melchizedek-agents 1.11.0 → 1.12.0

package/config/agents/examples/classifier.yaml

@@ -0,0 +1,104 @@
+# tier: typesafe  — needs only TYPESAFE_API_KEY, or one MODEL_GATEWAY key (Vercel AI Gateway or OpenRouter); `npm run doctor` shows what each key unlocks.
+# ============================================================
+# CLASSIFIER — one decision model, typed answers, calibrated confidence.
+# ============================================================
+#
+# JOB: read one inbound support message and decide three things about it:
+# which team it belongs to, how urgent it is, and whether a person must
+# look before anything is sent back. The reply is one JSON object the
+# `output.schema` below describes, so the software that calls this agent
+# acts on fields, never on prose.
+#
+# WHY A DECISION MODEL: `model: jev-latest` is TypeSafe's Jev, a System One
+# model (https://typesafe.ai). It writes no sentences and calls no tool: it
+# answers typed questions with a probability for every option, in about a
+# tenth of a second, at $0.042 per million input tokens and nothing for
+# output. The engine turns this file's schema into Jev's questions
+# (lib/models/jev.ts): a boolean property is a yes/no question, a string
+# whose `oneOf` describes each constant is a choice, an integer whose
+# `oneOf` describes the levels 0, 1, 2 in order is a score. The property's
+# `description` is the question. The instruction below and the message are
+# the state Jev decides about.
+#
+# WHAT COMES BACK: the schema's object, plus a `jev` key holding the raw
+# answers: each question's probabilities and confidence. Act when the
+# confidence is high and route to a person when it is not: that threshold
+# is yours to set in the code that calls this agent, which is the point.
+#
+#   {"department":"technical","urgency":2,"needs_human":false,
+#    "jev":{"department":{"type":"choice","choice":"technical","confidence":0.91,
+#           "probabilities":{"billing":0.03,"technical":0.91,"sales":0.01,"other":0.05}},
+#           "urgency":{"type":"score","score":1.8,"confidence":0.8,...},
+#           "needs_human":{"type":"noul","noul":0.12}}}
+#
+# ONE FILE, ANY MODEL: change `model:` to gemini-3.5-flash-lite,
+# claude-haiku-5-5 or ollama/qwen3.5:9b and the same schema is answered by a
+# chat model's structured output (the matrix's `structured_output` cell);
+# the `jev` key then does not appear, since a chat model states no
+# probabilities. The doctor shows what each path keeps.
+#
+# NOT A CONVERSATION: memory_system internal-only and includeContents none
+# make every message stand alone; nothing is kept between calls.
+#
+# MAKE IT YOURS: rename the departments and their descriptions, change the
+# urgency levels (up to 10, each described), add a boolean per policy you
+# enforce. Every property must be a decision: a free string, an array or a
+# nested object is refused before any call (TYPESAFE_SCHEMA_UNSUPPORTED),
+# with the shapes Jev takes named in the error.
+# ============================================================
+syndicate_name: "Classifier"
+memory_system: internal-only
+
+orchestrator:
+  name: "Triage"
+  description: "Decides a support message's department, its urgency and whether a person must look, as typed answers with probabilities."
+  model: "jev-latest"
+  includeContents: none
+  instruction: |
+    You triage inbound messages for a software company's support desk. Each message was sent by a customer or a prospect through the help form or by email. You decide where it goes and how fast; you do not answer it.
+
+    Departments:
+    - billing handles charges, refunds, invoices, subscriptions and payment methods.
+    - technical handles bugs, outages, errors, integrations and anything about how the product behaves.
+    - sales handles pricing questions, quotes, upgrades, trials and new accounts.
+    - other is anything else: partnerships, press, job applications, spam.
+
+    Urgency is about the customer's situation, not their tone: an outage or a blocked payment is urgent however calmly it is written; a question with no deadline is not, however angrily.
+
+    A person must look before any automated reply when the message mentions legal action, a safety or security concern, a complaint about staff, a request to delete an account or data, or when it is unclear which department it belongs to.
+  output:
+    schema:
+      type: object
+      properties:
+        department:
+          type: string
+          description: "Which team should handle this message."
+          oneOf:
+            - const: billing
+              description: "Charges, refunds, invoices, subscriptions, payment methods."
+            - const: technical
+              description: "Bugs, outages, errors, integrations, product behaviour."
+            - const: sales
+              description: "Pricing, quotes, upgrades, trials, new accounts."
+            - const: other
+              description: "Partnerships, press, job applications, spam, or nothing above."
+        urgency:
+          type: integer
+          description: "How soon the company must act on this message."
+          oneOf:
+            - const: 0
+              description: "No deadline and nothing blocked: a question or a request that can wait days."
+            - const: 1
+              description: "Something is inconvenient or a date is near: within a day."
+            - const: 2
+              description: "Service is down, money is stuck, or a deadline is today: now."
+        needs_human:
+          type: boolean
+          description: "A person must read this message before any automated reply is sent."
+          oneOf:
+            - const: true
+              description: "Legal action, a safety or security concern, a complaint about staff, a deletion request, or an unclear department."
+            - const: false
+              description: "A routine message a department can answer on its own."
+      required: [department, urgency, needs_human]
+    mime: "application/json"

