KnowMe · Architecture research · 27 Sep 2026 · updated 28 Sep
KnowMe Decision Layer
Self-hosted decision models, packaged as one Rust crate family and fronted by one decision proxy. The proxy speaks TypeSafe's Jev API and MCP, and routes each call to hosted Jev, Laya (MLX, candle, ONNX, browser), local Qwen via candle-vllm, or remote Qwen, depending on how sensitive the data is. The Boss ships it as a standard sidecar, UAR and KnowMe link it natively, and CounselMe and the Prior Authorization Workbench get their decisions from it.
Build it as one crate family
knowme-decide is a pure-Rust core with pluggable backends. The same types run in-process inside UAR, KnowMe and the prior-auth host, and behind an rmcp server that The Boss bundles as a sidecar.One proxy in front of every modelThe Jev-compatible
/v1/systemone, a native /v1/decide, SSE streaming and MCP at /mcp. A sensitivity gate keeps PHI off hosted Jev and Qwen, and the router picks the cheapest backend that answers confidently.No single open model replaces JevStack them instead: tripwires, an encoder router (Laya or ModernBERT), a Jev-style head (Kev, or your LitJev port on Qwen3.8-27B), guard models (Qwen3Guard, Granite Guardian), and conformal calibration fitted on your own labels.
Calibration is the productThe open models give you the interface for free. Recall guarantees on escalation, crisis and met/gap/void classes come from your counselor and coordinator overrides, which the audit log turns into labels.
Propose, never act, on clinical stateCounselMe escalates and never treats. Prior-auth proposes met/gap/void and never writes or denies. Both rules already match how each codebase is built.
01 · Context
Where this came from
In the 27 September mentoring session with Treston (46:55–49:11), Travis described a decision model sitting between a patient and a counselor's digital twin. The model routes each message to the right agent, then decides whether the twin's draft answer can go out or should be handed to the human counselor, with a summary and a pointer. He expected about 90% of questions to be handled without the counselor, all logged for the counselor's next session.
The model he named was TypeSafe AI's Jev, a "System One" model. It fills a typed schema in one non-autoregressive pass and attaches a calibrated probability to each answer. Its three primitives are Choice (up to 255 options), Score (an ordinal rubric) and Noul (the probability that a statement is true). Jev is hosted-only, with no weights, no on-prem option and no published BAA. That rules it out for an architecture where PHI and counseling data stay on the user's devices.
This report covers four things:
- the self-hostable alternatives (from the research run)
- how to package them as a Rust crate library and MCP server that fits the existing codebases (from reading the four repos)
- concrete decision use cases for CounselMe and the Prior Authorization Workbench
- a set of AgentSkills-compatible decision skills, distributed through a plugin marketplace
Honesty about the numbers. Nearly every benchmark for the open Jev-style models is self-reported. The models are days or weeks old and were measured against Jev reference values, not in a head-to-head run. Treat them as a shortlist to evaluate on your own data, not as settled rankings.
02 · Research
Open model landscape
Four families matter: Jev-shaped decision models, guard and verifier models, routers and zero-shot encoders, and clinical models.
Jev-shaped "System One" models (released 15–27 Sep 2026)
| Model | Base / size | License | Latency (self-reported) | Calibration evidence | Rust / serving |
|---|---|---|---|---|---|
| Kev | Qwen3.5/3.8 at 0.8B, 4B, 9B, 27B; LoRA plus pointer head on a frozen backbone | Apache-2.0, with training code and evals | Kev-4B about 495 ms for 3 questions on an M5; Kev-27B needs ~55 GB (an 80 GB GPU) | Kev-27B out-of-distribution: accuracy 0.896, Brier 0.160, coverage at ≤5% error 0.835. Kev-9B ECE 0.106→0.042 after temperature fitting | Python server; TypeSafe /v1/systemone wire format |
| Laya | ModernBERT-large 421M (EN), mmBERT-base 322M (multilingual) | Apache-2.0 | 33–40 ms on a T4; 193–464 ms on CPU | ECE 0.466 as shipped → 0.081 after temperature fitting | Pure-Rust candle port (laya-rust): CPU, Metal and CUDA, with a ModernBERT f16 mask fix |
| Julia 1 | mmBERT-small, 144.3M | Apache-2.0 | 33 ms median on an Apple M4; 203 ms on a tablet CPU (ONNX) | Accuracy only. 73.15% vs Jev's 72.70% on Typed Decisions, but 64% vs 87% on Banking77 (72 labels) | ONNX Runtime, WebGPU |
| CLM-8B | Frozen Qwen3-8B plus two 20M heads | Apache-2.0 | 28 ms per new state on an RTX 4090 | None claimed | vLLM pooling; scores candidate actions |
| litjev · AnyJev · jevfire · jevmlx | Logit readers over any frozen LLM | MIT / Apache | Your hardware | AnyJev fits a head on 100–300 labels; jevfire warns its label probabilities are not correctness probabilities | vLLM, MLX; the pattern your LitJev port copies |
What this tells you: the small open models match Jev when there are a handful of well-described options. They fall behind when there are many similar labels, long inputs, or policy and date reasoning. Kev-27B uses exactly Qwen/Qwen3.8-27B, the base you chose for the LitJev port, and is the best-calibrated open option the research found. That makes it the reference your port should match.
Guard, judge and verifier models
| Model | Size | License | Output | Role here |
|---|---|---|---|---|
| Qwen3Guard-Gen / -Stream | 0.6B, 4B, 8B | Apache-2.0 | Safe / Unsafe / Controversial plus a category (incl. Suicide & Self-Harm, PII, Jailbreak). The Stream variant labels each token as it is generated | Real-time monitoring of the twin's output. A second, uncorrelated crisis signal |
| Granite Guardian 4.1 8B | 8B | Apache-2.0 | Yes/no score from logprobs, with criteria you supply | Answer sufficiency, groundedness and citation support. English only |
| gpt-oss-safeguard-20b | 20B (≥12 GB) | Apache-2.0 | Reasoning plus a label against a policy you write | Async audit of sent answers against a written escalation policy. Too slow to run inline |
No guard model is a validated suicide-risk detector. A 2026 study of 127 open-weight LLMs found that mental-health-, medical- and safety-tuned variants gave no reliable gain over their base models. On PsyCrisisBench, a fine-tuned 1.5B Qwen reached suicidal-ideation F1 0.8925, beating larger zero-shot models. Fine-tune a small classifier on labeled crisis data. Don't rely on a guard model's generic self-harm category.
Routers, encoders and clinical models
| Model | What it is | License | Notes |
|---|---|---|---|
| ModernBERT / mmBERT fine-tunes | Encoder classifiers | Apache-2.0 | The cheapest and most accurate option once you have labels. Rust paths exist today: candle-pipelines, candle-semantic-router |
| GLiClass | Zero-shot, label-conditioned classifier on ModernBERT, 8k context | Apache-2.0 | Multi-label and hierarchical labels. The vendor claims it is up to 50× faster than cross-encoders |
| Arch-Router-1.5B | Qwen2.5-1.5B router; routes are defined in natural language | Katanemo license (not Apache) | 93.17% routing accuracy (self-reported). Check the license before commercial use |
| MedGemma 27B text | Clinical LLM, 128K context | HAI-DEF terms | MedQA 87.7, EHRQA 86.3. The license bans automated decisions in healthcare and insurance, so it can only be used to extract evidence for human review |
| MedGemma 1.5 4B | Multimodal, including EHR and lab reports | HAI-DEF terms | On-device summarization of FHIR and lab data. Not evaluated for multi-turn use |
03 · Research
Technique layer
Four techniques turn any open LLM into a decision model. They are what decide-llm and decide-calibrate implement.
