Decision models

Decision models invert the LLM contract: instead of generating text that software then parses, the model is the decision function — unstructured state in, typed probabilistic decisions out. Where chat models optimize for human preference and produce strings that must be parsed, validated, and trusted not to hallucinate, a decision model commits to a schema up front, outputs type-safe structured values with calibrated probabilities, and cannot make type errors by construction.

TypeSafe’s Jev (early access, September 2026) is the reference release and made waves: a frontier-intelligence function call that gives up string generation entirely. Trained with RLCD (Reinforcement Learning for Calibrated Decisions) instead of RLHF, sampling all outputs in parallel rather than autoregressively — 70-500 ms end-to-end (claimed 40-200x faster than frontier LLMs on decision-shaped queries), output tokens free, input at $0.042/MTok. Named for Kahneman’s System 1 (fast, intuitive) and William Stanley Jevons (their thesis: every order-of-magnitude drop in the cost of intelligence unlocks orders of magnitude more use cases, as steam-engine efficiency did for coal).

The claim structure matters more than the claims: TypeSafe publishes their evals with explicit “Nuance” sections (reference probabilities from the average of the strongest frontier models, biasing against DeepSeek-class models; the 193.6x faster / 444.6x cheaper headline is “on the higher end of real-world gains”; the 0% type-error number is mathematical, not empirical). Jev owns the claimed Pareto frontier for ~2 orders of magnitude on their workflow evals — the same jobs where prompting a chat model to do all the logic in chain-of-thought does significantly worse than encoding the workflow in code.

The category matured fast: within days of Jev’s early access there is a dedicated benchmark (JevBench v1.4.2, ranking decider-4b v2, JevK5, Cygnet, Hopper) scoring smart, calibrated, fast and cheap equally — on which a 4B open model (decider-4b v2) takes #1 by being 5x faster at ~half the price, while Jev still leads on raw intelligence (53.1 vs 49.4) and calibration. Two lessons in one: the four-axis composite rewards exactly what small models are good at, and “beats Jev” headlines dissolve the moment you sort by a single axis — JevBench plans to rotate its hidden test set so nobody can benchmaxx.

The pushback worth keeping: Max Leiter’s emoji-search benchmark — “you don’t need Jev for good emoji search”. Matching against a known set (emoji, docs) is embedding search: faster, 1000-10000x cheaper, occasionally better quality. Classification with known labels belongs to a small fine-tuned classifier. Jev earns its slot only when the decision needs actual reasoning — context or knowledge not captured in embedding space. Notably: Jev must see the whole catalog to choose (58k input tokens per emoji search!), and narrowing the list first is embedding search. This is the same task-shape discipline as Fine-tuning GLiNER: pick the cheapest model class that owns the decision.

Where they slot in:

• Smart if-statements — classify, route, score, extract, or branch where hand-written rules are too brittle; surrounding code constrains the model’s freedom, making it composable into reliable systems.
• Map-reduce over big data, real-time applications (the Doom-at-10-queries/sec demo), and verification/judging/guardrailing of other models’ outputs.

Adjacent on the same axis: Cua-S1-4B (trycua) — a 4B computer-use decision model trained with RLOO where the only reward is task completion, LoRA adapters on frozen Qwen3.5-4B, 92.9% vs 60.1% on GUI-360 — the same “train for the decision, not the prose” shape in the GUI domain. And the open-weights entry: GLiNER2.5-Decide (Fastino, 340M, Apache-2.0) — encoder-based schema-defined decisions with joint constrained decoding, 38 ms p50 on a V100, 167 ms CPU-only, air-gappable. On Fastino’s internal 17-dataset Fast Decisions suite (5,100 examples, micro exact-match) it scores 60.1% average, beating JevK5 (57.5%, open Jev reproduction), SemIf (Qwen3.5-4B, 56.4%) and Laya (421M ModernBERT, 46.6%) — with intent routing its strength (75.3% support intent, 18.6 pts ahead). The interesting architecture move: questions are decoded jointly under schema rules, so “safe + prompt_injection detected” contradictions cannot occur. Their own caveat: internal benchmark, not JevBench; JevK5 is a reproduction, not TypeSafe’s Jev.

