feat(llm-evals): apologist evaluation harness with matrix scoring + rubric polisher [NES-1664]

libs/llm-evals/.env.example

@@ -0,0 +1,32 @@
+# Preferred path: `pnpm exec nx run llm-evals:fetch-secrets` will populate
+# libs/llm-evals/.env from the journeys Doppler project, filtered to only the
+# keys the eval suite needs. Requires `doppler` CLI + `$DOPPLER_JOURNEYS_TOKEN`.
+#
+# This file documents the keys the suite reads. If you need to override one of
+# them for a single run without re-fetching from Doppler, copy it to
+# libs/llm-evals/.env.local (gitignored, takes precedence over .env).
+
+# ── Required ──────────────────────────────────────────────────────────────
+# Used to fetch the system prompt under evaluation by label.
+LANGFUSE_PUBLIC_KEY=
+LANGFUSE_SECRET_KEY=
+LANGFUSE_BASE_URL=
+
+# ── Eval-under-test provider (default: openrouter → gemini-3-flash-preview) ─
+# EVAL_PROVIDER=openrouter | gemini | apologist
+# OpenRouter (default — mirrors /api/chat's default model):
+OPENROUTER_API_KEY=
+# OPENROUTER_MODEL=google/gemini-3-flash-preview
+#
+# Gemini (direct):
+# GOOGLE_GENERATIVE_AI_API_KEY=
+# EVAL_GEMINI_MODEL=gemini-2.0-flash
+#
+# Apologist gateway (cost-sensitive — only set EVAL_PROVIDER=apologist
+# when you explicitly want to bill it):
+# APOLOGIST_API_URL=
+# APOLOGIST_API_KEY=
+# APOLOGIST_MODEL_ID=openai/gpt/4o-mini
+
+# ── Judge provider (independent of eval-under-test; default: openrouter) ──
+# EVAL_JUDGE_PROVIDER=openrouter

libs/llm-evals/.gitignore

@@ -0,0 +1,3 @@
+# Local Doppler-managed secrets. Never commit.
+.env
+.env.local

libs/llm-evals/eslint.config.mjs

@@ -0,0 +1,18 @@
+import commonConfig from '../shared/eslint/common.mjs'
+
+export default [
+  ...commonConfig,
+  {
+    ignores: ['libs/llm-evals/vitest.evals.mts']
+  },
+  {
+    files: [
+      'libs/llm-evals/scenarios/**/*.ts',
+      'libs/llm-evals/eval.spec.ts',
+      'libs/llm-evals/src/judge.ts'
+    ],
+    rules: {
+      'i18next/no-literal-string': 'off'
+    }
+  }
+]