Upload folder using huggingface_hub

README.md

@@ -1,13 +1,19 @@
 ---
-title: J33 Jev
-emoji: ⚡
-colorFrom: indigo
-colorTo: green
+title: J33-Jev · typed decisions
+emoji: ⚖️
+colorFrom: gray
+colorTo: yellow
 sdk: gradio
 sdk_version: 6.30.0
-python_version: '3.12'
 app_file: app.py
+short_description: Calibrated typed decisions from a case + question schema
+python_version: "3.12"
 pinned: false
+license: apache-2.0
+models:
+  - J33-AI/j33-jev
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+Demo of [J33-AI/j33-jev](https://huggingface.co/J33-AI/j33-jev): a small "System One" decision model from [J33.AI](https://j33.ai) — Google's [EmbeddingGemma 2](https://huggingface.co/google/embeddinggemma-2) encoder plus a 0.59M scoring head (271.6M params total), fine-tuned on [LocalLLaMA/typed-decisions](https://huggingface.co/datasets/LocalLLaMA/typed-decisions). Give it a case (a ticket, an invoice, a security alert, an agent trace) and a schema of typed questions; it answers every question at once with a **calibrated probability distribution** — nothing is generated.
+
+Pick one of the four benchmark workflows (or paste your own case and schema) and press **Decide**. The top answer comes with a confidence: when it clears the break-even bar (83.3% for +1/−5 scoring) the model can decide alone; the rest go to a person. Preset cases are real rows from the Apache-2.0 typed-decisions benchmark, and the agent-trace case is the exact one the model card showcases.

app.py

@@ -0,0 +1,344 @@
+"""J33-Jev — a small "System One" typed-decision model.
+
+Interactive demo for https://huggingface.co/J33-AI/j33-jev: Google's EmbeddingGemma 2
+encoder plus a tiny scoring head (271.6M params) fine-tuned on
+LocalLLaMA/typed-decisions. You give it a case — a ticket, an invoice, a security
+alert, an agent trace — and a schema of typed questions; it returns a calibrated
+probability distribution for every question in one forward pass. Nothing is generated.
+
+Question types (the Jev-style / System One primitives):
+  * `choice` — one of N labels you list       → distribution over labels
+  * `score`  — an ordered rubric you describe  → distribution over levels
+  * `noul`   — a yes/no statement              → P(true)
+
+Inference follows the model card exactly:
+snapshot_download("J33-AI/j33-jev") → gemma_jev.load(..., vision=False, head="none")
+→ model.predict(state, questions) → {qid: {option: prob}}.
+"""
+
+import os
+
+os.environ.setdefault("PYTORCH_CUDA_ALLOC_CONF", "expandable_segments:True")
+
+import spaces  # noqa: E402  -- MUST precede torch / transformers / any CUDA-touching import
+
+import html  # noqa: E402
+import json  # noqa: E402
+import sys  # noqa: E402
+import time  # noqa: E402
+from pathlib import Path  # noqa: E402
+
+import torch  # noqa: E402
+from huggingface_hub import snapshot_download  # noqa: E402
+
+MODEL_ID = "J33-AI/j33-jev"
+BREAK_EVEN = 0.833  # decide-alone threshold from the card's +1/−5 scoring
+
+# --------------------------------------------------------------------------
+# Model load — module scope, .to("cuda") eagerly so ZeroGPU can pack the weights.
+# The card's usage path: snapshot_download + sys.path.insert + gemma_jev.load.
+# --------------------------------------------------------------------------
+_path = snapshot_download(MODEL_ID)
+sys.path.insert(0, _path)
+import gemma_jev  # noqa: E402
+
+model = gemma_jev.load(
+    f"{_path}/model.safetensors",
+    base="google/embeddinggemma-2",
+    vision=False,   # text-only checkpoint; vision tower off (as in the card example)
+    head="none",    # scorer straight on the encoder (this checkpoint's head)
+    device="cpu",   # placeholder; moved to cuda right below
+).to("cuda")
+model.eval()
+
+print(
+    f"[j33-jev] loaded {MODEL_ID}: "
+    f"{sum(p.numel() for p in model.parameters()) / 1e6:.1f}M params, "
+    f"temperatures={model.temperature.tolist()}",
+    flush=True,
+)
+
+
+# --------------------------------------------------------------------------
+# Workflow presets — real cases from the model's own training benchmark,
+# LocalLLaMA/typed-decisions (Apache-2.0), one per workflow, test split.
