONE Jev question object — the SOLE criterion (a classifier takes one instruction, not a layered prompt;
+     * unlike rubric/agentic, `contract` is NOT folded into it here — it is used only as the failed-critique
+     * string). `toVerdict` maps the classifier's per-question answer (`{type:'noul',noul}` /
+     * `{type:'choice',choice,...}` / `{type:'score',score,...}`) to a tri-state status — the caller owns
+     * thresholds/bands (Option A: caller-supplied mapping fn, open + simple, no premature abstraction over
+     * jev's three answer shapes). Requires a `jevProvider` (on the Evaluator or per-call). Exactly one of the four.
+     */
+    jev?: {
+        question: {
+            type: "noul" | "choice" | "score";
+            instructions: string;
+            criteria?: any;
+        };
+        toVerdict: (answer: any) => "satisfied" | "needs_revision" | "failed";
+    } | undefined;
     /**
      * - The shared, authoritative "definition of done" the grader judges against
-     * (A3 / D10). When present it is what success means — not the loose goal. Folded into the rubric/agentic prompt.
+     * (A3 / D10). When present it is what success means — not the loose goal. Folded into the rubric/agentic
+     * prompt; for the `jev` door it is used ONLY as the failed-critique string (never folded into `question`).
      */
     contract?: string | undefined;
 };
@@ -102,21 +127,28 @@ export type EvaluateOptions = {
      * critic MUST be bounded (turn/budget caps come from the gate; the Loop's HARD_ROUND_LIMIT is only a net).
      */
     policy?: Function | undefined;
+    /**
+     * - Per-call override of the `jev` door's classifier
+     * provider (else `EvaluatorOptions.jevProvider`).
+     */
+    jevProvider?: import("./provider-jev").JevProvider | undefined;
 };
 /**
  * Output-side judge — the mirror of `Planner` (input-side). Judges whether a result meets a goal, by a
- * deterministic `predicate`, an LLM `rubric`, or a tool-running `agentic` critic, returning one uniform
- * `Verdict`. The rubric and agentic paths run an ISOLATED adversarial critic (separate context + independent
- * system prompt) — that isolation, not a feedback knob, is what defeats the self-evaluation trap. The agentic
- * path additionally EXERCISES the artifact with scoped tools (it does not read the diff). Composes AROUND a
- * Loop (never inside `loop.js`).
+ * deterministic `predicate`, an LLM `rubric`, a tool-running `agentic` critic, or a cheap calibrated `jev`
+ * classifier tier, returning one uniform `Verdict`. The rubric and agentic paths run an ISOLATED adversarial
+ * critic (separate context + independent system prompt) — that isolation, not a feedback knob, is what
+ * defeats the self-evaluation trap. The agentic path additionally EXERCISES the artifact with scoped tools
+ * (it does not read the diff). The `jev` path composes `JevProvider` (a single classification call, ~100-1000x
+ * cheaper than a rubric round) for classification-shaped verdicts — the caller supplies a `toVerdict` mapping
+ * fn from the classifier's answer to the tri-state status. Composes AROUND a Loop (never inside `loop.js`).
  *
  * Built flagged-and-deletable per D11 — opt-in by import; calibrate the rubric/prompt from execution traces.
  */
 export class Evaluator {
     /**
      * @param {EvaluatorOptions} [options]
-     * @when you need to judge an output against a goal or contract — deterministically (predicate), by LLM rubric, or with a tool-running critic that exercises the live artifact
