Why not both?

Graph finds the neighbourhood; Jev picks the lucky hit. Can Jev on top of Graph RAG beat either alone — more consistent relevance in long docs — and can we get closer to an “I’m Feeling Lucky” #1? (Yes, we can have both — but “both” is not free lunch.)

Jev (rerank)

Graph expand

BM25

Jev (prep)

Prep Jev cleans the corpus; query Jev reorders Graph’s neighbourhood.

Run: 2026-09-24T06:58:36.822Z · Model: typesafe/jev-1.13 · Hybrid OpenRouter cost: ~$0.0040 · Jev-only (Early bake, reused): ~$0.0031 · Corpus: 171 docs / 224 nodes / 387 edges · Wall clock: 3.1s

Cleaned corpus. Graph-only: MiniSearch top-12 + 1-hop cites/covers expand. Hybrid: score that full Graph list with typesafe/jev-1.13 Decisions, sort by jevScore. Jev-only: MiniSearch top-15 → Jev (reused from Early Jev bake when corpus+model match). Gold@1 ids match findings-early-jev.ts.

Tables: Graph-only vs Hybrid (Graph→Jev) vs Gold. Keyword→Jev lives in the scoreboard (and per-row insights) so the grids stay readable.

Scoreboard

Gold@1

Graph 5/6
Jev-only 3/6
Hybrid 3/6

Gold in top-3

Graph 5/6
Jev-only 6/6
Hybrid 6/6

Cost

Hybrid (this run) ~$0.0040
Jev-only ~$0.0031 (reused)
Graph $0 (offline)

Latency

Avg Jev scoring 503 ms
Avg end-to-end / Q 508 ms
Concurrency 8 · ~3500 chars

Pipeline

Both vs either alone

Verdict: why not both?

Hybrid fixes Q4

Graph latches onto art-6 (framework wording). Scoring the Graph neighbourhood with Jev promotes art-28 General principles to #1 — same win as keyword→Jev, without needing a wider BM25 pool.

…and wrecks Q2 / Q3 / Q5

Hybrid inherits Jev’s taste: Art 17 over Art 19, Rec 56 over Art 26, Rec 52 over Art 45. Graph alone was already “I’m Feeling Lucky” on those. Gold stays in Hybrid top-3 (6/6) but rank-1 consistency drops to 3/6 — same as Jev-only.

Practical takeaway

Use Graph for default lucky #1 on a clean legal corpus. Reach for Graph→Jev when the question is principle-level / easy to keyword-mismatch (Q4-shaped). Always-on hybrid costs ~$0.0040 here and is not strictly better at rank 1.

What are the ICT risk management framework requirements?

Hybrid cost ~$0.0008 · Jev scoring 758 ms · e2e 766 ms · Keyword→Jev #1: art-6 · gold@1: Graph ✓ · Hybrid ✓ · Jev-only ✓

Ranking	Graph-only	Hybrid (Graph→Jev)	Perfect/gold	What this row tells us
1	`art-6`ICT risk management framework	`art-6`ICT risk management framework3.00 · Directly answers	`art-6`ICT risk management framework	Hybrid keeps Graph’s lucky #1 (art-6). Keyword→Jev also hits gold at #1.
2	`art-16`Simplified ICT risk management framework	`art-16`Simplified ICT risk management framework2.93 · Directly answers	`art-5`Governance and organisationabsent from Hybrid shortlist	Both keep art-16 at #2. Keyword→Jev #2=art-16.
3	`art-27`Requirements for testers for the carrying out of TLPT	`art-9`Protection and prevention2.87 · Directly answerswas Graph #10	`art-15`Further harmonisation of ICT risk management tools, methods, processes and policiesabsent from Graph shortlist; absent from Hybrid shortlist	Graph #3=art-27; Hybrid #3=art-9 (jev 2.87). Keyword→Jev #3=art-9.
4	`art-32`Structure of the Oversight Framework	`art-5`Governance and organisation2.86 · Directly answerswas Graph #19	`art-7`ICT systems, protocols and toolsabsent from Graph shortlist; absent from Hybrid shortlist	Graph #4=art-32; Hybrid #4=art-5 (jev 2.86). Keyword→Jev #4=art-33.
5	`art-24`General requirements for the performance of digital operational resilience testing	`art-33`Tasks of the Lead Overseer2.72 · Directly answerswas Graph #6	`art-16`Simplified ICT risk management framework (small/micro entities)	Graph #5=art-24; Hybrid #5=art-33 (jev 2.72). Keyword→Jev #5=rec-21.

When must financial entities report major ICT-related incidents?