The Polish entry: basal-1.0 (rkinas/basal, Apache-2.0, 4.5B + 1.5B; tweet) — a Jev-inspired dynamic classifier calibrated for Polish (and English): classes described in plain language per request, no retraining — the same model routes tickets, checks policy rules, scores urgency. One calibrated decision: 8.8 ms on B300, 12.5 ms H100, 27 ms RTX 5090, 45 ms DGX Spark FP8 (1.5B ~2x faster). On Polish decisions 88.6% vs Jev’s 0.780 and 0.779 for other open solutions. Blackwell-optimized (fp8, nvfp4 — 6 model variants), tested across DGX Nano/B300/B200/H100/RTX PRO 6000/5090. Ships an optimized inference engine plus a technical report covering the full build-and-optimize process, an on-the-fly content-moderation case study (no specialized classifier training), and comparisons to Sójka and Baszta (Polish language models). Built human-plus-Claude-Code: human research design, AI execution — itself a datapoint for the Golden repo AI-assisted-coding pattern. Directly relevant to the Fine-tuning GLiNER ticket-classification plan: a Polish-native decision model may own that slot before a fine-tune does — the task-shape question becomes “basal-1.0 vs fine-tuned GLiNER” for Polish tickets.

basal launched its site (basal.si5.pl, announcement, 2026-09-30 — captured): the Polish decision model now has a product page — live-use-case updates, partner roll-call (usage reports solicited), model params, news feed; positioning sharpened to “tworzymy polski model dynamicznego klasyfikatora” (the Polish dynamic-classifier model). Site confirms the mechanics in product language: context+question+options in, probability distribution out, categories editable per request (“Model zostaje ten sam”), routing example at 99.92% confidence, Apache-2.0 self-host pitch (“zachowaj kontrolę nad przepływem danych”), name inspiration basal ganglia — “jąder podstawy mózgu, które pomagują wybrać działanie spośród wielu możliwości”.

jev-pl-benchmark (HF Space, same author, announcement) — the leaderboard behind the basal numbers, notable for its methodology: private test items (can’t be trained on — author openly withholds the data: “niesprawiedliwe dla innych osób… ale cóż 😂”), accuracy averaged over both option orders (kills position bias), every system served with its own official server over HTTP, latency = median of 200 sequential requests, throughput = 32 concurrent clients on one H100. Key rows (polish_decisions / english_decisions / p50 ms H100):

• basal-1.0-4.5B: 0.884 / 0.741 / 13.9 — dominates Polish, competitive English
• basal-1.0-1.5B: 0.849 / 0.734 / 7.7 ms, 147 req/s — the speed/quality sweet spot
• Jev 1.13.0 API: 0.780 / 0.736 — the commercial reference, 10+ points behind on Polish
• AutoJev-27B: 0.779 / 0.753 — best open English decisions among the Jev-likes
• Cygnet 12B: 0.688 / 0.703 but 0.879 on the public English bench — general-knowledge strength
• JevK5/Winnow/decider/Hopper: 0.63-0.71 Polish — the JevBench cohort trails badly off-English

Honest read: basal wins on its author’s benchmark — categories (deadlines, statutes, rule families) mirror its training design, English general knowledge is not its lane (0.737 polish_general vs Cygnet 0.793, public-English 0.740 vs Jev 0.861). But the private-items + both-orders + official-server discipline is more rigorous than most model-launch leaderboards, and the 1.5B at 7.7 ms/147 rps is a genuinely deployable Polish decision endpoint.

Related concepts: structured output in the classic sense is the constraint side without the parallel sampling and calibration (llm-inference-adjacent); LLM fine-tuning/SFT is how you’d specialize such a model.