One-pass option scoring
Prefill the state once, then read the next-token logits restricted to the option tokens. For several questions over one state, fork the cache for each question. On Qwen3.8's hybrid Gated DeltaNet layers, paged-attention KV reuse doesn't cover the linear-attention state, so the candle-vllm fork needs a state snapshot and fork primitive.
Constrained decoding
Use it for the fields you actually generate: action items, missing-evidence lists, criteria decomposition. llguidance is a Rust crate that computes token masks at about 40–50 µs per token, so it fits directly in the candle-vllm fork. It guarantees the output structure, but says nothing about calibration.
Calibration
Temperature scaling fixes average overconfidence (Laya's ECE went from 0.466 to 0.081). For escalation, crisis and void classes, use class-conditional (Mondrian) split conformal so recall is guaranteed at a floor you set. Recalibrate for each counselor, clinic and population.
Fine-tune on your decisions
Options range from SetFit (dozens of labels, CPU) to a full ModernBERT fine-tune to LoRA plus a head on Qwen (Kev's recipe; soft targets beat hard labels). The counselor's transaction log and the coordinator's confirmations are the labeling pipeline, so capture overrides from day one.
04 · Build NEW
Crate & sidecar architecture
One workspace, knowme-decide, with a no-I/O core and feature-gated backends. The same library runs in-process in three products and behind an MCP server in the fourth.
knowme-decide sidecar the same way it ships rust-mcp-filesystem and uar-sidecar today. UAR, KnowMe and the Prior-Auth host link decide-policy directly, so decisions on PHI never leave the process.Workspace layout
The layering follows conventions all three Rust codebases already use: KnowMe's L0 types crate that builds for wasm, prior-auth's clinical-docs pure engine with no I/O, and UAR's rmcp #[tool_router] house style. Every heavy dependency is behind a feature, so a phone build pulls in only the tripwire, encoder and calibration layers.
| Crate | Responsibility | Key deps (feature) | Runs on |
|---|---|---|---|
decide-core | DecisionSpec, Choice/Score/Noul, Decision, Outcome, and the traits DecisionBackend, Calibrator, Tripwire, AuditSink. No I/O, no async runtime | serde, schemars, thiserror | Everywhere, including wasm32 and Android |
decide-schema | TypeSafe /v1/systemone wire compatibility, so Jev SDKs, Kev eval suites and Jev replay traffic run unchanged. JSON Schema export for MCP tool inputs | serde_json | Everywhere |
decide-tripwire | Deterministic, versioned, signed rule packs (crisis lexicon, means, abuse, overdose, PHI patterns). A hit always escalates | aho-corasick, regex | Everywhere; always compiled in |
decide-encoder | ModernBERT/mmBERT heads (Laya weights, your fine-tunes, GLiClass). Zero-shot and fine-tuned Choice | candle (candle), ort (onnx), tokenizers | Mac Metal, CUDA, CPU; ONNX on Android and Windows |
decide-llm | Jev-style logit reader over Qwen3.8 (your LitJev port). Prefix prefill, per-question fork, DeltaNet state snapshot. llguidance for generated fields. A remote OpenAI-compatible logprobs adapter for liter-llm | candle-vllm fork (local-llm), llguidance, reqwest (remote) | Desktop GPU, on-prem GPU |
decide-guard | Qwen3Guard categories, Granite Guardian yes/no logprob with criteria you supply, streaming token hooks | shares decide-llm runtime | Desktop and on-prem GPU (0.6B Qwen3Guard is phone-capable) |
decide-calibrate | Temperature fitting, Mondrian split conformal, recall floors per class. Versioned, signed calibration artifacts per spec, clinic or counselor | ndarray (small) | Everywhere (fit on desktop or server, apply on device) |
decide-policy | The Decider cascade. Locality enforcement (never escalates locality on its own), budgets, act/review/escalate mapping, Cedar context export | tokio (rt) | Everywhere |
decide-audit | Append-only, hash-chained decision records. Override capture, so human corrections become calibration labels. Event emission | blake3, serde | Everywhere; the host provides storage |
decide-mcp | rmcp server: tools, resources, ui:// review card. stdio and streamable HTTP | rmcp (server, transport-streamable-http-server) | Desktop and server |
decide-backends | Backend registry and adapters: jev, generic systemone-http, laya-candle, laya-mlx worker, onnx-encoder, candle-vllm instances, qwen-remote | reqwest, candle, ort (per feature) | Per backend |
decide-proxy | Sensitivity gate (locality ceiling), backend router, tier escalation, shadow comparisons | decide-policy | Everywhere |
decide-server | Axum: /v1/systemone (Jev wire), /v1/decide, SSE, /mcp, registry and metrics | axum =0.8.9, rmcp =3.5.0 | Desktop and server |
decide-wasm | Browser build of the pure crates, plus a JS DecisionProvider | wasm-bindgen | Browser |
knowme-decide (bin) | Sidecar: mcp --stdio or serve --port 0 printing READY:{port}, exits when stdin closes, weight manager, calibrate fit CLI | clap, axum | darwin-arm64, darwin-x64, win32-x64, win32-arm64 |
Pins to settle first. Use rmcp =3.5.0, the latest, released 28 Sep 2026; it supports MCP 2026-07-28 and 2025-11-25. UAR pins =3.1.2 and prior-auth uses 3.4.0, and both move to 3.5.0 in their integration milestones. decide-mcp keeps rmcp types out of its public API. UAR builds on candle 0.11 while KnowMe still declares 0.7, so KnowMe uses the onnx encoder feature until it bumps. Record every pin by hand in versions.toml.
The Rust API everyone links
// decide-core types, decide-policy cascade: identical in UAR, KnowMe and aso-host
use knowme_decide::{DecisionSpec, Decider, Locality, Outcome};
let spec = DecisionSpec::choice("counselme.sufficiency.v3")
.question("Can this draft reply go to the patient without counselor review?")
