Your harness makes a hundred small judgements a turn. Jev makes them typed.

Your agent proposes a command. The harness pauses, prints the diff, and waits for a keystroke. You hold the key down for an hour and then, at some point, you flip on the mode that stops asking. Something still has to decide which calls are worth interrupting you for, and in every coding harness that ships today, that something is a classifier nobody publishes: a small model, or a big one, asked in prose whether this git push --force is the kind you meant. It is the least glamorous call in the loop and it runs more often than the model that writes the code.

That call is not a conversation. It has no memory, produces no prose, and its entire useful output is a number you compare against a threshold. We have been paying chat prices and chat latency for it because chat was the only interface on offer. Jev is a bet that we no longer have to.

What is Jev? A System One model, not an LLM

TypeSafe AI released Jev on 15 September 2026 and called it a System One model, which they define as a class of models built to make fast, structured decisions that software can use directly. It is not a small LLM. It does not generate text at all. You send it a state and a map of named questions, and it returns a typed answer per question with a probability attached. No strings come back, so there is nothing to parse and no schema to validate. The name comes from Kahneman’s fast, intuitive System 1, and the model itself is named after William Stanley Jevons, which tells you exactly what the company expects to happen to demand when a class of decision gets two orders of magnitude cheaper.

There is one endpoint, POST /v1/systemone, and two official SDKs, Python and JavaScript. Go is not one of them, so the rest of this piece calls the HTTP API directly. That turns out to be a pleasant place to look at the design from, because the thing the API is selling is precisely what Go wants at a boundary: a closed set of possible answers, known before the call.

// Question is one typed judgement about the state.
// Type is "noul", "choice" or "score".
type Question struct {
	Type         string `json:"type"`
	Instructions string `json:"instructions"`
	Criteria     any    `json:"criteria,omitempty"`
}

func Noul(instructions string) Question {
	return Question{Type: "noul", Instructions: instructions}
}

func Choice(instructions string, options map[string]string) Question {
	return Question{Type: "choice", Instructions: instructions, Criteria: options}
}

func Score(instructions string, levels []string) Question {
	return Question{Type: "score", Instructions: instructions, Criteria: levels}
}

Three question types cover the whole surface. A Noul asks a yes/no question and returns noul, the probability that the answer is yes. A Choice picks one option from a set you supply and returns the winner, the full distribution across your options, and a confidence number. A Score rates the state against ordered levels you describe in words and returns a position along them that can land between two levels, plus the distribution and confidence. That is the entire vocabulary.

The client is fifty lines of net/http and the response type is the interesting part, because every field in it is one the model cannot exceed:

type Answer struct {
	Type          string             `json:"type"`
	Noul          float64            `json:"noul,omitzero"`
	Choice        string             `json:"choice,omitempty"`
	Score         float64            `json:"score,omitzero"`
	Legend        map[string]string  `json:"legend,omitempty"`
	Probabilities map[string]float64 `json:"probabilities,omitempty"`
	Confidence    float64            `json:"confidence,omitzero"`
}

func (c *Client) SystemOne(ctx context.Context, state any, qs map[string]Question) (*Response, error) {
	body, err := json.Marshal(request{Model: c.Model, State: state, Questions: qs})
	if err != nil {
		return nil, err
	}
	req, err := http.NewRequestWithContext(ctx, http.MethodPost,
		"https://api.typesafe.ai/v1/systemone", bytes.NewReader(body))
	if err != nil {
		return nil, err
	}
	req.Header.Set("Authorization", "Bearer "+c.Key)
	req.Header.Set("Content-Type", "application/json")

	res, err := c.HTTP.Do(req)
	if err != nil {
		return nil, err
	}
	defer res.Body.Close()
	if res.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("systemone: %s", res.Status)
	}
	out := new(Response)
	return out, json.NewDecoder(res.Body).Decode(out)
}

Notice what is missing. There is no retry for a malformed JSON block, no regex over a fenced code fence, no “the model said billing. with a trailing period” branch. The answer arrives inside the option set you defined or the request fails. TypeSafe makes a strong version of this claim and invites you to falsify it with a single counter-example: schema matching is guaranteed, so the type-error rate is zero by construction rather than by measurement.

Jev primitives: questions are nearly free, round trips are not

Here is the part that actually reorganises code. Every question in a request sees the same state, is evaluated in parallel, and is independent of the others. Adding a question barely moves the response time and costs only the tokens of that question’s text. The state is ingested once for all of them.