package/config/agents/examples/model_zoo.yaml

@@ -14,6 +14,11 @@
 #   kimi-*            → Moonshot       (MOONSHOT_API_KEY)
 #   deepseek-*        → DeepSeek       (DEEPSEEK_API_KEY)
 #
+# (jev-* → TypeSafe Jev is the eighth provider, and not in this zoo: a
+#  decision model answers a schema, never a question in prose. Its proof
+#  is classifier.yaml.) With no direct key, one MODEL_GATEWAY key serves
+# every cloud agent here.
+#
 # Run the proof:  npm run demo:models        (scripts/demo_model_optionality.ts
 #   sends "explain quantum mechanics" to every agent whose provider is
 #   available, and prints input, thinking, output, and a token/latency trace.

package/config/agents/syndicate.schema.json

@@ -22,7 +22,7 @@
         "model": {
           "type": "string",
           "minLength": 1,
-          "description": "Model id; its prefix picks the provider (gemini-*, claude-*, gpt-*/o*, grok-*, ollama/*)."
+          "description": "Model id; its prefix picks the provider (gemini-*, claude-*, gpt-*/o*, grok-*, kimi-*, deepseek-*, jev-*, ollama/*)."
         },
         "fallback_model": {
           "description": "A model on another provider that answers when this agent's model fails provider-side (5xx, 429, network) before producing anything, or while that provider's circuit is open (ADR 0044).",
@@ -448,6 +448,35 @@
                 }
               ]
             },
+            "typesafe": {
+              "type": "object",
+              "properties": {
+                "instruction": {
+                  "description": "Replaces the agent's instruction on this provider.",
+                  "type": "string",
+                  "minLength": 1
+                },
+                "instruction_append": {
+                  "description": "Appended to the agent's instruction, after a blank line, on this provider.",
+                  "type": "string",
+                  "minLength": 1
+                }
+              },
+              "additionalProperties": false,
+              "description": "The instruction on one provider: exactly one of instruction or instruction_append.",
+              "oneOf": [
+                {
+                  "required": [
+                    "instruction"
+                  ]
+                },
+                {
+                  "required": [
+                    "instruction_append"
+                  ]
+                }
+              ]
+            },
             "ollama": {
               "type": "object",
               "properties": {
@@ -1535,6 +1564,35 @@
                   }
                 ]
               },
+              "typesafe": {
+                "type": "object",
+                "properties": {
+                  "instruction": {
+                    "description": "Replaces the agent's instruction on this provider.",
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "instruction_append": {
+                    "description": "Appended to the agent's instruction, after a blank line, on this provider.",
+                    "type": "string",
+                    "minLength": 1
+                  }
+                },
+                "additionalProperties": false,
+                "description": "The instruction on one provider: exactly one of instruction or instruction_append.",
+                "oneOf": [
+                  {
+                    "required": [
+                      "instruction"
+                    ]
+                  },
+                  {
+                    "required": [
+                      "instruction_append"
+                    ]
+                  }
+                ]
+              },
               "ollama": {
                 "type": "object",
                 "properties": {

