jevtriage 0.1.0__tar.gz

jevtriage-0.1.0/.env.example

@@ -0,0 +1,12 @@
+# Required for live TypeSafe Jev calls. Never commit a real key.
+TYPESAFE_API_KEY=
+
+# Production pin. Rejected if empty or a floating alias (latest / preview).
+# A documented catalog pin as of 2026-09-19 is jev-1.13.0.
+TYPESAFE_DEFAULT_MODEL=jev-1.13.0
+
+# Optional API root override (typesafe-sdk).
+# TYPESAFE_BASE_URL=https://api.typesafe.ai
+
+# Optional. Used to fetch the PR and apply jev:* labels.
+# GITHUB_TOKEN=

jevtriage-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nithilan Kumaran
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT WITHOUT LIMITATION THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

jevtriage-0.1.0/MANIFEST.in

@@ -0,0 +1,9 @@
+include LICENSE
+include README.md
+include .env.example
+include action.yml
+include pyproject.toml
+recursive-include fixtures *.json
+recursive-include tests *.py
+graft src/jevtriage
+global-exclude __pycache__ *.py[cod]

jevtriage-0.1.0/PKG-INFO

@@ -0,0 +1,204 @@
+Metadata-Version: 2.4
+Name: jevtriage
+Version: 0.1.0
+Summary: Triage GitHub PRs with TypeSafe Jev — ready / needs_review / risky, with a confidence gate
+Author: Nithilan Kumaran
+License: MIT
+Project-URL: Homepage, https://github.com/sathariels/jevtriage
+Project-URL: Documentation, https://github.com/sathariels/jevtriage
+Keywords: jev,typesafe,github-action,pr,triage
+Classifier: Development Status :: 3 - Alpha
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: typesafe-sdk>=0.7.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Dynamic: license-file
+
+# jevtriage
+
+**Triage gate for pull requests.** A GitHub Action and small Python CLI that asks [TypeSafe Jev](https://typesafe.ai) (System One) one `Choice` question:
+
+| Verdict | Meaning |
+| --- | --- |
+| `ready` | Looks safe to merge with normal review depth |
+| `needs_review` | Needs human eyes (unclear risk, large or ambiguous change) |
+| `risky` | Elevated risk (security-sensitive, destructive, or high blast radius) |
+
+The official `ChoiceAnswer.confidence` is a gate: **`ready` only exits 0 when confidence ≥ threshold** (default `0.8`). Low confidence fails closed to `needs_review` (exit 1).
+
+v0.1 is a **drop-in Action**. Copy one workflow YAML, set `TYPESAFE_API_KEY`, pin a model, get a verdict on every PR.
+
+## Not these nearby tools
+
+| Tool | Niche |
+| --- | --- |
+| **[HexyeDEV/JevPR](https://github.com/HexyeDEV/JevPR)** | GitHub App + policy router (`LOW` / `NORMAL` / `SPECIALIST` → approve or assign reviewers). A review-routing service, not a CI gate. |
+| **[1jehuang/jev-pr-labeler](https://github.com/1jehuang/jev-pr-labeler)** | Semantic labels (`type:`, `area:`, `size:`) via OpenRouter. Taxonomy, not merge readiness. |
+| **jevtriage (this repo)** | **Triage gate**: `ready` / `needs_review` / `risky` + confidence fail + marketplace-friendly Action + CLI exit codes. |
+
+Pair with [`jevcheck`](https://github.com/sathariels/jevcheck) contracts if you want upgrades to fail when this question flips. **jevcheck is not a v0.1 dependency** — `fixtures/pr-triage.contract.json` and `fixtures/replay-ready.json` are the replay shape.
