Jev (TypeSafe AI) on AWS: When System One Decisions Belong Next to Bedrock (2026)

On 15 September 2026, TypeSafe AI published Jev — the first System One model. Unstructured state in; typed probabilistic decisions out. Input tokens are priced at $0.042 / MTok; output tokens are free. TypeSafe claims 70–500 ms end-to-end and, on their workflow evals, 193.6× faster / 444.6× cheaper than frontier LLMs wrapped into the same decision API. They also wrote the caveat themselves: those multipliers sit on the higher end of real-world gains, and the published latency traces were generally run from West Coast laptops against a West Coast service.

Jev is not an Amazon Bedrock model. There is no inference profile, no VPC endpoint, and no Guardrails hop. On AWS it is a System-1 sidecar: Lambda or AgentCore Runtime calls TypeSafe for classify / route / score / verify; Amazon Bedrock stays the System-2 generator and the account-shaped compliance boundary.

Opinionated take: do not replace Bedrock with Jev. Do not put Jev on a money or PII write without a confidence gate in your code. Buy the typed, sub-second decision. Give up VPC-native inference, string generation, and a Bedrock-shaped residency story.

First-party signals we reuse (not a Jev outcome, not an agent client case) — Gateway server-side tools cut median tool round-trip ~180 ms → ~95 ms on a B2B CRM assistant (12 tools, ~8k turns/day) — Gateway post. Platform TCO silhouette: support-style AgentCore at 50K sessions/mo ~$791/mo platform + model (decision guide). Model your mix on the AgentCore pricing calculator. Jev sits next to that hop. It does not replace Gateway, Cedar, or Runtime.

Reproduce this — Clone the artifacts under examples/architecture-blog-2026/jev-typesafe-aws/. python3 -m py_compile lambda_pydantic_ai_stub.py syntax-checks the request shape. Ship gates live in monday-checklist.md. Score the fit in decision-matrix.md. The CSV at cost-worksheet.csv works TypeSafe’s published $0.042/MTok on one ticket-volume row. No API key. No live Jev call.

Trade-off you accept: calibrated, schema-bound decisions at vendor-claimed tens-to-hundreds of milliseconds, in exchange for an egress dependency TypeSafe can rate-limit without notice (they published 1,200 rpm / 250,000 tokens per second for jev-1.13.0 and said those numbers will move).

What Jev is — and what it is not

TypeSafe named the class after Kahneman’s Thinking, Fast and Slow: System One for fast, structured judgments software can consume. They named the model after William Stanley Jevons — cheaper intelligence unlocking more of it. Training is RLCD (Reinforcement Learning for Calibrated Decisions), not RLHF. Sampling is parallel across questions, not token-by-token.

That design gives up strings on purpose. Jev will not write a refund email, a Terraform module, or a toolUse JSON blob. Pydantic AI’s docs are blunt: TypeSafeModel fills an output_type; with tools attached it can pick a tool; a language model behind FallbackModel writes arguments when ToolCallProposed fires.

TypeSafe’s marketing line is that Jev “can’t hallucinate.” Read that as cannot emit a value outside the schema. The Register, 16 Sep 2026, made the distinction we will keep: a typed wrong answer is still wrong. Confidence exists so your code can refuse to act.

Current model card, from TypeSafe Models as of this post:

Pin jev-1.13.0 once a confidence threshold is tuned. Aliases move when a release ships; the response model field reports the versioned ID that answered.

Access paths we will name, none of them Bedrock:

• TypeSafe HTTP: POST /v1/systemone
• Python typesafe_sdk / JS @typesafe-ai/sdk
• Pydantic AI Agent('typesafe:jev-1.13.0', output_type=...)
• OpenRouter typesafe/jev-1.13

English is the primary training language. Other languages, including CJK, are “handled but not equally well” — TypeSafe’s words. Test on your corpus before a non-English SLO.

The three primitives

Every request is the same shape: one state, one or more questions, typed answers back. TypeSafe evaluates every question against that state in parallel. Question IDs are for your code; they are not sent to the model. Write the full judgment in instructions.