Sources (captured 2026-09-25):

• TypeSafe: Introducing System One Models & Jev — clippings/typesafe-ai-blog-introducing-system-one-models-and-jev.md
• @martinbowling on Cua-S1-4B — clippings/x-2102825776592933214.md (quotes the @trycua announcement)
• @airesearch12 JevBench v1.4.2 thread — clippings/x-2103267811480993858-thread.md (decider-4b v2 vs Jev composite ranking)

The split, named (Tinybird’s LebrelBot, 2026-09-30 — captured)

“AI is splitting into coworkers and smart if-statements.” OpenAI launched dots (always-on agents on GPT-6 Astra, own cloud computer, 4,000+ app connections, Slack seat) and — same DevDay — a Decisions API (user-defined questions, finite answers, for classifying/routing/picking next actions): “a Jev-shaped product from the lab that just gave agents their own computers.” LebrelBot’s read: the bet isn’t dots or Jevs, it’s both — “a brilliant coworker you hand the keys to, and a smart if-statement you call a million times without asking how its day went.” From next to a lot of SQL: the second one is the quiet revolution — most automation won’t have a name or a color. Also in the issue: Jev’s founder arguing RLHF made models great at pleasing the human in the loop (“exactly what automation doesn’t need”), rebutted by multi-teacher on-policy distillation; Claude Code now reads AGENTS.md (fallback-only if CLAUDE.md exists); Opus 5.5 rerouting cyber tasks to an older model after the “Hacking OpenAI” writeup.

Rhymes with

• Tabular foundation models — the same pretrained-beats-per-task-pipeline inversion for typed tables: schema in, calibrated probabilities out, zero per-task lifecycle (TabPFN/TabICL/Kumo Tabular lineage).

Growing

• Would a decision model replace the judge/guardrail slot in the PII redaction stack (scoring prompts for sensitivity at 100 ms instead of a masked LLM pass)?
• Jev cardinality caps at 255 — where does that bite in routing over large tool catalogs?

basal-1.5 release wave (2026-10-04, @KinasRemek, captured → clippings/x-2106847656542629909-thread.md): “pierwszy polski klasyfikator typu system-one” with an extended instruction list, and the serving matrix broadened beyond NVIDIA: SGLang and vLLM, Apple Silicon (MLX 8-bit and 4-bit), Ollama and llama.cpp (GGUF) — Apache 2.0. The community ask is explicitly about Polish AI visibility (“narzekamy, że w Polsce mało dzieje się w AI a jak się dzieje to przechodzimy nad tym do porządku dziennego”); księga użytkowników (user registry, basal.si5.pl/uzywam) grants v2.0 early access 1–2 weeks before launch. GitHub README deliberately long/structured — “jak wpuścicie do agenta (codex, claude code) on sobie na tym tekście świetnie poradzi” (a README written as agent context — contextmaxxing applied to a repo, kin to Agent knowledge systems).

The security decision layer (JoshARosen’s X article, 2026-10-05)

“Securing AI Agents with Jev: Adding a Security Decision Layer” (captured in full via @JoshARosen) — the application matrix that completes the agent-security gap analysis: hard controls (sandboxes/permissions/network policy — NVIDIA OpenShell named) tell you what the agent can do, policy says what’s forbidden, but “the same action can be safe or unsafe depending on the task” — deleting a file, touching customer data, editing an auth module — a semantic judgment neither layer makes. Today “the same model doing the work is often deciding whether its own behavior introduces too much risk.” The decision-model placement points:

1. Pre-run posture classification — task→risk tier before execution (README edit vs prod-auth change run with different tools/credentials/approvals; “Jev doesn’t grant access — the deterministic system keeps control”).
2. Tool gating — task+action+side-effects+state → allow/escalate/approve (working examples: jev-guard, jev-computer-use; ScopeJudge arXiv:2607.07774 for offensive-security scoping).
3. Mid-run scrutiny adjustment — cheap enough to “run and rerun throughout the loop, adjusting the level of scrutiny as the work changes. Security can change with the work rather than fixing the entire security posture at the start.”
4. Verify security claims separately from the worker — a decision model evaluates traces/tests/exploit evidence against the worker’s “vulnerability fixed” claim (“an extra layer of defense against models making overly optimistic claims about their own work”; jevals = agent-trace eval + deterministic policy on top).
5. Prompt-injection triage — instruction + provenance + task context → risk score before execution (“‘run this command’ could be completely legitimate for one task and suspicious for another”; low-risk flows, high-risk verifies/blocks/escalates).