+
+## Install
+
+```bash
+pip install -e ".[dev]"
+export TYPESAFE_API_KEY=...          # live Jev only; never commit this
+export TYPESAFE_DEFAULT_MODEL=jev-1.13.0
+```
+
+Auth is **`TYPESAFE_API_KEY` only** (`typesafe-sdk`). Unit tests mock the client. This repo does not publish to PyPI in v0.1; the Action installs the checked-out tree.
+
+## GitHub Action
+
+Marketplace-friendly root `action.yml`:
+
+```yaml
+# .github/workflows/pr-triage.yml
+name: pr-triage
+on: pull_request
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+jobs:
+  triage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: sathariels/jevtriage@v0.1.0   # pin a tag or commit SHA once cut; @main until then
+        id: triage
+        env:
+          TYPESAFE_API_KEY: ${{ secrets.TYPESAFE_API_KEY }}
+        with:
+          model: jev-1.13.0
+          apply-labels: true
+      - run: echo "${{ steps.triage.outputs.verdict }} ${{ steps.triage.outputs.confidence }}"
+```
+
+Until a `v0.1.0` tag exists, use `sathariels/jevtriage@main` (or this PR’s SHA). The step **fails** on exit 1 or 2 — that is the gate. Use `continue-on-error: true` only if you want labels/comments after a non-ready verdict.
+
+This repository’s [example workflow](.github/workflows/example-pr-triage.yml) runs the same Action with `answers: fixtures/replay-single-ready.json` so default CI never calls TypeSafe.
+
+### Inputs
+
+| Input | Default | Notes |
+| --- | --- | --- |
+| `model` | `TYPESAFE_DEFAULT_MODEL` | Required pin. `latest` / `preview` / empty rejected |
+| `min-confidence` | `0.8` | Official `ChoiceAnswer.confidence` floor for exit 0 |
+| `allow-unpinned` | `false` | Production stay `false` |
+| `apply-labels` | `false` | Writes `jev:ready`, `jev:needs-review`, `jev:risky` |
+| `github-token` | `${{ github.token }}` | PR fetch + optional labels |
+| `pull-request` | event PR number | Used to fetch title/body/diff |
+| `repository` | `${{ github.repository }}` | `owner/name` |
+| `title` / `body` / `diff-path` | empty | Overrides; skip GitHub fetch when you pass them |
+| `answers` / `case` | empty | Fixture replay (CI / no key) |
+| `max-diff-chars` | `32000` | Unified diff cap (~20–40k) |
+| `python-version` | `3.12` | |
+
+### Outputs
+
+| Output | Source |
+| --- | --- |
+| `verdict` | `ChoiceAnswer.choice` (`ready` / `needs_review` / `risky`) |
+| `confidence` | official `ChoiceAnswer.confidence` in `[0, 1]` |
+| `model` | `SystemOneResponse.model` |
+
+## CLI
+
+```bash
+# Live (needs TYPESAFE_API_KEY). Fetches the PR via GITHUB_TOKEN.
+jevtriage --repo owner/name --pr 123 --model jev-1.13.0
+
+# Local files
+jevtriage --title "Fix typo" --body "nits" --diff pr.diff --model jev-1.13.0
+
+# Replay (no key) — jevcheck-style fixture
+jevtriage --answers fixtures/replay-single-ready.json --model jev-1.13.0
+jevtriage --answers fixtures/replay-ready.json --case auth-bypass --model jev-1.13.0
+```
+
+Stdout is one JSON object (`verdict`, `confidence`, `probabilities`, `model`, `usage`, `truncated`). A one-line summary goes to stderr. When `GITHUB_OUTPUT` is set, the Action outputs are appended.
+
+### Environment
+
+| Variable | Role |
+| --- | --- |