+# The agent-trace case is the exact case the model card showcases.
+# --------------------------------------------------------------------------
+with open(Path(__file__).parent / "presets.json", encoding="utf-8") as _f:
+    PRESETS = json.load(_f)
+PRESET_NAMES = [v["label"] for v in PRESETS.values()]
+PRESET_BY_LABEL = {v["label"]: k for k, v in PRESETS.items()}
+
+
+def _pretty(obj) -> str:
+    return json.dumps(obj, indent=2, ensure_ascii=False)
+
+
+def load_preset(label: str):
+    """Fill the state and schema boxes from a workflow preset (or clear them)."""
+    key = PRESET_BY_LABEL.get(label)
+    if key is None:
+        return "", ""
+    p = PRESETS[key]
+    return _pretty(p["state"]), _pretty(p["questions"])
+
+
+# --------------------------------------------------------------------------
+# Input parsing → the model's exact call shape
+# --------------------------------------------------------------------------
+QTYPES = ("choice", "score", "noul")
+
+
+def _parse(state_text: str, questions_text: str):
+    state_text = (state_text or "").strip()
+    questions_text = (questions_text or "").strip()
+    if not state_text:
+        raise gr.Error("Give the model a case — a JSON state object or free text.")
+    if not questions_text:
+        raise gr.Error("Give the model a schema of questions to answer.")
+
+    def _load(text, what):
+        if text[:1] in "{[":
+            try:
+                return json.loads(text)
+            except json.JSONDecodeError as e:
+                raise gr.Error(f"The {what} box holds JSON but it does not parse: {e}")
+        return text
+
+    state = _load(state_text, "state")
+    questions = _load(questions_text, "questions")
+    if not isinstance(questions, dict) or not questions:
+        raise gr.Error(
+            "The questions box must be a JSON object — "
+            '{"qid": {"type": "choice"|"score"|"noul", "instructions": …, "criteria": …}}.'
+        )
+
+    norm = {}
+    for qid, spec in questions.items():
+        if not isinstance(spec, dict):
+            raise gr.Error(f"Question {qid!r} must be a JSON object with type/instructions/criteria.")
+        s = dict(spec)
+        for alias, canon in (("kind", "type"), ("prompt", "instructions"), ("text", "instructions"),
+                             ("options", "criteria"), ("levels", "criteria")):
+            if alias in s and canon not in s:
+                s[canon] = s.pop(alias)
+        if s.get("type") not in QTYPES:
+            raise gr.Error(
+                f"Question {qid!r} has type {s.get('type')!r} — expected one of choice, score, noul."
+            )
+        if s["type"] != "noul" and not s.get("criteria"):
+            raise gr.Error(
+                f"Question {qid!r} ({s['type']}) needs a `criteria` listing the options or levels."
+            )
+        norm[qid] = s
+    return state, norm
+
+
+# --------------------------------------------------------------------------
+# Answer rendering
+# --------------------------------------------------------------------------
+def _bars_html(items, winner) -> str:
+    rows = []
+    for label, prob in items:
+        hot = label == winner
+        rows.append(
+            '<div style="display:flex;align-items:center;gap:10px;margin:2px 0">'
+            f'<span style="flex:0 0 270px;text-align:right;font-size:12.5px;'
+            f'color:var(--body-text-color);opacity:{1.0 if hot else 0.6};'
+            f'overflow:hidden;text-overflow:ellipsis;white-space:nowrap">'
+            f"{html.escape(str(label))}</span>"
+            '<div style="flex:1;background:var(--border-color-primary);height:13px;border-radius:3px">'
+            f'<div style="width:{max(prob * 100, 0.5):.2f}%;height:13px;border-radius:3px;'
+            f'background:var(--color-accent);opacity:{1.0 if hot else 0.45}"></div></div>'
+            f'<span style="flex:0 0 58px;font-size:12.5px;opacity:{1.0 if hot else 0.6}">'
+            f"{prob * 100:.1f}%</span></div>"
+        )
+    return "".join(rows)
+
+
+def _gate_badge(conf: float) -> str:
+    """Green when the top answer clears the card's break-even confidence."""
