Strategy

TypeSafe Jev and the Third Layer of the Agent Model Stack

By IdeaBosqueLast updated: September 20, 2026

Key takeaways

TypeSafe AI released Jev on September 18, 2026 — the first commercial transformer-based model that outputs calibrated probabilities instead of text — and because users define the output space in advance, the model cannot hallucinate by construction (TechCrunch).
Vercel replaced an OpenAI Luna-based safety classifier with Jev and got results 5–18x faster with greater accuracy; Bryo AI found Gemini slightly more accurate for email classification but 10–20x more expensive — two independent adoption datapoints on the same pattern.
Gartner now sizes "AI Agents and Assistants" as its own market: $16.5B in 2025, $29.2B in 2026, $65.5B in 2027 — agent software spending nearly doubles into 2027, and decision-layer models are part of what that budget buys.
The architecture consequence is a three-layer model stack — frontier reasoner, open-weight generalist, calibrated decision layer — which changes how agent systems route work, enforce guardrails, observe behavior, and verify kill-switch decisions.

An LLM classifying every agent action for safety is a guardrail that costs as much as the thing it guards. Vercel was running OpenAI's ChatGPT Luna 5.6 as the safety classifier for its agentic infrastructure — reviewing commands before execution — until this week. After replacing it with Jev, the classifier ran 5–18x faster with greater accuracy. At Bryo AI, Gemini beat Jev on email-classification accuracy by a hair and cost 10–20x more. Both companies reached the same conclusion from different directions: a large class of agent decisions does not need language generation at all, and paying an LLM to produce prose it immediately throws away is the wrong cost structure.

Jev, released September 18 by TypeSafe AI, is the first commercial model built for that class of work. It is transformer-based but not a large language model: it outputs calibrated probabilities — the company calls them "calibrated decisions" — over an output space the user defines in advance. Diogo Almeida, TypeSafe's co-founder and a former OpenAI researcher who worked on ChatGPT and RLHF, framed the thesis to TechCrunch: "We have been super good at human language for four years, but it's not useful for automation because computers speak a different language." This article maps what a non-linguistic decision model changes for agent architecture — model routing, guardrails, observability, and kill-switch verification — and where it fits in the model stack a production B2B system actually runs.

What Jev is, and what is still unknown

The verifiable facts first. Jev produces probabilities over a user-defined output space instead of free-form text. Its output tokens are free and input is metered by the billion, not the million — the pricing inverts the LLM cost structure because generation is the expensive part of language models, and Jev does not generate. It is trained exclusively on synthetic data using a technique Almeida calls "reinforcement learning from calibrated decisions," and demand briefly saturated the API — the company lost the ability to serve users for a period after launch.

The honesty markers matter as much as the claims. Almeida is tight-lipped about the architecture, which outside observers suspect is built on top of an open-weight LLM — the "cannot hallucinate" property follows from the constrained output space, not from any published architecture detail. The Vercel and Bryo comparisons are developer self-reports, not benchmarked evaluations. And Jev is early-access-only — one of three gated September releases (alongside Anthropic's Mythos 5.1 and Google's Fairwind-only Gemini 3.8 Flash Cyber) — so adoption numbers rest on an access-controlled cohort. Armin Ronacher, CTO of Earendil and the creator of the open-source model harness Pi, expects competitors to follow now that the utility is visible: "presumably because the LLMs are so cheap and subsidized, you often don't have to be creative yet." Treat Jev as a category proof, not a settled vendor choice.

The evidence base has already moved since launch. The Register reported (September 16) that TypeSafe raised $40M before the product launched — capital raised on a category proof, ahead of any published benchmark. InfoWorld confirmed (September 17) the pricing at $0.042 per million input tokens with output "too cheap to meter" — the inverted metering structure from the launch reports, now in a second outlet's confirmation — and analyst framing has Jev sitting "alongside general-purpose models … handling frequent structured decisions such as routing, scoring, verification, policy checks and workflow orchestration." The governance open question also sharpened: Doozer AI flagged auditability questions for regulated industries — a calibrated probability is only auditable if the audit trail records what the model decided and why, which is an open architectural requirement rather than a solved property.

