feat(agent-seam): one typed-decision seam for code-consumed verdicts, local-backend-first #17308

Problem

AutoBot makes ~8 kinds of small, frequent, code-consumed judgements, each through a full free-text LLM call with a bespoke parser. There is no shared seam for "decide this, typed, with a probability" — so every site reinvents the prompt, the output format, the parser and the threshold.

An external vendor category has appeared for exactly this shape: decision-only models that take a state plus typed questions (choice / score / boolean) and return typed values with calibrated probabilities instead of text, at roughly two orders of magnitude less cost and latency than a frontier LLM call. The performance claims are self-reported and unverified, the models are closed-weight, and at least one is documented by its own vendor as steerable by adversarial content in the state — so this issue is about owning the interface, not about adopting a vendor.

The call sites (audited on main)

Where this explicitly does NOT apply

Audited and rejected — recording so a later reader does not re-propose them:

• Model/provider routing is already deterministic and local. autobot-backend/llm_shared/tiered_routing/complexity_router.py:42 plus complexity_scorer.py:24 (six weighted factors at :40-45) decide the tier with no model call; provider choice is a fixed cascade at llm_shared/provider_registry.py:414. There is no LLM cost to displace, and a network call would add latency and a dependency to something that currently costs microseconds.
• Fast-path classifiers are already sub-10ms and local: autobot-backend/intent_classifier.py:51, workflow_classifier.py:205, services/knowledge/intent_detector.py:120, agent_tier_classifier.py:119.
• Reranking is a local cross-encoder, not an LLM — autobot-backend/advanced_rag_optimizer.py:691-704.
• Prompt-injection detection is deterministic regex — autobot-backend/security/prompt_injection_detector.py:361. Putting a steerable model on that decision would be the wrong direction.
• Security gates. The pre-action verifier (autobot_shared/pre_action_verifier_guard.py:298) is the best-fitting shape in the codebase — its entire output is one float — and is precisely where a cheaper, injection-steerable classifier must not go. It also deliberately picks a provider different from the actor (:273) to avoid shared-context steering.

What AutoBot already has

autobot-backend/agents/gemma_classification_agent.py:233 runs a small model through Ollama (:296) with a keyword fallback (:418) — zero per-call cost, zero egress, zero vendors. That is the existing in-house answer to this problem, and it should be the default backend behind the seam.

Proposal

Add a decide(state, questions) -> typed answers with probabilities seam beside llm_shared/structured_ops.py:16 extract():

• question primitives: choice (probability per option), score (ordered levels), boolean (probability)
• multiple questions evaluated against one shared state in a single round trip
• pluggable backend: the local small-model path by default; a hosted decision model only as an optional backend, behind a benchmark, never on a security gate
• call sites above migrate to it, replacing their bespoke prompt + parser + threshold

Acceptance criteria

• A single typed-decision interface exists with the three question primitives and returns calibrated probabilities, not just labels
• Backend is pluggable and defaults to the local small-model path — no new outbound dependency is required to use the seam
• At least the two highest-volume sites (services/claim_verifier.py:287, judges/__init__.py:157) are migrated, with their bespoke parsers deleted
• If a hosted backend is enabled it goes through the guarded fetch with guard_egress passed explicitly (autobot_shared/http_client_manager.py:215 defaults it to None = unguarded) and through autobot_shared/security/redaction.py; its key is registered via services/provider_key_vault.py:73 and SSOT, never a literal
• A benchmark records accuracy and latency of each backend against a labelled sample before any hosted backend becomes a default — a calibration claim without our own measurement is not evidence
• Documented exclusion list: the seam is not used for provider/tier routing, injection detection, or the pre-action verifier gate

Notes

The endpoint shape of the hosted models in this category is not OpenAI chat-completions compatible (no messages array, no temperature — a state-plus-questions request shape), so such a backend cannot register as a normal provider next to autobot-backend/llm_shared/providers/openai_compatible.py. It would sit outside the fallback chain (provider_registry.py:414), the degradation skip (:464-476) and the cost tracking landed in #16230 — those gaps are part of the cost of enabling one.

Implementation Order

Wave: 3
Depends on: the provider structured-output and parse-hardening children of this umbrella