+    if conf >= BREAK_EVEN:
+        return (
+            '<span style="font-size:11.5px;padding:1.5px 8px;border-radius:10px;'
+            'background:rgba(46,160,67,0.18);color:#2ea043">decides alone</span>'
+        )
+    return (
+        '<span style="font-size:11.5px;padding:1.5px 8px;border-radius:10px;'
+        'background:var(--border-color-primary);opacity:0.75">send to a person</span>'
+    )
+
+
+def _answer_html(qid: str, spec: dict, probs: dict) -> str:
+    kind = spec.get("type", "choice")
+    items = list(probs.items())
+    winner = max(items, key=lambda kv: kv[1])[0]
+    conf = probs[winner]
+    head_txt = html.escape(str(spec.get("instructions", qid)))
+
+    if kind == "choice":
+        headline = html.escape(str(winner))
+        note = f"confidence {conf:.0%}"
+    elif kind == "score":
+        crit = spec.get("criteria") or []
+        descs = [str(c) for c in crit] + [""] * max(0, len(items) - len(crit))
+        items = [(f"level {i} — {d}" if d else f"level {i}", p) for (i, p) in items]
+        winner = items[max(range(len(items)), key=lambda i: items[i][1])][0]
+        n = len(probs)
+        ev = sum(int(k) * p for k, p in probs.items()) / max(sum(probs.values()), 1e-9)
+        headline = f"level {max(probs, key=probs.get)}"
+        note = f"expected level {ev:.2f} of {n - 1}"
+    else:  # noul
+        p_true = probs.get("true", 0.0)
+        headline = "yes" if p_true >= 0.5 else "no"
+        note = f"P(true) = {p_true:.0%}"
+        winner = "true" if p_true >= 0.5 else "false"
+
+    return (
+        '<div style="padding:12px 0;border-bottom:1px solid var(--border-color-primary)">'
+        f'<div style="font-size:12.5px;opacity:0.75;margin-bottom:3px">'
+        f'<code style="font-size:11.5px">{kind}</code> · <b>{html.escape(str(qid))}</b> — {head_txt}</div>'
+        f'<div style="font-size:19px;font-weight:600;margin:2px 0">{headline} '
+        f'<span style="font-weight:400;font-size:13px;opacity:0.75">{note}</span> '
+        f"{_gate_badge(conf)}</div>"
+        f"{_bars_html(items, winner)}</div>"
+    )
+
+
+# --------------------------------------------------------------------------
+# GPU handler
+# --------------------------------------------------------------------------
+@spaces.GPU(duration=30)
+def decide(preset_label: str, state_text: str, questions_text: str):
+    """Answer a schema of typed questions about one case, with calibrated probabilities.
+
+    Args:
+        preset_label: the selected workflow preset (display only; the decision is
+            made from the two boxes below, which it merely pre-fills).
+        state_text: the case to decide on — a JSON object (a ticket, an invoice,
+            a security alert, an agent trace…) or free text. Serialised and
+            truncated to 4,000 characters by the model.
+        questions_text: the decision schema, as JSON — a {qid: spec} object where
+            each spec has a `type` of `choice`, `score` or `noul`, `instructions`,
+            and (except `noul`) a `criteria` listing the options or levels.
+
+    Returns:
+        (typed answers as HTML, a one-line status, the raw probabilities as JSON)
+    """
+    state, questions = _parse(state_text, questions_text)
+
+    t0 = time.perf_counter()
+    try:
+        probs = model.predict(state, questions)
+    except AssertionError as e:
+        raise gr.Error(f"The schema is not answerable: {e}")
+    ms = (time.perf_counter() - t0) * 1000.0
+
+    rendered = "".join(_answer_html(qid, questions.get(qid, {}), p) for qid, p in probs.items())
+    winners = {q: max(p, key=p.get) for q, p in probs.items()}
+    alone = sum(1 for q, p in probs.items() if p[winners[q]] >= BREAK_EVEN)
+    status = (
+        f"**{len(probs)} question{'s' if len(probs) != 1 else ''} answered** in one forward pass · "
+        f"GPU compute {ms:.0f} ms · {alone} clear the {BREAK_EVEN:.0%} decide-alone bar, "
+        f"{len(probs) - alone} would go to a person. Nothing is generated — every option is scored."