+| `TYPESAFE_API_KEY` | **Required** for live calls. The only auth env. |
+| `TYPESAFE_DEFAULT_MODEL` | Pin when `--model` / Action `model` is empty |
+| `TYPESAFE_BASE_URL` | Optional SDK API root |
+| `GITHUB_TOKEN` / `GH_TOKEN` | Fetch the PR; apply labels if requested |
+| `GITHUB_REPOSITORY` | Default `--repo` |
+| `GITHUB_OUTPUT` | Write Action outputs |
+
+## Exit codes
+
+| Code | When |
+| --- | --- |
+| **0** | Verdict is `ready` **and** `confidence` ≥ `--min-confidence` |
+| **1** | Verdict is `needs_review`, **or** `ready`/`needs_review` below the confidence threshold |
+| **2** | Verdict is `risky`, **or** a config/API/identity error |
+
+Exit **2** is shared on purpose (fail closed). Distinguish them from stdout: a successful call has `verdict`; a failure has `"error"`. `risky` still writes `verdict` + Action outputs before exiting 2. Config errors (missing key, unpinned model, bad replay) also exit 2 and print `{"error": "..."}`.
+
+Label apply failures are logged to stderr and **do not** change the verdict exit code.
+
+## What Jev sees
+
+System One `state` is a JSON object (official SDK: string or object):
+
+- `title`, `body` (body capped at 8k chars)
+- `diff` — unified diff, capped at 32k chars by default, with a visible truncation note
+- `files` + `stats` when provided or when the GitHub compare payload is used
+- `jevtriage_notes` when anything was truncated or the diff was omitted
+
+The only question is a `Choice` named `triage` with **exactly** the three criteria above. Official fields only (`instructions`, `criteria`). The gate uses official `choice` + `confidence` + `probabilities` — no invented confidence field.
+
+## Model pinning
+
+Production mode rejects empty names and floating aliases (`jev-latest`, `jev-preview`, or any name containing `latest` or `preview`). A documented TypeSafe catalog pin as of 2026-09-19 is `jev-1.13.0`. Pass `--allow-unpinned` only for experiments.
+
+The response `model` must match the requested pin (exact string). An opted-in alias may resolve to a concrete version.
+
+## Optional labels
+
+With `--apply-labels` / `apply-labels: true` and `GITHUB_TOKEN`:
+
+- `jev:ready`
+- `jev:needs-review`
+- `jev:risky`
+
+Other `jev:*` triage labels on the PR are removed so only one remains.
+
+## jevcheck (optional)
+
+`fixtures/pr-triage.contract.json` is a v0.1 jevcheck contract for this exact question. `fixtures/replay-ready.json` is a keyed replay (`docs-typo`, `large-ambiguous`, `auth-bypass`). After you add `jevcheck` to a repo:
+
+```bash
+jevcheck eval fixtures/pr-triage.contract.json \
+  --candidate-model jev-1.13.0 \
+  --answers fixtures/replay-ready.json
+```
+
+v0.1 of jevtriage does not install or invoke jevcheck.
+
+## Develop
+
+```bash
+pip install -e ".[dev]"
+pytest
+python -m jevtriage --answers fixtures/replay-single-ready.json --model jev-1.13.0
+```
+
+This repo’s default CI runs unit tests (mocked client) and a wheel/sdist smoke on the fixture. No live TypeSafe call.
+
+Verified System One contract: [docs.typesafe.ai/sdk/python.md](https://docs.typesafe.ai/sdk/python.md). Package: `typesafe-sdk`.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

