Integrate typed Jev decisions and evaluation

.agents/skills/typesafe-ai/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 TypeSafe AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

.agents/skills/typesafe-ai/SKILL.md

@@ -0,0 +1,149 @@
+---
+name: typesafe-ai
+license: MIT
+description: >
+  Build AI-powered software with TypeSafe: small units of AI intelligence you
+  can use like programming primitives. Its System One models, including Jev,
+  turn natural language and application state into typed judgments and
+  probabilities that code can combine. Use when a feature needs programmable
+  common sense, when brainstorming what AI could make possible in an app, or
+  when an LLM prompt-and-parse step could become a structured decision.
+  Applications include routing, ranking, extraction, verification, and
+  interactive experiences; these are starting points, not the limits.
+  Read live docs and cookbooks to find useful patterns and discover new combinations.
+---
+
+# Build with TypeSafe
+
+TypeSafe makes units of AI intelligence usable like programming primitives: small
+judgments you can compose into larger capabilities. Its **System One models** return
+fast, focused judgments that software can consume directly. **Jev** is TypeSafe's
+flagship and first System One model. It understands natural language and returns
+typed answers and probabilities rather
+than generating text or reasoning explanations. Code owns the workflow; the model
+supplies programmable common sense where ordinary code needs semantic understanding.
+
+## Read the live docs
+
+**The live TypeSafe docs are the source of truth. Read them as part of the task.**
+This skill gives direction; the docs carry current concepts, prompting guidance,
+API contracts, SDK usage, models, limits, and worked examples.
+
+- Start with the [documentation index](https://docs.typesafe.ai/llms.txt) to discover
+  relevant pages and cookbooks. Use targeted reads rather than loading the entire site.
+- Mintlify serves Markdown by appending `.md` to a page path, for example
+  [how to build with TypeSafe](https://docs.typesafe.ai/concepts/how-to-build-with-system-one.md).
+  Follow links from the index; convert extensionless documentation page links to
+  `.md` when useful. Resolve relative links against `https://docs.typesafe.ai`.
+- Before writing an integration, read the current API or chosen SDK page and the
+  question guidance relevant to the design. For a new workflow, also inspect the
+  closest cookbook: it often shows a better decomposition than a generic classifier.
+- If the index is unavailable, use the direct links below or the site's navigation.
+  If Markdown fetching fails, try the normal page. If live access is unavailable,
+  use available local docs or installed SDK types, state that limitation, and avoid
+  inventing version-dependent details.
+
+| Task | Start here; follow the relevant details |
+| --- | --- |
+| Understand the programming model | [System One](https://docs.typesafe.ai/concepts/system-one.md), [building guide](https://docs.typesafe.ai/concepts/how-to-build-with-system-one.md) |
+| Explore what to build | [Use-case map](https://docs.typesafe.ai/concepts/use-case-map.md), then relevant cookbooks from the index |
+| Prepare inputs and questions | [State](https://docs.typesafe.ai/concepts/state.md), [primitives](https://docs.typesafe.ai/primitives.md), then the chosen primitive's page |
+| Decide how to handle uncertainty | [Confidence](https://docs.typesafe.ai/confidence.md) |
+| Write API code | [HTTP API](https://docs.typesafe.ai/api.md), [Python SDK](https://docs.typesafe.ai/sdk/python.md), or [JavaScript SDK](https://docs.typesafe.ai/sdk/javascript.md) |
+| Update an older integration | [Migration guide](https://docs.typesafe.ai/migrating-to-v1.md) and the installed SDK's current reference |
+
+## Find the useful shape
+
+Start from the behavior the user wants: what will the application show, select,
+change, or hand off? Work backward to the judgments it needs. Keep known rules,
+calculations, exact lookups, and execution in code. Preserve the user's chosen stack
+and scope; add TypeSafe where semantic understanding helps.
+
+When brainstorming or choosing an architecture, consider more than classification.
+The patterns below are starting points: combine primitives around the user's goal,
+including ideas that do not fit an established recipe.
+
+- **Route and fill known arguments.** A request can select a handler and its typed
+  parameters. Ask useful branch-specific questions up front and consume only the
+  relevant answers. Explore [function calling](https://docs.typesafe.ai/cookbooks/function_calling.md)
+  and [speculative fan-out](https://docs.typesafe.ai/patterns/fan-out.md).
+- **Select instead of generate.** Find candidate values or source spans in code,
+  use a judgment to select the intended one, then copy or normalize it. Code can
+  also assemble source text into a formatted document or reading guide. Explore
+  [value extraction](https://docs.typesafe.ai/cookbooks/pre_parsed_value_extraction_cookbook.md)
+  and [structure recovery](https://docs.typesafe.ai/cookbooks/autoformat.md).
