KnowMe · Architecture research · 27 Sep 2026 · updated 28 Sep
KnowMe Decision Layer
Self-hosted decision models, packaged as one Rust crate family and fronted by one decision proxy. The proxy speaks TypeSafe's Jev API and MCP, and routes each call to hosted Jev, Laya (MLX, candle, ONNX, browser), local Qwen via candle-vllm, or a permitted remote Qwen service, within destinations authorized by trusted host policy. Sensitivity models may only restrict those destinations. The Boss ships it as a standard sidecar, UAR and KnowMe link it natively, and CounselMe and the Prior Authorization Workbench get their decisions from it.
Build it as one crate family
knowme-decide is a pure-Rust core with pluggable backends. The same types run in-process inside UAR, KnowMe and the prior-auth host, and behind an rmcp server that The Boss bundles as a sidecar.One proxy in front of every modelThe Jev-compatible
/v1/systemone, a native /v1/decide, SSE streaming and MCP at /mcp. Trusted host policy excludes hosted destinations for PHI and unknown data. The router ranks eligible deployments; required guards, calibration and host audit persistence govern the outcome.No single open model replaces JevStack them instead: tripwires, an encoder router (Laya or ModernBERT), a Jev-style head (Kev, or your LitJev port on Qwen3.8-27B), guard models (Qwen3Guard, Granite Guardian), and conformal calibration fitted on your own labels.
Calibration is the productThe open models give you the interface for free. Coverage claims require representative human labels across Act, Review and Escalate, with explicit statistical assumptions. Overrides alone miss confidently wrong automated decisions.
Propose, never act, on clinical stateCounselMe escalates and never treats. Prior-auth proposes met/gap/void and never writes or denies. Both rules already match how each codebase is built.
01 · Context
Where this came from
In the 27 September mentoring session with Treston (46:55–49:11), Travis described a decision model sitting between a patient and a counselor's digital twin. The model routes each message to the right agent, then decides whether the twin's draft answer can go out or should be handed to the human counselor, with a summary and a pointer. He expected about 90% of questions to be handled without the counselor, all logged for the counselor's next session.
The model he named was TypeSafe AI's Jev, a "System One" model. It fills a typed schema in one non-autoregressive pass and attaches a calibrated probability to each answer. Its three primitives are Choice (up to 255 options), Score (an ordinal rubric) and Noul (the probability that a statement is true). Jev is hosted-only, with no weights, no on-prem option and no published BAA. That rules it out for an architecture where PHI and counseling data stay on the user's devices.
This report covers four things:
- the self-hostable alternatives (from the research run)
- how to package them as a Rust crate library and MCP server that fits the existing codebases (from reading the four repos)
- concrete decision use cases for CounselMe and the Prior Authorization Workbench
- a set of AgentSkills-compatible decision skills, distributed through a plugin marketplace
Honesty about the numbers. Nearly every benchmark for the open Jev-style models is self-reported. The models are days or weeks old and were measured against Jev reference values, not in a head-to-head run. Treat them as a shortlist to evaluate on your own data, not as settled rankings.
02 · Research
Open model landscape
Four families matter: Jev-shaped decision models, guard and verifier models, routers and zero-shot encoders, and clinical models.
Jev-shaped "System One" models (released 15–27 Sep 2026)
| Model | Base / size | License | Latency (self-reported) | Calibration evidence | Rust / serving |
|---|---|---|---|---|---|
| Kev | Qwen3.5/3.8 at 0.8B, 4B, 9B, 27B; LoRA plus pointer head on a frozen backbone | Apache-2.0, with training code and evals | Kev-4B about 495 ms for 3 questions on an M5; Kev-27B needs ~55 GB (an 80 GB GPU) | Kev-27B out-of-distribution: accuracy 0.896, Brier 0.160, coverage at ≤5% error 0.835. Kev-9B ECE 0.106→0.042 after temperature fitting | Python server; TypeSafe /v1/systemone wire format |
| Laya | ModernBERT-large 421M (EN), mmBERT-base 322M (multilingual) | Apache-2.0 | 33–40 ms on a T4; 193–464 ms on CPU | ECE 0.466 as shipped → 0.081 after temperature fitting | Pure-Rust candle port (laya-rust): CPU, Metal and CUDA, with a ModernBERT f16 mask fix |
| Julia 1 | mmBERT-small, 144.3M | Apache-2.0 | 33 ms median on an Apple M4; 203 ms on a tablet CPU (ONNX) | Accuracy only. 73.15% vs Jev's 72.70% on Typed Decisions, but 64% vs 87% on Banking77 (72 labels) | ONNX Runtime, WebGPU |
| CLM-8B | Frozen Qwen3-8B plus two 20M heads | Apache-2.0 | 28 ms per new state on an RTX 4090 | None claimed | vLLM pooling; scores candidate actions |
| litjev · AnyJev · jevfire · jevmlx | Logit readers over any frozen LLM | MIT / Apache | Your hardware | AnyJev fits a head on 100–300 labels; jevfire warns its label probabilities are not correctness probabilities | vLLM, MLX; the pattern your LitJev port copies |
What this tells you: the small open models match Jev when there are a handful of well-described options. They fall behind when there are many similar labels, long inputs, or policy and date reasoning. Kev-27B uses exactly Qwen/Qwen3.8-27B, the base you chose for the LitJev port, and is the best-calibrated open option the research found. That makes it the reference your port should match.
Guard, judge and verifier models
| Model | Size | License | Output | Role here |
|---|---|---|---|---|
| Qwen3Guard-Gen / -Stream | 0.6B, 4B, 8B | Apache-2.0 | Safe / Unsafe / Controversial plus a category (incl. Suicide & Self-Harm, PII, Jailbreak). The Stream variant labels each token as it is generated | Real-time monitoring of the twin's output. An additional crisis signal; error independence must be measured |
| Granite Guardian 4.1 8B | 8B | Apache-2.0 | Yes/no score from logprobs, with criteria you supply | Answer sufficiency, groundedness and citation support. English only |
| gpt-oss-safeguard-20b | 20B (≥12 GB) | Apache-2.0 | Reasoning plus a label against a policy you write | Async audit of sent answers against a written escalation policy. Too slow to run inline |
No guard model is a validated suicide-risk detector. A 2026 study of 127 open-weight LLMs found that mental-health-, medical- and safety-tuned variants gave no reliable gain over their base models. On PsyCrisisBench, a fine-tuned 1.5B Qwen reached suicidal-ideation F1 0.8925, beating larger zero-shot models. Fine-tune a small classifier on labeled crisis data. Don't rely on a guard model's generic self-harm category.
Routers, encoders and clinical models
| Model | What it is | License | Notes |
|---|---|---|---|
| ModernBERT / mmBERT fine-tunes | Encoder classifiers | Apache-2.0 | The cheapest and most accurate option once you have labels. Rust paths exist today: candle-pipelines, candle-semantic-router |
| GLiClass | Zero-shot, label-conditioned classifier on ModernBERT, 8k context | Apache-2.0 | Multi-label and hierarchical labels. The vendor claims it is up to 50× faster than cross-encoders |
| Arch-Router-1.5B | Qwen2.5-1.5B router; routes are defined in natural language | Katanemo license (not Apache) | 93.17% routing accuracy (self-reported). Check the license before commercial use |
| MedGemma 27B text | Clinical LLM, 128K context | HAI-DEF terms | MedQA 87.7, EHRQA 86.3. The license bans automated decisions in healthcare and insurance, so it can only be used to extract evidence for human review |
| MedGemma 1.5 4B | Multimodal, including EHR and lab reports | HAI-DEF terms | On-device summarization of FHIR and lab data. Not evaluated for multi-turn use |
03 · Research
Technique layer
Four techniques turn any open LLM into a decision model. They are what decide-llm and decide-calibrate implement.