+     * @when you need to judge an output against a goal or contract — deterministically (predicate), by LLM rubric, with a tool-running critic that exercises the live artifact, or by a cheap calibrated classifier (jev)
      * @fails never throws for a bad grade — returns a Verdict {status: satisfied|needs_revision|failed}; a provider HaltError propagates clean. Judge tokens forward via onLlmResult.
      * @example
      *   const evaluator = new Evaluator({ provider });
@@ -128,14 +160,15 @@ export class Evaluator {
     prompt: string;
     agenticPrompt: string;
     tools: import("../types").ToolDef[];
+    jevProvider: import("./provider-jev").JevProvider | null;
     /**
      * Judge `result` against `goal` by exactly one criteria type.
      * @param {string} goal - The objective the result is judged against.
      * @param {any} result - The output under judgment.
-     * @param {Criteria} criteria - Exactly one of `predicate` | `rubric` | `agentic` (none/more-than-one throws).
+     * @param {Criteria} criteria - Exactly one of `predicate` | `rubric` | `agentic` | `jev` (none/more-than-one throws).
      * @param {EvaluateOptions} [opts]
      * @returns {Promise<Verdict>}
-     * @throws {ValidationError} not-exactly-one criteria supplied, or rubric/agentic requested with no provider.
+     * @throws {ValidationError} not-exactly-one criteria supplied, or rubric/agentic/jev requested with no provider.
      */
     evaluate(goal: string, result: any, criteria: Criteria, opts?: EvaluateOptions): Promise<Verdict>;
     /**
@@ -155,6 +188,29 @@ export class Evaluator {
      * @throws {HaltError} a governance cap halted the critic mid-run.
      */
     _evaluateAgentic(goal: string, result: any, instructions: string, contract: string | null, opts: EvaluateOptions): Promise<Verdict>;
+    /**
+     * Jev path — a cheap calibrated classifier verdict tier (the cost tier below `rubric`; ~100-1000x cheaper
+     * for classification-shaped verdicts). Unlike rubric/agentic there is NO layered prompt: `question.instructions`
+     * is the SOLE criterion sent to the classifier (a classifier takes one instruction, not goal+contract+rubric).
+     * `toVerdict` — caller-supplied (Option A: open + simple, no premature abstraction over jev's three answer
+     * shapes) — maps the classifier's answer to a tri-state status; the caller owns thresholds/bands.
+     * @param {any} result
+     * @param {{question: {type: 'noul'|'choice'|'score', instructions: string, criteria?: any}, toVerdict: (answer: any) => any}} jevCriteria
+     * @param {string|null} contract - Used ONLY as the failed-critique string (never folded into the question).
+     * @param {EvaluateOptions} opts
+     * @returns {Promise<Verdict>}
+     * @throws {ValidationError} no jevProvider, `toVerdict` isn't a function, or it returns something other
+     *   than a valid tri-state status (BA-15 family — a broken arbiter is named loudly, never coerced; the
+     *   error names the TYPE only, never the returned VALUE, F16/BA-1 audit-safety).
+     */
+    _evaluateJev(result: any, jevCriteria: {
+        question: {
+            type: "noul" | "choice" | "score";
+            instructions: string;
+            criteria?: any;
+        };
+        toVerdict: (answer: any) => any;
+    }, contract: string | null, opts: EvaluateOptions): Promise<Verdict>;
     /**
      * Defensive JSON parse of a grader response into a `Verdict` (mirrors `Planner._parse`).
      * @param {string} text

