feat(judge): support independent judge engine configuration

[zpzjzj]

Summary

An agent_judge currently inherits the evaluated agent's engine even when its model requires another protocol. Add an explicit judge.engine using the existing engine schema so a Codex runner can be reviewed by Claude Code, with independently resolved model connections and adapter settings. Legacy judge.model remains supported.

Related issues

Fixes #104. First of the three proposed changes; Shared-runtime Docker/OpenSandbox judging follows in #315 and #316; #308 remains separate.

Changes

• Resolve explicit judge engines without runner model, CLI credential/endpoint, kwargs, version, or custom-engine fallback. Reuse existing provider/protocol connection resolution, environment expansion, adapter construction, and installation.
• Treat case-level engine/model selections as replacements while preserving legacy defaults and existing judge-list semantics.
• Reject known native OpenAI/Anthropic protocol mismatches and model overrides the adapter would discard before the evaluated agent executes. Explicit protocol-specific provider endpoints remain supported; no provider-to-engine inference is added.
• Install, preflight and initialize independent judge CLIs in the selected runtime during the judge phase; host runtime requires preinstalled CLIs. OpenCode judges initialize their own provider endpoint and API-key environment binding while preserving existing case MCP configuration.
• Add regression coverage, bilingual documentation, defaults comments, and an independently configured code-stats reviewer.

Test plan

• make fmt
• make verify (0 lint issues)
• make test (race detector, plugin tests, Skill regression scripts)
• go run ./cmd/skill-up validate ./examples/code-stats/evals/eval.yaml
• Tests cover separate judge connections, config replacement, custom-engine env expansion, installation/preflight errors, validation before runner execution, and distinct judge engines over isolated copies of one completed run.

Provider configuration regression

• Built-in OpenAI and custom OpenCode providers override the runner endpoint; existing MCP configuration is preserved. Custom-provider model registration and API-key environment references are checked, along with configuration-initialization failures.
• The new provider regression fails on the pre-fix evaluator in all four provider/runner combinations and passes after the fix.
• The combined feat(judge): support independent judge engine configuration #314/feat(evaluator): run sequential judges in the shared case runtime #315/test(runtime): verify sequential judges in a shared OpenSandbox #316 code was validated in a real OpenSandbox with OpenCode 1.14.24 and live qwen3.8-max requests. A runner fixture seeds an unusable endpoint and wrong key; two independent OpenCode judges both PASS with distinct session IDs. The real-provider regression is committed in test(runtime): verify sequential judges in a shared OpenSandbox #316.

Default-endpoint follow-up:

• Independent OpenCode judges reset only their selected provider's inherited inline configuration, including endpoint and API-key/SDK/model settings; case MCP, unrelated providers, plugins and permissions remain intact. Normal runner and legacy judge initialization retain their existing behavior.
• Regression uses the real resolver and adapter factory. Both OpenAI and Anthropic omitted-base_url cases reproduce on the previous evaluator and pass after the fix; explicit-endpoint controls pass as well.
• Real OpenSandbox/OpenCode 1.14.24 default-configuration installation, preflight and readback passed. The real qwen3.8-max explicit-endpoint control passed with two distinct judge sessions.
• Native OpenAI model calls were not completed: direct api.openai.com connectivity timed out from the test sandbox, and both model invocations hit their deadlines. No native OpenAI model success is claimed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 84064f1bde

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T07:27:24.639596Z	84064f1	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[JHWang-1997]

Reproduced one remaining P2 in independent OpenCode judge initialization: omitting judge.engine.model.base_url leaves the runner’s provider endpoint active. The inline comment includes a minimal setup, expected/actual behavior, and a passing explicit-endpoint control.

[zpzjzj]

Addressed the default-endpoint routing review in f61c678 and synchronized #315/#316. Regression tests, real OpenSandbox default-configuration readback, and the live explicit-endpoint judge control passed. Native OpenAI connectivity remains a separately documented limitation. Details are in the inline reply. Please re-review the updated stack.