feat(client): grounded judge context and per-judge diagnostics

[apucacao]

Why

A judge is a second AI call that grades the first one. Three things were wrong with how it ran. This PR fixes all three.

1. The judge was grading blind. It saw the user request and the model's answer, but not the data the run actually looked at. So it had to guess. It now receives that evidence as context.

2. A broken judge could hold up a good answer. Judges run after the primary call is finished and billed. Python already caught a judge's errors and logged them, but nothing bounded a judge that hung, so a stuck judge held the response the caller already paid for. Each judge is now isolated and bounded by judge_timeout_ms: its failure is recorded, not raised, and a malformed judgeConfiguration entry no longer escapes either.

3. Failures were invisible. A judge that was disabled, timed out, or errored simply vanished from the results, with no way to tell which. Every skip or failure now leaves a JudgeDiagnostic behind.

What changed

• config(...) gains judge_context (a lazy callback, resolved once after the primary call) and judge_timeout_ms.
• ProviderResponse, the stream done event, and JudgeTask gain judge_context; those plus the graph response and the final graph().stream() done event gain judge_diagnostics.
• The evidence block is one more part of judge_scoring.build_message_history, after the answer (and the tool trajectory) and before the formatting instructions, so run_judges and run_judge on a JudgeTask still show a judge the same conversation. A callback that returns None supplies no evidence.
• The context is validated as JSON under 64 KiB, then injected into each judge's message_history inside UNTRUSTED_ACTUATOR_EVIDENCE_BEGIN / ..._END. It never reaches the primary model and is never recorded in telemetry. A judge's own prompt is a LaunchDarkly AI Config and stays swappable at runtime; the evidence rides in a fixed slot that prompt cannot displace.

Breaking change

run_judges and build_judge_tasks now return RunJudgesResult { judge_results, judge_diagnostics } and BuildJudgeTasksResult { judge_tasks, judge_diagnostics, judge_context } instead of the bare value. The per-entry shape inside is unchanged. This is a clean break on purpose: a wrapper that returned only results would reintroduce the silent-failure hole point 3 closes.

Stacked

Based on #86 (fix(judges): a judge config's outputFormat must not reach the provider), not on main, because both change judges.py. Review #86 first; its diff is small. GitHub retargets this PR to main automatically when #86 merges.

🤖 Generated with Claude Code

[apucacao]

bugbot run

[cursor]

Stale Bugbot comment from a previous run.

[apucacao]

bugbot run

[cursor]

Stale Bugbot comment from a previous run.

[apucacao]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 827218c. Configure here.}