.options(["send", "send_and_flag", "hold_for_clinician", "crisis_protocol"])
.recall_floor("crisis_protocol", 0.99) // Mondrian conformal guarantee
.recall_floor("hold_for_clinician", 0.95)
.tripwires("counselme-crisis@2026.10") // signed, clinician-owned pack
.locality(Locality::DeviceOnly); // PHI never leaves the process
let d = decider.decide(&spec, &state).await?;
match d.outcome {
Outcome::Act(v) => send(v, &draft),
Outcome::Review { set, .. } => queue_for_counselor(set, &draft, d.audit_id),
Outcome::Escalate { reason, .. } => crisis_protocol(reason), // 988 + counselor alert
}04b · Build UPDATED 28 SEP
The decision proxy
One Axum server exposes TypeSafe's Jev API, a native API and MCP. Behind it, a decision model routes the decision models: a sensitivity gate sets how far data may travel, and a backend router picks Jev, Qwen (local or remote), Laya (MLX, candle, ONNX) or any Jev-compatible server within that limit.
laya-serve, openjev-sglang, Kev, another knowme-decide) registers through the generic systemone-http adapter into the band its declared locality allows.Surfaces
| Route | Contract | Notes |
|---|---|---|
POST /v1/systemone | TypeSafe Jev wire, exact: state, model, questions (choice, score, noul); answers with choice, confidence and probabilities, or score and legend, or noul; plus usage. Errors 401, 422, 429, 529 | model picks a backend (jev-latest, laya, laya-multilingual, kev-9b, litjev-qwen3.8-27b, qwen-remote…) or auto. KnowMe fields appear under x_knowme only on request |
POST /v1/decide | Native: a spec plus state, returning a Decision with its outcome, prediction set, calibration and audit ID | What hosts use |
Accept: text/event-stream | SSE events: route, answer, escalate, outcome, usage, done, error | A KnowMe extension; Jev itself doesn't stream |
POST /mcp | MCP Streamable HTTP, rmcp =3.5.0: stateless 2026-07-28, plus legacy_session_mode for 2025-11-25 | Same tools as stdio |
GET /sse, POST /messages | Legacy HTTP+SSE shim (2024-11-05) | Feature-gated and off by default; deprecated in the spec |
/v1/models, /v1/backends, /healthz, /readyz, /metrics | Registry, health, Prometheus | Feed the operator panel |
Backends
| Backend | Adapter | Locality | Enabled when | Checked 28 Sep |
|---|---|---|---|---|
| jev | systemone-http → api.typesafe.ai (Bearer) | hosted · no BAA | JEV_API_KEY in .env | Live call returned jev-1.13.0 in 236 ms with choice, confidence, probabilities and noul |
| qwen-remote | OpenAI-compatible logprob reader: letter options, renormalized top-5, thinking off, split above 5 options | hosted · no BAA | All three QWEN_TOKEN_PLAN_* keys | Model Studio token plan (Singapore), qwen3.8-max, returns top_logprobs: 5, 1.7 s |
| laya-mlx | Supervised laya_mlx worker (Apache-2.0); native mlx-rs 0.32 later | device | macOS on Apple Silicon, MLX ≥ 0.32.2, pinned checkpoints verified | The author reports 13.4 ms (EN) and 7.4 ms (multilingual) p50 on M3 Max, and 63/63 parity with upstream |
| laya-candle | In-process ModernBERT/mmBERT (laya-rust) | device | Weights verified | — |
| onnx-encoder | ort: Julia 1, mmBERT heads, Laya-for-web | device | Weights verified | — |
| candle-vllm:<instance> | LitJev logit reader against the fork's /v1/systemone route, or OpenAI logprobs as a fallback | device · clinic | Listed in decide.toml and healthy | Qwen3.8-27B (clinic) and Qwen 0.8B–9B (desktop) |
| systemone-http:<name> | Generic Jev-wire client | As declared | Passes the wire-conformance check | Upstream Laya ships a Jev-compatible laya-serve |
MCP conformance (2026-07-28, rmcp 3.5.0)
| Area | Implemented |
|---|---|
| Lifecycle | server/discover, per-request _meta version and capabilities, UnsupportedProtocolVersion (−32022), and the initialize handshake only in 2025-11-25 mode |
| Transports | stdio; stateless Streamable HTTP with Mcp-Method and Mcp-Name headers; the legacy HTTP+SSE shim (off by default) |
| Server features | Tools in deterministic order with outputSchema and annotations; resources and templates; prompts; completions; ttlMs/cacheScope |
| Streams | subscriptions/listen; progress and cancellation on each request's own response stream |
| MRTR | input_required results for clarifying elicitations and admin confirmation |
| Extensions | Tasks (long evals and calibration fits) and MCP Apps (ui://decide/review-card) |
| Auth | OAuth 2.1 resource server, protected-resource metadata, iss validation (RFC 9207), Client ID Metadata Documents |
| Not implemented | Roots, Sampling and Logging: all deprecated in 2026-07-28. We log to stderr and OpenTelemetry instead |
The uncomfortable part. The sensitivity model is the riskiest component in the repo: one false negative sends PHI to a third party with no BAA. The design responds in four ways: deterministic checks run first, the model can only narrow, the floor is 0.999, and hosted routing is off by default for clinical tenants. The cost is that local-only tenants lose Jev's edge on hard, many-option decisions and see more Review outcomes. proxy-shadow measures that gap on non-PHI traffic.
05 · Build NEW
The decision cascade
Each layer either decides or passes the case on. Tripwires can exit straight to escalation. A confident encoder skips the LLM head. Calibration is the last step before any outcome.
06 · Build NEW
MCP tool surface
Over stdio and Streamable HTTP (MCP 2026-07-28 via rmcp 3.5.0), the sidecar exposes the same Decider as MCP tools. Decision tools are read-only by annotation. Only calibration fitting changes state, and it is admin-gated.
| Tool / resource | Input | Returns | Effect |
|---|---|---|---|
decide_choice | state, options[] (≤255), spec id or inline spec | value, per-option probs, prediction set, outcome | readOnly |
decide_score | state, ordinal rubric | level, distribution, expected score, outcome | readOnly |
decide_noul | state, statement(s) | P(true) for each statement, calibrated | readOnly |
decide_batch | one state, many questions | all answers; shared prefill, forked per question | readOnly |
route_intent | message, route table (hierarchical) | domain → agent path with probs, abstain flag | readOnly |
tripwire_scan | text, pack id | hits with rule ids and spans | readOnly |
guard_check | text, policy (Qwen3Guard categories or your own criteria) | label, category, score | readOnly |
sufficiency_check | question, draft, knowledge refs | grounded / consistent / no new directive / answers the question: each P(yes) | readOnly |
decision_explain | audit id | which layer decided, thresholds, calibration version | readOnly |
decision_log_query | spec, time range, outcome | audit records (redacted per locality) | readOnly |
calibrate_fit | spec, labeled set ref, recall floors | new signed calibration artifact and coverage report | admin · approval |
decide://specs/{id} | Resource: the versioned DecisionSpec (JSON Schema) | resource | |
decide://calibration/{spec}@{ver} | Resource: coverage, ECE and recall per class; the automation rate the floors allow | resource | |
ui://decide/review-card | MCP App resource: a review card that shows the decision, its prediction set and a confirm/override control, so hosts can render the human step | resource | |
decide_choice → result (MCP structuredContent)
{
"spec": "counselme.sufficiency.v3",
"value": "hold_for_clinician",
"probs": { "send": 0.08, "send_and_flag": 0.37, "hold_for_clinician": 0.52, "crisis_protocol": 0.03 },
"prediction_set": ["send_and_flag", "hold_for_clinician"],
"outcome": "review",
"decided_by": "llm-head",
"tripwires": [],
"calibration": { "method": "mondrian-split-conformal", "version": "2026-10-12.c4", "recall_floor": { "crisis_protocol": 0.99 } },
"backend": "litjev-qwen3.8-27b@candle-vllm",
"locality": "device-only",
"latency_ms": 214,
"audit_id": "dec_01K6ZQ3M4T9V"
}The example numbers are illustrative, not measured.