package/src/evaluator.js

@@ -34,6 +34,9 @@ const { Loop } = require('./loop');
  * @property {ToolDef[]} [tools] - The critic's SCOPED functional tools (`barebrowse`/`baremobile`) for the
  *   agentic path — what lets it exercise the live artifact rather than read text. Overridable per call via
  *   `EvaluateOptions.tools`. Ignored by predicate/rubric.
+ * @property {import('./provider-jev').JevProvider} [jevProvider] - REQUIRED for the `jev` path — a cheap
+ *   calibrated classifier tier (~100-1000x cheaper than a rubric LLM round for classification-shaped verdicts).
+ *   Overridable per call via `EvaluateOptions.jevProvider`. Ignored by predicate/rubric/agentic.
  */
 
 /**
@@ -46,8 +49,17 @@ const { Loop } = require('./loop');
  * @property {string} [agentic] - Instructions for a tool-running critic (D9): how to EXERCISE the live artifact
  *   (open it, click, read console/network) and what would make it fail. Runs an ISOLATED Loop with the scoped
  *   `tools`. The strongest verification — catches what only running the thing reveals. Exactly one of the three.
+ * @property {{question: {type: 'noul'|'choice'|'score', instructions: string, criteria?: any}, toVerdict: (answer: any) => 'satisfied'|'needs_revision'|'failed'}} [jev] -
+ *   Cheap calibrated classifier door (composes `JevProvider`, the cost tier below `rubric`). `question` is
+ *   ONE Jev question object — the SOLE criterion (a classifier takes one instruction, not a layered prompt;
+ *   unlike rubric/agentic, `contract` is NOT folded into it here — it is used only as the failed-critique
+ *   string). `toVerdict` maps the classifier's per-question answer (`{type:'noul',noul}` /
+ *   `{type:'choice',choice,...}` / `{type:'score',score,...}`) to a tri-state status — the caller owns
+ *   thresholds/bands (Option A: caller-supplied mapping fn, open + simple, no premature abstraction over
+ *   jev's three answer shapes). Requires a `jevProvider` (on the Evaluator or per-call). Exactly one of the four.
  * @property {string} [contract] - The shared, authoritative "definition of done" the grader judges against
- *   (A3 / D10). When present it is what success means — not the loose goal. Folded into the rubric/agentic prompt.
+ *   (A3 / D10). When present it is what success means — not the loose goal. Folded into the rubric/agentic
+ *   prompt; for the `jev` door it is used ONLY as the failed-critique string (never folded into `question`).
  */
 
 /**
@@ -59,6 +71,8 @@ const { Loop } = require('./loop');
  * @property {ToolDef[]} [tools] - Per-call override of the agentic critic's scoped tools (else `EvaluatorOptions.tools`).
  * @property {Function} [policy] - bareguard `policy` forwarded to the agentic critic's Loop — a tool-running
  *   critic MUST be bounded (turn/budget caps come from the gate; the Loop's HARD_ROUND_LIMIT is only a net).
+ * @property {import('./provider-jev').JevProvider} [jevProvider] - Per-call override of the `jev` door's classifier
+ *   provider (else `EvaluatorOptions.jevProvider`).
  */
 
 // The adversarial grader system prompt — the anti-sycophancy core (A1, "Self-Evaluation is a Trap"). The
@@ -99,18 +113,20 @@ Output your FINAL answer as ONLY this JSON, no markdown, no prose:
 
 /**
  * Output-side judge — the mirror of `Planner` (input-side). Judges whether a result meets a goal, by a
- * deterministic `predicate`, an LLM `rubric`, or a tool-running `agentic` critic, returning one uniform
- * `Verdict`. The rubric and agentic paths run an ISOLATED adversarial critic (separate context + independent
- * system prompt) — that isolation, not a feedback knob, is what defeats the self-evaluation trap. The agentic
- * path additionally EXERCISES the artifact with scoped tools (it does not read the diff). Composes AROUND a
- * Loop (never inside `loop.js`).
+ * deterministic `predicate`, an LLM `rubric`, a tool-running `agentic` critic, or a cheap calibrated `jev`
+ * classifier tier, returning one uniform `Verdict`. The rubric and agentic paths run an ISOLATED adversarial
+ * critic (separate context + independent system prompt) — that isolation, not a feedback knob, is what
+ * defeats the self-evaluation trap. The agentic path additionally EXERCISES the artifact with scoped tools
+ * (it does not read the diff). The `jev` path composes `JevProvider` (a single classification call, ~100-1000x
+ * cheaper than a rubric round) for classification-shaped verdicts — the caller supplies a `toVerdict` mapping
+ * fn from the classifier's answer to the tri-state status. Composes AROUND a Loop (never inside `loop.js`).
  *
  * Built flagged-and-deletable per D11 — opt-in by import; calibrate the rubric/prompt from execution traces.
  */
 class Evaluator {
   /**
    * @param {EvaluatorOptions} [options]
-   * @when you need to judge an output against a goal or contract — deterministically (predicate), by LLM rubric, or with a tool-running critic that exercises the live artifact
+   * @when you need to judge an output against a goal or contract — deterministically (predicate), by LLM rubric, with a tool-running critic that exercises the live artifact, or by a cheap calibrated classifier (jev)
    * @fails never throws for a bad grade — returns a Verdict {status: satisfied|needs_revision|failed}; a provider HaltError propagates clean. Judge tokens forward via onLlmResult.
    * @example
    *   const evaluator = new Evaluator({ provider });
@@ -122,23 +138,25 @@ class Evaluator {
     this.prompt = options.prompt || GRADER_PROMPT;
     this.agenticPrompt = options.agenticPrompt || AGENTIC_PROMPT;
     this.tools = Array.isArray(options.tools) ? options.tools : [];
+    this.jevProvider = options.jevProvider || null;
   }
 
