# The Agent Stack Is Growing a Reflex Layer

**Jev, Laya and a new class of decision models. The future agent may not have one brain — and the biggest one should be called only when the smaller ones cannot decide.**

Checked: 21 September 2026 · auxfirst
Canonical: https://auxfirst.com/news/system-one-models-jev.html

> **The short answer**
>
> Jev is a model that returns a typed decision with a probability instead of a sentence. That is a small interface change with a large architectural consequence: it separates *deciding* from *generating*, and it makes the bounded decisions an agent takes constantly cheap enough to stop routing through a frontier model. The headline multiples — 193.6× faster, 444.6× cheaper — come from one vendor workflow, and the one independent test published so far puts a 149M open model on a laptop CPU within 0.6 percentage points of Jev’s accuracy. The category is real. The numbers are young. And a probability is still not a permission.

For the last few years the default architecture for AI software has been strangely simple. Something happens, send it to an LLM. Classify an email? LLM. Choose which tool to call? LLM. Score a lead, decide whether a ticket is urgent, check whether an action needs approval, work out which agent should receive a task? LLM, LLM, LLM, LLM.

It works. We have effectively hired a very capable reasoning engine to make thousands of tiny decisions. But it may not be the architecture we keep, because a new class of models is appearing around a different premise: **not every decision requires generation.** Sometimes software does not need an answer written in English. It needs a decision.

## 01 · The missing layer between code and the LLM

Traditional software is good at deterministic decisions: `if amount > 10,000 then require approval`. Large language models are good at ambiguous ones: *does this customer sound like they are about to churn?* The problem is the space between.

A large share of agentic work consists of decisions that are too fuzzy for an `if` statement, too repetitive to justify a frontier model, bounded to a known set of outcomes, and needed constantly during execution. Which department should receive this request — billing, technical, sales, security? How urgent is this incident — low, medium, high, critical? Is this action risky enough to require human review?

Today we mostly solve these by prompting a model, generating tokens, asking for JSON, parsing the JSON, validating the schema, and retrying when something unexpected comes back — all to make a decision that could have been three probabilities. That is the gap a new category of **decision models** is aimed at.

## 02 · What Jev actually is

On 15 September 2026 TypeSafe AI released **Jev** and called it the first *System One Model*: in the company’s words, “a new class of frontier models built to make fast, structured decisions that software can use directly”. [1] The name is doing marketing work — System One is a vendor’s coinage for an emerging category, not an established model class — but the interface underneath it is the part worth reading.

*Figure 1 · The interface change.* An LLM call for a bounded decision runs five stages — prompt, model, tokens, a sentence with the answer in it, then parse, validate and retry. A decision call runs three — state plus typed questions, the model, a typed value with a probability. The two stages that disappear are the ones carrying most of the failure handling.

You send program state and a set of typed questions. You get back a typed value per question with a probability attached. The model is not composing an explanation token by token, and it cannot: Jev does not generate text at all. [1][4] Its three question types are the whole surface area. [5]

**The three question types**

- `noul` — the probability that a yes/no condition holds.
- `choice` — one option from a declared set, returned with the full distribution.
- `score` — a probability-weighted position on an ordered scale.


Everything else follows from that. Here is the published specification, as stated by TypeSafe and by the first independent write-up to actually use it.

| Field | What is published | Source |
|---|---|---|
| What it is | “A new class of frontier models built to make fast, structured decisions that software can use directly” | [1] |
| Input | Unstructured or structured program state, plus a set of typed questions | [1, 5] |
| Question types | `noul` (probability of a yes/no condition), `choice` (one option from a declared set, with the full distribution), `score` (a position on an ordered scale, probability-weighted) | [5] |
| Output | A typed value per question with a calibrated probability — no prose, no JSON to parse | [1, 5] |
| Training | “Reinforcement Learning for Calibrated Decisions” (RLCD) rather than optimization for human preference | [1] |
| Latency | 70–500 ms end to end, vendor-measured; “most calls complete in about 100 milliseconds” | [1, 5] |
| Price | $0.042 per million input tokens; output tokens free | [1, 3] |
| Hard limits | No image input; a maximum of 255 options per choice; it cannot generate text at all | [1] |
| Availability | Early access from 15 September 2026. No paper, no open weights and no published training data are mentioned on the launch post or the homepage | [1, 3] |