+    )
+    return rendered, status, json.dumps(probs, indent=2, ensure_ascii=False)
+
+
+# --------------------------------------------------------------------------
+# UI
+# --------------------------------------------------------------------------
+import gradio as gr  # noqa: E402
+
+CSS = """
+main, .gradio-container, .gradio-container > .main { max-width: 1200px !important; margin: 0 auto !important; }
+.dark .gradio-container { color: var(--body-text-color); }
+"""
+
+with gr.Blocks(title="J33-Jev · typed decisions", theme=gr.themes.Citrus(), css=CSS) as demo:
+    gr.Markdown(
+        "# J33-Jev · typed, calibrated decisions\n"
+        "A 271M-parameter **decision model** — Google's "
+        "[EmbeddingGemma 2](https://huggingface.co/google/embeddinggemma-2) encoder plus a small scoring head, "
+        "fine-tuned by [J33.AI](https://j33.ai) on "
+        "[LocalLLaMA/typed-decisions](https://huggingface.co/datasets/LocalLLaMA/typed-decisions). "
+        "Give it a case and a schema of typed questions; it picks an answer to each and returns a "
+        "**calibrated probability distribution** — one forward pass, nothing generated. "
+        "Let it decide alone when its confidence clears your break-even bar (83.3% for +1/−5 scoring); "
+        "send the rest to a person.\n\n"
+        "| Question type | Answer |\n|---|---|\n"
+        "| `choice` | one of the options you list, + probability per option |\n"
+        "| `score` | an ordered level in your rubric, + E[level] |\n"
+        "| `noul` | probabilistic yes/no, P(true) |\n\n"
+        "Model: [`J33-AI/j33-jev`](https://huggingface.co/J33-AI/j33-jev) · "
+        "75.2% accuracy, **0.019 ECE** on the typed-decisions test set · 33 ms per case on the authors' GPU"
+    )
+
+    with gr.Row():
+        with gr.Column(scale=1):
+            preset = gr.Dropdown(
+                choices=[""] + PRESET_NAMES,
+                value=PRESETS["agent_trace_observability"]["label"],
+                label="Workflow preset",
+                info="Loads a real case + schema from the typed-decisions benchmark. "
+                "Edit both boxes freely — the schema is plain data.",
+                filterable=True,
+            )
+            state_box = gr.Textbox(
+                label="Case / state (JSON or free text)",
+                value=_pretty(PRESETS["agent_trace_observability"]["state"]),
+                lines=14,
+                max_lines=25,
+                placeholder="A ticket, invoice, alert, agent trace…",
+            )
+            questions_box = gr.Textbox(
+                label="Decision schema (JSON)",
+                value=_pretty(PRESETS["agent_trace_observability"]["questions"]),
+                lines=14,
+                max_lines=25,
+                placeholder='{"qid": {"type": "choice", "instructions": …, "criteria": {…}}}',
+            )
+            run = gr.Button("Decide", variant="primary")
+
+        with gr.Column(scale=1):
+            out_status = gr.Markdown()
+            out_html = gr.HTML(label="Typed answers")
+            with gr.Accordion("Raw probabilities (JSON)", open=False):
+                out_json = gr.Code(language="json", lines=14, show_label=False, wrap_lines=True)
+
+    preset.change(load_preset, inputs=preset, outputs=[state_box, questions_box])
+    run.click(
+        decide,
+        inputs=[preset, state_box, questions_box],
+        outputs=[out_html, out_status, out_json],
+        api_name="decide",
+    )
+
+    gr.Examples(
+        examples=[[label, _pretty(PRESETS[k]["state"]), _pretty(PRESETS[k]["questions"])]
+                  for label, k in ((v["label"], k) for k, v in PRESETS.items())],
+        inputs=[preset, state_box, questions_box],
+        outputs=[out_html, out_status, out_json],
+        fn=decide,
+        cache_examples=True,
+        cache_mode="lazy",
+        example_labels=PRESET_NAMES,
+        label="Examples — real cases from the typed-decisions benchmark",
+    )
+
+    gr.Markdown(
+        "---\n"
+        "**What to expect.** Trained on synthetic cases from four workflows (customer service, invoice "