   /**
    * Judge `result` against `goal` by exactly one criteria type.
    * @param {string} goal - The objective the result is judged against.
    * @param {any} result - The output under judgment.
-   * @param {Criteria} criteria - Exactly one of `predicate` | `rubric` | `agentic` (none/more-than-one throws).
+   * @param {Criteria} criteria - Exactly one of `predicate` | `rubric` | `agentic` | `jev` (none/more-than-one throws).
    * @param {EvaluateOptions} [opts]
    * @returns {Promise<Verdict>}
-   * @throws {ValidationError} not-exactly-one criteria supplied, or rubric/agentic requested with no provider.
+   * @throws {ValidationError} not-exactly-one criteria supplied, or rubric/agentic/jev requested with no provider.
    */
   async evaluate(goal, result, criteria, opts = {}) {
     const predicate = typeof criteria?.predicate === 'function' ? criteria.predicate : null;
     const rubric = typeof criteria?.rubric === 'string' && criteria.rubric.length > 0 ? criteria.rubric : null;
     const agentic = typeof criteria?.agentic === 'string' && criteria.agentic.length > 0 ? criteria.agentic : null;
-    if ([predicate, rubric, agentic].filter(Boolean).length !== 1) {
-      throw new ValidationError('[Evaluator] criteria must supply exactly one of { predicate } | { rubric } | { agentic }');
+    const jev = criteria && typeof criteria.jev === 'object' && criteria.jev !== null ? criteria.jev : null;
+    if ([predicate, rubric, agentic, jev].filter(Boolean).length !== 1) {
+      throw new ValidationError('[Evaluator] criteria must supply exactly one of { predicate } | { rubric } | { agentic } | { jev }');
     }
 
     if (predicate) {
@@ -184,6 +202,12 @@ class Evaluator {
       return this._evaluateAgentic(goal, result, agentic, contract, opts);
     }
 
+    // Jev path — a cheap calibrated classifier tier (the cost tier below rubric). No layered prompt: the
+    // question's `instructions` is the sole criterion; `contract` (if any) is used only as the failed-critique.
+    if (jev) {
+      return this._evaluateJev(result, jev, contract, opts);
+    }
+
     // Rubric path — isolated adversarial grader.
     if (!this.provider) {
       throw new ValidationError('[Evaluator] rubric criteria requires a provider on the Evaluator');
@@ -275,6 +299,63 @@ class Evaluator {
     return this._parse(out.text);
   }
 