> **What “0% type errors” does and does not mean**
>
> It means the answer is always a member of the type you declared — one of your four departments, a number in your range, a probability. It is a property of constrained decoding, and it is genuinely useful: the parse step, the schema validation and the retry loop disappear from your code.
>
> It does not mean the answer is right. A model can be perfectly type-safe and confidently route the wrong ticket to the wrong team all day. **Type safety removes a class of engineering failure, not a class of judgment failure.**

That distinction matters more than any multiple in the launch post, because it is the one that changes what you have to build. An LLM call that returns JSON needs defensive code around it. A decision model does not — which means the interesting risk moves from *will this parse* to *is this calibrated*, and calibration is much harder to notice when it fails.

## 03 · Which numbers survive a second look

The figures circulating this week are real, published and mostly the vendor’s own. That is not an accusation — a launch post is supposed to make a case. It does mean the numbers need sorting by who measured them and against what, before any of them reach an architecture decision.

| Claim | Whose number | What it actually measures | Standing |
|---|---|---|---|
| 193.6× faster, 444.6× cheaper | TypeSafe, reported by Copes[5] | One workflow — the research-paper example. Copes calls it “the high end of real-world results”. | Vendor, single case |
| Up to 200× faster, 400× cheaper | TypeSafe, quoted by LangChain[4] | Classification tasks only. LangChain restates the vendor figure rather than reproducing it. | Vendor, restated |
| 70–500 ms against 3–329 s | TypeSafe[1] | Vendor timing of its own workflow examples against frontier LLMs. Network conditions are not stated. | Vendor |
| $0.042 / MTok in, output free | TypeSafe[1][3] | A published list price, checkable by anyone. This is the one headline number that is not an estimate. | Published price |
| 0% type errors | TypeSafe[1] | The output is always a member of the declared type. It says nothing about whether the answer is right. | True, widely misread |
| Accuracy in the vendor evals | TypeSafe[2] | Reference labels are “an average of the responses of GPT-6 Astra and Claude Fable 5.1” at high thinking settings — agreement with two frontier models, not ground truth. | Measures agreement |
| 79.3% vs 78.7% macro accuracy | Independent benchmark[6] | 10,000 decisions across SST-2, AG News, Emotion and BANKING77, CPU-only. A 149M open cross-encoder lands 0.6 pp behind Jev. Single run, single seed, ±2 pp on subsamples. | Independent, one run |
| 381 ms observed latency | Independent benchmark[6] | “Almost entirely network” in that setup, so it measures the round trip rather than the model. | Independent |

> **The measurement detail worth knowing**
>
> In TypeSafe’s own workflow evals, the reference labels are “an average of the responses of GPT-6 Astra and Claude Fable 5.1” at high thinking settings. [2] Read that twice. Accuracy on that page is **agreement with a frontier-model consensus**, not agreement with a human-labeled ground truth. Where the two frontier models are jointly wrong — which is exactly where the hard cases live — a system that matches them scores full marks.
>
> The same page carries a finding that got almost no attention and deserves more: *“Averaged across the four example tasks, every model is more accurate, cheaper and faster in the workflow than it is with the same policy as a prompt.”* [2] A large part of the gain on display belongs to structuring the decision, not to the model making it. That is a free lesson for anyone not buying anything: write the policy as an explicit set of questions and your current model gets better too.

### The one independent test so far

A reproducible benchmark published on GitHub ran **10,000 decisions** across four public datasets — SST-2, AG News, Emotion and BANKING77, the last of which routes among 77 confusable intents — on a single machine, CPU only, batch size one. [6] It compares Jev against a 149M ModernBERT cross-encoder, a bi-encoder with a small learned decision head, and a generative baseline.

Jev takes the top score at **79.3% macro accuracy** with enriched option descriptions. The 149M open cross-encoder lands at **78.7%** — 0.6 percentage points behind, on a laptop, with no network. The bi-encoder with an eight-float head reaches 69.9% at 15.7 ms per decision.