+- **Find and judge evidence.** Retrieve candidates, compare their relevance to a
+  query, and select useful context. Explore [reranking](https://docs.typesafe.ai/cookbooks/rerank_typesafe.md)
+  and [hierarchical classification](https://docs.typesafe.ai/cookbooks/hierarchical_classification.md).
+- **Turn judgments into reusable data.** Score dimensions once, then let code or
+  user controls change weights, thresholds, rankings, and views. With labeled
+  outcomes, those signals can become classical ML features. Explore
+  [composite scoring](https://docs.typesafe.ai/patterns/composite-scoring.md) and
+  [feature discovery](https://docs.typesafe.ai/cookbooks/autoresearch_feature_discovery.md).
+- **Verify and escalate.** Check specific claims or fields against their evidence;
+  send uncertain or failing cases to a person or reasoning model. Explore
+  [citation checks](https://docs.typesafe.ai/cookbooks/citation_check.md) and
+  [extraction cascades](https://docs.typesafe.ai/cookbooks/sde_cascade.md).
+- **Respond to changing state.** Code can retain goals and observations while fresh
+  judgments guide the next bounded step. Keep inferred state distinct from observed
+  facts, and check freshness before applying a result to a changed situation.
+
+For open-ended requests, offer the few directions that best serve the user's goal
+and recommend a starting point. For a concrete request, choose the relevant pattern
+and build; a brainstorm is not a mandatory detour.
+
+## Design the judgments
+
+Choose by what the answer means, then read the relevant primitive page:
+
+| Need | Primitive | Important distinction |
+| --- | --- | --- |
+| One of a defined set | [Choice](https://docs.typesafe.ai/primitives/choice.md) | Picks one option; its distribution compares competing options |
+| Whether a condition holds | [Noul](https://docs.typesafe.ai/primitives/noul.md) | Probability of yes; no separate confidence; use one per label when several may apply |
+| Degree along a described dimension | [Score](https://docs.typesafe.ai/primitives/score.md) | Probability-weighted position on ordered levels; use comparable per-item Scores for graded ranking |
+
+Give each question enough relevant **state** to answer: source text, identities,
+relationships, policies, and current facts. Prefer named JSON fields when context
+has several parts. Put the judgment in **instructions** and define its possible
+answers in **criteria**. Question IDs are for code and are not sent to the model;
+include complete meaning in the question. Reference nested state with backticked
+paths such as `ticket.messages[0].text`.
+
+Ask one narrow, coherent judgment per question. Split independently useful dimensions,
+without destroying the relationship being judged. A bounded action selection or
+contextual interpretation is valid; atomic does not mean literal fact extraction
+or a one-sentence limit. Strings work for simple questions. Use structured objects
+or arrays when definitions, contrasts, exclusions, or examples clarify instructions
+or criteria. Score levels must describe concrete situations and stand on their own.
+
+Keep the needed answers available. Include a no-match outcome when nothing may fit;
+use a separate presence judgment when it is independently useful. For source-value
+selection, check candidate coverage: the model cannot choose an omitted value.
+
+## Compose and verify
+
+**Ask independent questions over the same state together**, including useful
+speculative questions. They run in parallel and cannot see one another's answers.
+State each speculative premise explicitly; code consumes the applicable answers.
+A second request is warranted when an earlier answer is needed to fetch evidence,
+construct new state, or determine the next options. Extra questions still use tokens;
+measure actual request budgets, cost, and end-to-end latency.
+
+Use probabilities and confidence to guide behavior, with thresholds evaluated on
+the user's data and consequences. Choice/Score confidence summarizes distribution
+concentration, not overall workflow correctness or permission to act. A Noul near
+0.5 means similar probability for yes and no, not medium intensity. Several
+acceptable alternatives can also spread probability; low confidence need not
+invalidate a harmless preference choice. Ignore uncertainty on unused branches.
+
+Keep policy explicit and raw judgments reusable. Weighted scores suit compensating
+preferences; an “any serious violation” rule needs separate conditions. Changing a
+weight or display filter need not rerun inference when evidence and question meanings
+are unchanged. Typed output guarantees the interface, not truth. System One models
+are trained for calibrated decisions; validate their performance in the target domain.
+
+Test representative cases and the resulting application behavior. For failures,
+inspect the exact state, questions, candidates, answers, composition, and observed
+outcome. Separate missing evidence, model errors, code errors, and service failures.
+Treat cookbook thresholds and demo results as examples to evaluate, not universal
+rules or permanent model limitations. Keep API credentials server-side in web apps.