+  /**
+   * Jev path — a cheap calibrated classifier verdict tier (the cost tier below `rubric`; ~100-1000x cheaper
+   * for classification-shaped verdicts). Unlike rubric/agentic there is NO layered prompt: `question.instructions`
+   * is the SOLE criterion sent to the classifier (a classifier takes one instruction, not goal+contract+rubric).
+   * `toVerdict` — caller-supplied (Option A: open + simple, no premature abstraction over jev's three answer
+   * shapes) — maps the classifier's answer to a tri-state status; the caller owns thresholds/bands.
+   * @param {any} result
+   * @param {{question: {type: 'noul'|'choice'|'score', instructions: string, criteria?: any}, toVerdict: (answer: any) => any}} jevCriteria
+   * @param {string|null} contract - Used ONLY as the failed-critique string (never folded into the question).
+   * @param {EvaluateOptions} opts
+   * @returns {Promise<Verdict>}
+   * @throws {ValidationError} no jevProvider, `toVerdict` isn't a function, or it returns something other
+   *   than a valid tri-state status (BA-15 family — a broken arbiter is named loudly, never coerced; the
+   *   error names the TYPE only, never the returned VALUE, F16/BA-1 audit-safety).
+   */
+  async _evaluateJev(result, jevCriteria, contract, opts) {
+    const jevProvider = opts.jevProvider || this.jevProvider;
+    if (!jevProvider) {
+      throw new ValidationError('[Evaluator] jev criteria requires a jevProvider (on the Evaluator or per-call opts.jevProvider)');
+    }
+    const toVerdict = typeof jevCriteria?.toVerdict === 'function' ? jevCriteria.toVerdict : null;
+    if (!toVerdict) {
+      throw new ValidationError('[Evaluator] jev criteria requires a toVerdict(answer) => status function');
+    }
+    const question = jevCriteria.question;
+    const forward = opts.onLlmResult;
+
+    const out = await jevProvider.classify(stringifyResult(result), { q: question }, {
+      // Re-tag jev's own kind:'classify' as kind:'evaluate' at the Evaluator boundary (mirrors rubric/agentic).
+      // A HaltError thrown by the consumer's hook propagates clean (JevProvider awaits it, no swallow).
+      onLlmResult: forward
+        ? async (/** @type {any} */ e) => { await forward({ usage: e.usage, model: e.model, kind: 'evaluate' }); }
+        : undefined,
+    });
+    const answer = out.answers.q;
+
+    const status = await toVerdict(answer);
+    if (status !== 'satisfied' && status !== 'needs_revision' && status !== 'failed') {
+      // Name the TYPE only, never the value — mirrors the predicate door's broken-arbiter guard (BA-15/F16).
+      const got = status === null ? 'null'
+        : status === undefined ? 'undefined'
+        : Array.isArray(status) ? 'an array'
+        : typeof status === 'object' ? 'an object'
+        : `a ${typeof status}`;
+      throw new ValidationError(
+        `[Evaluator] jev criteria toVerdict must return 'satisfied'|'needs_revision'|'failed', got ${got}.`,
+      );
+    }
+    return {
+      status,
+      pass: status === 'satisfied',
+      score: null,
+      critique: status === 'satisfied' ? '' : (typeof contract === 'string' ? contract : ''),
+      suggestions: [],
+    };
+  }
+
   /**
    * Defensive JSON parse of a grader response into a `Verdict` (mirrors `Planner._parse`).
    * @param {string} text