Context: TypeSafe Python SDK shape; pin jev-1.13.0. This block is a request sketch, not a live call.

# typesafe_sdk request shape against jev-1.13.0.
# Do not run this without a TypeSafe key. The companion stub is DRY_RUN.

from typesafe_sdk import Choice, Noul, Score, TypeSafeClient

state = {
    "ticket_message": "My card was charged twice. Please refund the duplicate.",
    "refund_policy": "Duplicate captured charges are eligible for a refund.",
}

questions = {
    "refund_requested": Noul(
        instructions="Does `ticket_message` request a refund?",
    ),
    "queue": Choice(
        instructions="Which team should own `ticket_message`?",
        criteria={
            "billing": "Charges, invoices, refunds, tax.",
            "shipping": "Delivery, tracking, damaged parcels.",
            "product": "Fit, quality, how-to.",
            "other": "None of the above.",
        },
    ),
    "urgency": Score(
        instructions="How urgent is `ticket_message`?",
        criteria=[
            "Can wait a business day.",
            "Same-day reply expected.",
            "Customer is blocked or alleging fraud.",
        ],
    ),
}

# Live: TypeSafeClient().system_one(state=state, questions=questions, model="jev-1.13.0")

Two composition rules from TypeSafe that AWS teams routinely violate with LLMs:

1. One snap judgment per question. “Decide the best next action” is a System-2 prompt. Split it: refund requested? which queue? how urgent? Combine in code.
2. Ask speculative questions in the same call. Extra questions cost question tokens, not another copy of a large state. TypeSafe’s parallel questions cookbook batched 13 questions over a ~54k-character GDPR Wikipedia article on jev-1.12 and reported 12.2× cheaper / 10.0× faster than 13 serial calls, with no change in answers ($0.000497 batched vs $0.006090 serial; 0.27 s vs 2.71 s). That is a document-dominated workload. Short tickets will not print a 12×.

Confidence (Choice / Score) is a second axis: the answer says what; confidence says whether to act. Do not carry a Noul threshold onto a Choice. TypeSafe’s jaggedness note shows a refund Noul and a yes/no Choice on the same ticket that do not invert cleanly — P(noul) and 1 - P(not noul) are not an identity you can bank on.

AWS architecture: Jev is an egress hop

Keep the control plane on AWS. Jev answers questions. Bedrock generates. Gateway Cedar authorizes writes.

flowchart LR
  ingress[API_Gateway_or_Event]
  runtime[Lambda_or_AgentCore_Runtime]
  jev[TypeSafe_Jev_API]
  bedrock[Bedrock_Converse]
  writes[Gateway_Cedar_writes]
  ingress --> runtime
  runtime -->|"closed-set route score verify"| jev
  runtime -->|"generate args reply"| bedrock
  runtime -->|"confidence gated"| writes

Pydantic AI’s documented split is the one we recommend on Runtime: Jev selects the tool; a Bedrock model behind FallbackModel fills arguments when ToolCallProposed fires at typesafe_tool_call_threshold (default 0.6 — tune against jev-1.13.0, not the alias). Then Gateway Policy still has to allow the write.

Step Functions is a valid outer loop: a Lambda task returns { "queue": "billing", "confidence": 0.91 }; a Choice state branches. Do not put the TypeSafe HTTP call inside a Map over PHI payloads until residency has signed the egress.

From a real engagement (AWS hop, not Jev) — Same B2B CRM assistant, 12 tools, ~8k turns/day. The number that moved was Gateway tool RTT ~180 ms → ~95 ms. If you insert Jev in front of those tools, budget TypeSafe’s claimed 70–500 ms plus that Gateway RTT plus any Bedrock draft. Do not subtract Jev from the Gateway canary. We have not timed Jev in that account.

