
Security News
Agent Baseline Publishes Security Reference Architecture for Software Factories
Agent Baseline’s new reference architecture shows how to secure software factories with four boundaries enforced outside the AI agent.
@tangle-network/agent-eval
Advanced tools
Evaluate and improve AI agents from runs, traces, judges, and feedback. Compare candidates, cluster failures, measure lift, and gate releases.
@tangle-network/agent-evalRun agent evaluations, compare changes on the same cases, and decide whether a candidate has enough evidence to release.
Eval runs in your TypeScript process. You supply agent execution, judges, and model transports. It records outputs, failures, costs, and evidence for each comparison.
Use Node.js 20.19 or newer. This release line requires Interface 5 and Core 0.12. Eval 0.212 remains the release line for Interface 4 and Core 0.11. Eval 0.211 remains the release line for Interface 3.
pnpm add @tangle-network/agent-eval
This complete example runs offline.
Save it as eval.mts.
import { defineAgentEval } from '@tangle-network/agent-eval/contract'
interface SupportCase {
id: string
kind: 'support'
}
const evalKit = defineAgentEval<SupportCase, string>({
scenarios: [
{ id: 'refund', kind: 'support' },
{ id: 'shipping', kind: 'support' },
{ id: 'cancel', kind: 'support' },
],
agent: async (prompt, scenario) =>
String(prompt).includes('ticket') ? `Ticket ${scenario.id}: on it.` : 'On it.',
judge: {
name: 'ticket-id',
dimensions: [{ key: 'present', description: 'The answer includes the ticket id' }],
score: ({ artifact, scenario }) => {
const present = artifact.includes(scenario.id) ? 1 : 0
return { dimensions: { present }, composite: present, notes: '' }
},
},
baselineSurface: 'Answer politely.',
expectUsage: 'off',
})
const baseline = await evalKit.evaluate()
const candidate = await evalKit.evaluate({
surface: 'Answer politely and cite the ticket id.',
})
console.log('baseline:', baseline.aggregates.byJudge['ticket-id']?.mean)
console.log('candidate:', candidate.aggregates.byJudge['ticket-id']?.mean)
Run it with a TypeScript runner:
pnpm add --save-dev tsx
pnpm exec tsx eval.mts
baseline: 0
candidate: 1
The baseline scores 0; the candidate scores 1 on all three cases.
These scores describe the three examples.
They do not establish a release decision or performance on new tasks.
A case is one task. A surface is the prompt, skill, or configuration being changed. A judge scores the agent's result.
expectUsage: 'off' applies because this example makes no paid calls.
Set expectUsage: 'assert' for paid agents so missing dispatch receipts become execution failures.
The runnable example uses the same evaluation.
The existing-agent example shows how to connect your agent and record model usage.
| Goal | Start with |
|---|---|
| Score one change on the same cases | defineAgentEval — see the Quickstart above |
| Compare two candidates on paired cases | runComparison — example |
| Apply a release rule without search | createHeldOutGate — example |
| Improve a prompt surface | optimize — example |
| Analyze what happened | analyzeRuns — docs |
| Trace analysts (RLM) | @tangle-network/agent-runtime — analysts guide |
| Intent | Start with | Result |
|---|---|---|
| Score one change | defineAgentEval() from /contract | Cell results, failures, score distributions, and measured cost. |
| Search for a better surface | selfImprove() from /contract | A selected surface, final comparison, and gateDecision. |
| Compare search methods | compareOptimizationMethods() from /campaign | Paired final comparisons, uncertainty, coverage, and costs under declared budgets. |
| Register evidence and decision rules | defineEvaluationClaim() and sealExperiment() from /experiment | A declared population, independent unit, optional practical effect, and sealed rules. |
| Check the evaluator | auditEvaluator(), calibration tools and the judge gate from /meta-eval | Error rates, admission evidence, agreement with owner verdicts, drift, bias diagnostics, and outcome associations. |
| Analyze completed work | analyzeRuns() from /contract; trace analysts from /analyst | Comparisons and findings with links to recorded evidence. |
| Gate on the path a run took | A trace contract (compileTraceContractSpec() from the root), or traces check in CI | pass, fail, or error per rule, with the spans that broke it. |
defineAgentEval() also exposes improve() when the same agent, cases, judge, and baseline should share configuration.
Use direct campaign controls for scheduling, durable caches, model matrices, or custom release rules.
The example index covers fixtures, trace intake, code verification, replay, and training-data exports.