07 · Build NEW
Product integration
Each host already has the seam. These are the exact files and types where the crate plugs in, taken from reading each repo on 27 September.
The Boss · standard sidecar
- Build: pin the source in
build/integration-sources.jsonand the per-platform artifacts plus sha256 inbuild/integration-artifacts.json. Addknowme-decidetoscripts/release-profile.cjsnext torust-mcp-filesystem. - Ship: it lands in
resources/binaries/<platform>. Add it toBUNDLED_TOOLSinBinaryManager.tsand resolve it withgetBinaryPath('knowme-decide'). - Register: as
@prometheus/decidein the unbuiltprometheus-005-mcp-server-presetschange, withinstallSource: 'builtin'and stdio by default. Today's workspace-managed rows (workspaceMcp.ts) are the fallback pattern. - Shared mode: when UAR is enabled, run
knowme-decide serve --port 0under aDecideSidecarServicecopied fromUarSidecarService.ts(READY:{port},ensureReady(), process-tree kill). UAR and the renderer then share one model cache. - Weights: download on first use with the checksums pinned in the release manifest, the same way onnxruntime is fetched for local embeddings, so the installer stays small.
- Operator view: per
PRODUCT.md, show requested vs. effective state: which specs are loaded, their calibration versions, the backend on each device, and the automation rate at the current floors.
UAR · native crate
- Intent routing: add
ClassifierBackend::DecisionimplementingIntentClassifier(src/uar/runtime/matching/intent/mod.rs). Its calibrated prediction set replaces theshould_accepttop-1 plus margin heuristic and theout_of_scope< 0.1 rule. - Graph routing: swap the LLM prompt in
RouterNode(runtime/graph/nodes/router_node.rs) fordecide_choiceover the edge labels. - Model routing: feed a task-type Choice into
ModelRouter. This closesdocs/uar-next.md"Gap 1: No Dynamic Model Router". - Governance: export decision outcomes as Cedar context for
ToolApprovalGate, replacing the 6-keywordtool_requires_approvalheuristic.mount-governance-guardrailsexplicitly ruled out ML guards, so this needs a new openspec change. - Tools and MCP: register the decide tools as
NativeSkills, and add them toUarRuntimeMcpServerso/mcp/uarexposes them too. - Config and features: a new
decision_models:section. Thedecidefeature goes intodesktop-fullandserver-full, anddecide-lite(tripwire, encoder, calibrate) intoembedded-mobile. Emit events throughRuntimeEventSink.
KnowMe · on-device L2 crate
- New crate:
gen_ui_decideat L2, behind aDecisionProvidertrait ingen_ui_types, mirroringInferenceProvider. - Where it runs: desktop links it in-process through
tauri-plugin-gen-ui, and mobile throughgen_ui_ffi(flutter_rust_bridge). Android uses theonnxencoder feature until the candle bump lands. - Agent tools: register native tools in
gen_ui_agent/src/uar.rs. Surface decisions through the existingagui.guardrailanduar.guardrail.flaggedevents, which the UI already understands. - Locality: each spec declares its locality, and
decide-policyenforces the model-configuration rule that resolution never escalates locality without a Cedar grant or a user prompt. - First outbound MCP server:
decide-mcpcan be KnowMe's first outbound MCP server, the onedocs/strategies/skill-support/README.md§3 designs but hasn't built. - Data sources: the P2P layer (
knowme_ofp) and the SurrealDB graph (gen_ui_db_graph) hold the state the decisions read. Omi, Oura and FHIR ingestion don't exist in the repo yet, so CounselMe signal decisions depend on those connectors.
Prior-Auth Workbench · pure kernel
- New crate:
aso-decidesits besideclinical-docswith no I/O, andaso-hostreaches it through a port. It follows "agent kernels do not write" and "proposes; never writes". - Outputs map to existing states: met, gap or void (never two states). Abstaining maps to the existing
classification_needs_reviewfixture path. Proposals are persisted only through the evidence and reassessment commands after a coordinator or surgeon confirms. - Agent slots it fills: 04 Criteria Matcher, 06 Gap Analyst, 12 Response Parser, 13 Denial Classifier and 18 Gold Card Tracker. None has been built yet.
- Calibration data: ground truth is
criterion_observationsanddeterminations. The Wilson-boundshared_criterion_summariesis the only statistical precedent in the codebase. - MCP: read-only tools join
aso-document-assembly/src/mcp.rs, or the sidecar is allowlisted ingeneration_mcp.rs. There are no affirm, sign or submit tools, ever. - Why it matters: production PHI inference is disabled today until a US provider signs a BAA. On-prem
decide-llmremoves that blocker for decisions.
Deployment tiers
| Tier | Hardware | Backends compiled in | Models | Typical specs |
|---|---|---|---|---|
| Phone (KnowMe mobile) | Android / iOS CPU, NPU | tripwire, encoder (onnx), calibrate, audit | Julia 1 or mmBERT-small head; Qwen3Guard-0.6B optional | crisis tripwire, intent route, consent/locality, check-in timing |
| Desktop (The Boss, KnowMe desktop) | Apple Silicon Metal; Windows CUDA/CPU | + encoder (candle), llm (Kev-4B/9B), guard | Laya-rust, Kev-4B or 9B, Qwen3Guard-Stream-4B, Granite Guardian 8B (Q4) | sufficiency gate, action items, completion checks, UAR routing |
| Clinic on-prem (prior-auth) | 48–80 GB GPU | all backends | LitJev-Qwen3.8-27B or Kev-27B, Granite Guardian 8B, MedGemma 27B for extraction only | criterion evidence, denial triage, response parsing |
| Mac (The Boss, KnowMe desktop) | Apple Silicon, MLX ≥ 0.32.2 | desktop + backend-laya-mlx | laya-mlx (EN, multilingual, typed-decisions) | fastest local routing and triage |
| Browser | WebGPU or WASM | decide-wasm + ONNX Runtime Web | Julia 1, Laya-for-web int4/int8 | prior-auth web document type, KnowMe web, workflow DAGs |
| Hosted (non-PHI only) | TypeSafe, Model Studio | backend-jev, backend-qwen-remote | Jev, qwen3.8-max | hard or many-option non-PHI decisions, and shadow evaluation |
| Async audit | Any GPU, batch | llm, guard | gpt-oss-safeguard-20b | policy re-review of sent answers, drift reports |
08 · Use cases NEW
CounselMe
This is the between-session product from the Treston session: a counselor's digital twin in the patient's pocket, fed by session transcripts, with the counselor always reachable. Twelve decisions make it work. Three of them are safety-critical.
hold_for_clinician, not because the top option crossed a threshold. The counselor's edit goes into the audit log as a labeled example for the next conformal fit.Decision catalog
Select a use case to load its decision spec. Each one is served as an HTMX fragment.
Crisis detection
- Trigger
- Every patient message, before any other layer runs, and every twin output token (streaming).