So you stop asking one thing at a time. TypeSafe calls the resulting pattern speculative fan-out: put every question the decision tree might need into one request, including the ones that only matter on a branch you may not take, and let code throw away the answers it did not need. A triage that would have been a classification call followed by a severity call followed by a refund check is one round trip, and the branch you skip cost you the tokens of its instructions.

The budgets and prices that bound this are published: 64k tokens for the whole request, state plus every question combined, and 32k for the state plus the single longest question. Input is priced at $0.042 per million tokens, which is $42 per billion, and output tokens are free because there are none. Rate limits sit at 250,000 tokens per second and 1,200 requests per minute, with a warning on the docs page that they move without notice while the GPU deals land. A Choice supports up to 255 options.

In Go, fan-out is a map literal, which is the point:

res, err := c.SystemOne(ctx,
	map[string]any{"tool": call.Name, "arguments": call.Args, "agent_plan": plan},
	map[string]Question{
		"destructive": Noul("`arguments` deletes, overwrites or force-pushes something the user did not ask to lose"),
		"secrets":     Noul("`arguments` reads or transmits credentials, tokens or private keys"),
		"off_plan":    Noul("The call does something `agent_plan` does not call for"),
		"blast": Score("How much state this call can destroy if it is wrong", []string{
			"one file in the working tree",
			"the repository",
			"something outside the machine",
		}),
	})

Four judgements, one round trip, and the policy that combines them lives in Go where you can read it in a code review:

a := res.Answers
switch {
case a["destructive"].Noul > 0.5, a["secrets"].Noul > 0.5:
	return false, nil
case a["blast"].Score > 1.5 && a["off_plan"].Noul > 0.3:
	return false, nil
}
return true, nil

Those thresholds are the part you own. When the policy changes, you change a float in a file that has tests, not a paragraph in a prompt that does not.

Jev confidence is the shape of the distribution

Every Choice and Score answer carries probabilities, the full distribution across your options or levels, and confidence, a single number from 0 to 1 that collapses the shape of that distribution so you can threshold on it directly. A peaked distribution means the model has a clear read. A flat one means none of your options is winning, which can mean the state is ambiguous, or that your options do not carve the space properly. Noul answers carry no separate confidence, because the probability already is the answer.

Calibration is the claim underneath all of this: across many predictions, outcomes assigned 0.8 should happen about 80% of the time. TypeSafe is careful in the docs that this describes groups of predictions and guarantees nothing about any single answer, which is the correct caveat and also the one that makes the property useful. A number you can threshold is worth more than a number that is merely usually right.

The architectural move is to treat confidence as a second axis, independent of the answer. The answer says what; confidence says whether you are allowed to act on it unattended. The threshold is not one number for the whole system either. It scales with what the action costs when it is wrong, which in a coding harness means reading a file and rewriting git history sit at opposite ends.

tier := res.Answers["tier"]
switch {
case tier.Confidence < 0.5:
	return "powerful", nil // genuinely unsure: do not economise
case tier.Choice == "fast":
	return "fast", nil
default:
	return "powerful", nil
}

That is model routing, and it is the first place most harnesses will put this. LangChain shipped the integration two days after launch: langchain-typesafe exposes Jev as TypeSafeClassifier, plus two experimental middlewares, ModelRouterMiddleware for picking a model per run and AutoModeMiddleware for checking tool calls before they execute. Their framing of the second one is the honest one. The dangerous-action classifier has existed in Claude Code, Codex and Cursor for a while; what changed is that it is now something you can buy a version of and put in front of your own agent.

Where Jev falls down: the jagged edges

TypeSafe publishes a page of failure modes for jev-1.13 and it is the most useful page in the docs. Jev reads questions literally, answering the words you wrote rather than the intent behind them. It does not count reliably, and the error grows with the size of the thing being counted. It reads dates as text rather than ordered quantities, so comparisons and windows are unreliable and belong in code after a Choice extracts the parts. Accuracy falls as the state fills with material the question does not need, which is the same context rot you already fight in a long agent run. And structural invariants you would assume hold do not. In one of their worked examples the same judgement scores 0.22 as a Noul and 0.01 as the yes option of a Choice; in another, a question and its negation sum to 1.19.

One of those edges deserves a louder mention than the docs give it, because of where people will deploy this first.

The flagship harness use case is a guardrail, and a guardrail’s input is by definition the part of the system an attacker controls. A cheap, fast, calibrated classifier in front of bash is a real improvement over no classifier. It is not a boundary, and a tool call whose arguments include a paragraph explaining why this particular rm -rf is routine is exactly the input the vendor is telling you it has not hardened against yet. Treat it the way you treat every other probabilistic check in the loop: a prior that adjusts a risk score, not the thing standing between an agent and your credentials. The deterministic checks still have to run, and they should run before you wake the expensive part.