Use reusable evaluations for development feedback. For a direct edit, compare the baseline and candidate on the same cases. Claims, evaluator audits, and final-evidence tracking are optional. Add stronger controls when a result must support performance on new tasks or an adaptive release decision.
claim describing the population, sampling frame, and independent unit to the comparison.
Declare minimumEffect when the decision concerns a useful improvement.auditEvaluator().finalEvidence with a shared ledger, request ID, and evaluator digest.
This reserves final units before search and records exposure before measurement.Repeated attempts on one task do not create new independent tasks.
The top-level claim controls unit aggregation for reusable comparisons.
Power checks assess the declared minimum effect.
Optional finalEvidence binds fresh confirmation to that claim and refuses reused final units across campaigns sharing the ledger.
The host must enforce access isolation and author/auditor separation. A digest records identity; it cannot prove secrecy or that a benchmark represents future users. Custom gates remain responsible for their decision rules. See evaluation integrity for the complete API and its boundaries.
These controls check the evidence behind a result. They do not establish that an optimizer beats a direct edit or simple search. The historical evidence audit records prior gains, failed transfer, and missing comparisons.
Set searchHistoryPolicy: 'require-complete' when a method's search must be closed, with every cell, operation and node accounted for, before final evidence is exposed.
The search ledger records every search as nodes, edges and cells, and its receipt is the bounded proof.
Eight lenses read that ledger and each expose one named signal a SearchPolicy can read — operatorYield for operator choice, landscape for a plateau-triggered draft, skillManifold for adaptive unit selection, metaSearch for tuning the climber itself — so agent-eval search show <ledger> --operator-yield prints the same numbers a policy or Intelligence would use.
A gateDecision is ship, hold, need_more_work, model_ceiling, or arch_ceiling.
Gate contributions distinguish missing evidence from measured failures and successful checks.
Concepts explains these decisions and how gates compose.
Pass a ChatClient to model judges, analysts, and adapters.
Eval obtains credentials from the values you supply; it does not search your environment.
import { createChatClient } from '@tangle-network/agent-eval/contract'
const chat = createChatClient({
transport: 'openai-compatible',
baseUrl: 'https://router.example/v1',
apiKey: process.env.MY_ROUTER_KEY,
defaultModel: process.env.EVAL_MODEL_ID,
})
Use your deployed model identifier and preserve the returned servedModel identity and cost receipt.
For an existing SDK, use transport: 'custom' with your chat callback and an explicit maximumAttempts.
Agent Runtime callers can bind profileChatClient() from @tangle-network/agent-runtime/kernel.
Eval has no dependency on Runtime.
Official GEPA, SkillOpt, and DSPy integrations use a Python bridge. Their maintained installation instructions and execution contracts are in campaign proposers. The Python client and wire protocol support other-language consumers.
Use /contract for a product integration, /campaign for execution controls, /experiment for registered decisions, and /meta-eval for evaluator checks.
Root Scenario, JudgeScore, and GateDecision are the same types as /contract.
Product judging retains the explicit root names ProductScenario and DimensionJudgeScore beside its functions.
HeldOutGate.evaluate() returns HeldOutGateDecision.
Specialist subpaths and their examples are listed in the surface map. Current canonical envelopes are required for seals, attestations, and profile identities. Retired or incomplete formats fail verification; historical reports retain their recorded identities.
Published measurements live in the evidence registry. The benchmark-book review records the source analysis and reproduced defects behind these integrity changes. The charter defines package ownership and the remaining research boundaries.
Read CLAUDE.md (or AGENTS.md) first: dependency boundaries, ledger canonicalization, and local conventions apply to every change.
pnpm install
pnpm build
pnpm typecheck
pnpm typecheck:examples
pnpm typecheck:scripts
pnpm lint
pnpm test
pnpm verify:package
Build before checking examples because they resolve the package's generated declarations. The Python development guide gives the locked commands for each optimizer environment.
MIT.
FAQs
Evaluate and improve AI agents from runs, traces, judges, and feedback. Compare candidates, cluster failures, measure lift, and gate releases.
The npm package @tangle-network/agent-eval receives a total of 6,321 weekly downloads. As such, @tangle-network/agent-eval popularity was classified as popular.
We found that @tangle-network/agent-eval demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Agent Baseline’s new reference architecture shows how to secure software factories with four boundaries enforced outside the AI agent.

Security News
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.

Research
/Security News
A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.