package/src/provider-jev.d.ts

@@ -21,7 +21,7 @@ export class JevProvider {
      * @param {number} [options.deadlineMs] - Total call-duration deadline (ms); 0 disables (default).
      * @param {{in: number, out: number, cacheReadMult?: number, cacheWriteMult?: number}} [options.rates] - Per-1K-token USD rates for authoritative pricing (Jev: `{ in: 0.042/1000, out: 0 }`).
      * @param {boolean} [options.exposeErrorBody=false] - Include the raw error body on a ProviderError (default off).
-     * @param {boolean} [options.harden=true] - Prepend a defensive preamble to each question's instructions, treating `state` as untrusted data and resisting embedded role/label-override attempts. Overridable per-call via `opts.harden`.
+     * @param {boolean} [options.harden=true] - Wrap each question's instructions with a defensive preamble (prefixed for a string, prepended as element 0 for an array, or added under a reserved key for an object), treating `state` as untrusted data and resisting embedded role/label-override attempts. Overridable per-call via `opts.harden`.
      */
     constructor(options?: {
         apiKey?: string | undefined;
@@ -54,7 +54,7 @@ export class JevProvider {
     /**
      * Classify `state` against one or more typed `questions`. See the class doc for the primitive tags.
      * @param {string|object|any[]} state - The shared input all questions judge (Jev's `state`).
-     * @param {Record<string, {type: 'noul'|'choice'|'score', instructions: string, criteria?: any}>} questions - Keyed questions; each judged independently against `state`.
+     * @param {Record<string, {type: 'noul'|'choice'|'score', instructions: string|object|any[], criteria?: any}>} questions - Keyed questions; each judged independently against `state`.
      * @param {object} [opts]
      * @param {string} [opts.model] - Override the model for this call.
      * @param {{in: number, out: number, cacheReadMult?: number, cacheWriteMult?: number}} [opts.rates] - Override rates for this call.
@@ -68,7 +68,7 @@ export class JevProvider {
      */
     classify(state: string | object | any[], questions: Record<string, {
         type: "noul" | "choice" | "score";
-        instructions: string;
+        instructions: string | object | any[];
         criteria?: any;
     }>, opts?: {
         model?: string | undefined;
@@ -101,9 +101,13 @@ export class JevProvider {
      */
     _validateRequest(state: any, questions: any): void;
     /**
-     * Build a hardened COPY of `questions` (new object, new nested question objects) with
-     * {@link HARDENING_PREAMBLE} prepended to each `instructions` string. Never mutates the
-     * caller's `questions` argument or its nested objects. @param {Record<string, any>} questions @returns {Record<string, any>}
+     * Build a hardened COPY of `questions` (new object, new nested question objects, new
+     * nested instructions containers) with {@link HARDENING_PREAMBLE} woven into each
+     * `instructions`, shape-aware so a structured form is wrapped rather than stringified:
+     * a string gets the preamble prefixed, an array gets it prepended as element 0, and an
+     * object gets it added under the reserved {@link HARDENING_KEY}. Never mutates the
+     * caller's `questions` argument or its nested objects/arrays.
+     * @param {Record<string, any>} questions @returns {Record<string, any>}
      */
     _hardenQuestions(questions: Record<string, any>): Record<string, any>;
     /**

package/src/provider-jev.js

@@ -36,6 +36,9 @@ const CLASSIFY_PATH = '/v1/systemone';
 const DEFAULT_MODEL = 'jev-latest';
 const QUESTION_TYPES = new Set(['noul', 'choice', 'score']);
 const JEV_USAGE_KEYS = ['input_tokens', 'output_tokens'];
+// Reserved key hardening uses to carry the preamble on an object-shaped `instructions` — a
+// caller-supplied key of the same name would silently overwrite the preamble on spread.
+const HARDENING_KEY = '__hardening__';
 