Three caveats from the author, all of which cut in different directions, and all of which are the reason this benchmark is worth more than the marketing: the 381 ms Jev latency observed there is “almost entirely network” rather than compute; the open models had their temperature fitted on 1,000 labeled examples while Jev received no such tuning, which favors the open side on calibration; and a single run with one seed moved ±2 percentage points on subsamples, so the 0.6 pp gap is inside the noise. [6]

**The practical reading**

On a bounded classification task, the interface is the innovation. The weights are catching up in public, fast.

There is a fourth finding in that benchmark which is really a warning about all of them: **there is no neutral set of option descriptions.** Enriching the labels with one-sentence descriptions improved bi-encoders by 6.3 points on average and *hurt* cross-encoders by 4.3. [6] How you word the options is part of the system, not part of the prompt. If you benchmark two decision models with one wording, you have measured the wording as much as the models.

## 04 · Thirty reproductions in a week

The more interesting signal is not Jev’s numbers. It is how fast the idea was reproduced. Within days of the launch a community index was tracking more than thirty open implementations and adjacent projects — encoders, logit readers, models trained from scratch, and one iPhone app. [7] Neither the launch post nor the TypeSafe homepage mentions a paper, open weights or published training data, [1][3] and the reproductions are what happens when an interface is published without them.

| Project | Built on | Weights | What it reports | Measured by |
|---|---|---|---|---|
| Laya | ModernBERT-large encoder | Apache-2.0, open weights | Expected calibration error 0.081 after temperature fitting | Project |
| Verdict | 151M non-autoregressive, ModernBERT | Open | Expected calibration error 0.0144 | Project author |
| NanoJev | 0.6B trained from scratch | MIT, weights and dataset | A training pipeline, not only a model | Project |
| SemIf (formerly openjev) | Frozen Qwen3.5-4B, read from logits | MIT code | No calibration claimed — stated openly | Project |
| kev | Qwen3.5 family, 0.8B / 4B / 9B | Open weights | Implements TypeSafe’s API shape | Project |
| Decider | Fine-tuned Qwen3.5-2B | Apache-2.0 | Serves TypeSafe’s wire format | Project |
| open-alternative-jev | Any open-weights model, one pass | Open | 92.9% accuracy with Qwen3.6-27B | Project |
| PocketJev | Vision-language logits on iPhone | Open | Explicitly not calibrated | Project |

> **How to read those calibration figures**
>
> Expected calibration error is the right metric to care about here — it asks whether a stated 0.8 is right about 80% of the time — but the numbers above are self-reported, measured on different sets, and in at least one case reported after temperature fitting. They are not comparable with each other, and none of them is a measurement of your domain. **Calibration does not travel.** A model calibrated on public sentiment data tells you nothing about how it will behave on your refund policy.

Older technology belongs in the same conversation. Encoder models like GLiNER handle schema-conditioned extraction and classification locally, on a CPU, with confidence scores and labels supplied at runtime [8] — not a Jev clone, but the same architectural idea: **specialized models doing bounded cognitive work without invoking a general-purpose model for everything.** Libraries that constrain decoding, like Outlines and Instructor, get you part of the way from the other direction, by forcing an existing model’s output into a declared shape. [7]

The names will change. Some of these projects will be gone by Christmas. The architectural idea is worth separating from any individual vendor, and that is the part of this story that will still be true next year.

## 05 · Small brain is not small LLM

Imagine an inbound support agent receiving: *our production database has been unreachable for twenty minutes and none of our customers can log in.* A language model would write you a paragraph and a JSON object with an explanation field. The system does not need the explanation yet. It needs three answers and their confidence.

*Figure 2 · What the system needs before it needs a paragraph (illustrative values for one inbound ticket).*

| Question | Answer | Probability |
|---|---|---|
| department (choice) | technical | 0.96 |
| priority (choice) | critical | 0.91 |
| incident (noul) | yes | 0.98 |

Control flow: above 0.90 continue automatically and log it; 0.60–0.90 continue and flag for sampled review; below 0.60 escalate to a reasoning model, then to a person.