package/config/agents/syndicateSchema.yaml

@@ -270,7 +270,14 @@ orchestrator:
   #   grok-*    → xAI           (XAI_API_KEY)
   #   kimi-*    → Moonshot Kimi (MOONSHOT_API_KEY)
   #   deepseek-* → DeepSeek     (DEEPSEEK_API_KEY)
+  #   jev-*     → TypeSafe Jev  (TYPESAFE_API_KEY; a decision model: it answers
+  #                              this agent's output.schema, never prose, so it
+  #                              takes no tools and no subagents)
   #   ollama/*  → local Ollama  (keyless)
+  # With no direct key, MODEL_GATEWAY (vercel | openrouter) serves any cloud id;
+  # MODEL_GATEWAY_PREFER=gateway sends every cloud id through it even beside
+  # a direct key, and MODEL_GATEWAY_EXCEPT names the providers that do the
+  # opposite. Deployment config, never YAML: the file names models, not paths.
   # Subagents inherit this if not set on their own config.
   model: "gemini-3.5-flash-lite"
 
@@ -444,6 +451,7 @@ orchestrator:
   #                           that effort; none is the model's off switch,
   #                           or low effort on Opus 5 and 5.5, Fable and
   #                           Mythos (ADR 0049)
+  #   jev-*                 → nothing: Jev decides without reasoning
   #   gpt-*/o*, grok-*, kimi-*, deepseek-*, ollama/*, a gateway
   #                         → reasoningEffort (an effort word; where the
   #                           provider lacks one, its nearest setting above;
@@ -508,7 +516,7 @@ orchestrator:
   # ── model_overrides ───────────────────────────────────────
   # [optional] A prompt nuance for one provider (ADR 0115). Keys are the
   # providers a model id routes to: gemini, anthropic, openai, xai,
-  # moonshot, deepseek, ollama. Each holds ONE of:
+  # moonshot, deepseek, typesafe, ollama. Each holds ONE of:
   #   instruction:         replaces the instruction on that provider
   #   instruction_append:  added after the instruction, after a blank line
   # Applied for the provider of this agent's model, before the skills

package/db/hardening.sql

@@ -57,6 +57,8 @@ END $$;
 -- deny-by-default. service_role is unaffected (it bypasses RLS).
 ALTER TABLE adk_memory_facts ENABLE ROW LEVEL SECURITY;
 ALTER TABLE adk_sessions     ENABLE ROW LEVEL SECURITY;
+-- The store's one embedder row (migration 0023) names a model, nothing personal; locked all the same.
+ALTER TABLE IF EXISTS melchizedek_memory_embedder ENABLE ROW LEVEL SECURITY;
 
 -- Belt and suspenders: also revoke the default table privileges from the
 -- API roles, so even a future accidentally-created permissive policy
@@ -65,6 +67,9 @@ DO $$
 BEGIN
   PERFORM pg_temp.melchizedek_revoke_api('adk_memory_facts');
   PERFORM pg_temp.melchizedek_revoke_api('adk_sessions');
+  IF to_regclass('melchizedek_memory_embedder') IS NOT NULL THEN
+    PERFORM pg_temp.melchizedek_revoke_api('melchizedek_memory_embedder');
+  END IF;
 END $$;
 
