Optional model boundary
Integrate probabilistic reasoning without coupling the core to a provider or granting a model execution authority.
Routing conditions
DiagnosisService calls a ModelGateway only when three conditions hold at once: the deterministic classification is unknown, model policy is enabled, and a gateway has been injected by the application. If any condition fails, the deterministic result is returned unchanged. There is no ambient model default, no bundled provider, and no billable call in CI—tests use the fake gateway from the testkit.
ModelUsePolicy
| Field | Default |
|---|---|
| enabled | false |
| max_input_characters | 20,000 |
| max_output_tokens | 2,000 |
| max_tool_calls | 8 |
| timeout | 30 seconds |
| prompt_version | diagnosis-v1 |
Auditable output
ModelInvocation pairs a schema-validated diagnosis with provider, model, prompt version, input character count, and optional output token count. Redaction and minimum-necessary context happen before provider invocation. Model output enters memory as an unconfirmed hypothesis, exactly like a deterministic one.