Combine checks
validate accepts one validator or an array:
Configuration
A case accepts up to 20 validators. Each judge accepts up to 20 choices. Names, rubrics, and expected answers are checked when the eval compiles.
Authentication
Agent judges use your organization’s connection for that harness. A Codex judge can use a ChatGPT subscription connection; it does not need an OpenAI API key. When the task uses the same harness, the judge reuses its bound connection. For direct OpenAI calls, replaceharness with provider: "openai". Configure OPENAI_API_KEY in the organization’s environment connection, or in the server and worker environment for a self-hosted deployment. A ChatGPT subscription is not an OpenAI API key.
Keep credentials out of eval definitions, rubrics, and fixtures.
Evidence and isolation
Judges receive the rendered task prompt, final answer, and optional expected answer. They do not receive the task workspace, transcript, MCP or CLI configuration, or task environment. Agent judges start in a fresh sandbox after the task sandbox closes. They are instructed to grade only the supplied evidence. Tool use invalidates the judgment; it is detected, not prevented by a network firewall. For tool-use assertions, keep a code validator that inspects the mock call log. Direct OpenAI judges use structured outputs with storage disabled. Both backends validate the response against the declared choices and require a short explanation. Timeouts, refusals, invalid responses, and provider failures producescore: null and make the trial void.
Results
Each trial’sjudgments contains name, model, evaluator, choice, score, threshold, reason, durationMs, and error. The dashboard shows these separately from code checks. Judge costs are marked unpriced, so a judged run’s cost total is incomplete.
Changing a judge changes the case identity used for baselines. Calibrate each rubric against known good and bad answers before trusting its scores. Repeat trials: model judgments can vary, even with the same model and rubric.