 -- Optional observability ledger (db/telemetry.sql). Guarded: the tables only

package/db/migrations/0020_embedding_flash_grok_pricing.sql

@@ -0,0 +1,38 @@
+-- ============================================================================
+-- 0020_embedding_flash_grok_pricing — price rows for three models a ledger
+--                                     already holds calls of (extends ADR 0136)
+-- ============================================================================
+-- Rows only, in 0017's column layout (USD per million tokens). A deployment's
+-- ledger (penguin's, 2026-10-22) had calls of these three models priced NULL
+-- because no row existed; scripts that re-price NULL rows can now fill them.
+--
+-- grok-4.3: xAI first-party, docs.x.ai/docs/models, checked 2026-10-22. The
+-- row holds the rate under 200k prompt tokens ($1.25 in / $0.20 cached /
+-- $2.50 out); a request of 200k or more is billed at double for all its
+-- tokens ($2.50 / $0.40 / $5.00), which a flat row cannot say: such a call
+-- is underestimated by half.
+--
+-- gemini-embedding-001: Google's GA announcement for the Gemini API
+-- (developers.googleblog.com, "Gemini Embedding now generally available"):
+-- $0.15 per 1M input tokens, no output tokens. Google's current pricing page
+-- lists only its successor (gemini-embedding-2), so verified_at stays NULL.
+--
+-- gemini-3.5-flash: $1.50 in / $0.15 cached / $9.00 out, as two pricing
+-- guides give it, one citing Google's Gemini API pricing documentation
+-- (June 2026). Google's current page no longer lists the model (superseded
+-- by 3.6 and 3.8 Flash), so this could not be checked against the vendor:
+-- verified_at NULL, a steering estimate (0015's convention).
+--
+-- New rows never overwrite a row that exists: an operator's own rates
+-- survive. Nothing secret, nothing personal. Idempotent; safe to re-run.
+-- ============================================================================
+
+INSERT INTO model_pricing (model, input_per_mtok, output_per_mtok, cache_read_per_mtok, cache_write_per_mtok, verified_at, source, note) VALUES
+  ('grok-4.3',             1.25, 2.50, 0.20, NULL, '2026-10-22', 'docs.x.ai/docs/models', 'xAI first-party, checked 2026-10-22; rate under 200k prompt tokens (a request of 200k or more bills $2.50 / $0.40 / $5.00)'),
+  ('gemini-embedding-001', 0.15, 0.00, NULL, NULL, NULL,         'developers.googleblog.com, Gemini Embedding now generally available in the Gemini API', 'Google first-party announcement; input only; no longer on the current pricing page (successor gemini-embedding-2), not re-checked'),
+  ('gemini-3.5-flash',     1.50, 9.00, 0.15, NULL, NULL,         'eesel.ai Gemini 3 pricing guide (citing ai.google.dev pricing, June 2026), agreeing with other guides', 'unverified: off Google''s current pricing page (superseded by 3.6 and 3.8 Flash)')
+ON CONFLICT (model) DO NOTHING;
+
+INSERT INTO melchizedek_schema_version (version, name)
+VALUES (20, '0020_embedding_flash_grok_pricing')
+ON CONFLICT (version) DO NOTHING;

package/db/migrations/0021_correct_gemini_flash_grok_rates.sql

@@ -0,0 +1,46 @@
+-- ============================================================================
+-- 0021_correct_gemini_flash_grok_rates — two seed rows to their vendors'
+--                                        current lists (extends ADR 0136)
+-- ============================================================================
+-- 0015 seeded gemini-3.8-flash and grok-4.7 from melch-obs's pricing.toml as
+-- unverified estimates. Checked 2026-10-22 against the vendors' lists, both
+-- were wrong:
+--
+--   gemini-3.8-flash  ai.google.dev/gemini-api/docs/pricing (paid, standard):
+--                     $0.75 in / $0.075 cached / $3.75 out, thinking billed
+--                     as output, through 2026-12-31. Google has announced
+--                     $1.50 / $0.15 / $7.50 from 2027-01-01; a flat row cannot
+--                     say the date, so that needs its own row change then.
+--                     Seed: $0.30 / $2.50 (a placeholder at 3.7's rate).
+--   grok-4.7          docs.x.ai/docs/models: $2.00 in / $0.50 cached / $6.00
+--                     out under 200k prompt tokens (a request of 200k or more
+--                     bills $4.00 / $1.00 / $12.00 for all its tokens, which a
+--                     flat row underestimates by half). Seed: $3.00 / $15.00.
+--
+-- A row changes only while it is still the seed: source melch-obs/pricing.toml,
+-- verified_at NULL, and the seed's own rates. A rate an operator set is kept.
+--
+-- Rows already priced keep what they were priced at: the ledger records the
+-- rate in force at write time (db/telemetry.sql). Re-pricing history is a
+-- deliberate UPDATE, never a migration. Idempotent; safe to re-run.
+-- ============================================================================
+
+UPDATE model_pricing
+   SET input_per_mtok = 0.75, output_per_mtok = 3.75, cache_read_per_mtok = 0.075,
+       verified_at = '2026-10-22', source = 'ai.google.dev/gemini-api/docs/pricing',
+       note = 'Gemini API paid standard tier, checked 2026-10-22; rate through 2026-12-31 (Google lists $1.50 / $0.15 / $7.50 from 2027-01-01)',
+       updated_at = now()
+ WHERE model = 'gemini-3.8-flash' AND source = 'melch-obs/pricing.toml' AND verified_at IS NULL
+   AND input_per_mtok = 0.30 AND output_per_mtok = 2.50;
+
+UPDATE model_pricing
+   SET input_per_mtok = 2.00, output_per_mtok = 6.00, cache_read_per_mtok = 0.50,
+       verified_at = '2026-10-22', source = 'docs.x.ai/docs/models',
+       note = 'xAI first-party, checked 2026-10-22; rate under 200k prompt tokens (a request of 200k or more bills $4.00 / $1.00 / $12.00)',
+       updated_at = now()
+ WHERE model = 'grok-4.7' AND source = 'melch-obs/pricing.toml' AND verified_at IS NULL
+   AND input_per_mtok = 3.00 AND output_per_mtok = 15.00;
+
+INSERT INTO melchizedek_schema_version (version, name)
+VALUES (21, '0021_correct_gemini_flash_grok_rates')
+ON CONFLICT (version) DO NOTHING;