One-pass option scoring
Prefill the state once, then read the next-token logits restricted to the option tokens. For several questions over one state, fork the cache for each question. On Qwen3.8's hybrid Gated DeltaNet layers, paged-attention KV reuse doesn't cover the linear-attention state, so the candle-vllm fork needs a state snapshot and fork primitive.
Constrained decoding
Use it for the fields you actually generate: action items, missing-evidence lists, criteria decomposition. llguidance is a Rust crate that computes token masks at about 40–50 µs per token, so it fits directly in the candle-vllm fork. It guarantees the output structure, but says nothing about calibration.
Calibration
Temperature scaling fixes average overconfidence (Laya's ECE went from 0.466 to 0.081). For escalation, crisis and void classes, use class-conditional (Mondrian) split conformal to target class-conditional coverage under documented sampling assumptions. Minimum sample counts do not prove deployment recall or automated-action safety. Evaluate the routed system and each population; pooled fallback cannot claim subgroup coverage.
Fine-tune on your decisions
Options range from SetFit (dozens of labels, CPU) to a full ModernBERT fine-tune to LoRA plus a head on Qwen (Kev's recipe; soft targets beat hard labels). Capture overrides and representative human-reviewed samples from all outcomes. Separate training, calibration and test sets; synthetic cases never count toward calibration-positive minimums.
04 · Build NEW
Crate & sidecar architecture
One workspace, knowme-decide, with a no-I/O core and feature-gated backends. The same library runs in-process in three products and behind an MCP server in the fourth.
knowme-decide sidecar the same way it ships rust-mcp-filesystem and uar-sidecar today. UAR, KnowMe and the Prior-Auth host link decide-policy directly, with the same trusted locality enforcement as HTTP and MCP callers. DeviceOnly stays on the device; clinic dispatch needs an explicit host grant.Workspace layout
The layering follows conventions all three Rust codebases already use: KnowMe's L0 types crate that builds for wasm, prior-auth's clinical-docs pure engine with no I/O, and UAR's rmcp #[tool_router] house style. Every heavy dependency is behind a feature, so a phone build pulls in only the tripwire, encoder and calibration layers.
| Crate | Responsibility | Key deps (feature) | Runs on |
|---|---|---|---|
decide-core | DecisionSpec, Choice/Score/Noul, Decision, Outcome, and the traits DecisionBackend, Calibrator, Tripwire, AuditSink. No I/O, no async runtime | serde, schemars, thiserror | Everywhere, including wasm32 and Android |
decide-schema | TypeSafe /v1/systemone wire compatibility, so Jev SDKs, Kev eval suites and Jev replay traffic run unchanged. JSON Schema export for MCP tool inputs | serde_json | Everywhere |
decide-tripwire | Deterministic, versioned, signed rule packs (crisis lexicon, means, abuse, overdose, PHI patterns). A hit always escalates | aho-corasick, regex | Everywhere; always compiled in |
decide-encoder | ModernBERT/mmBERT heads (Laya weights, your fine-tunes, GLiClass). Zero-shot and fine-tuned Choice | candle (candle), ort (onnx), tokenizers | Mac Metal, CUDA, CPU; ONNX on Android and Windows |
decide-llm | Jev-style logit reader over Qwen3.8 (your LitJev port). Prefix prefill, per-question fork, DeltaNet state snapshot. llguidance for generated fields. A remote OpenAI-compatible logprobs adapter for liter-llm | candle-vllm fork (local-llm), llguidance, reqwest (remote) | Desktop GPU, on-prem GPU |
decide-guard | Qwen3Guard categories, Granite Guardian yes/no logprob with criteria you supply, streaming token hooks | shares decide-llm runtime | Desktop and on-prem GPU (0.6B Qwen3Guard is phone-capable) |
decide-calibrate | Temperature fitting, Mondrian split conformal, recall floors per class. Versioned, signed calibration artifacts per spec, clinic or counselor | ndarray (small) | Everywhere (fit on desktop or server, apply on device) |
decide-policy | The Decider cascade. Locality enforcement (never escalates locality on its own), budgets, act/review/escalate mapping, Cedar context export | tokio (rt) | Everywhere |
decide-audit | Append-only, hash-chained decision records. Override capture, so human corrections become calibration labels. Event emission | blake3, serde | Everywhere; the host provides storage |
decide-mcp | rmcp server: tools, resources, ui:// review card. stdio and streamable HTTP | rmcp (server, transport-streamable-http-server) | Desktop and server |
decide-backends | Backend registry and adapters: jev, generic systemone-http, laya-candle, laya-mlx worker, onnx-encoder, candle-vllm instances, qwen-remote | reqwest, candle, ort (per feature) | Per backend |
decide-proxy | Sensitivity gate (locality ceiling), backend router, tier escalation, shadow comparisons | decide-policy | Everywhere |
decide-server | Axum: /v1/systemone (Jev wire), /v1/decide, SSE, /mcp, registry and metrics | axum =0.8.9, rmcp =3.5.0 | Desktop and server |
decide-wasm | Browser build of the pure crates, plus a JS DecisionProvider | wasm-bindgen | Browser |
knowme-decide (bin) | Sidecar: mcp --stdio or serve --port 0 printing READY:{port}, exits when stdin closes, weight manager, calibrate fit CLI | clap, axum | darwin-arm64, darwin-x64, win32-x64, win32-arm64 |
Pins to settle first. Use rmcp =3.5.0, the latest, released 28 Sep 2026; it supports MCP 2026-07-28 and 2025-11-25. UAR pins =3.1.2 and prior-auth uses 3.4.0, and both move to 3.5.0 in their integration milestones. decide-mcp keeps rmcp types out of its public API. UAR builds on candle 0.11 while KnowMe still declares 0.7, so KnowMe uses the onnx encoder feature until it bumps. Record every pin by hand in versions.toml.
The host contract everyone shares
The normative proposed types are in PLAYBOOK §5. Choice returns a selected option and distribution; Score returns a level distribution and expected value; each Noul returns its own P(true) and true/false prediction set. Batches retain per-question outcomes. These are planned contracts, not an available Rust API.
Authenticated host policy and trusted data provenance authorize destinations.
Tripwires run first. A sensitivity model can only remove destinations.
An eligible backend proposes an answer; every required guard runs.
The pure policy returns a proposal and redacted audit record.
The trusted host persists the audit record before releasing Act.
Audit failure withholds Act and reports an explicit failure without a fabricated audit ID.
Urgent Escalate remains deliverable with an explicit audit-failure status.