- Spec
counselme.crisis.v1, a Choice overnone · passive_ideation · active_ideation_or_plan · harm_to_others · abuse_disclosure · medical_emergency.- Layers
- 1) The signed
counselme-crisistripwire pack, which the clinician owns. 2) A fine-tuned ~1.5B Qwen crisis classifier (PsyCrisisBench shows a fine-tuned small model beats larger zero-shot ones). 3) Qwen3Guard-Stream's Suicide & Self-Harm category as a second, uncorrelated signal. - Outcome
- Any tripwire hit, or any non-
noneclass in the prediction set, means Escalate: show 988 and the counselor's safety plan, alert the counselor, and keep the twin out of the reply. - Calibration
- Mondrian conformal with a recall floor of ≥0.99 on every crisis class. False positives are cheap here and false negatives are catastrophic.
- Human
- The counselor sets the after-hours protocol and reviews every escalation. The patient can always reach a human directly.
- Labels
- Clinician-labeled transcripts, plus synthetic crisis examples reviewed by a clinician to oversample the rare classes.
Twin intent routing
- Trigger
- After CM-01 clears the message.
- Spec
counselme.route.v1, a hierarchical Choice. The domain is one ofreflection · accountability · psychoeducation · scheduling_admin · out_of_scope, then an agent within that domain.- Layers
- Start with Laya or Julia 1 zero-shot, and switch to a fine-tuned mmBERT head once each agent has 50+ labeled messages. Two levels avoid the many-similar-labels weakness (Julia: 64% on Banking77).
- Outcome
- A single-agent set routes the message. A multi-agent set asks the patient one clarifying question.
out_of_scopeproduces a polite handoff. - Integration
- The same spec powers
ClassifierBackend::Decisionin UAR, so the twin's sub-agents are ordinary UAR skills.
Answer sufficiency gate
- Trigger
- Every draft the twin produces, before the patient sees it.
- Spec
counselme.sufficiency.v3, a Choice oversend · send_and_flag · hold_for_clinician · crisis_protocol.- Layers
- Granite Guardian 4.1 criteria scores feed the Kev/LitJev head as state features. The criteria are: grounded in the counselor's knowledge base; consistent with prior guidance; contains no new clinical directive (medication, diagnosis, stopping treatment); and answers the question asked.
- Outcome
- A set of
{send}sends the reply. A set that includessend_and_flagsends it and adds it to the digest. A set that includeshold_for_clinicianholds it, sends the counselor a summary and pointer, and tells the patient when to expect a reply. - Automation rate
- Fix the recall floor on
hold_for_clinician(≥0.95) first, then measure the automation rate it leaves. Kev-27B covered 84% of general decisions at a 5% error budget, and clinical budgets are tighter. The 90% target is a result to measure, not an input. - Labels
- Every counselor approval, edit or rewrite of a held draft.
Scope & jurisdiction boundary
- Trigger
- Session start (jurisdiction), and every draft (content).
- Spec
- First a deterministic rule on the patient's state of residence and the counselor's license. Then
counselme.scope.v1, a Noul: "this reply constitutes therapeutic communication or a therapeutic decision". - Why
- Illinois HB 1806 (Public Act 104-0054) bars AI from independent therapeutic decisions and from therapeutic communication with clients. An escalation gate does not cure that.
- Outcome
- In restricted jurisdictions the twin is limited to administrative and supplementary support, with explicit consent. Anything with P above the floor is held for the counselor.
- Human
- Counsel reviews the jurisdiction table. It is a versioned artifact, not a model.
Session commitments
- Trigger
- End of each counseling session, from the recorded transcript. This is the workflow Travis demonstrated with the Omi device.
- Spec
- Extraction uses llguidance-constrained JSON on Qwen3.8 (
{action, owner, due, evidence_type}). Each item then gets a Noul: "the patient committed to this". - Outcome
- High-confidence items go straight onto the accountability plan. Low-confidence items appear in the counselor's session summary as "confirm?".
- Labels
- Counselor confirmations and deletions.
Check-in timing
- Spec
counselme.checkin.v1, a Score oversame_day · two_days · one_week · next_session.- Inputs
- Commitment type, the patient's response history, their stated preference, and CM-08 context.
- Layers
- An encoder head on device. Kev-4B on desktop when the history is long.
- Outcome
- Always acts, and the patient can reschedule. Missed check-ins adjust the next decision.
Completion evidence
- Spec
counselme.done.v1, a Noul: "the submitted evidence shows task X is complete". Granite Guardian groundedness gives a second opinion.- Outcome
- High P checks the task off. Low P asks the patient "Did you finish this?". The system never marks a task failed on its own.
- Human
- The counselor sees completion evidence in the digest, just as Travis described ("put it in a Word document… push it into the app").
Wellness signal context
- Inputs
- Deterministic features, never raw time series: HRV z-score against the patient's 30-day baseline, sleep debt, and schedule load from Oura and the calendar.
- Spec
counselme.blocker.v1, a Choice oversleep · stress · schedule · motivation · health_event · unknown.- Framing
- Wellness and coaching language only ("you slept less this week"). Under the January 2026 CDS guidance, interpreting physiologic patterns for clinical meaning is likely a device function.
- Outcome
- Context for the counselor and for CM-06 timing. Not a risk score.
- Dependency
- Oura, Omi and FHIR connectors don't exist in know-me-system yet.
Counselor digest triage
- Spec
counselme.digest.v1, a Score overread_first · this_week · fyifor each logged interaction.- Why
- In the session, the counselor "knows a lot more stuff" at the next meeting because the transaction log exists. Triage makes that log readable in the five minutes before a session.
- Outcome
- Ordering only. The counselor still has everything.
Consent & locality gate
- Trigger
- Any movement of data off the device, and any recording that captures other people's voices.
- Spec
- The consent decision is deterministic Cedar. The model only runs a Noul on content: "this segment contains third-party personal information" (Omi recordings pick up everyone nearby).
- Outcome
- Third-party segments are redacted or kept on device. Locality never escalates without a grant, matching KnowMe's model-configuration rule.
Intake: which counselor
- Spec
counselme.intake.v1, a ranked Choice over modality:cbt · trauma_informed · couples_family · substance_use · grief · psychiatry_referral. Plus a Noul: "the plan requires pre-authorization for this service".- Outcome
- Always shown as ranked options to a human intake coordinator. The pre-authorization flag reuses the prior-auth decision specs.
- Caution
- Matching must not become a therapeutic recommendation in restricted states (CM-04).
Twin fidelity & drift
- Spec
- Granite Guardian with your own criteria: "reply is consistent with the counselor's stated philosophy and prior guidance", run on a sample of sent replies. gpt-oss-safeguard-20b re-reviews borderline replies against a written policy.
- Outcome
- A weekly drift report for the counselor. Coverage dropping below the calibrated level triggers a refit.
- Why
- The twin is built from writing samples and personality data, and both of those drift as the knowledge base grows.
09 · Use cases NEW
Prior Authorization Workbench
The workbench already has the right shape: three evidence states, a surgeon gate, cited claims and deterministic QA. Decision models fill the five agent slots the spec names but hasn't built. Every output is a proposal a person confirms.
aso-host. The gate and signing stay human-only; this is enforced three times today (gateway policy, the AppServices capability check and a Postgres trigger), and an agent acting for a surgeon gets none of the surgeon's authority.Decision catalog
CMS-0057-F. Payers must decide within 72 hours (urgent) or 7 calendar days (standard) from 1 January 2026, and must meet the FHIR Prior Authorization API requirements (Da Vinci CRD, DTR and PAS) by 1 January 2027. The repo has a PAS document-class stub and nothing for CRD or DTR yet. Once payers expose DTR questionnaires, those become a structured criteria source for PA-02.