package/db/migrations/0022_typesafe_jev_pricing.sql

@@ -0,0 +1,36 @@
+-- ============================================================================
+-- 0022_typesafe_jev_pricing — price rows for TypeSafe Jev (extends ADR 0136;
+--                             the provider is ADR 0144)
+-- ============================================================================
+-- Rows only, in 0017's column layout (USD per million tokens):
+--   input_per_mtok        an input token
+--   output_per_mtok       0: TypeSafe bills nothing for output today
+--                         (docs.typesafe.ai/models, "output tokens are free")
+--   cache_read_per_mtok   NULL: no cache on this API
+--   cache_write_per_mtok  NULL
+--
+-- TypeSafe Jev (lib/models/jevAdapter.ts): $42 per billion input tokens,
+-- which is $0.042 per million, the same on jev-1.14.0 and jev-1.13.0.
+-- `jev-latest` and `jev-preview` are TypeSafe's aliases (both jev-1.14.0 on
+-- 2026-10-23); a call made under an alias is priced under the alias, so the
+-- aliases get rows too. Checked 2026-10-23 against docs.typesafe.ai/models.
+--
+-- Through a gateway (Vercel AI Gateway lists $0.042 input, max output 0;
+-- OpenRouter bills "the rate on the Jev model page") the rate is the same
+-- at the time of writing; an operator whose gateway adds a margin edits the
+-- row.
+--
+-- New rows never overwrite a row that exists: an operator's own rates
+-- survive. Nothing secret, nothing personal. Idempotent; safe to re-run.
+-- ============================================================================
+
+INSERT INTO model_pricing (model, input_per_mtok, output_per_mtok, cache_read_per_mtok, cache_write_per_mtok, verified_at, source, note) VALUES
+  ('jev-latest',  0.042, 0, NULL, NULL, '2026-10-23', 'docs.typesafe.ai/models', 'TypeSafe first-party, checked 2026-10-23; alias of jev-1.14.0; output is free'),
+  ('jev-preview', 0.042, 0, NULL, NULL, '2026-10-23', 'docs.typesafe.ai/models', 'TypeSafe first-party, checked 2026-10-23; alias of the newest build (jev-1.14.0); output is free'),
+  ('jev-1.14.0',  0.042, 0, NULL, NULL, '2026-10-23', 'docs.typesafe.ai/models', 'TypeSafe first-party, checked 2026-10-23; output is free'),
+  ('jev-1.13.0',  0.042, 0, NULL, NULL, '2026-10-23', 'docs.typesafe.ai/models', 'TypeSafe first-party, checked 2026-10-23; output is free')
+ON CONFLICT (model) DO NOTHING;
+
+INSERT INTO melchizedek_schema_version (version, name)
+VALUES (22, '0022_typesafe_jev_pricing')
+ON CONFLICT (version) DO NOTHING;