Clinical state changes require a separate human-confirmed host command.04b · Build UPDATED 28 SEP
The decision proxy
One Axum server exposes TypeSafe's Jev API, a native API and MCP. Behind it, a decision model routes the decision models: trusted host policy sets permitted destinations, a sensitivity gate may only narrow them, and a backend router picks Jev, Qwen (local or remote), Laya (MLX, candle, ONNX) or any Jev-compatible server within that limit.
laya-serve, openjev-sglang, Kev, another knowme-decide) registers through the generic systemone-http adapter only after deployment identity, score capabilities and host-authorized destinations are checked. Endpoint labels and credentials cannot grant egress.Surfaces
| Route | Contract | Notes |
|---|---|---|
POST /v1/systemone | Jev-compatible successful answers for explicitly authorized, nonclinical advisory requests. Choice, Score and Noul preserve their primitive semantics. Upstream errors remain 401, 422, 429 and 529 | Native safety outcomes cannot be hidden: refuse with the documented KnowMe 403 policy error when Review or Escalate must be enforced. Optional x_knowme metadata never grants action permission |
POST /v1/decide | Native: versioned spec and state; primitive-specific answers, per-question outcomes, provenance and explicit audit status | Required for KnowMe safety-enforced hosts. Act requires required guards, valid calibration and a durable host audit receipt |
Accept: text/event-stream | Planned KnowMe SSE extension: route and progress first; answers and final outcomes only after their safety and audit gates. An error terminates incomplete work | Progress is never actionable. Batch partial results remain provisional until the final completion contract; Jev itself does not stream |
POST /mcp | MCP Streamable HTTP, rmcp =3.5.0: stateless 2026-07-28, plus legacy_session_mode for 2025-11-25 | Same tools as stdio |
GET /sse, POST /messages | Legacy HTTP+SSE shim (2024-11-05) | Feature-gated and off by default; deprecated in the spec |
/v1/models, /v1/backends, /healthz, /readyz, /metrics | Registry, health, Prometheus | Feed the operator panel |
Backends
| Backend | Adapter | Locality | Enabled when | Checked 28 Sep |
|---|---|---|---|---|
| jev | systemone-http → api.typesafe.ai (Bearer) | hosted · PHI excluded | Credentials plus trusted grant and approved deployment configuration | Historical synthetic probe: jev-1.13.0, 236 ms. Connectivity evidence, not production acceptance |
| qwen-remote | Candidate-scoring adapter; incomplete top-k scores cannot authorize Act. No invented probability mass or false claim of complete normalization | hosted · PHI excluded | Permitted API or explicit provider authorization, host grant and verified scoring capabilities | Historical Token Plan probe returned top-five tokens in 1.7 s. Subscription backend use is restricted; this probe does not qualify a production adapter |
| laya-mlx | Supervised laya_mlx worker (Apache-2.0); native mlx-rs 0.32 later | device | macOS on Apple Silicon, MLX ≥ 0.32.2, pinned checkpoints verified | The author reports 13.4 ms (EN) and 7.4 ms (multilingual) p50 on M3 Max, and 63/63 parity with upstream |
| laya-candle | In-process ModernBERT/mmBERT (laya-rust) | device | Weights verified | — |
| onnx-encoder | ort: Julia 1, mmBERT heads, Laya-for-web | device | Weights verified | — |
| candle-vllm:<instance> | Planned LitJev scoring route; DeltaNet state fork and full candidate scores remain M0 feasibility gates | device · clinic | Verified deployment revision, capabilities and host-authorized destination | Qwen3.8-27B and smaller checkpoints require runtime-specific receipts before being advertised |
| systemone-http:<name> | Generic Jev-wire client | Verified deployment | Wire and scoring conformance, deployment identity and trusted host grant | Upstream Laya offers laya-serve; compatibility alone does not certify calibration |
Planned MCP acceptance matrix (2026-07-28, rmcp 3.5.0)
Every row is pending implementation and host interoperability evidence. Start with version handling, authentication, stdio, Streamable HTTP and decision tools. Optional capabilities and extensions are advertised only after their own tests pass; a dependency pin is not certification.
| Area | Acceptance target |
|---|---|
| Lifecycle | server/discover, per-request _meta version and capabilities, UnsupportedProtocolVersion (−32022), and the initialize handshake only in 2025-11-25 mode |
| Transports | stdio; stateless Streamable HTTP with Mcp-Method and Mcp-Name headers; the legacy HTTP+SSE shim (off by default) |
| Server features | Tools in deterministic order with outputSchema and annotations; resources and templates; prompts; completions; ttlMs/cacheScope |
| Streams | subscriptions/listen; progress and cancellation on each request's own response stream |
| MRTR | input_required results for clarifying elicitations and admin confirmation |
| Extensions | Tasks (long evals and calibration fits) and MCP Apps (ui://decide/review-card) |
| Auth | OAuth 2.1 resource server, protected-resource metadata, iss validation (RFC 9207), Client ID Metadata Documents |
| Outside the modern core target | Roots, Sampling and Logging: all deprecated in 2026-07-28. We log to stderr and OpenTelemetry instead |
The uncomfortable part. A sensitivity false negative cannot establish permission to disclose data. Hosted routing requires a trusted grant for known, approved non-PHI data; unknown and internal data are not automatically eligible. The 0.999 coverage target is a statistical evaluation target, not a zero-leak guarantee. Shadow calls obey the same grants. The cost is more Review outcomes and a substantial labeling and validation burden.
05 · Build NEW
The decision cascade
Tripwires can exit straight to escalation. A calibrated encoder may skip the LLM head, but never a required guard. A guard veto survives later calibration. The host commits the audit record before releasing Act; failures are explicit.
06 · Build NEW
MCP tool surface
Over stdio and Streamable HTTP (MCP 2026-07-28 via rmcp 3.5.0), the sidecar exposes the same Decider as MCP tools. Decision tools do not write business state. The trusted host owns mandatory audit writes. Only calibration fitting is a model-visible mutating tool, and it is admin-gated; review confirmations use a separate authenticated host command.
| Tool / resource | Input | Returns | Effect |
|---|---|---|---|
decide_choice | state, options[] (≤255), spec id or inline spec | Choice answer, candidate probabilities and completeness, prediction set, outcome, audit status | readOnly |
decide_score | state, ordinal rubric | level, distribution, expected score, outcome | readOnly |
decide_noul | state, statement(s) | Independent P(true), true/false prediction set and outcome for each statement | readOnly |
decide_batch | one state, many questions | Per-question primitive answer, outcome and failure status; shared prefill only on verified runtimes | readOnly |
route_intent | message, route table (hierarchical) | domain → agent path with probs, abstain flag | readOnly |
tripwire_scan | text, pack id | hits with rule ids and spans | readOnly |
guard_check | text, policy (Qwen3Guard categories or your own criteria) | label, category, score | readOnly |
sufficiency_check | question, draft, knowledge refs | grounded / consistent / no new directive / answers the question: each P(yes) | readOnly |
decision_explain | audit id | which layer decided, thresholds, calibration version | readOnly |
decision_log_query | spec, time range, outcome | audit records (redacted per locality) | readOnly |
calibrate_fit | spec, labeled set ref, recall floors | new signed calibration artifact and coverage report | admin · approval |
decide://specs/{id} | Resource: the versioned DecisionSpec (JSON Schema) | resource | |
decide://calibration/{spec}@{ver} | Resource: coverage, ECE and recall per class; the automation rate the floors allow | resource | |
ui://decide/review-card | MCP App resource: a review card that shows the decision, its prediction set and a confirm/override control, using an authenticated host command with actor identity from the session, audit/tenant binding and idempotency; it cannot be invoked by the deciding model | resource | |
Illustrative Choice review — semantic example
Spec: counselme.sufficiency.v3
Answer: hold_for_clinician
Complete candidate probabilities:
send 0.08
send_and_flag 0.37
hold_for_clinician 0.52
crisis_protocol 0.03
Calibrated set: send_and_flag, hold_for_clinician
Effective outcome: Review
Required guards: complete; no escalation
Deployment: local Qwen; DeviceOnly
Calibration: valid for this deployment, scoring and routing pipeline
Audit status: committed; durable receipt required
Host action: show the review card; do not send clinical adviceIllustrative values and status, not measured results or a frozen wire schema. PLAYBOOK §5 defines the planned primitive-specific contracts; M1 freezes their serialization. Audit failure blocks Act and exposes failure without inventing a receipt.