The third layer of the agent model stack

Production agent systems already run two model layers that behave nothing alike. A frontier reasoner plans, drafts, and handles ambiguity. An open-weight generalist — the pattern DeepSeek, Qwen, and GLM releases have pushed down-cost — executes high-volume tool calls and validations at a fraction of frontier pricing. What has been missing is a third layer for the work that is neither reasoning nor language: the millions of small classification decisions an agent system makes every day. Is this command safe to run. Does this trace look like a jailbreak. Does this workload need the expensive model. Is this price deviation real.

Putting a language model on those decisions has been the default only because no commercial alternative existed. Gartner's September forecast sizes the agent-software market at $16.5B in 2025, $29.2B in 2026, and $65.5B in 2027 — nearly doubling into 2027 — and every dollar of that build-out makes the decision-layer question more expensive to ignore, because each deployed agent multiplies the volume of guardrail checks, routing calls, and verification passes that currently run through LLMs by default.

The three-layer model stack — two language layers and the non-linguistic decision layer that prices the volume around them:

What it changes for agent architecture

Four architecture decisions change shape when a calibrated decision layer exists as a commercial option. Each maps to a decision production agent systems already make; the change is cost structure and honesty about where judgment lives.

Model routing becomes economically rational at high frequency. The most requested near-term use, per Ronacher, is predicting whether a workload requires a specific model — real-time sorting that is only possible when the routing call itself is nearly free. The DeepSeek auto-routing incident showed what vendor-side auto-routing costs when the operator does not control it: silent model substitution, reversed under user pressure in about 45 hours. A cheap decision layer moves routing from the vendor's gateway into the operator's runtime — route with your own classifier, keep the fallback model behind your own flag, and the substitution risk becomes a design choice instead of a surprise.

Guardrails get a probability contract. Ronacher's framing on Jev: "it delegates the hallucination problem a little bit to the user" — the operator states the threshold. If a decision comes back at 50%, treat it as a coin toss and route to a human; at 95%, act. That is a materially better contract than asking an LLM "is this safe?" and parsing a prose answer for confidence the model never calibrated. The governance checklist pattern of explicit approval gates survives; what changes is that the gate check itself runs on a model that cannot invent a yes.

Observability gets a cheap watcher. Almeida's own framing: using agents to monitor agents is expensive, but using Jev to do it is not — tracking LLM agent traces and preventing jailbreaks is exactly the high-volume, low-ambiguity classification work the decision layer is priced for. The observability architecture most teams want but skip because the monitoring LLM rivals the production LLM in cost becomes viable when the watcher costs an order of magnitude less.

Kill-switch verification gets an independent evaluator. A kill switch that triggers on an LLM's judgment inherits the LLM's failure modes. A decision-layer model evaluating "does this trace match the halt criteria" gives the kill-switch layer a check that is cheap enough to run on every action, calibrated rather than vibes-based, and architecturally separate from the agent it evaluates. The kill-switch-by-design pattern has always required the halt decision to be independent of the agent being halted; a non-linguistic evaluator is the first commercial substrate for that independence.

The cost arithmetic, stated plainly

The comparison datapoints are self-reported, so hold them loosely — but the direction is consistent across two independent adopters. Vercel: 5–18x faster than its Luna-based classifier, with greater accuracy. Bryo: Gemini slightly more accurate on business-email classification, at 10–20x the price. The structure behind both numbers is the same: an LLM spends most of its compute generating language that a classification pipeline discards, while a decision model spends it on the discrimination itself, with free outputs and billion-scale input metering. On the volume profile of a production agent — thousands of guardrail checks per day, one routing call per request, one trace evaluation per step — the decision layer is the only layer where "nearly free per call" is the design target, and it is the layer agents currently rent from the most expensive models on the market.