package/db/migrations/0023_memory_embedder.sql

@@ -0,0 +1,66 @@
+-- ============================================================================
+-- 0023_memory_embedder — the one embedding model a memory store's vectors
+--                        come from (ADR 0147)
+-- ============================================================================
+-- Every vector in adk_memory_facts must come from one model: a different
+-- model at the same dimension passes the size check (0007's
+-- melchizedek_memory_dimensions) and quietly degrades recall. This table
+-- holds one row: the provider, model and dimension the store was first
+-- written with. The memory service records it on its first successful
+-- insert and refuses, at start, an embedder whose model differs
+-- (lib/memory/supabaseMemoryService.ts); switching models means re-embedding
+-- the stored facts, never a silent change.
+--
+-- A gateway's spelling of the same model (google/gemini-embedding-001 for
+-- gemini-embedding-001) is the same model: the service compares the last
+-- path segment. Two functions serve the Supabase REST path, which reaches
+-- tables through RPC here (0007's convention):
+--   melchizedek_memory_embedder()                  the row, or none
+--   melchizedek_memory_record_embedder(p, m, d)    record it once; a later
+--                                                  call changes nothing
+--   melchizedek_memory_set_embedder(p, m, d)       overwrite it: what a
+--                                                  completed re-embed writes
+--                                                  (lib/memory/reembed.ts)
+-- Nothing secret, nothing personal. Idempotent; safe to re-run.
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS melchizedek_memory_embedder (
+  one          BOOLEAN     PRIMARY KEY DEFAULT TRUE CHECK (one),
+  provider     TEXT        NOT NULL,
+  model        TEXT        NOT NULL,
+  dimensions   INTEGER     NOT NULL CHECK (dimensions > 0),
+  recorded_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE OR REPLACE FUNCTION melchizedek_memory_embedder()
+RETURNS TABLE (provider text, model text, dimensions integer, recorded_at timestamptz)
+LANGUAGE sql
+STABLE
+SET search_path = public
+AS $$
+  SELECT provider, model, dimensions, recorded_at FROM melchizedek_memory_embedder WHERE one;
+$$;
+
+CREATE OR REPLACE FUNCTION melchizedek_memory_record_embedder(p_provider text, p_model text, p_dimensions integer)
+RETURNS void
+LANGUAGE sql
+SET search_path = public
+AS $$
+  INSERT INTO melchizedek_memory_embedder (one, provider, model, dimensions)
+  VALUES (TRUE, p_provider, p_model, p_dimensions)
+  ON CONFLICT (one) DO NOTHING;
+$$;
+
+CREATE OR REPLACE FUNCTION melchizedek_memory_set_embedder(p_provider text, p_model text, p_dimensions integer)
+RETURNS void
+LANGUAGE sql
+SET search_path = public
+AS $$
+  INSERT INTO melchizedek_memory_embedder (one, provider, model, dimensions, recorded_at)
+  VALUES (TRUE, p_provider, p_model, p_dimensions, now())
+  ON CONFLICT (one) DO UPDATE SET provider = EXCLUDED.provider, model = EXCLUDED.model, dimensions = EXCLUDED.dimensions, recorded_at = now();
+$$;
+
+INSERT INTO melchizedek_schema_version (version, name)
+VALUES (23, '0023_memory_embedder')
+ON CONFLICT (version) DO NOTHING;

package/dist/lib/config.d.ts

@@ -100,6 +100,12 @@ export declare const DEFAULT_MAX_STEPS = 50;
  * qwen3:8b is the smallest pulled model that supports tool calling — the
  * floor capability for syndicate delegation. Vision work uses ollama/qwen3-vl:8b.
  */
+/**
+ * TypeSafe Jev (lib/models/jevAdapter.ts): `jev-latest` is TypeSafe's alias
+ * for the newest stable release (jev-1.14.0 as of 2026-10-14). A decision
+ * model: it answers an agent's `output.schema`, never free text.
+ */
+export declare const DEFAULT_JEV_MODEL = "jev-latest";
 export declare const DEFAULT_OLLAMA_MODEL = "ollama/qwen3:8b";
 /**
  * Model used by SupabaseVectorMemoryService to extract discrete facts

package/dist/lib/config.js

@@ -101,6 +101,12 @@ export const DEFAULT_MAX_STEPS = 50;
  * qwen3:8b is the smallest pulled model that supports tool calling — the
  * floor capability for syndicate delegation. Vision work uses ollama/qwen3-vl:8b.
  */
+/**
+ * TypeSafe Jev (lib/models/jevAdapter.ts): `jev-latest` is TypeSafe's alias
+ * for the newest stable release (jev-1.14.0 as of 2026-10-14). A decision
+ * model: it answers an agent's `output.schema`, never free text.
+ */
+export const DEFAULT_JEV_MODEL = 'jev-latest';
 export const DEFAULT_OLLAMA_MODEL = 'ollama/qwen3:8b';
 /**
  * Model used by SupabaseVectorMemoryService to extract discrete facts