Now the probability is not metadata printed next to the answer. It is part of the control flow: above a threshold the agent continues, in the middle it continues and flags, below it escalates. Which is where the terminology usually goes wrong, because we think about AI architecture in terms of model size — small, medium, large — when the useful distinction is what a component is *for*.

A small brain is not a smaller GPT. It is a machine dedicated to one kind of cognition: a lead-fit brain, an intent brain, a routing brain. None of them writes an essay. Each makes one class of decision repeatedly, which is exactly the shape of the work an agent does between the moments that look impressive in a demo: which context to load, which tool to use, whether to ask, whether the result is suspicious, whether this needs approval, which specialist should handle it, whether the task is complete.

*Figure 3 · The reflex layer.* An event meets deterministic code, then a reflex layer answering routing, classification, risk and policy matching, relevance and confidence in milliseconds. Confident enough, the agent acts. Otherwise the decision escalates to a small reasoning model, then a frontier model, then a human with the evidence attached — each step an order of magnitude more expensive than the one above it.

We send all of those questions back through the same general reasoning engine today. There is no reason that has to stay true — and once it stops being true, the agent stops looking like one intelligent model connected to tools and starts looking like an engineered system with parts.

### What this does to a Process Brain

At auxfirst we use [Process Brains](https://auxfirst.com/process-brains.html) for governed machines built around one repeatable job. The load-bearing word has always been *process*, not *brain*: what the work is, which context matters, which decisions exist, where autonomy is permitted, how outputs are validated, where a human stays involved. Decision models make the inside of that machine more specialized — a context router, an intent classifier, a risk read, a priority read, a main reasoner, a validator, a policy gate, an escalation path — and the question stops being which model we use and becomes **which component owns which decision**. That is the question [agent-first architecture](https://auxfirst.com/agent-first-architecture.html) is written to answer, and it is software architecture rather than prompt engineering.

## 06 · Cognitive routing

For years, optimization around LLM applications meant prompts: better instructions, better context, better examples. Agentic systems add a different optimization problem — **which cognitive work should reach the large model at all?**

Suppose an agent makes a thousand decisions while completing a workflow. The shape of that distribution, not the quality of any single prompt, is what determines the cost and the latency of the whole thing.

*Figure 4 · Where a thousand decisions could go (illustrative distribution, not a measurement).*

| Mechanism | Decisions |
|---|---|
| Deterministic rules | 700 |
| Bounded, fuzzy — a decision model | 220 |
| Small-model reasoning | 70 |
| Frontier reasoning | 9 |
| Human judgment | 1 |

If all thousand go to the largest model, the problem is not that your prompt is inefficient. The architecture is. The goal is to route each unit of cognition to the cheapest mechanism that can decide it safely — sometimes code, sometimes retrieval, sometimes a classifier, sometimes a decision model, sometimes a small model, sometimes a frontier model, sometimes another person.

Cognitive routing has a second-order effect that the cost table does not show. Cheap decisions multiply actions, and actions have to be checked by somebody. We named that constraint *verification throughput* in [the Publisher Agent Map](https://auxfirst.com/ad-industry/publisher-agent-map.html): the number of agent outputs a qualified person can genuinely check in a day. Routing a decision to a model that costs a thousandth as much does not make the review cheaper. **Speed moves the bottleneck; it does not remove it.**

## 07 · A probability is not a permission

This is where decision models meet the part of the work we actually do. Agentic experience design is about delegation: when should an agent act, when should it ask, when should it explain, when should it stop, when should it bring in a human. Those look like interaction questions. Underneath, many of them are decision functions — and now they are cheap.

Consider an outbound agent about to send an email. It could evaluate five bounded questions before acting: is this reversible, does it reach an external party, is sensitive data present, does policy require approval, is model confidence sufficient. Each is a `noul` question. Each returns a number. Feeding those numbers into a gate is an obvious move, and it is where the obvious move goes wrong.

> **The failure mode to design out first**
>
> A confidence score is the model’s estimate of whether *it* is right. Consequence is a property of the *action*, and it does not change when the model feels sure. Letting a high probability unlock an irreversible external action is not a modeling decision that went wrong; it is a governance decision nobody made.

