Typed Decision Bert

It is a placeholder zero-shot NLI classifier slotted into the specified shape while JevBERT itself remains untrained, returning uncalibrated probabilities. Quality is recorded only as a small smoke trend log, not an evaluation, and business-grade judgment is unmeasured.

Only the SDK-facing wire behavior in one section is proven over real sockets, including three question types, request ids, error shapes, large batches, and reserved-string handling. Schema-inferred behaviors and all real-server comparisons remain unverified or intentionally divergent.

Because probabilities ship uncalibrated, ported gates would mislead. The repo warns explicitly against reusing confidence cutoffs developed for Jev and documents overflow rejection instead of silent truncation.

Generate a local key, fetch the pinned-revision model with hash recording, then serve on loopback and point the official client at it. Auth is default-deny and model downloads stay local-only; first fetch is trust-on-first-use by explicit flag.

Four endpoints, two of which are JevBERT's own rather than Jev's. POST /v1/systemone and GET /v1/models cover the compatibility target, while GET /jevbert/v1/capabilities reports effective limits, definition IDs, and known differences, and GET /healthz plus GET /readyz handle liveness and readiness. Auth is default-deny: an unauthenticated caller gets 401 even on undefined paths, so the surface cannot be enumerated.

Structural and numeric invariants I01 through I09 are checked before every send, independent of model accuracy, and a violation is a 500 rather than a bad answer. NaN or infinite logits and a candidate-count mismatch are 500 with no probabilities in the body, truncation is disabled so an oversized request is a 422 context_length_exceeded rather than a quiet trim, and one invalid question rejects the whole request before inference, so there is no partial 200.

Pinned end to end: a lockfile, a revision pinned to a commit SHA, trust_remote_code off, no .bin files allowed, and SHA-256 recorded for the six manifest files and rechecked at load time. If the recorded hashes do not cover every file being loaded, it refuses to start, and files outside the allow-list in the model directory are rejected. First fetch is trust-on-first-use behind an explicit --trust-first-fetch flag, and a manifest pointing at a different repo or revision than this build is refused rather than fetched.