package/dist/lib/doctor.d.ts

@@ -26,6 +26,7 @@
 import type { Platform } from './models/endpoints.ts';
 import type { CapabilityGap, CapabilityReport } from './models/capabilities.ts';
 import type { ProviderId } from './models/providerMap.ts';
+import type { EmbedderPlan } from './memory/providers.ts';
 import type { RuntimeName, RuntimeSource } from './runtime/runtimeFlag.ts';
 import { type ProjectCheck } from './project.ts';
 /**
@@ -172,6 +173,13 @@ export interface DoctorResult {
     chatgpt?: DoctorChatGpt;
     /** The project manifest (ADR 0138) found from the working directory, when there is one. */
     project?: DoctorProject;
+    /** Long-term memory's embedder (ADR 0147), when any syndicate here is long-term or MEMORY_EMBEDDING_PROVIDER is set. */
+    memory?: DoctorMemory;
+}
+/** What would embed long-term memory here: the plan, and how many of this directory's syndicates need it. */
+export interface DoctorMemory {
+    longTerm: number;
+    embedder: EmbedderPlan;
 }
 /** A `melchizedek.json` at or above the working directory: its checks, or why it does not load. */
 export type DoctorProject = ProjectCheck | {

package/dist/lib/doctor.js

@@ -33,6 +33,7 @@ import { CAPABILITY_LABELS, capabilityGaps, describeCapabilities } from './model
 import { credentialSource, endpointFromEnv, endpointLabel, endpointProblems, PLATFORM_SDK, PLATFORMS_FOR } from './models/endpoints.js';
 import { GATEWAY_ENV, GATEWAY_KEY_ENV, GATEWAYS, gatewayConfig, gatewayProblem, gatewayUsable, } from './models/gateway.js';
 import { PROVIDERS } from './models/providerMap.js';
+import { embedderPlan } from './memory/providers.js';
 import { describeRuntime } from './runtime/runtimeFlag.js';
 import { CHATGPT_SIGNIN_ENV, CHATGPT_SIGNIN_FILE_ENV, chatGptSignInRoutesOpenAi, chatGptSignInStatus } from './chatgpt/state.js';
 import { agentOAuthGrants, oauthEnvNames } from './tools/oauthTools.js';
@@ -179,6 +180,7 @@ export const CONSOLE_URLS = {
     xai: 'https://console.x.ai',
     moonshot: 'https://platform.moonshot.ai',
     deepseek: 'https://platform.deepseek.com/api_keys',
+    typesafe: 'https://console.typesafe.ai/keys',
     ollama: 'https://ollama.com',
 };
 // ── Discovery ────────────────────────────────────────────────────────────────
@@ -506,6 +508,9 @@ export function runDoctor(options = {}) {
     for (const s of syndicates)
         counts[s.verdict.state]++;
     flagMemoryNamespaces(syndicates);
+    // Long-term memory's embedder (ADR 0147): what would embed, or what to set, names only.
+    const longTerm = syndicates.filter((s) => s.memory).length;
+    const memory = longTerm || process.env.MEMORY_EMBEDDING_PROVIDER?.trim() ? { longTerm, embedder: embedderPlan() } : undefined;
     // The server's OAuth setup (ADR 0114): the key, the redirect URI and the allowlist, names only.
     const grants = syndicates.flatMap((s) => s.grants ?? []).map((g) => ({ agent: g.agent, tools: g.tools, oauth2: { provider: g.provider, grant: g.grant, token_url: '' } }));
     const set = Object.fromEntries([CREDENTIAL_KEY_ENV, OAUTH_REDIRECT_URI_ENV, OAUTH_HOSTS_ENV].map((name) => [name, !!process.env[name]?.trim()]));
@@ -537,6 +542,7 @@ export function runDoctor(options = {}) {
         syndicates,
         unlocks,
         gateway,
+        ...(memory ? { memory } : {}),
         endpoints: endpointRows(),
         counts,
         ...(oauth ? { oauth } : {}),
@@ -605,6 +611,7 @@ const PROBE_ID = {
     xai: 'grok-x',
     moonshot: 'kimi-x',
     deepseek: 'deepseek-x',
+    typesafe: 'jev-x',
     ollama: 'ollama/x',
 };
 /**
@@ -695,6 +702,16 @@ export function renderDoctor(result, opts = {}) {
             ? `gateway     ${c.red}✗${c.reset} ${result.gateway.problem}`
             : `gateway     ${c.yellow}◇${c.reset} ${result.gateway.label} fills in for any provider whose direct key is absent ${c.dim}(native search is lost on that path)${c.reset}`);
     }
+    if (result.memory) {
+        // Long-term memory's embedder (ADR 0147): funded directly, through the gateway, or what to set. Names only.
+        const e = result.memory.embedder;
+        const n = result.memory.longTerm;
+        const who = n ? `${n} long-term syndicate${n === 1 ? '' : 's'}` : 'MEMORY_EMBEDDING_PROVIDER set';
+        const mark = !e.funded ? `${c.red}✗${c.reset}` : e.transport === 'gateway' ? `${c.yellow}◇${c.reset}` : `${c.green}✓${c.reset}`;
+        lines.push(e.funded
+            ? `memory      ${mark} embeddings ${e.provider}/${e.model} (${e.dimensions}d)${e.transport === 'gateway' ? ` via gateway:${e.gateway}` : ''} ${c.dim}· ${e.detail} · ${who}${c.reset}`
+            : `memory      ${mark} ${c.red}${e.detail}${c.reset} ${c.dim}· ${who}${c.reset}`);
+    }
     if (result.serving) {
         // Names only: the A2A identity mode, who pays, and what the server would refuse.
         const sv = result.serving;