Cargo.toml

@@ -79,6 +79,9 @@ async-trait = "0.1"
 # forbidden in every crate under `crates/*` and reaches nothing there — the
 # `desk` example is a dev-dependency edge, outside what `assert-pure.sh` guards.
 anyhow = "1"
+# EXAMPLE-ONLY. The benchmark's Jev arm uses the native System One client;
+# library crates keep only provider-neutral fixed-point decision snapshots.
+tinyjevclient = { git = "https://github.com/tinyhumansai/tinyjevclient", rev = "8d116fc2ac9bceecdad9df7a0c72e0f14ee3fea5", default-features = false }
 
 # Lints apply to every member that opts in with `[lints] workspace = true`, and
 # to every target of that member. CI runs clippy with `-D warnings`, so anything

README.md

@@ -97,9 +97,8 @@ one !support trace, rescored as the room talks past it
      80       █                   62        2531
 ```
 
-The floor under the bars is the trace's standing importance, which is why a
-proposal nobody has touched for eighty messages still outranks a fresh
-question. Recency is the term that moves.
+The floor under the bars is standing importance: an old proposal can outrank a
+fresh question, while recency is the term that moves.
 
 **[Quorum sensing](https://en.wikipedia.org/wiki/Quorum_sensing).** An option
 carries when some number of distinct participants have grounded support for it
@@ -109,6 +108,8 @@ to exactly the same standing as one that watched live. This is how
 [honeybee swarms](https://en.wikipedia.org/wiki/Swarming_%28honey_bee%29)
 settle a nest site.
 
+With a typed model, `standings_with_evaluations` uses fixed-point Choice × Score after a Noul gate; see the [quorum module](crates/tinyhivemind-hive/src/quorum/README.md).
+
 ```text
 1 planner  !propose #stage Stage the rollout.
 2 scout    !propose #ship  Ship it all at once.
@@ -472,8 +473,7 @@ tinyhivemind = { path = "vendor/tinyhivemind/crates/tinyhivemind" }
 cargo run --release -p tinyhivemind-hive --example bench -- --trace
 ```
 
-That prints one deliberation episode turn by turn, which is the fastest way to
-see what the thing actually does.
+That prints one deliberation episode turn by turn—the fastest way to see the mechanics.
 
 ## Read more
 

ROADMAP.md

@@ -27,7 +27,7 @@ dependency direction is enforced by construction.
 | P13 | Digests and supersession | planned |
 | P15 | Cross-desk referral: one child turn that may run on another channel, the answer that comes back, and the federated benchmark that scored it | **done**, every knob **off by default** |
 | P14 | Recall: one selection ranking, roster and desk pickers, bounded transcript search with optional regular expressions, pinning as a fold, and a stated per-message budget | **done** |
-| P16 | Approval: a pure gate for a side-effecting action — `approve` as a total fold, standing grants, and epoch-scoped consent, with the waiting behind one `ApprovalGate` port | planned, **not implemented** |
+| P16 | Approval: a pure gate for a side-effecting action — `approve` as a total fold, standing grants, and epoch-scoped consent, with the waiting behind one `ApprovalGate` port | **done** |
 | P17 | Private asides: an audience on a stored row, a viewer on a query, the collapsed redaction stub and its settlement pointer, and the rule that an aside carries information rather than support | **done**, **off by default** — the benchmark arm says asides do not improve a decision, see below |
 | P18 | The utterance surface: a seat speaks by calling a tool rather than emitting a fence — the tool descriptions, the validation and the utterance-to-row fold live in `tinyhivemind::speech`, and a refused aside reaches its author inside the turn | **done** — see [`docs/specs/the-utterance-surface.md`](docs/specs/the-utterance-surface.md) |
 | P19 | Folding by size: the standing account triggers on the characters of foldable content as well as its row count, stated by a host as a token budget, and the fold is told which messages the room pinned so it cannot drop one | **done** — see [`docs/specs/folding-by-size.md`](docs/specs/folding-by-size.md) |