When to use Jev — best fit on AWS

Use Jev when all of these are true:

1. The answer space is closed. You can write the options, the score levels, or the yes/no criteria before the request. Ticket queues, intent enums, “is this a jailbreak,” “does this passage contradict the question.”
2. Code, not a prompt, owns the branch. A Choice maps onto three Lambda paths or a Step Functions Choice. A Noul maps onto if. You are willing to maintain thresholds.
3. You need calibrated refusal. High-impact writes (refund, PII export, production change) should no-op or HITL when confidence is low. That is the whole point of RLCD versus “pretty please return JSON.”
4. Latency budget is interactive. TypeSafe’s published band is 70–500 ms. That is the right shape for a pre-router in front of AgentCore Gateway, not for a 30-second reasoning trace.
5. Volume is text map-reduce. S3 object created → EventBridge → Lambda concurrency classifying catalog copy, tickets, or RAG passages. Fan-out questions in one call so you do not re-pay a large state.
6. Bedrock still does the words. Reply text, tool arguments, Knowledge Base synthesis, Automated Reasoning Checks against a formal policy — those stay in-account.

Concrete AWS-shaped fits:

• AgentCore Gateway pre-router. Jev Choice over the tool list; Cedar still gates the write. Browser off unless the turn needs it.
• Support / sales intake. Queue + urgency + “needs human” in one request; Bedrock drafts only after the route is set. This is intake automation, not a published FactualMinds agent case study.
• LLM I/O screen. TypeSafe’s guardrails cookbook scores jailbreak / harm on messages entering or leaving a generative model. Run it in addition to Bedrock Guardrails, not instead of them — Guardrails never see the TypeSafe hop, and TypeSafe never sees Bedrock’s denied-topic list.
• RAG passage filter. Score retrieved chunks (contradiction, injection, relevance) in Lambda before Converse. Knowledge Bases stay on AWS; Jev sees the passage text you chose to send.
• Shadow mode vs Nova Micro. Same closed-set labels, two classifiers, CloudWatch on disagreement. Promote Jev only if disagreement-plus-confidence beats the in-account model on a held-out set you label.

When not to use Jev — not suitable

Do not use Jev when any of these are true:

• You need generated text. Replies, code, SQL, emails, explanations to a human. TypeSafe’s jaggedness doc: chaining Choices to fake generation “will not work well and will be very slow.” Use Bedrock.
• Input is not text. Images, audio, video, binaries. Pre-process to text first, or stay on a multimodal Bedrock model.
• The model must write tool arguments. Jev picks; it does not fill. If the product is “the model calls refund(order_id, amount) with numbers it extracted,” that is Bedrock tool use (and then Cedar).
• Data cannot leave AWS. HIPAA PHI, PCI account data, a residency clause, GovCloud, or a customer DPA that names Bedrock regions and does not name TypeSafe. There is no VPC endpoint to hide behind.
• The set is already enumerable in rules. Order status ∈ {pending, shipped, delivered} from DynamoDB. Step Functions + DynamoDB beats a model. Do not pay $0.042/MTok for an if.
• Math, counts, dates. jev-1.13 does not count reliably, does not compare dates as ordered quantities, and Score levels are weak for interpolating a magnitude. Extract in the model if you must; arithmetic in code. TypeSafe wrote this down on 17 Sep 2026.
• Cardinality above 255 without a two-stage score-then-choose. TypeSafe’s Wikiracing note: above 255 they score independently, then choose — expect occasional slowdown.
• You need fine-tunes or customer weights. Jev is one set of weights per model ID. Domain adaptation is state + criteria, or a classical model on Jev probabilities (their AutoResearch cookbook) — not LoRA on Bedrock Custom Model Import.
• Non-English is the product and you have not run a held-out test.
• You are treating early access as a production SLO. Limits change; origin is West Coast; 429 handling is on you (Retry-After, SDK backoff).
• Literal / adversarial state. Injected instructions in a ticket can steer answers. TypeSafe says state is not treated as hostile by default. Customer-origin text is hostile until you prove otherwise — same rule as prompt injection on Bedrock.