Hybrid cost ~$0.0005 · Jev scoring 689 ms · e2e 696 ms · Keyword→Jev #1: art-17 · gold@1: Graph ✓ · Hybrid ✗ · Jev-only ✗

Ranking	Graph-only	Hybrid (Graph→Jev)	Perfect/gold	What this row tells us
1	`art-19`Reporting of major ICT-related incidents and voluntary notification of significant cyber threats	`art-17`ICT-related incident management process2.24 · Usefulwas Graph #4	`art-19`Reporting of major ICT-related incidents and voluntary notification of significant cyber threats	Hybrid moves gold art-19 off #1 (now art-17) — Graph alone was luckier. Keyword→Jev #1 was art-17.
2	`art-21`Centralisation of reporting of major ICT-related incidents	`art-19`Reporting of major ICT-related incidents and voluntary notification of significant cyber threats2.15 · Usefulwas Graph #1	`art-17`ICT-related incident management process	Graph #2=art-21; Hybrid #2=art-19 (jev 2.15). Keyword→Jev #2=art-19.
3	`art-18`Classification of ICT-related incidents and cyber threats	`rec-53`Recital (53)1.75 · Usefulwas Graph #7	`art-18`Classification of ICT-related incidents and cyber threats	Graph #3=art-18; Hybrid #3=rec-53 (jev 1.75). Keyword→Jev #3=rec-53.
4	`art-17`ICT-related incident management process	`rec-51`Recital (51)1.64 · Usefulwas Graph #12	`art-21`Centralisation of reporting of major ICT-related incidents	Graph #4=art-17; Hybrid #4=rec-51 (jev 1.64). Keyword→Jev #4=rec-51.
5	`rec-100`Recital (100)	`art-18`Classification of ICT-related incidents and cyber threats1.40 · Tangentialwas Graph #3	`art-20`Harmonisation of reporting content and templatesabsent from Graph shortlist; absent from Hybrid shortlist	Graph #5=rec-100; Hybrid #5=art-18 (jev 1.40). Keyword→Jev #5=art-18.

What is TLPT and who must perform threat-led penetration testing?

Hybrid cost ~$0.0006 · Jev scoring 398 ms · e2e 402 ms · Keyword→Jev #1: rec-56 · gold@1: Graph ✓ · Hybrid ✗ · Jev-only ✗

Ranking	Graph-only	Hybrid (Graph→Jev)	Perfect/gold	What this row tells us
1	`art-26`Advanced testing of ICT tools, systems and processes based on TLPT	`rec-56`Recital (56)2.28 · Usefulwas Graph #5	`art-26`Advanced testing of ICT tools, systems and processes based on TLPT	Hybrid moves gold art-26 off #1 (now rec-56) — Graph alone was luckier. Keyword→Jev #1 was rec-56.
2	`rec-18`Recital (18)	`rec-18`Recital (18)2.16 · Useful	`art-27`Requirements for testers for the carrying out of TLPT	Both keep rec-18 at #2. Keyword→Jev #2=rec-18.
3	`art-3`Definitions	`art-26`Advanced testing of ICT tools, systems and processes based on TLPT2.11 · Usefulwas Graph #1	`art-24`General requirements for the performance of digital operational resilience testingabsent from Graph shortlist; absent from Hybrid shortlist	Graph #3=art-3; Hybrid #3=art-26 (jev 2.11). Keyword→Jev #3=art-26.
4	`art-27`Requirements for testers for the carrying out of TLPT	`art-27`Requirements for testers for the carrying out of TLPT1.77 · Useful	`art-25`Testing of ICT tools and systems	Both keep art-27 at #4. Keyword→Jev #4=art-27.
5	`rec-56`Recital (56)	`rec-44`Recital (44)1.54 · Usefulwas Graph #7	`rec-56`Recital (56) — TLPT rationale	Graph #5=rec-56; Hybrid #5=rec-44 (jev 1.54). Keyword→Jev #5=rec-44.

How should financial entities manage ICT third-party risk?

Hybrid cost ~$0.0007 · Jev scoring 409 ms · e2e 412 ms · Keyword→Jev #1: art-28 · gold@1: Graph ✗ · Hybrid ✓ · Jev-only ✓