jevtriage-0.1.0/README.md

@@ -0,0 +1,181 @@
+# jevtriage
+
+**Triage gate for pull requests.** A GitHub Action and small Python CLI that asks [TypeSafe Jev](https://typesafe.ai) (System One) one `Choice` question:
+
+| Verdict | Meaning |
+| --- | --- |
+| `ready` | Looks safe to merge with normal review depth |
+| `needs_review` | Needs human eyes (unclear risk, large or ambiguous change) |
+| `risky` | Elevated risk (security-sensitive, destructive, or high blast radius) |
+
+The official `ChoiceAnswer.confidence` is a gate: **`ready` only exits 0 when confidence ≥ threshold** (default `0.8`). Low confidence fails closed to `needs_review` (exit 1).
+
+v0.1 is a **drop-in Action**. Copy one workflow YAML, set `TYPESAFE_API_KEY`, pin a model, get a verdict on every PR.
+
+## Not these nearby tools
+
+| Tool | Niche |
+| --- | --- |
+| **[HexyeDEV/JevPR](https://github.com/HexyeDEV/JevPR)** | GitHub App + policy router (`LOW` / `NORMAL` / `SPECIALIST` → approve or assign reviewers). A review-routing service, not a CI gate. |
+| **[1jehuang/jev-pr-labeler](https://github.com/1jehuang/jev-pr-labeler)** | Semantic labels (`type:`, `area:`, `size:`) via OpenRouter. Taxonomy, not merge readiness. |
+| **jevtriage (this repo)** | **Triage gate**: `ready` / `needs_review` / `risky` + confidence fail + marketplace-friendly Action + CLI exit codes. |
+
+Pair with [`jevcheck`](https://github.com/sathariels/jevcheck) contracts if you want upgrades to fail when this question flips. **jevcheck is not a v0.1 dependency** — `fixtures/pr-triage.contract.json` and `fixtures/replay-ready.json` are the replay shape.
+
+## Install
+
+```bash
+pip install -e ".[dev]"
+export TYPESAFE_API_KEY=...          # live Jev only; never commit this
+export TYPESAFE_DEFAULT_MODEL=jev-1.13.0
+```
+
+Auth is **`TYPESAFE_API_KEY` only** (`typesafe-sdk`). Unit tests mock the client. This repo does not publish to PyPI in v0.1; the Action installs the checked-out tree.
+
+## GitHub Action
+
+Marketplace-friendly root `action.yml`:
+
+```yaml
+# .github/workflows/pr-triage.yml
+name: pr-triage
+on: pull_request
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+jobs:
+  triage:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: sathariels/jevtriage@v0.1.0   # pin a tag or commit SHA once cut; @main until then
+        id: triage
+        env:
+          TYPESAFE_API_KEY: ${{ secrets.TYPESAFE_API_KEY }}
+        with:
+          model: jev-1.13.0
+          apply-labels: true
+      - run: echo "${{ steps.triage.outputs.verdict }} ${{ steps.triage.outputs.confidence }}"
+```
+
+Until a `v0.1.0` tag exists, use `sathariels/jevtriage@main` (or this PR’s SHA). The step **fails** on exit 1 or 2 — that is the gate. Use `continue-on-error: true` only if you want labels/comments after a non-ready verdict.
+
+This repository’s [example workflow](.github/workflows/example-pr-triage.yml) runs the same Action with `answers: fixtures/replay-single-ready.json` so default CI never calls TypeSafe.
+
+### Inputs
+
+| Input | Default | Notes |
+| --- | --- | --- |
+| `model` | `TYPESAFE_DEFAULT_MODEL` | Required pin. `latest` / `preview` / empty rejected |
+| `min-confidence` | `0.8` | Official `ChoiceAnswer.confidence` floor for exit 0 |
+| `allow-unpinned` | `false` | Production stay `false` |
+| `apply-labels` | `false` | Writes `jev:ready`, `jev:needs-review`, `jev:risky` |
+| `github-token` | `${{ github.token }}` | PR fetch + optional labels |
+| `pull-request` | event PR number | Used to fetch title/body/diff |
+| `repository` | `${{ github.repository }}` | `owner/name` |
+| `title` / `body` / `diff-path` | empty | Overrides; skip GitHub fetch when you pass them |
+| `answers` / `case` | empty | Fixture replay (CI / no key) |
+| `max-diff-chars` | `32000` | Unified diff cap (~20–40k) |
+| `python-version` | `3.12` | |
+
+### Outputs
+
+| Output | Source |
+| --- | --- |
+| `verdict` | `ChoiceAnswer.choice` (`ready` / `needs_review` / `risky`) |