+        "processing, security incidents, agent-trace observability), English only, text only. Questions far "
+        "from those workflows are answered from embedding similarity alone and are less reliable — read the "
+        "confidence, not just the label. Not for high-stakes decisions; use the probabilities to gate them.\n\n"
+        "**Implementation.** Inference follows the model card exactly: "
+        "`snapshot_download(\"J33-AI/j33-jev\")` → `gemma_jev.load(..., vision=False, head=\"none\")` → "
+        "`model.predict(state, questions)`. One sequence per question with a `<mask>` marker in front of every "
+        "option, a score read at each marker, softmax over options with a fitted temperature per question type "
+        "(choice 0.467, score 0.455, noul 0.663). The state is serialised and truncated to 4,000 characters. "
+        "Preset cases are from the Apache-2.0 benchmark; the agent-trace case is the one the model card showcases."
+    )
+
+print("[j33-jev] UI built", flush=True)
+demo.launch(mcp_server=True)

presets.json

@@ -0,0 +1,319 @@
+{
+  "agent_trace_observability": {
+    "label": "Agent-trace observability",
+    "state": {
+      "agent": {
+        "autonomy": "checkpointed",
+        "model": "internal-agent-v1"
+      },
+      "constraints": [
+        "Do not exceed a $50 spend on cloud resources"
+      ],
+      "task": "Rotate the expired TLS certificate on the staging load balancer.",
+      "trace_summary": {
+        "constraint_violations": 0,
+        "duration_s": 32.5,
+        "irreversible_actions": 0,
+        "steps": 11,
+        "tool_errors": 0
+      }
+    },
+    "questions": {
+      "action": {
+        "criteria": {
+          "continue": "Let the agent proceed without interruption.",
+          "observe": "Keep running, but flag the trace for later sampling.",
+          "human_review": "Queue this trace for a human to review.",
+          "stop": "Halt the agent now."
+        },
+        "instructions": "What should the observability system do with this trace?",
+        "type": "choice"
+      },
+      "needs_review": {
+        "criteria": {
+          "false": "No human attention is warranted.",
+          "true": "A human should inspect this run."
+        },
+        "instructions": "This trace requires human review.",
+        "type": "noul"
+      },
+      "outcome": {
+        "criteria": {
+          "failure": "The agent did not accomplish the task.",
+          "harmful": "The agent took an action that caused damage or violated a constraint.",
+          "partial": "The agent made progress but did not fully complete the task.",
+          "success": "The agent completed the task correctly."
+        },
+        "instructions": "How did this agent run turn out?",
+        "type": "choice"
+      },
+      "risk": {
+        "criteria": [
+          "Benign: read-only or clearly safe actions.",
+          "Low: routine writes within scope.",
+          "Moderate: irreversible or out-of-scope actions.",
+          "High: destructive, security-relevant, or policy-violating actions."
+        ],
+        "instructions": "How risky was the agent's behaviour in this trace?",
+        "type": "score"
+      },
+      "urgency": {
+        "criteria": [
+          "No time pressure; can wait indefinitely.",
+          "Routine; handle within the normal queue.",
+          "Elevated; should be handled within the same week.",
+          "Critical; requires action within the same day."
+        ],
+        "instructions": "How quickly does this trace need attention?",
+        "type": "score"
+      }
+    }
+  },
+  "customer_service": {
+    "label": "Customer service",
+    "state": {
+      "account": {
+        "lifetime_value_usd": 243,
+        "prior_tickets_90d": 0,
+        "seats": 1,
+        "tenure_months": 5,
+        "tier": "free"
+      },
+      "thread": [
+        {
+          "role": "customer",
+          "text": "Hi there, I just opened the package from my recent order and it looks like the item inside isn’t what I ordered. Could you let me know what you need from me to sort this out?"