None of this makes the decision layer a reasoner. It cannot draft the quote, negotiate the exception, or write the customer email — the first two layers still own that. The claim is narrower: the volume of decisions around an agent's language work has outgrown language models as their substrate, and the first commercial model built for that volume shipped on September 18, 2026.

A representative build

A mid-market distributor running a 24-hour quoting agent on NetSuite and BigCommerce was paying a frontier model to classify every quoting decision: is this discount within policy, is this supplier response complete, does this trace need human review. The model routing decision (three in the five-decision architecture) split the work: a frontier model drafts and negotiates, an execution-tier open-weight model handles catalog and price lookups, and a calibrated decision-layer classifier runs the guardrails — command safety checks, trace classification, and the routing call that decides which layer handles each step. The classifier's probability output made the escalation policy explicit: decisions above 0.95 auto-resolve, below 0.50 route to a human, and the middle band queues for review with the probability attached. Guardrail cost per quote dropped from LLM rates to a rounding error, and the audit trail improved — every escalation decision now carries a calibrated number instead of a prose verdict.

Building the three-layer stack — frontier reasoner, open-weight generalist, decision layer — behind one runtime with explicit escalation thresholds is a scoped build, not a research project.

Request a scoped build. One-week discovery. You get a system inventory, workflow map, and fixed scope — whether or not you build with us.

Update — 2026-10-02: the thesis is now three vendors — Cloudflare Clef and AWS Strands Decider 2B ship the decision layer

DM-P1-TYPESAFE

Eleven days after this article documented the third layer of the agent model stack as a pattern with one commercial vendor, the category doubled. On October 2, 2026, Cloudflare released Clef and Clef-flash — open-source, Apache-2.0 decision models returning structured choices at lower latency and cost than calling a full LLM — and AWS Strands Labs published Strands Decider 2B, a 2B-parameter open-source decision model (TREND-02 §3.1). The third-layer pattern this article's architecture decisions rest on now has three independent vendors (TypeSafe, Cloudflare, AWS) spanning two hyperscale infrastructure companies — the strongest post-publication validation the thesis could receive. What this changes for the decisions above: each option got cheaper and more portable, but nothing got structurally different — the calibration contract, the cheap watcher, and the independent kill-switch evaluator all still depend on a decision layer that returns structured, calibrated choices; now the supply side of that contract is competitive.

Update — 2026-10-03: the fourth vendor — Perplexity's Decider v1 27B takes benchmark #1

One day after this article's three-vendor update, the category's fourth vendor landed and took the top benchmark score. Perplexity released Decider v1 27B — fine-tuned from Qwen3.8-27B, 250K context, multimodal input, Apache 2.0, available both through Perplexity's Decisions API and as downloadable weights — and its 85.71% overall beats Jev's 84.51% across 11 benchmarks, with wins on FinancialPhraseBank, RAGTruth, Tabfact, and Circa (TREND-03 §3.1). The third layer of the agent model stack now has four independent vendors (TypeSafe, Cloudflare, AWS, Perplexity) and benchmark competition — the two conditions that turn a pattern into a market. The consequence for the architecture decisions above is benign and real: contract-grade choice. The calibration contract, the cheap watcher, and the independent kill-switch evaluator can now be sourced competitively — and the kill-switch evaluator's independence requirement gains a literal answer: a decision model from a vendor unrelated to both the agent's operator and the agent's LLM vendor.

Update — 2026-10-04: llama.cpp serves decision models — the third layer goes local

The decision-model layer this article tracks no longer requires an API: llama.cpp now serves decision models — Julia-1, Laya, Kev-4B, lev, and OpenJev ship as GGUF, exposed through a /v1/systemone-style endpoint — following the same adoption trajectory open-weight LLMs ran. For the three-layer stack (deterministic schema → open-weight LLM → decision model), the local option removes the API dependency from the tier whose whole economic argument is cheap, fast, deterministic routing: the judgment layer can now be self-hosted next to the open-weight layer it governs, with the verification posture (calibration, drift, escape-hatch to the frontier model) unchanged.