Payer, plan & delegation selection
- Spec
- Deterministic lookup through
payer_plans,plan_delegation_rulesandadministering_entities(which utilization-management vendor applies which policy). The Choice fallbackpa.plan.v1runs only when the eligibility text is ambiguous. - Outcome
- Proposes the plan and administering entity. The coordinator confirms, and the confirmation selects the policy version.
- Labels
- Coordinator corrections.
Intake document type
- Spec
pa.doctype.v1, a Choice overmri_report · radiology_other · pt_notes · injection_procedure · office_note · op_note · imaging_order · prior_denial · other, on page text.- Layers
- A fine-tuned ModernBERT head (Laya zero-shot until labels exist). ~30 ms per page.
- Outcome
- Places pages on the evidence timeline. Low confidence goes to the coordinator's labeling queue.
Gold card tracking · Agent 18
- Spec
- A Noul on payer notices: "an active gold-card exemption covers this service for this payer". Plus a Score for renewal risk, from the practice's own approval trend.
- Outcome
- If the proposal is "exempt", the coordinator confirms before skipping prior auth. The renewal-risk Score feeds admin reporting (US-18).
Policy criteria decomposition
- Spec
- llguidance-constrained extraction of payer policy text into atomic criteria (
{id, text, evidence_kind, lookback, count}). Then a Noul per criterion: "faithful to the source clause". - Outcome
- A draft
criteria_catalogversion. A person verifies it once per policy version before cases can select from it. This pairs with thePolicyVersionCurrencyQA check. - Models
- LitJev/Kev-27B on Qwen3.8 for extraction and the Noul. MedGemma is optional as an extractor, never as the decider.
Criterion evidence: met / gap / void
- Trigger
- For each selected criterion, whenever the evidence timeline changes.
- Spec
pa.criterion.v1, a Choice overmet · gap · void. Each answer carries citations (document, page, date, hash) fromchunksandretrieval_log.- Meaning
- met: the record satisfies the criterion. gap: the record exists but falls short, so the surgeon argues it. void: the record is absent, so the coordinator obtains it. The kernel never returns two states.
- Layers
- Encoder retrieval filter, then MedGemma 27B span extraction (human-reviewed), then the LitJev/Kev-27B head, then Granite Guardian's check that the citation supports the decision.
- Outcome
- A single-state set is a proposal the coordinator confirms through the
evidence_assemblycommand. A multi-state set goes toclassification_needs_review. - Calibration
- Recall floors on
void(so missing records get requested) and ongap(so the surgeon sees every weak point). Ground truth comes fromcriterion_observationsanddeterminations. - Never
- The kernel never writes, never denies, and never touches the surgeon gate.
Where to obtain a void
- Why
- From the session: much of the evidence "didn't come from you… it's in his chart", meaning the referring physician's.
- Spec
pa.source.v1, a Choice overreferring_pcp · pt_clinic · imaging_center · pain_management · patient · other, based on the timeline and the missing criterion.- Outcome
- Drafts a records request for the coordinator. When a FHIR connection exists for that source, it proposes the pull instead.
Letter claim support
- Spec
- For each claim
{text, sourceId, sourceQuote}, a Noul: "sourceQuote supports the claim text". Granite Guardian groundedness gives a second score. - Outcome
- This adds an eighth, probabilistic check next to the seven deterministic QA checks in
clinical-docs/src/qa.rs. It never replaces them. A low score blocks QA from passing with the claim highlighted.
First-pass approval likelihood
- Rule
- Until enough
criterion_observationsexist, show the criteria gaps, not a probability. - Spec
- A Score over
likely · uncertain · unlikely, calibrated against real determinations, with Wilson bounds displayed. Shared summaries keep the antitrust guard (≥10 cases, ≥2 practices). - KPI
- The spec's first-pass approval rate: an 80% baseline and an 88–92% target.
Payer response parser · Agent 12
- Spec
- A Choice over
approved · approved_modified · pended_more_info · denied_medical_necessity · denied_administrative · p2p_offered, plus constrained extraction of the reference number, units and dates. - Outcome
- This is the "confidence flag" the spec asks for. Below the floor, it goes to review. The coordinator records the acknowledgement.
Denial triage · Agent 13
- Spec
- A Choice over
correct_and_resubmit · clinical_appeal · peer_to_peer, citing the denial reason and the criteria it touches. - Outcome
- Proposes a path. Abstaining uses the existing
low-confidence-denialfixture path (classification_needs_review). An appeal still needs a fresh affirmation made after the determination.
Peer-to-peer prep
- Spec
- A Score per criterion,
strong · contestable · weak, given the evidence and the denial rationale. - Outcome
- Orders the surgeon's prep sheet weakest first, with citations. Nothing is submitted.
10 · Distribution NEW
Decision skills & marketplace
The skills follow the AgentSkills.io format, grouped into four plugins and published through one marketplace. The skills teach an agent how to author, calibrate and use decision specs. The bundled .mcp.json gives it the tools.
Skill (name) | Plugin | What it does | Tools it calls |
|---|---|---|---|
decision-spec-author | decide-foundation | Turns a described decision into a versioned DecisionSpec: options, primitive, recall floors, locality, tripwire pack | decide://specs, decide_choice (dry run) |
decision-calibrate | decide-foundation | Builds the labeled set from audit overrides, fits temperature and Mondrian conformal, and reports the automation rate the floors allow | decision_log_query, calibrate_fit |
decision-eval-harness | decide-foundation | Replays Jev traffic, Kev frozen suites or a golden set against the backends, and compares accuracy, Brier, ECE and latency | decide_batch |
guard-policy-author | decide-foundation | Writes Granite Guardian criteria and gpt-oss-safeguard policies, then tests them on examples | guard_check, sufficiency_check |
decision-audit-review | decide-foundation | Explains a decision, finds drift, and prepares an audit packet for counsel or compliance | decision_explain, decision_log_query |
route-intent-designer | uar-decision-routing | Designs a two-level route table for a UAR agent team and wires ClassifierBackend::Decision | route_intent |
model-route-tuner | uar-decision-routing | Adds task-type Choice specs that feed UAR's ModelRouter | decide_choice |
crisis-tripwire-pack | counselme-decisions | Maintains the clinician-owned tripwire pack and its regression suite. Can't be published without clinician sign-off | tripwire_scan |
escalation-gate | counselme-decisions | Runs CM-03 on a twin draft and follows the outcome contract | tripwire_scan, sufficiency_check, decide_choice |
session-commitments | counselme-decisions | Extracts CM-05 action items from a session transcript, with a confidence for each | decide_batch |
twin-fidelity-check | counselme-decisions | Samples sent replies for the CM-12 drift report | guard_check |
pa-criteria-decompose | prior-auth-decisions | Turns a payer policy into atomic criteria for human verification (PA-02) | decide_batch |
pa-evidence-check | prior-auth-decisions | Proposes met/gap/void with citations (PA-03, PA-04) | decide_choice, guard_check |
pa-denial-triage | prior-auth-decisions | Parses a payer response and proposes a denial path (PA-06, PA-07) | decide_choice |
Repository layout
knowme-decisions/ # marketplace repo
├── .claude-plugin/
│ └── marketplace.json
└── plugins/
├── decide-foundation/
│ ├── .claude-plugin/plugin.json
│ ├── .mcp.json # launches the knowme-decide sidecar
│ ├── bin/ # optional per-platform binaries for non-Boss hosts
│ └── skills/
│ ├── decision-spec-author/SKILL.md
│ ├── decision-calibrate/{SKILL.md, scripts/, references/CONFORMAL.md}
│ ├── decision-eval-harness/…
│ ├── guard-policy-author/…
│ └── decision-audit-review/…
├── uar-decision-routing/…
├── counselme-decisions/
│ └── skills/
│ ├── escalation-gate/{SKILL.md, references/OUTCOMES.md, assets/spec.json}
│ ├── crisis-tripwire-pack/…
│ ├── session-commitments/…
│ └── twin-fidelity-check/…
└── prior-auth-decisions/…
plugins/counselme-decisions/skills/escalation-gate/SKILL.md
---
name: escalation-gate
description: Decide whether a counselor digital-twin draft reply can be sent to the patient, flagged, held for the counselor, or routed to crisis protocol. Use for every CounselMe twin draft before the patient sees it, or when asked to check, gate or escalate a between-session reply.