+| `confidence` | official `ChoiceAnswer.confidence` in `[0, 1]` |
+| `model` | `SystemOneResponse.model` |
+
+## CLI
+
+```bash
+# Live (needs TYPESAFE_API_KEY). Fetches the PR via GITHUB_TOKEN.
+jevtriage --repo owner/name --pr 123 --model jev-1.13.0
+
+# Local files
+jevtriage --title "Fix typo" --body "nits" --diff pr.diff --model jev-1.13.0
+
+# Replay (no key) — jevcheck-style fixture
+jevtriage --answers fixtures/replay-single-ready.json --model jev-1.13.0
+jevtriage --answers fixtures/replay-ready.json --case auth-bypass --model jev-1.13.0
+```
+
+Stdout is one JSON object (`verdict`, `confidence`, `probabilities`, `model`, `usage`, `truncated`). A one-line summary goes to stderr. When `GITHUB_OUTPUT` is set, the Action outputs are appended.
+
+### Environment
+
+| Variable | Role |
+| --- | --- |
+| `TYPESAFE_API_KEY` | **Required** for live calls. The only auth env. |
+| `TYPESAFE_DEFAULT_MODEL` | Pin when `--model` / Action `model` is empty |
+| `TYPESAFE_BASE_URL` | Optional SDK API root |
+| `GITHUB_TOKEN` / `GH_TOKEN` | Fetch the PR; apply labels if requested |
+| `GITHUB_REPOSITORY` | Default `--repo` |
+| `GITHUB_OUTPUT` | Write Action outputs |
+
+## Exit codes
+
+| Code | When |
+| --- | --- |
+| **0** | Verdict is `ready` **and** `confidence` ≥ `--min-confidence` |
+| **1** | Verdict is `needs_review`, **or** `ready`/`needs_review` below the confidence threshold |
+| **2** | Verdict is `risky`, **or** a config/API/identity error |
+
+Exit **2** is shared on purpose (fail closed). Distinguish them from stdout: a successful call has `verdict`; a failure has `"error"`. `risky` still writes `verdict` + Action outputs before exiting 2. Config errors (missing key, unpinned model, bad replay) also exit 2 and print `{"error": "..."}`.
+
+Label apply failures are logged to stderr and **do not** change the verdict exit code.
+
+## What Jev sees
+
+System One `state` is a JSON object (official SDK: string or object):
+
+- `title`, `body` (body capped at 8k chars)
+- `diff` — unified diff, capped at 32k chars by default, with a visible truncation note
+- `files` + `stats` when provided or when the GitHub compare payload is used
+- `jevtriage_notes` when anything was truncated or the diff was omitted
+
+The only question is a `Choice` named `triage` with **exactly** the three criteria above. Official fields only (`instructions`, `criteria`). The gate uses official `choice` + `confidence` + `probabilities` — no invented confidence field.
+
+## Model pinning
+
+Production mode rejects empty names and floating aliases (`jev-latest`, `jev-preview`, or any name containing `latest` or `preview`). A documented TypeSafe catalog pin as of 2026-09-19 is `jev-1.13.0`. Pass `--allow-unpinned` only for experiments.
+
+The response `model` must match the requested pin (exact string). An opted-in alias may resolve to a concrete version.
+
+## Optional labels
+
+With `--apply-labels` / `apply-labels: true` and `GITHUB_TOKEN`:
+
+- `jev:ready`
+- `jev:needs-review`
+- `jev:risky`
+
+Other `jev:*` triage labels on the PR are removed so only one remains.
+
+## jevcheck (optional)
+
+`fixtures/pr-triage.contract.json` is a v0.1 jevcheck contract for this exact question. `fixtures/replay-ready.json` is a keyed replay (`docs-typo`, `large-ambiguous`, `auth-bypass`). After you add `jevcheck` to a repo:
+
+```bash
+jevcheck eval fixtures/pr-triage.contract.json \
+  --candidate-model jev-1.13.0 \
+  --answers fixtures/replay-ready.json
+```
+
+v0.1 of jevtriage does not install or invoke jevcheck.
+
+## Develop
+
+```bash
+pip install -e ".[dev]"
+pytest
+python -m jevtriage --answers fixtures/replay-single-ready.json --model jev-1.13.0
+```
+
+This repo’s default CI runs unit tests (mocked client) and a wheel/sdist smoke on the fixture. No live TypeSafe call.
+
+Verified System One contract: [docs.typesafe.ai/sdk/python.md](https://docs.typesafe.ai/sdk/python.md). Package: `typesafe-sdk`.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