The version that holds is two dials with two owners. Consequence sets the band, in advance, by design — that is [the Action Heat Ladder](https://auxfirst.com/action-heat-ladder.html), where the hottest dimension of an action decides who pulls the trigger. Confidence then moves behavior *inside* that band: how loudly the agent works, how much evidence it shows, whether it proposes rather than acts. Confidence never promotes an action to a hotter band, and a model is never allowed to grade its own consequence.

*Figure 5 · Confidence moves along a row. It never moves a row.* Rows are consequence, set in advance by design; columns are the model's runtime estimate.

| Consequence | Confidence ≥ 0.90 | 0.60–0.90 | Below 0.60 |
|---|---|---|---|
| Low — internal, reversible in minutes | Act, log it | Act, log it, sample the reviews | Ask the next layer |
| Medium — touches a client record or shared system | Act and disclose | Propose; a named human approves | Stop, escalate with the evidence |
| High — leaves the building, binds money or policy | Draft only; a named approver sends | Draft, flagged as uncertain | Do not produce an action at all |

Read that grid as a policy rather than a suggestion. Low-consequence work runs quietly and the log is the control. Medium-consequence work runs with disclosure, and a wobble in confidence turns it into a proposal. High-consequence work is drafted, never sent, whatever the number says. The model estimates. **The system governs.**

Two consequences for anyone building this. First, the gate belongs in the mandate, not in the prompt: who may approve what, in writing, per action, is the [AI agent operating model](https://auxfirst.com/agent-owners-manual.html), and a probability threshold is a parameter of that document rather than a replacement for it. Second, the thresholds need evidence. When we scored twelve enterprise platforms in [the Agent Supervision Register](https://auxfirst.com/news/agent-supervision-register.html), median capability came out at 11 of 12 and median supervision at 6, and not one documented a way to reverse work an agent had performed. A confidence number in a product that cannot undo anything is decoration.

Used properly, though, confidence becomes what [Confidence Cues](https://auxfirst.com/index.html#patterns) always wanted it to be: not a percentage printed next to an answer, but a reason the system behaves differently. An agent that does not merely *have* confidence but *acts* differently because of it is a much better design primitive than a badge saying 87%.

## 08 · Where not to put one

Every new category arrives with a hammer problem. Decision models are useful precisely because their domain is bounded, which means the damage from over-applying them is predictable.

They fit when the possible answers can be written down in advance. They do not fit exploration, novel planning, synthesis across unfamiliar evidence, open-ended explanation, creative generation, or any task where the answer space cannot be specified. You would not ask a `choice` model to develop a market-entry strategy. You might use one twenty times inside the agent executing that strategy.

Beyond the category question there are concrete failure modes, documented by the first writer to put Jev through real work: it breaks on literal reading that requires an explicit condition, it cannot reliably do arithmetic or counting, and it struggles with dates and with indirection. [5] His practical rule is the most useful sentence written about this model class so far — when your instinct says *extract X*, rephrase it as *here are the candidates for X, which one is it?* [5] A decision model is a chooser, not an extractor.

And the hard limits are hard: no images, a ceiling of 255 options per choice, and no text output of any kind. [1] A routing problem with a thousand destinations is not a `choice` question; it is a retrieval problem with a `choice` question at the end of it.

> **Reasoning models handle the open world**
>
> Decision models handle bounded uncertainty inside it. Code handles certainty. People handle consequence. The architecture is the assignment, and the assignment is the work.

## 09 · What to watch

Jev is days old and most of its alternatives are younger. This is not a settled category, and the honest list of open questions is short and specific.

- **Calibration in your domain.** Published expected calibration error is a claim about somebody else’s test set. Two hundred labeled examples from your own traffic will tell you more than every benchmark in this article.

- **Independent evaluation with human labels.** The vendor evals score agreement with two frontier models. Until something scores these systems against human judgment on domain data, “accuracy” is a comparison, not a measurement.

- **Failure modes in production**, which will matter more than demo latency — particularly the quiet ones, where a bounded output space makes a wrong answer look exactly like a right one.