07 · Build NEW
Product integration
Each host already has the seam. These are the exact files and types where the crate plugs in, taken from reading each repo on 27 September.
The Boss · standard sidecar
- Build: pin the source in
build/integration-sources.jsonand the per-platform artifacts plus sha256 inbuild/integration-artifacts.json. Addknowme-decidetoscripts/release-profile.cjsnext torust-mcp-filesystem. - Ship: it lands in
resources/binaries/<platform>. Add it toBUNDLED_TOOLSinBinaryManager.tsand resolve it withgetBinaryPath('knowme-decide'). - Register: as
@prometheus/decidein the unbuiltprometheus-005-mcp-server-presetschange, withinstallSource: 'builtin'and stdio by default. Today's workspace-managed rows (workspaceMcp.ts) are the fallback pattern. - Shared mode: when UAR is enabled, run
knowme-decide serve --port 0under aDecideSidecarServicecopied fromUarSidecarService.ts(READY:{port},ensureReady(), process-tree kill). UAR and the renderer then share one model cache. - Weights: download on first use with the checksums pinned in the release manifest, the same way onnxruntime is fetched for local embeddings, so the installer stays small.
- Operator view: per
PRODUCT.md, show requested vs. effective state: which specs are loaded, their calibration versions, the backend on each device, and the automation rate at the current floors.
UAR · native crate
- Intent routing: add
ClassifierBackend::DecisionimplementingIntentClassifier(src/uar/runtime/matching/intent/mod.rs). Its calibrated prediction set replaces theshould_accepttop-1 plus margin heuristic and theout_of_scope< 0.1 rule. - Graph routing: swap the LLM prompt in
RouterNode(runtime/graph/nodes/router_node.rs) fordecide_choiceover the edge labels. - Model routing: feed a task-type Choice into
ModelRouter. This closesdocs/uar-next.md"Gap 1: No Dynamic Model Router". - Governance: export decision outcomes as Cedar context for
ToolApprovalGate, replacing the 6-keywordtool_requires_approvalheuristic.mount-governance-guardrailsexplicitly ruled out ML guards, so this needs a new openspec change. - Tools and MCP: register the decide tools as
NativeSkills, and add them toUarRuntimeMcpServerso/mcp/uarexposes them too. - Config and features: a new
decision_models:section. Thedecidefeature goes intodesktop-fullandserver-full, anddecide-lite(tripwire, encoder, calibrate) intoembedded-mobile. Emit events throughRuntimeEventSink.
KnowMe · on-device L2 crate
- New crate:
gen_ui_decideat L2, behind aDecisionProvidertrait ingen_ui_types, mirroringInferenceProvider. - Where it runs: desktop links it in-process through
tauri-plugin-gen-ui, and mobile throughgen_ui_ffi(flutter_rust_bridge). Android uses theonnxencoder feature until the candle bump lands. - Agent tools: register native tools in
gen_ui_agent/src/uar.rs. Surface decisions through the existingagui.guardrailanduar.guardrail.flaggedevents, which the UI already understands. - Locality: each spec declares its locality, and
decide-policyenforces the model-configuration rule that resolution never escalates locality without a Cedar grant or a user prompt. - First outbound MCP server:
decide-mcpcan be KnowMe's first outbound MCP server, the onedocs/strategies/skill-support/README.md§3 designs but hasn't built. - Data sources: the P2P layer (
knowme_ofp) and the SurrealDB graph (gen_ui_db_graph) hold the state the decisions read. Omi, Oura and FHIR ingestion don't exist in the repo yet, so CounselMe signal decisions depend on those connectors.
Prior-Auth Workbench · pure kernel
- New crate:
aso-decidesits besideclinical-docswith no I/O, andaso-hostreaches it through a port. It follows "agent kernels do not write" and "proposes; never writes". - Outputs map to existing states: met, gap or void (never two states). Abstaining maps to the existing
classification_needs_reviewfixture path. Proposals are persisted only through the evidence and reassessment commands after a coordinator or surgeon confirms. - Agent slots it fills: 04 Criteria Matcher, 06 Gap Analyst, 12 Response Parser, 13 Denial Classifier and 18 Gold Card Tracker. None has been built yet.
- Calibration data: ground truth is
criterion_observationsanddeterminations. The Wilson-boundshared_criterion_summariesis the only statistical precedent in the codebase. - MCP: read-only tools join
aso-document-assembly/src/mcp.rs, or the sidecar is allowlisted ingeneration_mcp.rs. There are no affirm, sign or submit tools, ever. - Why it matters: production PHI inference is disabled today until a US provider signs a BAA. On-prem
decide-llmremoves that blocker for decisions.
Deployment tiers
| Tier | Hardware | Backends compiled in | Models | Typical specs |
|---|---|---|---|---|
| Phone (KnowMe mobile) | Android / iOS CPU, NPU | tripwire, encoder (onnx), calibrate, audit | Julia 1 or mmBERT-small head; Qwen3Guard-0.6B optional | crisis tripwire, intent route, consent/locality, check-in timing |
| Desktop (The Boss, KnowMe desktop) | Apple Silicon Metal; Windows CUDA/CPU | + encoder (candle), llm (Kev-4B/9B), guard | Laya-rust, Kev-4B or 9B, Qwen3Guard-Stream-4B, Granite Guardian 8B (Q4) | sufficiency gate, action items, completion checks, UAR routing |
| Clinic on-prem (prior-auth) | 48–80 GB GPU | all backends | LitJev-Qwen3.8-27B or Kev-27B, Granite Guardian 8B, MedGemma 27B for extraction only | criterion evidence, denial triage, response parsing |
| Mac (The Boss, KnowMe desktop) | Apple Silicon, MLX ≥ 0.32.2 | desktop + backend-laya-mlx | laya-mlx (EN, multilingual, typed-decisions) | fastest local routing and triage |
| Browser | WebGPU or WASM | decide-wasm + ONNX Runtime Web | Julia 1, Laya-for-web int4/int8 | prior-auth web document type, KnowMe web, workflow DAGs |
| Hosted (non-PHI only) | TypeSafe, Model Studio | backend-jev, backend-qwen-remote | Jev, qwen3.8-max | hard or many-option non-PHI decisions, and shadow evaluation |
| Async audit | Any GPU, batch | llm, guard | gpt-oss-safeguard-20b | policy re-review of sent answers, drift reports |
08 · Use cases NEW
CounselMe
This is the between-session product from the Treston session: a counselor's digital twin in the patient's pocket, fed by session transcripts, with the counselor always reachable. Twelve decisions make it work. Three of them are safety-critical.
hold_for_clinician, not because the top option crossed a threshold. The counselor's edit goes into the audit log as a labeled example for the next conformal fit.Decision catalog
Select a use case to load its proposed spec. Every catalog action is subject to the finalized native outcome, required guards, valid calibration and host audit receipt; clinical changes require human confirmation. Urgent Escalate remains deliverable with explicit audit failure.
Crisis detection
- Trigger
- Every patient message, before any other layer runs, and every twin output token (streaming).
- Spec
counselme.crisis.v1, a Choice overnone · passive_ideation · active_ideation_or_plan · harm_to_others · abuse_disclosure · medical_emergency.- Layers
- 1) The signed
counselme-crisistripwire pack, which the clinician owns. 2) A fine-tuned ~1.5B Qwen crisis classifier (PsyCrisisBench shows a fine-tuned small model beats larger zero-shot ones). 3) Qwen3Guard-Stream's Suicide & Self-Harm category as an additional signal; error independence must be measured, not assumed. - Outcome
- Any tripwire hit, or any non-
noneclass in the prediction set, means Escalate: show 988 and the counselor's safety plan, alert the counselor, and keep the twin out of the reply. - Calibration
- Mondrian conformal with a recall floor of ≥0.99 on every crisis class. False positives are cheap here and false negatives are catastrophic.