jevtriage-0.1.0/action.yml

@@ -0,0 +1,148 @@
+name: jevtriage
+description: Triage a pull request with TypeSafe Jev (ready / needs_review / risky)
+author: sathariels
+branding:
+  icon: git-pull-request
+  color: purple
+
+inputs:
+  model:
+    description: Pinned Jev model (for example jev-1.13.0). Rejects empty / latest / preview. Falls back to TYPESAFE_DEFAULT_MODEL.
+    required: false
+    default: ""
+  min-confidence:
+    description: Minimum official ChoiceAnswer.confidence required for exit 0 when the verdict is ready
+    required: false
+    default: "0.8"
+  allow-unpinned:
+    description: Opt in to floating latest/preview aliases. Keep false in production.
+    required: false
+    default: "false"
+  apply-labels:
+    description: Apply jev:ready / jev:needs-review / jev:risky when GITHUB_TOKEN is set
+    required: false
+    default: "false"
+  github-token:
+    description: Token used to read the pull request and optionally apply labels
+    required: false
+    default: ${{ github.token }}
+  pull-request:
+    description: Pull request number. Defaults to the triggering pull_request event.
+    required: false
+    default: ${{ github.event.pull_request.number }}
+  repository:
+    description: owner/name repository. Defaults to github.repository.
+    required: false
+    default: ${{ github.repository }}
+  title:
+    description: Override PR title (skips GitHub title fetch when set with body/diff)
+    required: false
+    default: ""
+  body:
+    description: Override PR body
+    required: false
+    default: ""
+  diff-path:
+    description: Path to a unified diff file
+    required: false
+    default: ""
+  answers:
+    description: Replay JSON (single System One response or jevcheck-style keyed replay). Skips the live TypeSafe call.
+    required: false
+    default: ""
+  case:
+    description: Case id when answers is a keyed replay file
+    required: false
+    default: ""
+  max-diff-chars:
+    description: Unified diff character cap (default 32000)
+    required: false
+    default: "32000"
+  python-version:
+    description: Python version for the composite action
+    required: false
+    default: "3.12"
+
+outputs:
+  verdict:
+    description: ready | needs_review | risky
+    value: ${{ steps.run.outputs.verdict }}
+  confidence:
+    description: Official ChoiceAnswer.confidence from 0 to 1
+    value: ${{ steps.run.outputs.confidence }}
+  model:
+    description: response.model returned by TypeSafe (or the replay)
+    value: ${{ steps.run.outputs.model }}
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Python
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      with:
+        python-version: ${{ inputs.python-version }}
+
+    - name: Install jevtriage
+      shell: bash
+      run: python -m pip install --disable-pip-version-check "${{ github.action_path }}"
+
+    - name: Run jevtriage
+      id: run
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+        GH_TOKEN: ${{ inputs.github-token }}
+        JEVTRIAGE_MODEL: ${{ inputs.model }}
+        JEVTRIAGE_MIN_CONFIDENCE: ${{ inputs.min-confidence }}
+        JEVTRIAGE_ALLOW_UNPINNED: ${{ inputs.allow-unpinned }}
+        JEVTRIAGE_APPLY_LABELS: ${{ inputs.apply-labels }}
+        JEVTRIAGE_PR: ${{ inputs.pull-request }}
+        JEVTRIAGE_REPO: ${{ inputs.repository }}
+        JEVTRIAGE_TITLE: ${{ inputs.title }}
+        JEVTRIAGE_BODY: ${{ inputs.body }}
+        JEVTRIAGE_DIFF: ${{ inputs.diff-path }}
+        JEVTRIAGE_ANSWERS: ${{ inputs.answers }}
+        JEVTRIAGE_CASE: ${{ inputs.case }}
+        JEVTRIAGE_MAX_DIFF: ${{ inputs.max-diff-chars }}
+      run: |
+        set -euo pipefail
+        args=()
+        if [[ -n "${JEVTRIAGE_MODEL}" ]]; then
+          args+=(--model "${JEVTRIAGE_MODEL}")
+        fi
+        args+=(--min-confidence "${JEVTRIAGE_MIN_CONFIDENCE}")
+        args+=(--max-diff-chars "${JEVTRIAGE_MAX_DIFF}")
+        if [[ "${JEVTRIAGE_ALLOW_UNPINNED}" == "true" ]]; then
+          args+=(--allow-unpinned)
+        elif [[ "${JEVTRIAGE_ALLOW_UNPINNED}" != "false" ]]; then
+          echo "allow-unpinned must be true or false" >&2
+          exit 2
+        fi
+        if [[ "${JEVTRIAGE_APPLY_LABELS}" == "true" ]]; then
+          args+=(--apply-labels)
+        elif [[ "${JEVTRIAGE_APPLY_LABELS}" != "false" ]]; then
+          echo "apply-labels must be true or false" >&2
+          exit 2
+        fi
+        if [[ -n "${JEVTRIAGE_PR}" ]]; then
+          args+=(--pr "${JEVTRIAGE_PR}")
+        fi
+        if [[ -n "${JEVTRIAGE_REPO}" ]]; then
+          args+=(--repo "${JEVTRIAGE_REPO}")
+        fi
+        if [[ -n "${JEVTRIAGE_TITLE}" ]]; then
+          args+=(--title "${JEVTRIAGE_TITLE}")
+        fi
+        if [[ -n "${JEVTRIAGE_BODY}" ]]; then
+          args+=(--body "${JEVTRIAGE_BODY}")
+        fi
+        if [[ -n "${JEVTRIAGE_DIFF}" ]]; then
+          args+=(--diff "${JEVTRIAGE_DIFF}")
+        fi
+        if [[ -n "${JEVTRIAGE_ANSWERS}" ]]; then
+          args+=(--answers "${JEVTRIAGE_ANSWERS}")
+        fi
+        if [[ -n "${JEVTRIAGE_CASE}" ]]; then
+          args+=(--case "${JEVTRIAGE_CASE}")
+        fi
+        jevtriage "${args[@]}"

