Propose Jev as typed judgments for Ask why and household intents

[frahlg]

Problem and result

Fredrik asked to look at what Jev (TypeSafe System One) could do in FTW.

Jev is a fast judgment model: it takes named site state and returns typed Choice / Noul / Score answers with probabilities. It does not write prose, plans or driver commands. That matches FTW’s split: agents and language understand intent; Core admits and dispatches.

This PR installs the TypeSafe skill for later work and lands a proposed, unwired judgment layer:

1. Ask why routing (recommended starting point). One speculative fan-out classifies the question, picks read-only tools, detects a control request, and decides whether an FTW bug issue is warranted. Low confidence keeps today’s full OpenRouter path.
2. Household intents. The same pattern maps a sentence onto operations Core already has: Charge now (loadpoint.hold), standing ready-by (PUT …/schedule), vehicle SoC (loadpoint.soc.set). Percent and clock values are extracted in code, then Jev selects among those candidates. Safety-bypass language refuses before any Core write is proposed.
3. Not in this PR, still useful later: scoring whether a charging goal-risk event should notify, and ranking command-result / log spans for analysis agents (roadmap rows on notifications and live evidence).

Nothing is hooked to /api/assistant/ask, config, or dispatch. Missing TypeSafe means the existing UI and typed APIs keep working.

Scope and safety

• Jev never talks to hardware. Planner output is still untrusted input. Stale site-meter data still stops dispatch.
• Ask why stays read-only. A control-classified utterance becomes refuse_control, not a command.
• Unsafe household requests (asks_to_bypass_safety) win over a high-confidence Charge now.
• Unstated days on a standing schedule default to weekdays (the product example). A stated “every day” keeps the zero mask.
• Thresholds in the composer are starting points to evaluate on real utterances, not cookbook defaults and not permission to act.
• No overlapping open PR was touching go/internal/assistant or Ask why.

Marked proposed in VISION.md, architecture and the roadmap agents row.

Verification

cd go && go test ./internal/typesafe ./internal/assistant

That run passed here, including composition cases for plan-without-issue, control refuse, weekday schedule, everyday vs weekday masks, and safety bypass.

Optional live check against Jev (not CI):

TYPESAFE_API_KEY=… TYPESAFE_LIVE=1 go test ./internal/assistant -run LiveJev -v

No UI changed; no browser review.

Checklist

• Follows VISION.md as a proposed direction; selected scope is Ask why routing first, household intents after write authority exists.
• Checked overlapping PRs; none on these files.
• Tests cover composition and failure paths (unsafe, uncertain, missing deadline).
• No UI changed.
• Needs the no-changeset label: nothing ships to boxes yet (internal composer + docs + skill).
• DCO sign-off on the commit.