- Human
- The counselor sets the after-hours protocol and reviews every escalation. The patient can always reach a human directly.
- Labels
- Representative clinician-labeled real transcripts supply calibration and held-out evaluation. Clinician-reviewed synthetic crisis examples may augment training and regression tests, but never count toward real calibration-positive minimums.
Twin intent routing
- Trigger
- After CM-01 clears the message.
- Spec
counselme.route.v1, a hierarchical Choice. The domain is one ofreflection · accountability · psychoeducation · scheduling_admin · out_of_scope, then an agent within that domain.- Layers
- Start with Laya or Julia 1 zero-shot, and switch to a fine-tuned mmBERT head once each agent has 50+ labeled messages. Two levels avoid the many-similar-labels weakness (Julia: 64% on Banking77).
- Outcome
- The host routes only on a finalized, audited Act with a single-agent set after required guards and valid calibration. Review asks one clarifying question or opens human review; Escalate follows the escalation path. An authorized
out_of_scopedisposition produces a polite handoff. - Integration
- The same spec powers
ClassifierBackend::Decisionin UAR, so the twin's sub-agents are ordinary UAR skills.
Answer sufficiency gate
- Trigger
- Every draft the twin produces, before the patient sees it.
- Spec
counselme.sufficiency.v3, a Choice oversend · send_and_flag · hold_for_clinician · crisis_protocol.- Layers
- Granite Guardian 4.1 criteria scores feed the Kev/LitJev head as state features. The criteria are: grounded in the counselor's knowledge base; consistent with prior guidance; contains no new clinical directive (medication, diagnosis, stopping treatment); and answers the question asked.
- Outcome
- The host follows the finalized native outcome. Escalate takes precedence; Review holds the draft for the counselor. Only an audited Act after valid calibration and required guards may release an eligible non-clinical reply with singleton
{send}or{send_and_flag}. Any ambiguous set is held; a clinical directive requires human confirmation regardless of the answer value. - Automation rate
- Fix the recall floor on
hold_for_clinician(≥0.95) first, then measure the automation rate it leaves. Kev-27B covered 84% of general decisions at a 5% error budget, and clinical budgets are tighter. The 90% target is a result to measure, not an input. - Labels
- Representative independent adjudication across Act, Review and Escalate, including sampled sent replies, plus counselor approvals, edits and rewrites. Preserve sampling provenance and held-out partitions.
Scope & jurisdiction boundary
- Trigger
- Session start (jurisdiction), and every draft (content).
- Spec
- First a deterministic rule on the patient's state of residence and the counselor's license. Then
counselme.scope.v1, a Noul: "this reply constitutes therapeutic communication or a therapeutic decision". - Why
- Illinois HB 1806 (Public Act 104-0054) bars AI from independent therapeutic decisions and from therapeutic communication with clients. An escalation gate does not cure that.
- Outcome
- In restricted jurisdictions the twin is limited to administrative and supplementary support, with explicit consent. The versioned jurisdiction rule and calibrated Noul acceptance predicate determine Review or Escalate; a raw probability is not a recall-floor test.
- Human
- Counsel reviews the jurisdiction table. It is a versioned artifact, not a model.
Session commitments
- Trigger
- End of each counseling session, from the recorded transcript. This is the workflow Travis demonstrated with the Omi device.
- Spec
- Extraction uses llguidance-constrained JSON on Qwen3.8 (
{action, owner, due, evidence_type}). Each item then gets a Noul: "the patient committed to this". - Outcome
- Items propose changes to the accountability plan; clinical commitments require counselor confirmation through the host. Non-clinical reminders may automate only on a finalized Act after calibrated Noul acceptance, required guards and committed audit. Review presents "confirm?"; Escalate follows the human escalation path.
- Labels
- Counselor confirmations and deletions.
Check-in timing
- Spec
counselme.checkin.v1, a Score oversame_day · two_days · one_week · next_session.- Inputs
- Commitment type, the patient's response history, their stated preference, and CM-08 context.
- Layers
- An encoder head on device. Kev-4B on desktop when the history is long.
- Outcome
- The Score retains its fractional expected value. The spec maps it to a timing action only after its calibrated acceptance predicate, required guards and committed audit permit Act. Review requests a timing choice; Escalate follows the human path. The patient can reschedule.
Completion evidence
- Spec
counselme.done.v1, a Noul: "the submitted evidence shows task X is complete". Granite Guardian groundedness gives a second opinion.- Outcome
- Only a finalized, audited Act satisfying the calibrated Noul predicate and required guards may mark a non-clinical task complete. Review asks "Did you finish this?"; clinical state still requires host confirmation and Escalate follows the human path. A high raw probability alone grants no action.
- Human
- The counselor sees completion evidence in the digest, just as Travis described ("put it in a Word document… push it into the app").
Wellness signal context
- Inputs
- Deterministic features, never raw time series: HRV z-score against the patient's 30-day baseline, sleep debt, and schedule load from Oura and the calendar.
- Spec
counselme.blocker.v1, a Choice oversleep · stress · schedule · motivation · health_event · unknown.- Framing
- Wellness and coaching language only ("you slept less this week"). Under the January 2026 CDS guidance, interpreting physiologic patterns for clinical meaning is likely a device function.
- Outcome
- Context for the counselor and for CM-06 timing. Not a risk score.
- Dependency
- Oura, Omi and FHIR connectors don't exist in know-me-system yet.
Counselor digest triage
- Spec
counselme.digest.v1, a Score overread_first · this_week · fyifor each logged interaction.- Why
- In the session, the counselor "knows a lot more stuff" at the next meeting because the transaction log exists. Triage makes that log readable in the five minutes before a session.
- Outcome
- Ordering only. The counselor still has everything.
Consent & locality gate
- Trigger
- Any movement of data off the device, and any recording that captures other people's voices.
- Spec
- The consent decision is deterministic Cedar. The model only runs a Noul on content: "this segment contains third-party personal information" (Omi recordings pick up everyone nearby).
- Outcome
- Third-party segments are redacted or kept on device. Locality never escalates without a grant, matching KnowMe's model-configuration rule.
Intake: which counselor
- Spec
counselme.intake.v1, a ranked Choice over modality:cbt · trauma_informed · couples_family · substance_use · grief · psychiatry_referral. Plus a Noul: "the plan requires pre-authorization for this service".- Outcome
- Always shown as ranked options to a human intake coordinator. The pre-authorization flag reuses the prior-auth decision specs.
- Caution
- Matching must not become a therapeutic recommendation in restricted states (CM-04).
Twin fidelity & drift
- Spec
- Granite Guardian with your own criteria: "reply is consistent with the counselor's stated philosophy and prior guidance", run on a sample of sent replies. gpt-oss-safeguard-20b re-reviews borderline replies against a written policy.
- Outcome
- A weekly drift report for the counselor. Coverage dropping below the calibrated level triggers a refit.
- Why
- The twin is built from writing samples and personality data, and both of those drift as the knowledge base grows.