What broke — Paper architecture, week of 15 Sep 2026 launch notes: put raw HIPAA support mail in Jev state to classify “refund vs medical question” before an AgentCore Gateway write. That design fails three independent controls at once. (1) The payload egresses to api.typesafe.ai; Bedrock Guardrails never see it. (2) Cedar on Gateway cannot authorize TypeSafe. (3) TypeSafe’s DPA / ZDR is an enterprise paperwork path, not an AWS BAA. Detection: NAT Gateway / VPC flow logs to TypeSafe. Rollback: classify with a Bedrock model in-region under the existing BAA, or strip to non-PHI features (queue enum, order-id only) before any third-party call. We did not run this against a client mailbox — we are refusing the design on controls, not on a fake latency trace.

Named substitutes

When Jev is the wrong tool, name the replacement and the condition:

We recommend Jev in front of Bedrock, not instead of it, when the decision is closed-set, the payload is allowed to leave AWS, and you will operate confidence histograms. We recommend Nova Micro (or rules) when the payload cannot leave, or when you have not yet earned a TypeSafe key and a shadow-mode week.

One cost example (TypeSafe published rate only)

One synthetic row — not a second invented workload.

Assume 1,000,000 support tickets, 500 input tokens each (message + a short policy snippet + question text). That is 500 MTok.

500 × $0.042 / MTok = $21 of Jev input. Output tokens are $0 on TypeSafe’s card.

That $21 does not include Lambda, NAT bytes, retries, or the Bedrock draft you still owe after the route is chosen. It also assumes you batch questions so the ticket text is sent once. Thirteen serial Jev calls would re-pay the state; the GDPR cookbook’s 12.2× was that effect on a 54k-character document, not on a 500-token ticket.

For a Bedrock classifier on the same labels, use the Bedrock pricing page and the token-budget post. We are not printing a Nova Micro dollar total here — that would be a second synthetic workload with a conveniently round number. The worksheet in the artifact leaves those cells as formulas.

Platform context you already have: support-style AgentCore at 50K sessions/mo ~$791/mo. Jev’s $21 at a million tickets is a model-API line, not a replacement for that platform silhouette.

What to Do This Week

1. Residency first. If the state can contain PHI, PCI, or a named-region clause, stop. Stay on Bedrock. Do not “just POC” with production mail.
2. Pin jev-1.13.0. Do not tune against jev-latest.
3. Write five atomic questions (two Noul, two Choice, one Score) against one real anonymized ticket. No “decide the action.”
4. Log noul / choice / confidence / model to CloudWatch as a histogram, not a single average.
5. Shadow against Nova Micro (or your current classifier) for a week. Promote only on disagreement you can explain.
6. Keep Cedar on the write. A high-confidence Jev Choice is not authorization.
7. Run the artifact checklist — monday-checklist.md. python3 -m py_compile the stub. Fill cost-worksheet.csv with your token counts.

If you only do one thing: do not send customer text to TypeSafe until legal has a sentence about egress. The model card is the easy part.

What This Post Doesn’t Cover

• We have not called the Jev API. No first-party p50/p95, no error-rate, no 429 trace. TypeSafe’s 70–500 ms and 193.6× / 444.6× remain vendor claims, with their own “higher end” and West-Coast-laptop caveats attached.
• Jev is not in Amazon Bedrock Marketplace as of this writing. A listing would change the IAM / VPC story; it has not shipped.
• TypeSafe enterprise ZDR, DPA, and BAA equivalence. Paperwork, not a blog post.
• Doom and Wikiracing demos. Toys. TypeSafe says the Doom bot reads structured state as text, not pixels.
• OpenRouter versus TypeSafe-direct billing, latency, and data handling.
• A live Pydantic AI FallbackModel deploy on AgentCore Runtime — the stub shows the shape; it does not invoke Bedrock or Jev.
• Any FactualMinds AI-agent case study. There are zero published agent engagements. Permitted proof here is the field guide, the calculators, the Gateway canary, and cited vendor numbers.

Recommended next posts

These are backlog items, not unpublished drafts. The routing bake-off is blocked until someone with a TypeSafe key ships a public artifact.

Until those artifacts exist, this guide is the decision layer: Jev next to Bedrock when the set is closed and the payload may leave; Bedrock or rules when it may not.