The architectural closing: “putting all of those decisions inside the frontier model gives the same system doing the work even more authority over how its own risky behavior is judged. Encoding all of them as hard policy pushes the agent back toward a predefined workflow.” A separate decision layer lets frontier models do open-ended work while a fast decision layer identifies where scrutiny is needed — the exact slot Qwen3Guard-Stream (token-level) and the Aegis-BPF LSM (kernel-level) occupy at their layers: judgment between enforcement and capability.

Jev in production: OpenHuman ships it as the decider (2026-10-06)

openhuman (OSS) (41k★ Rust harness; #1 trending on GitHub nine days straight at launch — captured via exploraX_/marcusyul “FOUND A NousResearch AND openclaw KILLER. FASTER AND CHEAPER THAN BOTH”, 635❤ / 43k views) embeds Jev as its in-harness decision model, with published production numbers: tool search over 215 core tools + 1,000 Composio actions — plain BM25: right tool top-1 22.5%, 26 needless tool calls out of 31 tool-less requests. Embedding top-20 + Jev choosing among them: 62.0% top-1 (66.7% top-3), 1 needless call, p50 1.5s (vs BM25’s 28 ms — the decider tax, explicit). Jev-picks-app-family-first pushes Composio-only accuracy to 80.3% top-1. Auto-fallback to BM25 without credentials. Second production use: the browser tool returns NeedsConfirmation for consequential actions (purchase/send/delete) — Jev as the pre-effect gate. The deployment shape matters for this note’s thesis: Jev sits between retrieval and action inside the harness — retrieval narrows, the decider commits; a working answer to the “1,000-tool context tax” this note tracks.

Rasmussen’s operating point: boundaries, gradients, and deviance (management as systems)

bibryam → sunilsadasivan, “Managing Systems” (10.8 KB, captured; via Richard Cook’s talk + Rasmussen’s Risk Management in a Dynamic Society). The model: a system’s operating point sits inside three accident boundaries — economic failure, unacceptable workload, performance failure — with gradients pushing it toward the performance boundary and counter-gradients pushing back. Three named dynamics: (1) pendulum overcorrection (cross the quality boundary → counter-gradient overshoots toward the growth boundary — “many pendulum swings of sensing and adapting”); (2) marginal boundaries (alerts/safety measures that keep the point away from boundaries you can’t otherwise see — “we never truly know where an accident boundary is, only when we’ve crossed it”); (3) normalization of deviance (over time the point tests marginal boundaries; we forget why a rule exists, remove it — “nearly guaranteed that when you’re not focusing on a part of the system, the operating point finds ways past the marginal boundaries”). Field cases: getting hacked (push far from security boundary, but mind the productivity boundary on the other side) and over-hiring/layoffs (economic-boundary overshoot toward the not-a-great-place-to-work boundary). The transfer thesis: monitoring/alerting as marginal boundaries for organizations — weekly exec review = “assess where the operating point sits within the company’s system of marginal boundaries.” Ops kin: this is the oncall/homelab monitoring discipline (Ops toolbelt stack) restated as a general systems law; normalization of deviance is why alert fatigue and dismissed warnings precede every incident; pendulum overcorrection is the post-incident freeze-vs-move dynamic.

Calibrated estimation: Hubbard/Twitch, now as an agent skill (2026-10)

nurijanian (2-tweet; full article rides in the clipping): the Twitch/HBR calibration protocol (from Douglas Hubbard’s How to Measure Anything) turned into a /measure skill — paste a messy “immeasurable” problem, the agent iterates to the exact aspects worth measuring and the lowest-cost way to measure them.