09 · Use cases NEW
Prior Authorization Workbench
The workbench already has the right shape: three evidence states, a surgeon gate, cited claims and deterministic QA. Decision models fill the five agent slots the spec names but hasn't built. Every output is a proposal a person confirms.
aso-host. The gate and signing stay human-only; this is enforced three times today (gateway policy, the AppServices capability check and a Postgres trigger), and an agent acting for a surgeon gets none of the surgeon's authority.Decision catalog
CMS-0057-F. Payers must decide within 72 hours (urgent) or 7 calendar days (standard) from 1 January 2026, and must meet the FHIR Prior Authorization API requirements (Da Vinci CRD, DTR and PAS) by 1 January 2027. The repo has a PAS document-class stub and nothing for CRD or DTR yet. Once payers expose DTR questionnaires, those become a structured criteria source for PA-02.
Payer, plan & delegation selection
- Spec
- Deterministic lookup through
payer_plans,plan_delegation_rulesandadministering_entities(which utilization-management vendor applies which policy). The Choice fallbackpa.plan.v1runs only when the eligibility text is ambiguous. - Outcome
- Proposes the plan and administering entity. The coordinator confirms, and the confirmation selects the policy version.
- Labels
- Coordinator corrections.
Intake document type
- Spec
pa.doctype.v1, a Choice overmri_report · radiology_other · pt_notes · injection_procedure · office_note · op_note · imaging_order · prior_denial · other, on page text.- Layers
- A fine-tuned ModernBERT head (Laya zero-shot until labels exist). ~30 ms per page.
- Outcome
- A finalized, audited Act may place document pages on the timeline as a non-clinical filing action after calibration and guards. Review goes to the coordinator; clinical evidence determinations still require confirmation. Escalate retains precedence.
Gold card tracking · Agent 18
- Spec
- A Noul on payer notices: "an active gold-card exemption covers this service for this payer". Plus a Score for renewal risk, from the practice's own approval trend.
- Outcome
- If the proposal is "exempt", the coordinator confirms before skipping prior auth. The renewal-risk Score feeds admin reporting (US-18).
Policy criteria decomposition
- Spec
- llguidance-constrained extraction of payer policy text into atomic criteria (
{id, text, evidence_kind, lookback, count}). Then a Noul per criterion: "faithful to the source clause". - Outcome
- A draft
criteria_catalogversion. A person verifies it once per policy version before cases can select from it. This pairs with thePolicyVersionCurrencyQA check. - Models
- LitJev/Kev-27B on Qwen3.8 for extraction and the Noul. MedGemma is optional as an extractor, never as the decider.
Criterion evidence: met / gap / void
- Trigger
- For each selected criterion, whenever the evidence timeline changes.
- Spec
pa.criterion.v1, a Choice overmet · gap · void. Each answer carries citations (document, page, date, hash) fromchunksandretrieval_log.- Meaning
- met: the record satisfies the criterion. gap: the record exists but falls short, so the surgeon argues it. void: the record is absent, so the coordinator obtains it. The kernel never returns two states.
- Layers
- Encoder retrieval filter, then MedGemma 27B span extraction (human-reviewed), then the LitJev/Kev-27B head, then Granite Guardian's check that the citation supports the decision.
- Outcome
- A single-state set is a proposal the coordinator confirms through the
evidence_assemblycommand. A multi-state set goes toclassification_needs_review. - Calibration
- Recall floors on
void(so missing records get requested) and ongap(so the surgeon sees every weak point). Ground truth comes fromcriterion_observationsanddeterminations. - Never
- The kernel never writes, never denies, and never touches the surgeon gate.
Where to obtain a void
- Why
- From the session: much of the evidence "didn't come from you… it's in his chart", meaning the referring physician's.
- Spec
pa.source.v1, a Choice overreferring_pcp · pt_clinic · imaging_center · pain_management · patient · other, based on the timeline and the missing criterion.- Outcome
- Drafts a records request for the coordinator. When a FHIR connection exists for that source, it proposes the pull instead.
Letter claim support
- Spec
- For each claim
{text, sourceId, sourceQuote}, a Noul: "sourceQuote supports the claim text". Granite Guardian groundedness gives a second score. - Outcome
- This adds an eighth, probabilistic check next to the seven deterministic QA checks in
clinical-docs/src/qa.rs. It never replaces them. A low score blocks QA from passing with the claim highlighted.
First-pass approval likelihood
- Rule
- Until enough
criterion_observationsexist, show the criteria gaps, not a probability. - Spec
- A Score over
likely · uncertain · unlikely, calibrated against real determinations, with Wilson bounds displayed. Shared summaries keep the antitrust guard (≥10 cases, ≥2 practices). - KPI
- The spec's first-pass approval rate: an 80% baseline and an 88–92% target.
Payer response parser · Agent 12
- Spec
- A Choice over
approved · approved_modified · pended_more_info · denied_medical_necessity · denied_administrative · p2p_offered, plus constrained extraction of the reference number, units and dates. - Outcome
- This is the "confidence flag" the spec asks for. Below the floor, it goes to review. The coordinator records the acknowledgement.
Denial triage · Agent 13
- Spec
- A Choice over
correct_and_resubmit · clinical_appeal · peer_to_peer, citing the denial reason and the criteria it touches. - Outcome
- Proposes a path. Abstaining uses the existing
low-confidence-denialfixture path (classification_needs_review). An appeal still needs a fresh affirmation made after the determination.
Peer-to-peer prep
- Spec
- A Score per criterion,
strong · contestable · weak, given the evidence and the denial rationale. - Outcome
- Orders the surgeon's prep sheet weakest first, with citations. Nothing is submitted.
10 · Distribution NEW
Decision skills & marketplace
The skills follow the AgentSkills.io format, grouped into four plugins and published through one marketplace. The skills teach an agent how to author, calibrate and use decision specs. The bundled .mcp.json gives it the tools.
Skill (name) | Plugin | What it does | Tools it calls |
|---|---|---|---|
decision-spec-author | decide-foundation | Turns a described decision into a versioned DecisionSpec: options, primitive, recall floors, locality, tripwire pack | decide://specs, decide_choice (dry run) |
decision-calibrate | decide-foundation | Builds representative labels across all outcomes plus overrides, fits temperature and Mondrian conformal, and reports coverage assumptions and measured automation | decision_log_query, calibrate_fit |
decision-eval-harness | decide-foundation | Replays Jev traffic, Kev frozen suites or a golden set against the backends, and compares accuracy, Brier, ECE and latency | decide_batch |
guard-policy-author | decide-foundation | Writes Granite Guardian criteria and gpt-oss-safeguard policies, then tests them on examples | guard_check, sufficiency_check |
decision-audit-review | decide-foundation | Explains a decision, finds drift, and prepares an audit packet for counsel or compliance | decision_explain, decision_log_query |
route-intent-designer | uar-decision-routing | Designs a two-level route table for a UAR agent team and wires ClassifierBackend::Decision | route_intent |
model-route-tuner | uar-decision-routing | Adds task-type Choice specs that feed UAR's ModelRouter | decide_choice |
crisis-tripwire-pack | counselme-decisions | Maintains the clinician-owned tripwire pack and its regression suite. Can't be published without clinician sign-off | tripwire_scan |
escalation-gate | counselme-decisions | Runs CM-03 on a twin draft and follows the outcome contract | tripwire_scan, sufficiency_check, decide_choice |
session-commitments | counselme-decisions | Extracts CM-05 action items from a session transcript, with a confidence for each | decide_batch |
twin-fidelity-check | counselme-decisions | Samples sent replies for the CM-12 drift report | guard_check |
pa-criteria-decompose | prior-auth-decisions | Turns a payer policy into atomic criteria for human verification (PA-02) | decide_batch |
pa-evidence-check | prior-auth-decisions | Proposes met/gap/void with citations (PA-03, PA-04) | decide_choice, guard_check |
pa-denial-triage | prior-auth-decisions | Parses a payer response and proposes a denial path (PA-06, PA-07) | decide_choice |
Repository layout
knowme-decisions/ # marketplace repo
├── .claude-plugin/
│ └── marketplace.json
└── plugins/
├── decide-foundation/
│ ├── .claude-plugin/plugin.json
│ ├── .mcp.json # launches the knowme-decide sidecar
│ ├── bin/ # optional per-platform binaries for non-Boss hosts
│ └── skills/
│ ├── decision-spec-author/SKILL.md
│ ├── decision-calibrate/{SKILL.md, scripts/, references/CONFORMAL.md}
│ ├── decision-eval-harness/…
│ ├── guard-policy-author/…
│ └── decision-audit-review/…
├── uar-decision-routing/…
├── counselme-decisions/
│ └── skills/
│ ├── escalation-gate/{SKILL.md, references/OUTCOMES.md, assets/spec.json}
│ ├── crisis-tripwire-pack/…
│ ├── session-commitments/…
│ └── twin-fidelity-check/…
└── prior-auth-decisions/…
plugins/counselme-decisions/skills/escalation-gate/SKILL.md
---
name: escalation-gate
description: Decide whether a counselor digital-twin draft reply can be sent to the patient, flagged, held for the counselor, or routed to crisis protocol. Use for every CounselMe twin draft before the patient sees it, or when asked to check, gate or escalate a between-session reply.