Is Jev really 200x faster? The receipts, read closely

TypeSafe opened their announcement with “extraordinary claims require extraordinary evidence” and then published a nuance box under each claim, which is more than most launches do. Read the boxes.

The headline numbers, 193.6x faster and 444.6x cheaper, come from workflow evals the company built. They say so. They also say the reference answers are the average of GPT-6 Astra and Fable 5.1, which biases the comparison toward OpenAI and Anthropic, and that the workflows were authored by their own model capabilities team, so bias could exist. Most importantly, the LLM baselines run through what they call their System One LLM wrapper, which constrains a chat model to emit structured decisions with probabilities, and which they note is slower and more expensive than asking for a decision without them. That is the most accurate way to get calibrated decisions out of an LLM. It is also not what your harness does today, so the ratio you should expect is not the ratio on the homepage.

The benchmark abstention is deliberate and they argue for it: put no weight on public benchmarks, build your own evals, disclose the nuance. I have some sympathy for that position, and it happens to be very convenient. The part I would want before putting this on a destructive path is the calibration evidence, because calibration is the entire product. A reliability diagram and an expected calibration error on a held-out workload is a cheap thing to publish for a company whose training objective is named after it.

So build the eval yourself. It is genuinely easier here than for a chat model: the output is a number, the ground truth is a label you already have in your logs, and a few thousand historical tool calls with their eventual outcomes is a calibration curve in an afternoon. The model class that asks you to trust its probabilities is also the model class where checking that trust is a for loop.

Where Jev lands in an agent harness

Look at your agent loop and count the decisions that produce no text. Which model takes this turn. Is this retrieved chunk actually relevant to the question. Has the agent called the same tool three times with the same arguments because it is stuck rather than because it is iterating. Does this citation support the sentence attached to it. Is this diff touching a path the plan never mentioned. Every one of those is a Noul or a Choice wearing a chat interface, and every one of them is currently either a second LLM call you are paying for or a heuristic you wrote because the LLM call was too slow to run on every turn.

That is the real pitch, and it is narrower and more interesting than “200x faster”. The harness is where an agent’s behaviour actually lives, and the harness is made of small judgements that were never conversations. Giving them a type, a probability, and a price that lets you run them on every turn is a change in what you can afford to check.

The smart if-statement finally has a signature. What it returns is still a probability, and what you do with it is still your code’s problem.

Jev FAQ

What is Jev?

Jev is TypeSafe AI’s first System One model, released on 15 September 2026. It does not generate text. You send it a state and a map of named typed questions, and it returns one typed answer per question with a calibrated probability attached, every question evaluated in parallel.

Is Jev an LLM?

No. TypeSafe describes it as a new model class with a parallel sampler rather than autoregressive decoding, trained with reinforcement learning for calibrated decisions (RLCD) instead of RLHF or RLVR. It understands natural language input but cannot produce free-form text, code or explanations.

What are Noul, Choice and Score?

The three question types. A Noul is a yes/no question that returns the probability the answer is yes. A Choice picks one option from a set you define and returns the pick, a probability per option, and a confidence. A Score rates the state against ordered levels you describe and returns a continuous position along them.

How much does Jev cost?

Input tokens are priced at $0.042 per million, which is $42 per billion, and output tokens are free because the model emits no tokens. Published rate limits are 250,000 tokens per second and 1,200 requests per minute, and the docs warn those limits move without notice.

What is Jev’s context limit?

64k tokens for the whole request, covering the state plus every question combined, and 32k for the state plus the single longest question. A Choice supports up to 255 options. Accuracy falls as the state fills with material the question does not need, so filter before you send.

Is Jev really 200x faster than an LLM?

The headline 193.6x faster and 444.6x cheaper figures come from workflow evals TypeSafe built and graded in-house against the average of GPT-6 Astra and Fable 5.1. The LLM baselines run through a wrapper that forces structured decisions with probabilities, which TypeSafe says is slower and more expensive than an unconstrained call. Published end-to-end latency is 70ms to 500ms.

Can Jev be used as a prompt-injection guardrail?

Only as one signal among several. TypeSafe’s own jaggedness page states that Jev does not treat state as hostile by default, and that injected instructions or misleading framing can move an answer. Use it as a prior that adjusts a risk score, not as the boundary between an agent and your credentials.

Is there a Go SDK for Jev?

Not officially. TypeSafe ships Python and JavaScript clients and documents the HTTP API for every other language. In Go, a typed client over POST /v1/systemone is about fifty lines of net/http plus a struct per answer type.