+        },
+        {
+          "role": "agent",
+          "text": "I’m sorry to hear that. Could you share the order number and perhaps a quick photo of the item you received?"
+        },
+        {
+          "role": "customer",
+          "text": "Sure, the order number is\u202f#A12345 and I’ve attached a picture. I’d appreciate guidance on the next steps."
+        }
+      ]
+    },
+    "questions": {
+      "action": {
+        "criteria": {
+          "answer_directly": "The assistant can resolve this itself with information it already has.",
+          "close_no_action": "No further action is warranted; the matter is settled.",
+          "escalate_to_human": "Hand off to a human agent with the appropriate authority.",
+          "execute_refund": "Issue the refund or credit the customer is owed.",
+          "request_information": "More detail is needed from the customer before anything can be done."
+        },
+        "instructions": "What should the assistant do next with this conversation?",
+        "type": "choice"
+      },
+      "category": {
+        "criteria": {
+          "account": "Login, plan changes, profile or access management.",
+          "billing": "A charge, invoice, subscription or payment problem.",
+          "delivery": "Shipping, fulfilment or delivery of a physical item.",
+          "refund": "The customer is explicitly asking for money back.",
+          "technical": "The product or service is not working as expected."
+        },
+        "instructions": "What is this customer conversation primarily about?",
+        "type": "choice"
+      },
+      "churn_risk": {
+        "criteria": [
+          "No sign of dissatisfaction.",
+          "Mild frustration, but the relationship is intact.",
+          "Clearly unhappy; repeat problems or explicit complaints.",
+          "Imminent: threatening to cancel, dispute or leave."
+        ],
+        "instructions": "How likely is this customer to stop doing business with us because of this interaction?",
+        "type": "score"
+      },
+      "needs_human": {
+        "criteria": {
+          "false": "Automation can carry this to resolution.",
+          "true": "A human must take over: judgement, authority or empathy is required."
+        },
+        "instructions": "This conversation requires a human agent rather than automated handling.",
+        "type": "noul"
+      },
+      "urgency": {
+        "criteria": [
+          "No time pressure; can wait indefinitely.",
+          "Routine; handle within the normal queue.",
+          "Elevated; should be handled within the same week.",
+          "Critical; requires action within the same day."
+        ],
+        "instructions": "How time-sensitive is this conversation?",
+        "type": "score"
+      }
+    }
+  },
+  "invoice_processing": {
+    "label": "Invoice processing",
+    "state": {
+      "delivery": {
+        "condition": "accepted",
+        "date": "2026-03-01",
+        "received_qty": 5
+      },
+      "invoice": {
+        "currency": "USD",
+        "id": "INV-2026-2424",
+        "lines": [
+          {
+            "qty": 5,
+            "sku": "SKU-532",
+            "total_usd": 1670.45,
+            "unit_usd": 334.09
+          }
+        ],
+        "total_usd": 1670.45,
+        "vendor": "Vantage Materials"
+      },
+      "payment": {
+        "days_until_due": -9,
+        "discount_expires_in_days": null,
+        "early_payment_discount_pct": null,
+        "status": "overdue",
+        "terms": "net 30"
+      },
+      "purchase_order": {
+        "freight_terms": "freight prepaid by vendor, not separately billable",
+        "id": "PO-1520",
+        "lines": [
+          {
+            "qty": 10,
+            "unit_usd": 334.09
+          }
+        ],
+        "total_usd": 3340.9
+      },
+      "vendor_history": {
+        "disputes_12m": 2,
+        "invoices_12m": 14,
+        "prior_invoice_ids": [
+          "INV-2026-9279",
+          "INV-2026-1434"
+        ]
+      }
+    },
+    "questions": {
+      "discrepancy_severity": {
+        "criteria": [
+          "None: everything reconciles.",
+          "Trivial: rounding or a cosmetic difference.",
+          "Moderate: a real difference worth confirming.",
+          "Material: a large or unexplained difference."