 // Injection hardening (default on): prepended to each question's `instructions` before the
 // request is sent, so an attack embedded in `state` (untrusted) can't hijack the classifier's
@@ -73,7 +76,7 @@ class JevProvider {
    * @param {number} [options.deadlineMs] - Total call-duration deadline (ms); 0 disables (default).
    * @param {{in: number, out: number, cacheReadMult?: number, cacheWriteMult?: number}} [options.rates] - Per-1K-token USD rates for authoritative pricing (Jev: `{ in: 0.042/1000, out: 0 }`).
    * @param {boolean} [options.exposeErrorBody=false] - Include the raw error body on a ProviderError (default off).
-   * @param {boolean} [options.harden=true] - Prepend a defensive preamble to each question's instructions, treating `state` as untrusted data and resisting embedded role/label-override attempts. Overridable per-call via `opts.harden`.
+   * @param {boolean} [options.harden=true] - Wrap each question's instructions with a defensive preamble (prefixed for a string, prepended as element 0 for an array, or added under a reserved key for an object), treating `state` as untrusted data and resisting embedded role/label-override attempts. Overridable per-call via `opts.harden`.
    */
   constructor(options = {}) {
     this.apiKey = options.apiKey;
@@ -89,7 +92,7 @@ class JevProvider {
   /**
    * Classify `state` against one or more typed `questions`. See the class doc for the primitive tags.
    * @param {string|object|any[]} state - The shared input all questions judge (Jev's `state`).
-   * @param {Record<string, {type: 'noul'|'choice'|'score', instructions: string, criteria?: any}>} questions - Keyed questions; each judged independently against `state`.
+   * @param {Record<string, {type: 'noul'|'choice'|'score', instructions: string|object|any[], criteria?: any}>} questions - Keyed questions; each judged independently against `state`.
    * @param {object} [opts]
    * @param {string} [opts.model] - Override the model for this call.
    * @param {{in: number, out: number, cacheReadMult?: number, cacheWriteMult?: number}} [opts.rates] - Override rates for this call.
@@ -139,7 +142,14 @@ class JevProvider {
       const q = questions[id];
       if (!isPlainObject(q)) throw invalid(`question "${id}" must be an object`);
       if (!QUESTION_TYPES.has(q.type)) throw invalid(`question "${id}" has invalid type`, { type: q.type });
-      if (typeof q.instructions !== 'string' || !q.instructions) throw invalid(`question "${id}" missing instructions`);
+      const ins = q.instructions;
+      const insValid = (typeof ins === 'string' && ins.length > 0) ||
+        (Array.isArray(ins) && ins.length > 0) ||
+        (isPlainObject(ins) && Object.keys(ins).length > 0);
+      if (!insValid) throw invalid(`question "${id}" missing instructions`);
+      if (isPlainObject(q.instructions) && Object.prototype.hasOwnProperty.call(q.instructions, HARDENING_KEY)) {
+        throw invalid(`question "${id}" may not use reserved instructions key`, { key: HARDENING_KEY });
+      }
       if (q.type === 'choice') {
         if (!isPlainObject(q.criteria) || Object.keys(q.criteria).length < 2) {
           throw invalid(`choice "${id}" needs a criteria object of >=2 {key: description}`);
@@ -156,16 +166,29 @@ class JevProvider {
   }
 
   /**
-   * Build a hardened COPY of `questions` (new object, new nested question objects) with
-   * {@link HARDENING_PREAMBLE} prepended to each `instructions` string. Never mutates the
-   * caller's `questions` argument or its nested objects. @param {Record<string, any>} questions @returns {Record<string, any>}
+   * Build a hardened COPY of `questions` (new object, new nested question objects, new
+   * nested instructions containers) with {@link HARDENING_PREAMBLE} woven into each
+   * `instructions`, shape-aware so a structured form is wrapped rather than stringified:
+   * a string gets the preamble prefixed, an array gets it prepended as element 0, and an
+   * object gets it added under the reserved {@link HARDENING_KEY}. Never mutates the
+   * caller's `questions` argument or its nested objects/arrays.
+   * @param {Record<string, any>} questions @returns {Record<string, any>}
    */
   _hardenQuestions(questions) {
     /** @type {Record<string, any>} */
     const hardened = {};
     for (const id of Object.keys(questions)) {
       const q = questions[id];
-      hardened[id] = { ...q, instructions: HARDENING_PREAMBLE + q.instructions };
+      const ins = q.instructions;
+      let hardenedIns;
+      if (typeof ins === 'string') {
+        hardenedIns = HARDENING_PREAMBLE + ins;
+      } else if (Array.isArray(ins)) {
+        hardenedIns = [HARDENING_PREAMBLE, ...ins];
+      } else {
+        hardenedIns = { [HARDENING_KEY]: HARDENING_PREAMBLE, ...ins };
+      }
+      hardened[id] = { ...q, instructions: hardenedIns };
     }
     return hardened;
   }