@@ -36,6 +36,7 @@ dependency direction is enforced by construction.
 | P22 | A task with a horizon: `--stages` runs a chain of decisions on one accumulating window, against a soloist handed the whole brief that compacts by eviction or by a superseding account | **done** — see [`docs/specs/long-horizon-tasks.md`](docs/specs/long-horizon-tasks.md) and [the experiment](docs/experiments/2026-09-09-the-long-horizon.md) |
 | P23 | A task with variety: `--facets` runs several independent sub-decisions belonging to one task, each with an owner, against the soloist that won the horizon — and the room wins from two facets on | **done** — see [`docs/specs/task-variety.md`](docs/specs/task-variety.md) and [the experiment](docs/experiments/2026-09-09-variety-and-roles.md) |
 | P24 | The seat-per-facet shape as the default: `division` folds a task's facets across the seats that own them, `Division::scoped` gives each owner its own facet and none of the others, and `DivisionPolicy::DEFAULT` is the one default in this crate that is **on** | **done** — see [ADR 0015](docs/adr/0015-the-division-of-labour-is-the-default-shape.md); the benchmark's `hive+fold` now calls the library and reproduces every cell bit-for-bit |
+| P28 | Typed semantic decisions: fixed-point selector distributions, admission-gated probabilistic quorum, native Jev example integration, and a paired strict-JSON baseline | **done** — see [`docs/specs/jev-integration.md`](docs/specs/jev-integration.md) |
 | P25 | Scale: the harness runs a thousand agents across a hundred desks, the sample loops spread across cores, and a cross-channel question is asked **off the floor** so a large federation still decides something. Host-side only — no library crate touched | **done** — see [the write-up](docs/experiments/2026-09-10-hive-at-scale.md) |
 | P26 | What the scale run found, fixed in the library: `EpisodePolicy::for_room` scales the three bounds `DEFAULT` states absolutely, `HiveStep::Exhausted` reports the standings and visibility it ended at, distance is measurable in the rows a fold reads, the room-size hot loops stop being quadratic, and the harness gains a federation-wide digest for desks that share a blind spot | **done** — see [the write-up](docs/experiments/2026-09-10-what-the-scale-run-found.md) and [ADR 0016](docs/adr/0016-distance-is-measured-in-the-rows-a-fold-reads.md) |
 | P27 | Evidence rather than opinion: a federation's disqualifying **facts** are planted on a desk other than the one that needs them, and a member states what it can rule out alongside what it scores. A broadcast of evidence closes the gap to the free-information ceiling at a thousand agents where a broadcast of opinion plateaus at 62.5% | **done** — see [the write-up](docs/experiments/2026-09-11-evidence-not-opinion.md) |

crates/tinyhivemind-core/src/README.md

@@ -8,6 +8,7 @@ README.
 | module | question it answers |
 | --- | --- |
 | [`aside`](aside/README.md) | how a private, off-transcript note is scoped to the readers it names |
+| [`approval`](approval/README.md) | whether one typed side-effecting action is allowed, denied, or must be put to one person |
 | [`chat`](chat/README.md) | which stored chat id names which conversation, and which four spellings mean the default desk |
 | [`desk`](desk/README.md) | what a desk is, and who is on it once the declared blueprint is merged with runtime overlays |
 | [`dispatch`](dispatch/README.md) | does one committed reply start a child turn, and for whom |

crates/tinyhivemind-core/src/approval/README.md

@@ -0,0 +1,7 @@
+# Approval module
+
+Approval is a total pure fold over a request, policy, grants, refusals, roster,
+desks, and a host-supplied monotonic time. It returns allow, deny, or one human
+question and never performs the action. `types.rs` holds stable wire payloads,
+`mod.rs` implements deny-before-allow evaluation, and `test/` pins failure,
+grant, epoch, rendering, and wire behavior.