Guarding the State Machine: Hexagonal Judgment and Sub-Second Micro-Decisions with TypeSafe Jev

The Limits of Boolean Guarding

Deterministic guard expressions (such as exit_code === 0 or schema validation) guarantee that programmatic operations succeed before a state machine advances.

However, state boundaries often involve semantic questions:

• "Did the security audit surface zero unredacted secrets or credentials?"
• "Does this proposed refactoring preserve public module boundaries without introducing circular dependencies?"
• "Does the generated pull request summary match the staged git diff?"

Routing these evaluations to frontier conversational models introduces 3 to 6 seconds of latency per transition, high per-turn token costs, variable formatting, and hard API dependencies in the runtime core.

Decoupled Ports and Adapters

Reactive Skills Architecture uses a Ports-and-Adapters design for semantic evaluation (packages/runtime/src/core/judgment-engine.ts). The core runtime contains no direct AI vendor SDKs.

Transitions declare high-level semantic contracts across three standardized judgment types:

• predicate: A binary query evaluating to true or false with a calibrated confidence score (p_yes).
• categorical: Structured classification that routes execution to one of several declared transition targets.
• evaluation: Rubric-based numerical scoring for multi-criteria quality gates.

The JudgmentAdapter interface abstracts the underlying evaluator, supporting local V8 sandboxes, custom internal classifiers, or specialized external micro-decision services.

Sub-Second Evaluation with TypeSafe Jev

For semantic evaluation, the runtime provides the built-in JevJudgmentAdapter, which connects to TypeSafe AI's System One decision model (Jev).

Instead of generating freeform chain-of-thought tokens, TypeSafe Jev evaluates structured decision contracts directly. Calls through JevJudgmentAdapter resolve in ~300–500ms with calibrated probabilities.

The runtime package includes @typesafe-ai/sdk and the adapter reads TYPESAFE_API_KEY from the environment. It calls System One directly without invoking jev-axi, a shell, or a temporary state file. If credentials are unavailable, the adapter reports unavailable without failing engine initialization and the engine preserves its deterministic Script fallback.

Circuit Breakers and Fallback Cascades

In production workflows, relying on external network services for transition gates introduces latency and outage risk. RSA implements a protective cascade directly in the Judgment Engine:

• Circuit breaker isolation: Each adapter maintains a state machine (CLOSED -> OPEN -> HALF_OPEN). If consecutive evaluation failures reach the configured threshold (default: 2), the breaker trips to OPEN, bypassing subsequent calls to protect agent turnaround time.
• Calibrated confidence gates: Transitions specify a min_confidence threshold (such as 0.85). If an evaluation returns a verdict below this threshold, the transition is rejected.
• Fallback cascade: When a primary adapter times out or trips, the engine delegates to a declared fallback adapter (such as ScriptJudgmentAdapter) or routes directly to an explicit fallback_target state (such as MANUAL_REVIEW or SECURITY_BLOCKED).
• Audit logging: Every breaker trip or fallback invocation appends a GUARD_FALLBACK_TRIGGERED event into the append-only SQLite store.

Transition Contract Specification

Here is a complete guarded transition contract in skill.yaml:

# skill.yaml transition contract
transitions:
  SECURITY_CLEAN:
    target: "SPEC_ALIGNMENT"
    judgment:
      type: "predicate"
      criterion: "Did the security audit confirm zero leaked API keys and no high-severity vulnerabilities?"
      min_confidence: 0.85
      adapter_hint: "jev"
      fallback_adapter: "script"
      fallback_target: "SECURITY_BLOCKED"
      timeout_ms: 2500

Operational Invariants

Because transition guards sit on the critical execution path of each turn, primary evaluation timeouts should remain under 2.5 seconds. Configuring a circuit breaker with a two-failure threshold and a 60-second recovery timeout ensures that downstream API degradation diverts to deterministic local fallbacks without hanging the agent.