license: Proprietary. KnowMe, LLC
compatibility: Needs the knowme-decide MCP server (bundled in The Boss as @prometheus/decide, or via this plugin's .mcp.json). Local-only; never send patient text to a hosted model.
metadata:
spec: "counselme.sufficiency.v3"
safety: "critical"
owner: "knowme"
allowed-tools: mcp__knowme-decide__tripwire_scan mcp__knowme-decide__sufficiency_check mcp__knowme-decide__decide_choice
---
# Escalation gate
## Steps
1. Call `tripwire_scan` with pack `counselme-crisis` on the patient message AND the draft.
Any hit → stop. Outcome is `crisis_protocol`. Do not call other tools.
2. Call `sufficiency_check` with the question, the draft and the knowledge refs.
3. Call `decide_choice` with spec `counselme.sufficiency.v3`, passing step 2 scores as state.
4. Follow the returned `outcome`, never the top `value`:
- `act` → send the draft.
- `review` → do not send. Post summary + pointer to the counselor; tell the patient
when to expect a reply (see references/OUTCOMES.md for wording).
- `escalate` → crisis protocol: 988 and the counselor's safety plan.
5. Record `audit_id` with the conversation turn.
## Never
- Never lower a recall floor or skip a step to raise the automation rate.
- Never rewrite the draft to get it past the gate; hold it instead.
- In restricted jurisdictions (see CM-04), treat any therapeutic content as `review`..claude-plugin/marketplace.json
{
"name": "knowme-decisions",
"description": "Self-hosted decision models for KnowMe, UAR, CounselMe and prior-auth",
"owner": { "name": "KnowMe, LLC" },
"plugins": [
{ "name": "decide-foundation",
"source": "./plugins/decide-foundation",
"description": "Author, calibrate and audit decision specs" },
{ "name": "uar-decision-routing",
"source": "./plugins/uar-decision-routing" },
{ "name": "counselme-decisions",
"source": "./plugins/counselme-decisions" },
{ "name": "prior-auth-decisions",
"source": "./plugins/prior-auth-decisions" }
]
}plugins/decide-foundation/.mcp.json
{
"mcpServers": {
"knowme-decide": {
"command": "${CLAUDE_PLUGIN_ROOT}/bin/knowme-decide",
"args": ["mcp", "--stdio", "--profile", "desktop"],
"env": { "KNOWME_DECIDE_LOCALITY": "device-only" }
}
}
}Inside The Boss, the built-in @prometheus/decide preset takes the place of this file, so skills resolve to the bundled sidecar and don't need a second binary.
How each host loads them
| Host | Today | Change needed |
|---|---|---|
| The Boss | SkillService mirrors SKILL.md folders into the SDK's .claude/skills. Local plugins load from <cwd>/.claude/plugins/*/.claude-plugin/plugin.json. Marketplace search covers claude-plugins.dev, skills.sh, clawhub.ai and GitHub | Nothing reads marketplace.json yet. Add a marketplace installer, and add knowme-decisions as a default source |
| UAR | SKILL.md skills through runtime/skills/, and the Prometheus skill pack through pack_detection.rs (the Claude plugin cache is one of its lookup paths) | Resolve plugin-cache installs of knowme-decisions. UAR leaves marketplaces to other hosts (docs/uar-next.md) |
| KnowMe | knowme:tool vs knowme:skill, with global, agent-private and agent-exposed scopes; a marketplace is planned for later | Map the counselme-decisions skills to agent-private scope on the twin, and the foundation skills to global scope |
| Claude Code / Codex | Standard claude plugin marketplace add | Ship per-platform binaries in bin/, or point .mcp.json at an installed sidecar |
11 · Research
The original seven uses
These are the per-use recommendations from the research run, now mapped to crates and specs.
| Use | Risk | Primary pick | Alternatives | Lands in |
|---|---|---|---|---|
| 1 · Intent / switch router | low | Laya (Rust/candle) or Julia 1 zero-shot, two-level; then a fine-tuned ModernBERT | GLiClass (multi-label), Arch-Router (check license), Kev-4B for ambiguous cases | decide-encoder → UAR IntentClassifier |
| 2 · Counseling escalation gate | critical | Tripwires, a fine-tuned small crisis classifier, Granite Guardian criteria and a Kev/LitJev head, with conformal floors | Qwen3Guard-Stream as a second crisis signal; gpt-oss-safeguard for async audit | CM-01, CM-03, CM-04 |
| 3 · Wearables + FHIR + transcripts | moderate | Deterministic features plus Kev Choice/Score | MedGemma 1.5 4B to summarize FHIR and labs on device | CM-08 |
| 4 · Accountability agent | moderate | llguidance extraction plus a Noul for each item | GLiNER spans; Granite groundedness | CM-05, CM-06, CM-07 |
| 5 · Prior authorization | critical | Rules, criteria decomposition, a Noul per criterion (LitJev/Kev-27B) and aggregation in code | MedGemma 27B for extraction only (license) | PA-01 to PA-11 |
| 6 · Sports / athletes | fairness | Julia or Laya for feedback; Kev Score for fit | Gradient boosting for NIL value | Future specs; never automate recruiting decisions about minors |
| 7 · Verification / ideation | low | Granite Guardian 4.1 8B as verifier | CLM-8B for ranking candidates | decide-guard; UAR graph loops |
12 · Decide
Versus Jev
| Dimension | Jev (hosted) | knowme-decide (self-hosted) |
|---|---|---|
| Latency | 70–500 ms end to end (vendor), plus the network | Tripwire <1 ms; encoder ~30 ms on GPU or M4, ~200 ms on a phone CPU; Kev-4B ~0.2–0.5 s; 27B on a GPU |
| Cost | $0.042 per 1M input tokens (possibly subsidized) | Hardware only; near-zero marginal cost on device |
| Calibration | RLCD, calibrated out of the box (vendor claim, unverified) | You fit it: temperature plus conformal on your own labels, versioned for each counselor and clinic |
| Accuracy | Leads on knowledge, policy and many-label tasks (MMLU 0.90 vs Kev-9B 0.74) | Matches Jev on few-option tasks; close the gap with fine-tuning and hierarchical specs |
| Privacy / HIPAA | PHI leaves your perimeter; no on-prem option or BAA information found | Data stays on the device or on your infrastructure, which is the architectural requirement |
| Compatibility | TypeSafe SDKs | The proxy serves /v1/systemone exactly and can call Jev itself for non-PHI traffic, so it is a drop-in replacement with a local-first policy |
13 · Decide
Safety & regulation
Illinois HB 1806 CounselMe
Public Act 104-0054, effective 4 August 2025, bars AI from independent therapeutic decisions and from therapeutic communication with clients, with penalties of up to $10,000 per violation. The escalation gate doesn't cure this. Geofence Illinois, or limit the product there to supplementary support with consent (CM-04). Get counsel's opinion, and track similar laws in other states.