license: Proprietary. KnowMe, LLC
compatibility: Needs the knowme-decide MCP server (bundled in The Boss as @prometheus/decide, or via this plugin's .mcp.json). Local-only; never send patient text to a hosted model.
metadata:
spec: "counselme.sufficiency.v3"
safety: "critical"
owner: "knowme"
allowed-tools: mcp__knowme-decide__tripwire_scan mcp__knowme-decide__sufficiency_check mcp__knowme-decide__decide_choice
---
# Escalation gate
## Steps
1. Call `tripwire_scan` with pack `counselme-crisis` on the patient message AND the draft.
Any hit → stop. Outcome is `crisis_protocol`. Do not call other tools.
2. Call `sufficiency_check` with the question, the draft and the knowledge refs.
3. Call `decide_choice` with spec `counselme.sufficiency.v3`, passing step 2 scores as state.
4. Follow the returned `outcome`, never the top `value`:
- `act` → send the draft.
- `review` → do not send. Post summary + pointer to the counselor; tell the patient
when to expect a reply (see references/OUTCOMES.md for wording).
- `escalate` → crisis protocol: 988 and the counselor's safety plan.
5. Record `audit_id` with the conversation turn.
## Never
- Never lower a recall floor or skip a step to raise the automation rate.
- Never rewrite the draft to get it past the gate; hold it instead.
- In restricted jurisdictions (see CM-04), treat any therapeutic content as `review`..claude-plugin/marketplace.json
{
"name": "knowme-decisions",
"description": "Self-hosted decision models for KnowMe, UAR, CounselMe and prior-auth",
"owner": { "name": "KnowMe, LLC" },
"plugins": [
{ "name": "decide-foundation",
"source": "./plugins/decide-foundation",
"description": "Author, calibrate and audit decision specs" },
{ "name": "uar-decision-routing",
"source": "./plugins/uar-decision-routing" },
{ "name": "counselme-decisions",
"source": "./plugins/counselme-decisions" },
{ "name": "prior-auth-decisions",
"source": "./plugins/prior-auth-decisions" }
]
}plugins/decide-foundation/.mcp.json
{
"mcpServers": {
"knowme-decide": {
"command": "${CLAUDE_PLUGIN_ROOT}/bin/knowme-decide",
"args": ["mcp", "--stdio", "--profile", "desktop"],
"env": { "KNOWME_DECIDE_LOCALITY": "device-only" }
}
}
}Inside The Boss, the built-in @prometheus/decide preset takes the place of this file, so skills resolve to the bundled sidecar and don't need a second binary.
How each host loads them
| Host | Today | Change needed |
|---|---|---|
| The Boss | SkillService mirrors SKILL.md folders into the SDK's .claude/skills. Local plugins load from <cwd>/.claude/plugins/*/.claude-plugin/plugin.json. Marketplace search covers claude-plugins.dev, skills.sh, clawhub.ai and GitHub | Nothing reads marketplace.json yet. Add a marketplace installer, and add knowme-decisions as a default source |
| UAR | SKILL.md skills through runtime/skills/, and the Prometheus skill pack through pack_detection.rs (the Claude plugin cache is one of its lookup paths) | Resolve plugin-cache installs of knowme-decisions. UAR leaves marketplaces to other hosts (docs/uar-next.md) |
| KnowMe | knowme:tool vs knowme:skill, with global, agent-private and agent-exposed scopes; a marketplace is planned for later | Map the counselme-decisions skills to agent-private scope on the twin, and the foundation skills to global scope |
| Claude Code / Codex | Standard claude plugin marketplace add | Ship per-platform binaries in bin/, or point .mcp.json at an installed sidecar |
11 · Research
The original seven uses
These are the per-use recommendations from the research run, now mapped to crates and specs.
| Use | Risk | Primary pick | Alternatives | Lands in |
|---|---|---|---|---|
| 1 · Intent / switch router | low | Laya (Rust/candle) or Julia 1 zero-shot, two-level; then a fine-tuned ModernBERT | GLiClass (multi-label), Arch-Router (check license), Kev-4B for ambiguous cases | decide-encoder → UAR IntentClassifier |
| 2 · Counseling escalation gate | critical | Tripwires, a fine-tuned small crisis classifier, Granite Guardian criteria and a Kev/LitJev head, with conformal floors | Qwen3Guard-Stream as a second crisis signal; gpt-oss-safeguard for async audit | CM-01, CM-03, CM-04 |
| 3 · Wearables + FHIR + transcripts | moderate | Deterministic features plus Kev Choice/Score | MedGemma 1.5 4B to summarize FHIR and labs on device | CM-08 |
| 4 · Accountability agent | moderate | llguidance extraction plus a Noul for each item | GLiNER spans; Granite groundedness | CM-05, CM-06, CM-07 |
| 5 · Prior authorization | critical | Rules, criteria decomposition, a Noul per criterion (LitJev/Kev-27B) and aggregation in code | MedGemma 27B for extraction only (license) | PA-01 to PA-11 |
| 6 · Sports / athletes | fairness | Julia or Laya for feedback; Kev Score for fit | Gradient boosting for NIL value | Future specs; never automate recruiting decisions about minors |
| 7 · Verification / ideation | low | Granite Guardian 4.1 8B as verifier | CLM-8B for ranking candidates | decide-guard; UAR graph loops |
12 · Decide
Versus Jev
| Dimension | Jev (hosted) | knowme-decide (self-hosted) |
|---|---|---|
| Latency | 70–500 ms end to end (vendor), plus the network | Tripwire <1 ms; encoder ~30 ms on GPU or M4, ~200 ms on a phone CPU; Kev-4B ~0.2–0.5 s; 27B on a GPU |
| Cost | $0.042 per 1M input tokens (possibly subsidized) | Hardware only; near-zero marginal cost on device |
| Calibration | RLCD, calibrated out of the box (vendor claim, unverified) | You fit it: temperature plus conformal on your own labels, versioned for each counselor and clinic |
| Accuracy | Leads on knowledge, policy and many-label tasks (MMLU 0.90 vs Kev-9B 0.74) | Matches Jev on few-option tasks; close the gap with fine-tuning and hierarchical specs |
| Privacy / HIPAA | PHI leaves your perimeter; no on-prem option or BAA information found | Data stays on the device or on your infrastructure, which is the architectural requirement |
| Compatibility | TypeSafe SDKs | The proxy serves /v1/systemone exactly and can call Jev itself for non-PHI traffic, so it is a drop-in replacement with a local-first policy |
13 · Decide
Safety & regulation
Illinois HB 1806 CounselMe
Public Act 104-0054, effective 4 August 2025, bars AI from independent therapeutic decisions and from therapeutic communication with clients, with penalties of up to $10,000 per violation. The escalation gate doesn't cure this. Geofence Illinois, or limit the product there to supplementary support with consent (CM-04). Get counsel's opinion, and track similar laws in other states.