- **Dependency shape.** A hosted decision model with no paper, no weights and no exported evaluation is a dependency in the control flow of your agent. That is a different risk class from a dependency in its prose.

- **Whether your platform can host any of this.** A decision layer needs somewhere to run, permissions it cannot exceed and evidence of what it decided — which is the test in [agent-first platform](https://auxfirst.com/agent-first-platform.html), and it is not passed by an API alone.

The bigger question is already independent of which vendor wins: **how much of an agent’s cognition actually requires a general-purpose model?** My guess is much less than today’s architectures imply. We began the LLM era by discovering that one sufficiently capable model could do almost everything. The next stage may be discovering that it should not.

## The AUX takeaway

The architecture of a trustworthy agent should not begin with *which model are we using*. It should begin with *what decisions does this system make* — then: which are deterministic, which carry bounded uncertainty, which need genuine reasoning, and which carry enough consequence that a person must stay in the loop. Running that inventory before choosing a model is most of what [AI agent development lifecycle](https://auxfirst.com/agent-development-lifecycle.html) work consists of, and it survives every change of vendor underneath it.

> *Code where certainty exists. Small brains where the answer space is bounded. Big brains where reasoning is necessary. Humans where consequence demands judgment.*

The future agent may not have one brain. It may have an entire nervous system — and the useful skill will be deciding which reflex belongs where.

## Terms used here

**System One model** — A model class that takes program state plus typed questions and returns a typed value with a probability, instead of generating text. Named by TypeSafe at Jev's launch on 15 September 2026; it is a vendor's term for an emerging category, not an established one.

**Decision model** — The neutral name for the same idea: a model whose output space is declared in advance, so the answer is a member of a known set rather than a sentence that has to be parsed.

**Reflex layer** — auxfirst's name for the tier of an agent that answers bounded, high-frequency questions — routing, classification, risk, relevance, policy matching — without invoking a general-purpose model.

**Calibration** — Whether a stated probability matches observed frequency: of the decisions a model calls 0.8, about 80% should be right. Usually reported as expected calibration error (ECE), where lower is better. Calibration is domain-specific, so a published figure is a hypothesis about your data, not a measurement of it.

**Cognitive routing** — Sending each unit of cognition to the cheapest mechanism that can decide it safely — code, retrieval, a classifier, a decision model, a small model, a frontier model, or a person.

**Constrained decoding** — Restricting a model's output to a declared type or grammar. It guarantees the shape of the answer, never its correctness — which is what a claim of zero type errors means.

## Questions people are asking this week

### What is Jev?

Jev is a model released by TypeSafe AI on 15 September 2026 that takes program state plus typed questions and returns typed decisions with calibrated probabilities instead of text. It answers three kinds of question — a yes/no probability, a choice from a declared set of options, and a score on an ordered scale — and it cannot generate prose at all.

### What is a System One model?

System One model is TypeSafe's name for a model class optimized for fast bounded decisions rather than for generating language, by analogy with fast intuitive thinking. It is a vendor term for an emerging category rather than an established one, and the neutral description is a decision model: the set of possible answers is declared in advance, so the output is a member of that set with a probability attached.

### What are noul, choice and score?

They are Jev's three question types. A noul question returns a single probability between 0 and 1 for a yes/no condition. A choice question picks one option from a declared list and returns the option, the full distribution and a confidence. A score question returns a probability-weighted position on an ordered scale.

### Is Jev really 193 times faster and 444 times cheaper?

Those are the vendor's figures for one workflow, described by an independent writer who tested it as the high end of real-world results. TypeSafe's broader claim is up to 200 times faster and 400 times lower cost on classification tasks. The price, $0.042 per million input tokens with free output, is published and checkable; the speed and cost multiples depend entirely on which baseline and which workflow you compare against.

### Are there open alternatives to Jev?

Within a week of the launch, a community index listed more than thirty open reproductions and adjacent projects, including Laya on a ModernBERT-large encoder with Apache-2.0 weights, a 151M non-autoregressive model called Verdict, NanoJev trained from scratch with its dataset published, and several logit readers on Qwen checkpoints. An independent benchmark over 10,000 decisions found a 149M open cross-encoder on a CPU landing 0.6 percentage points behind Jev on accuracy.