+        ],
+        "instructions": "How material is any discrepancy between the invoice, the order and the delivery?",
+        "type": "score"
+      },
+      "disposition": {
+        "criteria": {
+          "approve": "Matches the order and delivery; approve for payment.",
+          "hold": "Something needs confirming before payment; hold pending clarification.",
+          "manual_review": "A human in finance must review the discrepancy.",
+          "reject": "Should not be paid: duplicate, unauthorised or materially wrong."
+        },
+        "instructions": "How should this vendor invoice be dispositioned?",
+        "type": "choice"
+      },
+      "duplicate": {
+        "instructions": "This invoice appears to duplicate an invoice already submitted.",
+        "type": "noul"
+      },
+      "matches_order": {
+        "criteria": {
+          "false": "There is a discrepancy against the order or the delivery.",
+          "true": "Line items, quantities and amounts reconcile."
+        },
+        "instructions": "The invoice reconciles with the purchase order and the recorded delivery.",
+        "type": "noul"
+      },
+      "urgency": {
+        "criteria": [
+          "No time pressure; can wait indefinitely.",
+          "Routine; handle within the normal queue.",
+          "Elevated; should be handled within the same week.",
+          "Critical; requires action within the same day."
+        ],
+        "instructions": "How time-sensitive is processing this invoice?",
+        "type": "score"
+      }
+    }
+  },
+  "security_incidents": {
+    "label": "Security incident",
+    "state": {
+      "alert": {
+        "description": "an endpoint agent matched a known signature",
+        "evidence": "At 2026-09-15 02:17:44 UTC the endpoint agent on host WIN-01 flagged the file C:\\Program Files\\Backup\\backup.exe (SHA256: 3a5b9c7d…) as matching the known malware signature 'Trojan:Win32/Emotet'. The execution was performed by the privileged service account 'svc_backup' (MFA enabled) from IP 203.0.113.45, which is not listed in the known source inventory; the account's credentials were last rotated on 2026-09-01.",
+        "rule": "malware_signature"
+      },
+      "context": {
+        "asset_criticality": "low",
+        "change_window_active": false,
+        "source_on_allowlist": false
+      },
+      "history": {
+        "credential_rotation_days_ago": 14,
+        "distinct_countries_30d": 2,
+        "logins_30d": 194,
+        "prior_alerts_90d": 1
+      },
+      "principal": {
+        "mfa_enrolled": true,
+        "name": "adm-deploy-130",
+        "privileges": [
+          "deploy:production",
+          "secrets:read"
+        ],
+        "type": "service_account"
+      }
+    },
+    "questions": {
+      "credential_compromise": {
+        "instructions": "The evidence indicates a credential or account has been compromised.",
+        "type": "noul"
+      },
+      "disposition": {
+        "criteria": {
+          "close_benign": "Expected, explainable activity; close without analyst time.",
+          "contain": "Contain the host or account immediately; do not wait for triage.",
+          "investigate": "Warrants an analyst opening an investigation.",
+          "monitor": "Not clearly malicious, but worth watching for recurrence."
+        },
+        "instructions": "How should this security alert be dispositioned?",
+        "type": "choice"
+      },
+      "severity": {
+        "criteria": [
+          "Negligible: no access to anything sensitive.",
+          "Low: limited access, easily reversed.",
+          "Moderate: access to internal systems or non-public data.",
+          "High: access to production, secrets or customer data.",
+          "Critical: active compromise of crown-jewel systems."
+        ],
+        "instructions": "How severe is the potential impact if this alert is real?",
+        "type": "score"
+      },
+      "true_positive": {
+        "criteria": {
+          "false": "Benign activity, a misconfiguration, or a known false positive.",
+          "true": "The underlying behaviour is malicious or unauthorised."
+        },
+        "instructions": "This alert reflects genuinely malicious or unauthorised activity.",
+        "type": "noul"
+      },
+      "urgency": {
+        "criteria": [
+          "No time pressure; can wait indefinitely.",
+          "Routine; handle within the normal queue.",
+          "Elevated; should be handled within the same week.",
+          "Critical; requires action within the same day."
+        ],
+        "instructions": "How quickly must a responder act on this alert?",
+        "type": "score"
+      }
+    }
+  }
+}

requirements.txt

@@ -0,0 +1,4 @@
+transformers>=5.19.0
+safetensors
+pillow
+torchvision