FDA CDS guidance, Jan 2026 both
Non-device CDS supports a clinician "without replacing or directing" their judgment. Matching records to guidelines is a recognized pattern, and interpreting repeated physiologic measurements is likely a device function. Prior-auth stays transparent and proposal-only. CounselMe wellness signals stay wellness-framed (CM-08).
MedGemma license prior-auth
The HAI-DEF Prohibited Use Policy bans automated decisions in healthcare and insurance. MedGemma is allowed as an extractor whose output a person reviews, and never as the model that decides met/gap/void.
Hosted routing both
Neither Jev nor the Qwen token plan has a BAA, and the token plan runs in Singapore. The proxy sends them only data its sensitivity gate classifies as non-PHI. The gate is deterministic first, uses a 0.999 floor, and can only narrow. Hosted routing is off by default for clinical tenants.
HIPAA, BAA and Texas prior-auth
Production PHI inference is disabled in the workbench today until there is a BAA provider. Self-hosting removes that dependency for decisions. The spec already tracks Texas SB 1188 and TRAIGA AI-disclosure reporting, so each decision's audit_id should feed those reports.
Not legal advice. The Illinois statute, the FDA's device boundary and the MedGemma license each need counsel's reading for the specific product and jurisdictions.
14 · Decide
Roadmap
Ship the infrastructure where the risk is low (The Boss, UAR routing), build labels where the risk is high (prior-auth, CounselMe), and only then turn on automated outcomes.
Phase 02 weeks
- Stand up Kev-4B and
laya-rustlocally. Replay Jev traffic or TypeSafe's public evals to measure agreement and latency on the M-series Mac and a Windows CUDA box. - Scaffold the
knowme-decideworkspace:decide-core,decide-schema,decide-tripwire,decide-calibrate,decide-mcp. - Settle the rmcp (3.1 vs 3.4) and candle (0.7 vs 0.11) pins.
Phase 1Proxy + The Boss
- Build
decide-server: Jev-compatible/v1/systemone,/v1/decide, SSE, and MCP 2026-07-28 at/mcpwith rmcp 3.5.0. Wire thejev,qwen-remote,laya-candleandlaya-mlxbackends. - Build the sensitivity gate and backend router (M7b), and gate them on the
sensitivitysuite. - Add
knowme-decideto the integration pins,BUNDLED_TOOLSand the@prometheus/decidepreset (theprometheus-005change). - Build
DecideSidecarServicewith READY:{port}, plus the operator panel. - Publish the
knowme-decisionsmarketplace withdecide-foundation, and add a marketplace.json reader to The Boss.
Phase 2UAR routing
- Add
ClassifierBackend::Decision, theRouterNodeswap and theModelRoutertask type. - Write a new openspec change for ML guards and decision-model Cedar context, replacing the keyword heuristic.
- Port LitJev to the candle-vllm fork with the DeltaNet state snapshot, and validate against Kev-27B on Kev's frozen suites.
Phase 3Prior-auth shadow
- Build the
aso-decidekernel and run PA-03, PA-06 and PA-07 in shadow mode. Proposals are logged but not shown, then compared with coordinator and surgeon actions. - Encode 3–5 spine policies (lumbar fusion first). Label 100+ chart and criteria pairs with the staff.
- Fit conformal floors on void and gap, then show proposals.
Phase 3bBrowser tier
- Build
decide-wasmwith ONNX Runtime Web and a PGlite audit sink, and ship it in prior-auth web and KnowMe web with a separate calibration artifact (M9b).
Phase 4CounselMe pilot
- Label 500–2,000 examples with the counselor (sufficient, escalate, crisis). Oversample crisis examples using synthetic data the clinician reviews.
- Ship the tripwire pack and crisis classifier first. Run CM-03 with every draft held for the counselor until the measured automation rate at ≥0.95 recall is acceptable.
- Legal review: Illinois, other states, HIPAA BAA for any GPU host.
15 · Notes
Caveats & sources
- Nearly every figure for the Jev-style open models is self-reported, days old, and measured against Jev reference values rather than a new head-to-head run. MedGemma 27B hardware needs are estimates. Guard-model leads come from the vendors.
- Crisis-detection performance depends on fine-tuning and data, not on which model you pick. No model detects suicide risk until it has been validated on your population with clinician-labeled data.
- The repo findings reflect a read of each codebase on 27 September 2026. The crate names, tool names and spec IDs in this report are proposals and don't exist yet.
- The example numbers in the JSON result and the sequence diagram are illustrative.
Sources
- TypeSafe AI — Introducing System One Models & Jev
- TrueFoundry — What System One models actually are
- MarkTechPost — TypeSafe AI releases Jev
- systemonemodels.org — Alternatives
- Kev repository · Kev-27B card · Kev-9B card
- Julia 1 release
- laya-rust (candle port)
- CLM-8B model card
- awesome-jev
- Qwen3Guard-Gen-8B · Qwen3Guard blog
- Granite Guardian 4.1 8B
- gpt-oss-safeguard guide
- Kalinich et al. 2026 (arXiv 2609.06263)
- PsyCrisisBench (arXiv 2603.04445)
- Arch-Router-1.5B
- GLiClass
- candle-semantic-router · candle-pipelines
- MedGemma model card · HAI-DEF prohibited use policy
- llguidance
- Conformal methods, NeurIPS 2024
- CITI — FDA 2026 CDS expectations
- Prior-auth benchmark (arXiv 2604.09937) · arXiv 2605.16679
- AgentSkills.io specification
- TypeSafe API reference
- laya-mlx · Laya upstream (laya-serve)
- ambuj singh, "China Just Dropped Laya MLX…", Generative AI, Sep 2026
- layaForWorkflows · Jev & Laya project index
- MCP 2026-07-28 changelog · rmcp 3.5.0
- Claude Code — plugin marketplaces
- Repos read on the owner's Mac:
prometheus/universal-agent-runtime,know-me/know-me-system(brand:docs/knowme-ui-ux-standard.md),prometheus/the-boss,TribeHealth/kevin/prior-auth