FDA CDS guidance, Jan 2026 both
Non-device CDS supports a clinician "without replacing or directing" their judgment. Matching records to guidelines is a recognized pattern, and interpreting repeated physiologic measurements is likely a device function. Prior-auth stays transparent and proposal-only. CounselMe wellness signals stay wellness-framed (CM-08).
MedGemma license prior-auth
The HAI-DEF Prohibited Use Policy bans automated decisions in healthcare and insurance. MedGemma is allowed as an extractor whose output a person reviews, and never as the model that decides met/gap/void.
Hosted routing both
No applicable BAA is established by this plan. PHI and unknown data remain excluded from hosted adapters. Explicit trusted grants authorize non-PHI destinations; a classifier only vetoes. Alibaba Token Plan and Coding Plan prohibit custom application backend use, so a permitted API service or explicit provider authorization is required. Provider region labels do not prove inference residency.
HIPAA, BAA and Texas prior-auth
Production PHI inference is disabled in the workbench today until there is a BAA provider. Self-hosting removes that dependency for decisions. The spec already tracks Texas SB 1188 and TRAIGA AI-disclosure reporting, so each decision's audit_id should feed those reports.
Not legal advice. The Illinois statute, the FDA's device boundary and the MedGemma license each need counsel's reading for the specific product and jurisdictions.
14 · Decide
Roadmap
Ship the infrastructure where the risk is low (The Boss, UAR routing), build labels where the risk is high (prior-auth, CounselMe), and only then turn on automated outcomes.
Phase 02 weeks
- Stand up Kev-4B and
laya-rustlocally. Replay Jev traffic or TypeSafe's public evals to measure agreement and latency on the M-series Mac and a Windows CUDA box. - Scaffold the
knowme-decideworkspace:decide-core,decide-schema,decide-tripwire,decide-calibrate,decide-mcp. - Verify proposed rmcp 3.5.0 and candle pins against host compatibility. Resolve provider entitlement, complete candidate scoring and DeltaNet feasibility before committing to adapters.
Phase 1Proxy + The Boss
- Build
decide-server: Jev-compatible/v1/systemone,/v1/decide, SSE, and MCP 2026-07-28 at/mcpwith rmcp 3.5.0. First prove one local backend plus permitted Jev on approved non-sensitive fixtures, across native HTTP, Jev compatibility and MCP. Keep outcomes conservative until guards, calibration and audit gates pass; add other backends afterward. - Enforce trusted grants before the first external dispatch; add the model veto and learned ranking later in M7b, with real calibration positives and route-level evaluation.
- Add
knowme-decideto the integration pins,BUNDLED_TOOLSand the@prometheus/decidepreset (theprometheus-005change). - Build
DecideSidecarServicewith READY:{port}, plus the operator panel. - Publish the
knowme-decisionsmarketplace withdecide-foundation, and add a marketplace.json reader to The Boss.
Phase 2UAR routing
- Add
ClassifierBackend::Decision, theRouterNodeswap and theModelRoutertask type. - Write a new openspec change for ML guards and decision-model Cedar context, replacing the keyword heuristic.
- Port LitJev to the candle-vllm fork with the DeltaNet state snapshot, and validate against Kev-27B on Kev's frozen suites.
Phase 3Prior-auth shadow
- Build the
aso-decidekernel and run PA-03, PA-06 and PA-07 in shadow mode. Proposals are logged but not shown, then compared with coordinator and surgeon actions. - Encode 3–5 spine policies (lumbar fusion first). Label 100+ chart and criteria pairs with the staff.
- Fit conformal floors on void and gap, then show proposals.
Phase 3bBrowser tier
- Build
decide-wasmwith ONNX Runtime Web and a PGlite audit sink, and ship it in prior-auth web and KnowMe web with a separate calibration artifact (M9b). DeviceOnly disables synchronization; any later audit/label transfer requires its own scoped host grant.
Phase 4CounselMe pilot
- Label 500–2,000 examples with the counselor (sufficient, escalate, crisis). Use reviewed synthetic examples for training only; calibration and held-out evaluation require representative real labels across outcomes.
- Ship the tripwire pack and crisis classifier first. Run CM-03 with every draft held for the counselor until the measured automation rate at ≥0.95 recall is acceptable.
- Legal review: Illinois, other states, HIPAA BAA for any GPU host.
15 · Notes
Caveats & sources
- Nearly every figure for the Jev-style open models is self-reported, days old, and measured against Jev reference values rather than a new head-to-head run. MedGemma 27B hardware needs are estimates. Guard-model leads come from the vendors.
- Crisis-detection performance depends on fine-tuning and data, not on which model you pick. No model detects suicide risk until it has been validated on your population with clinician-labeled data.
- The repo findings reflect a read of each codebase on 27 September 2026. The crate names, tool names and spec IDs in this report are proposals and don't exist yet.
- The example numbers in the semantic result and sequence diagram are illustrative. This revision supersedes the earlier published snapshot. Publication of this architecture document does not establish runtime validation; implementation and acceptance gates remain pending.
Sources
- TypeSafe AI — Introducing System One Models & Jev
- TrueFoundry — What System One models actually are
- MarkTechPost — TypeSafe AI releases Jev
- systemonemodels.org — Alternatives
- Kev repository · Kev-27B card · Kev-9B card
- Julia 1 release
- laya-rust (candle port)
- CLM-8B model card
- awesome-jev
- Qwen3Guard-Gen-8B · Qwen3Guard blog
- Granite Guardian 4.1 8B
- gpt-oss-safeguard guide
- Kalinich et al. 2026 (arXiv 2609.06263)
- PsyCrisisBench (arXiv 2603.04445)
- Arch-Router-1.5B
- GLiClass
- candle-semantic-router · candle-pipelines
- MedGemma model card · HAI-DEF prohibited use policy
- llguidance
- Conformal methods, NeurIPS 2024
- CITI — FDA 2026 CDS expectations
- Prior-auth benchmark (arXiv 2604.09937) · arXiv 2605.16679
- AgentSkills.io specification
- TypeSafe API reference
- Alibaba Cloud — subscription usage restrictions
- Conformal prediction — assumptions and class-conditional coverage
- Jev project review · System One Connector · jev-mcp
- laya-mlx · Laya upstream (laya-serve)
- ambuj singh, "China Just Dropped Laya MLX…", Generative AI, Sep 2026
- layaForWorkflows · Jev & Laya project index
- MCP 2026-07-28 changelog · rmcp 3.5.0
- Claude Code — plugin marketplaces
- Repos read on the owner's Mac:
prometheus/universal-agent-runtime,know-me/know-me-system(brand:docs/knowme-ui-ux-standard.md),prometheus/the-boss,TribeHealth/kevin/prior-auth