• The core finding: ~70 practice questions with immediate feedback before confidence intervals match reality. Before calibration, “90% sure” ≈ 50% accurate; after, 90% means 90%.
• The method: estimate past known metrics as 80% intervals (containment <4/5 = overconfident; 5/5 = uselessly wide) → then forward predictions stated as calibrated bets (“70% confident 15% of partners use auto-host within 8 weeks”) — conflicting confidences focus the debate on why, replacing opinion volleyball.
• The three objections (and answers): “forecasting doesn’t work” (show them the team’s past accuracy — it’s terrible, which proves the point); “predictions will be used against us in reviews” (make it a learning exercise, never a performance metric); “not enough information to predict” (calibration itself teaches you know more than you think).
• The sprint-planning move: replace “how long will this take?” with “give me your 95% confidence range” — “3 to 8 days” is real information about scope uncertainty; “3 days” is a number the listener wants to hear. Behavioral payoff over quarters: teams front-load uncertain parts to narrow the range early and flag when a range is too wide to be useful — that shift matters more than accuracy.

Ops reading: this is LLM evals’ grader-calibration lesson transplanted from model-judges to human estimators — unchecked confidence is systematically miscalibrated in both; the fix is identical (score the estimator against ground truth, then require two numbers). Kin: the Rasmussen section above (predictions as marginal boundaries); AI metrics that actually matter (measured beats felt).

The taxonomy chart: classifier → decision → thinking decision (2026-10-08)

fastinoAI published the spectrum this note orbits, as a chart (vision-transcribed into the clipping): classification = categorize input against predefined labels (GLiNER2.5; intent/sentiment/tagging) → decision = score the available options, pick the best (GLiNER2.5-Decide; tool selection, routing, triage) → thinking decision = initial decision, then reason further when confidence is low (GLiDE, API-only; complex tool selection, code/logic evaluation, multi-step). The System-1 → scored-choice → System-2-on-low-confidence escalation, productized — the confidence check is the router between cheap and expensive paths, which is the Small language models win-a-job economics applied to a single decision.

The Abnormal write-up + $200 Kev-4B fine-tune (2026-10-08)

jaredpalmer (quoting ShrivuShankar of Abnormal Security): “how a **$200Kev-4Bfine-tunecanmogeveryotherdecisionmodel\ast \ast ."TheAbnormalarticle(quotedinfullinthecapture):theyclassify\ast \ast billionsofemailsaweek\ast \ast ;productionmodelsare\ast behavioral\ast (per-sender/recipient/orghistory,authentication,directory),butthehardcasesneedlanguageunderstanding("whetheravendorwouldreallychangebankdetailsmid-invoice-thread")—sotheytested\ast \ast TypeSaf{e}^{\prime }sJev,theOpenAIDecisionsAPI,34self-hostedopendecisionmodels,andfourfrontierLLMconfigs(40modelsinall)\ast \ast on1,985non-publicfully-synthetichard-caseemails,then\ast \ast fine-tunedoneofthesmallopenmodelsthemselves\ast \ast —kev-4b([[kev(OSS)]],8.7k★,JaredPalme{r}^{\prime }s"Jev-likefamilyofdecisionmodelsbuiltonQwen3.5/3.8youcantrainandrunonyourown")—oninternalcyber-classificationtasks,with"prettynon-trivialperformanceboostcomparedtojevandluna."Theeconomicsargumentintheirwords:decisionmodels"readtheemailandeveryquestioninoneforwardpassandreturnaprobabilityforeachoption\ast \ast withoutgeneratingatoken\ast \ast ,soananswercostsaboutwhatitcoststoreadtheinput"—LLM-classjudgmentatprefilterscale;newdetectorsstart\ast \ast zero-shotasawrittenquestion\ast \ast ,notafeaturetobuildandamodeltoretrain.Theself-servelane:\ast \ast officialskill‘npxskillsaddjaredpalmer/kev@kev-finetune‘\ast \ast —discoversJev/kev/decision-modelcallsitesinyourapporinterviewsyou,generatessyntheticdata,walksyouthroughfine-tuningonModal;sisterkev-deployskillshipstoModalendpoints.Thiscompletesthearcthisnotestartedwiththe"<$10 fine-tune your own Jev” claim: from cheap GLiNER-class fine-tunes to $200 to beat the frontier on your own task — the decision-model version of the Small language models win-a-job thesis.