Update — 2026-10-06: decision and frontier layers, three regions — ML4, Beam, Kolibri-1 join the swappable pool

Mistral Large 4 (ML4) enters the swappable pool with a cybersecurity-exclusivity datapoint: the 1T-parameter / 49B-active open-weight MoE (public preview October 6, 2026) posts 82% on reproduce-and-patch — the highest score of any model measured — on a task frontier closed models score near zero on because they refuse it. For the model-stack decision this article frames, that is the cleanest exhibit yet that model selection is per-capability routing, not per-vendor loyalty: the security-workload lane now has a best-in-class open-weight option. Reflection AI Beam (501B / 23B-active sparse MoE, 3–4× less inference compute than the GLM-5.2 class, SWE-Bench Verified 80.9%, MCP Atlas 78.7%, Nvidia-backed, Apache 2.0 this month) makes the Western open-weight frontier real — the pool is no longer US-closed / China-open. Kolibri-1 (Aleph Alpha, October 3: 78.1B / 3.46B-active MoE, 384 experts, bilingual German/English, Apache 2.0, built in Germany and Finland) adds the third national champion. The decision-layer economics are unchanged — the calibration contract, the cheap watcher, and the independent kill-switch evaluator still price at the decision tier while the frontier/open-weight pool they route into gains three-region depth — and sovereignty becomes the newest reason the swappable pool matters: a routing table that already spans open-weight and closed models can add a regional-sovereignty axis without any architectural change.

Update — 2026-10-07: the pool’s cheapest frontier-adjacent entry — GLM-5.3-Flash at $0.15/$0.50

The swappable pool the three-layer architecture routes into gained its most aggressive price point. Z.ai’s GLM-5.3-Flash (October 7, 2026) is a 320B total / 18B-active natively multimodal MoE at $0.15/$0.50 per million tokens — one-tenth of its own 744B flagship’s rate card — scoring Terminal Bench 2.1 84.3 (within 1 point of Claude Opus 4.8) and beating Claude Opus 4.8 (41.0) and GPT-5.6 Terra (37.2) on AutomationBench at 48.8 (Z.AI blog). For the model-stack decision this article frames, the Flash variant is the frontier/open-weight layer’s new cost-optimized default for the agentic-tool-use lane — the calibration contract and the escalation thresholds are unchanged, only the endpoint behind the decision layer shifts. The open-weight half of the pool’s three-region structure (US: Beam; Europe: ML4, Kolibri-1; China: DeepSeek, Qwen, GLM) now carries the strongest capability-per-dollar datapoint, and the weights are on Hugging Face, so the self-host route is available for the defensive-security lane Anthropic’s Frontier Red Team independently verified — the Flash variant chained two CVEs into a working ARM64 exploit for $20.40, a capability the escalation policy should treat as a governed-lane asset, not an unreviewed default.

Update — 2026-10-16: OpenRouter's decision-model catalog — 21 decision models from 13 makers on one Decisions API

The vendor ladder this article tracked (one → three → four) turned into a market catalog overnight: on October 16, 2026, OpenRouter listed 21 decision models from 13 makers behind a single Decisions API (catalog) — Jev-1.14 with typed decisions, GPT-6 Luna Decisions, Microsoft-Decision-1, Perplexity Decider, Cloudflare Clef, Inception Mercury Decide, Liquid d1, Upstage Solar Decide, and more. In the same window, LangChain published ModelRouterMiddleware — the third layer arriving as middleware inside a mainstream orchestration SDK, under a simple division of labor: the decision model chooses, the frontier LLM writes. For the three-layer thesis the consequence is on the supply side: the calibration contract these architecture decisions rest on — cheap, structured, calibrated choices — is now a purchasable commodity across 13 makers. Route, watch, and kill-switch can all be sourced competitively.