package/dist/lib/loadSyndicate.d.ts

@@ -149,7 +149,7 @@ export interface AgentYamlConfig {
      * appended after a blank line, for the provider of the model the agent runs
      * on. Applied at compile time, before the skills index; not for fallback_model.
      */
-    model_overrides?: Partial<Record<'gemini' | 'anthropic' | 'openai' | 'xai' | 'moonshot' | 'deepseek' | 'ollama', {
+    model_overrides?: Partial<Record<'gemini' | 'anthropic' | 'openai' | 'xai' | 'moonshot' | 'deepseek' | 'typesafe' | 'ollama', {
         instruction?: string;
         instruction_append?: string;
     }>>;

package/dist/lib/memory/providers.d.ts

@@ -27,6 +27,16 @@
  *   MEMORY_EMBEDDING_API_KEY      openai-compatible key (else none)
  * The vector column is fixed at creation (db/), so changing the model or the
  * dimension needs a re-embed, not just a new variable.
+ *
+ * THE GATEWAY (ADR 0146): with no key for the embedding provider, or with
+ *   MODEL_GATEWAY_PREFER=gateway, the embedder goes through the configured
+ *   gateway's /embeddings when that gateway carries the SAME model (Vercel
+ *   carries google/gemini-embedding-001 and openai/text-embedding-3-small
+ *   and honours `dimensions`; OpenRouter carries OpenAI's). The vectors are
+ *   the model's own, so a store embedded directly and one embedded through
+ *   the gateway agree. A gateway that lacks the model changes nothing: the
+ *   direct path stays, keyless and failing loudly, never a different model
+ *   behind the store's back.
  */
 import type { ProviderEndpoint } from '../models/endpoints.ts';
 import type { ModelAdapter } from '../models/contract.ts';
@@ -90,6 +100,27 @@ export interface MemoryProviders {
     extractor: MemoryExtractor;
     embedder: Embedder;
 }
+/** What the environment's embedder would be, with no client built (the doctor's memory line, ADR 0147). */
+export interface EmbedderPlan {
+    provider: string;
+    model: string;
+    dimensions: number;
+    /** `none` when nothing funds the embedder. */
+    transport: 'direct' | 'gateway' | 'none';
+    gateway?: string;
+    funded: boolean;
+    /** For a person: what funds it, or what to set. Never a key. */
+    detail: string;
+}
+/**
+ * The embedder `memoryProvidersFromEnv` would build, as a plan: provider,
+ * model, dimension, the path and whether it is funded, with the fix when it
+ * is not. The OpenRouter case gets its documented answer: OpenRouter carries
+ * no Gemini embedding model, so `MEMORY_EMBEDDING_PROVIDER=openai` embeds
+ * `text-embedding-3-small` through it, with the re-embed caveat for a store
+ * already embedded with Gemini (ADR 0147).
+ */
+export declare function embedderPlan(env?: NodeJS.ProcessEnv, geminiKey?: string): EmbedderPlan;
 /**
  * The deployment's extractor and embedder. `geminiKey` is the key the server
  * already passes for memory; it is used only when the configured extraction