### Where should a decision model not be used?

Anywhere the answer space cannot be written down in advance: exploration, planning, synthesis across unfamiliar evidence, open-ended explanation and creative work. Flavio Copes also documents concrete failure modes — literal reading that requires an explicit condition, arithmetic and counting, dates, and indirection — and the practical fix, which is to rephrase an extraction as a choice between candidates.

### Does a confidence score mean an agent can act on its own?

No. Confidence is the model's own estimate of whether it is right; consequence is a property of the action and is decided in advance. A calibrated probability can move an action inside its band — silent execution, execution with disclosure, a proposal — but only design should move the band itself. Sending an irreversible external action because the score read 0.97 is a governance failure, not a modeling one.

Method · Every source was fetched and read on 21 September 2026, and quotations are marked. Vendor figures are labeled as vendor figures wherever they appear; the only numbers in this article that are not somebody’s published claim are the ones in Figure 4, which is an illustration of a distribution rather than a measurement of one. The confidence and consequence grid in Figure 5 is auxfirst’s reading, built on the Action Heat Ladder, not an industry standard. Where a repository could not be fetched on the day of writing, its claims were left out rather than repeated second hand.

## Sources

1. [Introducing System One Models & Jev](https://typesafe.ai/blog/introducing-system-one-models-and-jev) — TypeSafe AI, 15 September 2026.
2. [Workflow evals](https://evals.typesafe.ai) — TypeSafe AI, read 21 September 2026.
3. [TypeSafe AI — homepage and pricing](https://typesafe.ai) — TypeSafe AI, read 21 September 2026.
4. [Building a harness with Jev](https://www.langchain.com/blog/building-a-harness-with-jev) — LangChain, 17 September 2026.
5. [Jev](https://flaviocopes.com/jev/) — Flavio Copes, September 2026.
6. [open-system-one — an independent, reproducible benchmark of Jev against open, CPU-only alternatives](https://github.com/zhlei07/open-system-one) — zhlei07, read 21 September 2026.
7. [Jev alternatives: open-source reproductions, local models and classifiers](https://systemonemodels.org/examples/alternatives/) — systemonemodels.org, read 21 September 2026.
8. [GLiNER2: An Efficient Multi-Task Information Extraction System with Schema-Driven Interface](https://arxiv.org/abs/2507.18546) — arXiv:2507.18546, 24 July 2025.

Related on auxfirst: [The Action Heat Ladder](https://auxfirst.com/action-heat-ladder.html) · [Agent-first architecture](https://auxfirst.com/agent-first-architecture.html) · [Agent-first platform](https://auxfirst.com/agent-first-platform.html) · [The Agent Owner's Manual](https://auxfirst.com/agent-owners-manual.html) · [The Agent Supervision Register](https://auxfirst.com/news/agent-supervision-register.html) · [The Publisher Agent Map](https://auxfirst.com/ad-industry/publisher-agent-map.html) · [Process Brains](https://auxfirst.com/process-brains.html) · [The Agent Development Lifecycle](https://auxfirst.com/agent-development-lifecycle.html)

Written by Emil Krzemiński, founder of auxfirst, the agentic experience design agency.

Cite: Krzemiński, E. (2026). *The Agent Stack Is Growing a Reflex Layer.* auxfirst. https://auxfirst.com/news/system-one-models-jev.html

*Emil Krzemiński is the founder of [auxfirst](https://auxfirst.com/index.html), the agentic experience design agency — helping product, developer and business teams design AI systems that remember, adapt, and earn the right to act. Start with [the Action Heat Ladder](https://auxfirst.com/action-heat-ladder.html), [agent-first architecture](https://auxfirst.com/agent-first-architecture.html), or [a conversation](https://auxfirst.com/index.html#contact). For how machines read auxfirst, see the [AI info page](https://auxfirst.com/ai-info.html). Subscribe to the [auxfirst Substack](https://auxfirst.substack.com/) for what’s next.*