Ranking	Graph-only	Hybrid (Graph→Jev)	Perfect/gold	What this row tells us
1	`art-6`ICT risk management framework	`art-28`General principles2.99 · Directly answerswas Graph #8	`art-28`General principles (ICT third-party risk)	Hybrid promotes gold art-28 to #1 (Graph had art-6). Keyword→Jev also hits gold at #1. Q4 fix: Jev on the Graph neighbourhood recovers Art 28.
2	`art-29`Preliminary assessment of ICT concentration risk at entity level	`rec-71`Recital (71)2.96 · Directly answerswas Graph #12	`art-29`Preliminary assessment of ICT concentration risk at entity level	Graph #2=art-29; Hybrid #2=rec-71 (jev 2.96). Keyword→Jev #2=rec-71.
3	`art-31`Designation of critical ICT third-party service providers	`art-29`Preliminary assessment of ICT concentration risk at entity level2.82 · Directly answerswas Graph #2	`art-30`Key contractual provisionsabsent from Graph shortlist; absent from Hybrid shortlist	Graph #3=art-31; Hybrid #3=art-29 (jev 2.82). Keyword→Jev #3=art-29.
4	`art-16`Simplified ICT risk management framework	`art-5`Governance and organisation2.74 · Directly answerswas Graph #18	`art-31`Designation of critical ICT third-party service providers	Graph #4=art-16; Hybrid #4=art-5 (jev 2.74). Keyword→Jev #4=art-26.
5	`rec-92`Recital (92)	`art-26`Advanced testing of ICT tools, systems and processes based on TLPT2.54 · Directly answerswas Graph #9	`rec-65`Recital (65) — third-party risk contextabsent from Graph shortlist; absent from Hybrid shortlist	Graph #5=rec-92; Hybrid #5=art-26 (jev 2.54). Keyword→Jev #5=rec-18.

What information must be shared on cyber threats?

Hybrid cost ~$0.0006 · Jev scoring 358 ms · e2e 360 ms · Keyword→Jev #1: rec-52 · gold@1: Graph ✓ · Hybrid ✗ · Jev-only ✗

Ranking	Graph-only	Hybrid (Graph→Jev)	Perfect/gold	What this row tells us
1	`art-45`Information-sharing arrangements on cyber threat information and intelligence	`rec-52`Recital (52)2.83 · Directly answerswas Graph #5	`art-45`Information-sharing arrangements on cyber threat information and intelligence	Hybrid moves gold art-45 off #1 (now rec-52) — Graph alone was luckier. Keyword→Jev #1 was rec-52.
2	`art-18`Classification of ICT-related incidents and cyber threats	`art-45`Information-sharing arrangements on cyber threat information and intelligence2.73 · Directly answerswas Graph #1	`rec-34`Recital (34) — encourage cyber threat information sharing	Graph #2=art-18; Hybrid #2=art-45 (jev 2.73). Keyword→Jev #2=art-45.
3	`art-19`Reporting of major ICT-related incidents and voluntary notification of significant cyber threats	`art-19`Reporting of major ICT-related incidents and voluntary notification of significant cyber threats2.42 · Useful	`rec-33`Recital (33) — limited/fragmented information sharingabsent from Graph shortlist; absent from Hybrid shortlist	Both keep art-19 at #3. Keyword→Jev #3=art-1.
4	`art-37`Request for information	`art-22`Supervisory feedback2.42 · Usefulwas Graph #20	`art-18`Classification of ICT-related incidents and cyber threats	Graph #4=art-37; Hybrid #4=art-22 (jev 2.42). Keyword→Jev #4=art-19.
5	`rec-52`Recital (52)	`rec-32`Recital (32)2.29 · Usefulwas Graph #8	`rec-52`Recital (52) — threat intelligence context	Graph #5=rec-52; Hybrid #5=rec-32 (jev 2.29). Keyword→Jev #5=art-18.

Which entities are in scope of DORA?

Hybrid cost ~$0.0008 · Jev scoring 407 ms · e2e 412 ms · Keyword→Jev #1: art-2 · gold@1: Graph ✓ · Hybrid ✓ · Jev-only ✓

Ranking	Graph-only	Hybrid (Graph→Jev)	Perfect/gold	What this row tells us
1	`art-2`Scope	`art-2`Scope3.00 · Directly answers	`art-2`Scope	Hybrid keeps Graph’s lucky #1 (art-2). Keyword→Jev also hits gold at #1.
2	`art-26`Advanced testing of ICT tools, systems and processes based on TLPT	`art-26`Advanced testing of ICT tools, systems and processes based on TLPT2.17 · Useful	`art-3`Definitions	Both keep art-26 at #2. Keyword→Jev #2=rec-42.
3	`art-19`Reporting of major ICT-related incidents and voluntary notification of significant cyber threats	`art-1`Subject matter2.14 · Usefulwas Graph #13	`art-1`Subject matterabsent from Hybrid shortlist	Graph #3=art-19; Hybrid #3=art-1 (jev 2.14). Keyword→Jev #3=art-26.
4	`art-38`General investigations	`art-16`Simplified ICT risk management framework1.76 · Usefulwas Graph #17	`art-16`Simplified ICT risk management framework (proportionality)absent from Hybrid shortlist	Graph #4=art-38; Hybrid #4=art-16 (jev 1.76). Keyword→Jev #4=art-19.
5	`art-3`Definitions	`art-19`Reporting of major ICT-related incidents and voluntary notification of significant cyber threats1.62 · Usefulwas Graph #3	`rec-42`Recital (42) — entity coverage contextabsent from Graph shortlist; absent from Hybrid shortlist	Graph #5=art-3; Hybrid #5=art-19 (jev 1.62). Keyword→Jev #5=art-45.