jevtriage-0.1.0/fixtures/pr-triage.contract.json

@@ -0,0 +1,95 @@
+{
+  "version": "0.1",
+  "name": "jevtriage-pr-gate",
+  "baseline_model": "jev-1.13.0",
+  "defaults": {
+    "min_confidence": 0.8,
+    "confidence_tolerance": 0.1
+  },
+  "cases": [
+    {
+      "id": "docs-typo",
+      "state": {
+        "title": "Fix typo in README",
+        "body": "Correct a spelling error in the install section.",
+        "diff": "diff --git a/README.md b/README.md\n--- a/README.md\n+++ b/README.md\n@@ -1,3 +1,3 @@\n-instal\n+install\n",
+        "diff_truncated": false,
+        "diff_original_chars": 120
+      },
+      "questions": {
+        "triage": {
+          "type": "choice",
+          "instructions": "Triage this pull request for merge readiness. Choose exactly one label. Use the pull request title, body, and the provided diff (or file list and stats when the diff is truncated or omitted).",
+          "criteria": {
+            "ready": "Looks safe to merge with normal review depth. The change is focused, has low blast radius, and is not security-sensitive or destructive.",
+            "needs_review": "Needs human eyes. Risk is unclear, or the change is large, ambiguous, or hard to assess from the provided context.",
+            "risky": "Elevated risk. Security-sensitive, destructive, or high blast radius."
+          }
+        }
+      },
+      "expect": {
+        "triage": {
+          "choice": "ready",
+          "min_confidence": 0.8,
+          "baseline_confidence": 0.94
+        }
+      }
+    },
+    {
+      "id": "large-ambiguous",
+      "state": {
+        "title": "Refactor billing pipeline",
+        "body": "Move several services around. Behavior should be the same.",
+        "diff": "",
+        "diff_truncated": false,
+        "stats": {"additions": 1800, "deletions": 1400, "changed_files": 47},
+        "jevtriage_notes": ["unified diff omitted; using file list and stats"]
+      },
+      "questions": {
+        "triage": {
+          "type": "choice",
+          "instructions": "Triage this pull request for merge readiness. Choose exactly one label. Use the pull request title, body, and the provided diff (or file list and stats when the diff is truncated or omitted).",
+          "criteria": {
+            "ready": "Looks safe to merge with normal review depth. The change is focused, has low blast radius, and is not security-sensitive or destructive.",
+            "needs_review": "Needs human eyes. Risk is unclear, or the change is large, ambiguous, or hard to assess from the provided context.",
+            "risky": "Elevated risk. Security-sensitive, destructive, or high blast radius."
+          }
+        }
+      },
+      "expect": {
+        "triage": {
+          "choice": "needs_review",
+          "min_confidence": 0.75,
+          "baseline_confidence": 0.88
+        }
+      }
+    },
+    {
+      "id": "auth-bypass",
+      "state": {
+        "title": "Skip auth on internal admin routes",
+        "body": "Temporary workaround so the dashboard loads.",
+        "diff": "diff --git a/app/auth.py b/app/auth.py\n--- a/app/auth.py\n+++ b/app/auth.py\n@@ -1,6 +1,3 @@\n-def require_admin(user):\n-    if not user.is_admin:\n-        raise PermissionError\n+def require_admin(user):\n+    return True\n",
+        "diff_truncated": false
+      },
+      "questions": {
+        "triage": {
+          "type": "choice",
+          "instructions": "Triage this pull request for merge readiness. Choose exactly one label. Use the pull request title, body, and the provided diff (or file list and stats when the diff is truncated or omitted).",
+          "criteria": {
+            "ready": "Looks safe to merge with normal review depth. The change is focused, has low blast radius, and is not security-sensitive or destructive.",
+            "needs_review": "Needs human eyes. Risk is unclear, or the change is large, ambiguous, or hard to assess from the provided context.",
+            "risky": "Elevated risk. Security-sensitive, destructive, or high blast radius."
+          }
+        }
+      },
+      "expect": {
+        "triage": {
+          "choice": "risky",
+          "min_confidence": 0.85,
+          "baseline_confidence": 0.96
+        }
+      }
+    }
+  ]
+}