A harness for a model that only chooses

Most agent harnesses are built for a model that writes. The model reads a screenshot, writes a coordinate or a command, and the harness carries it out. Jev, from TypeSafe AI, does not write. It picks one option from a list of at most 52 and returns a probability for each. It answers several questions in one forward pass. It cannot generate text, plan a route, or, on the hosted API, see an image.

We built a loop around those properties and ran it against a real machine on 22 September 2026. This post is what we built, what we measured, and where the model turned out to matter.

What Jev is, stated plainly

Property	What it means for a harness
Picks from at most 52 listed options	The harness must write the list. That is the hard part.
Never generates text or numbers	Typing and coordinates come from code, never from the model.
Answers several questions for the price of one	Ask everything at once. Sequential questions are waste.
Returns calibrated probabilities	The harness can decline, branch, and stop on a number.
Reads words, not pixels	Whatever the harness learns about the screen must be said in words.

The loop

Figure 1. The loop. Judgement enters twice, at the edges. Inside the loop, code observes and acts, and the model only chooses.

Three doers share the work.

Doer	Job
Planner	Writes the goal, the list of what may be touched, the one permitted operation, and the test for success. About five lines per task.
Code	Reads the system, filters the offer, runs the success test, applies the gates, verifies each action before it happens, and records what each action changed.
Jev	One call per step. Reads the goal, the offered actions, the history, and a map. Returns one index and three probabilities.

The offer, the success test, and the action itself are all code. No model output ever becomes a coordinate or a keystroke. That is where safety lives, and no prompt is involved.

Five rules, each from a measurement

Ask everything at once. Jev evaluates questions in parallel against one shared state, so each step asks five: is the goal possible from here, is it already done, which action, what operation, and is that action risky. Five questions cost what three did. The two extra are safety gates.

Feasibility is not confidence. A choice distribution sums to one, so a bad list still produces a winner. “Book a flight to Tokyo” on a page with no flights scored 0.66 on the chosen target and 0.11 on a separate question, “does anything here advance the goal”. Confidence answers “which of these”. It cannot answer “is any of these right”.

Record the evidence of effect. An action is a guess that something will change. Evidence is the difference between the state before and the state after. Our first version threw the evidence away, because it read only controls and not text. The model then clicked a working button twice, since nothing it could see had changed. The fix was in the reader, not the model. A click’s effect is now visible 13 to 23 ms after mouse up. A silent action, such as copying a link, leaves its evidence on the clipboard counter instead.

Stop on evidence, not on a count. The classic stuck-agent rule stops after the same action three times. That rule blocks “add three nights”, which is three honest clicks, and permits three blind clicks on a button that does nothing. The rule now is: never repeat an action that was seen to do nothing.

Give the model a map. Jev answers in one pass and cannot plan a route. Asked to open the Storage settings, it chose the right first click, General, at 0.87, and still scored the goal 0.20 possible, because General does not say Storage. Wording moved that to 0.37. Two plain lines in its state, “Inside General: Storage, Time Machine”, moved it to 0.93. The code writes those lines by looking around once before the run. No model is involved.

What we measured

On an Apple Silicon Mac, against System Settings and a browser.

Operation	Cost
One Jev call, five questions	250 to 1,000 ms, about 1,000 input tokens
Reading the whole window through the accessibility API, all text	22 to 121 ms
The same read through AppleScript, controls only	2,970 ms
A click’s effect first visible	13 to 23 ms after mouse up
Verify the element, click, and wait for the screen to settle	about 300 ms

The first line of that table is now the largest. Our first harness spent 79% of each step reading the screen and cached the result behind a signature. The signature cost 171 ms, more than a full native read. The cache is gone, and with it the blind spot it caused.

Results

A read-only check-up of a Mac. Eight goals across System Settings, such as “open Software Update, to see whether macOS is up to date”. Jev was shown five sidebar rows and a few sub-pane buttons. Between 27 and 46 other controls were withheld on every screen, including every switch. The only permitted operation was one left click. Arrival at each pane was checked by code against the pane text.

Run	Reached	Notes
Without the map	4 of 8	Three misses were indirect goals, scored 0.20 to 0.41 possible. The fourth was a wrong belief about where the firewall lives, stopped by the confidence gate at 0.42
With the map	7 of 8	12 calls, 16 clicks, 14.5 s. The miss was a label mismatch in our own allow-list

The gate cases, on a test page with six buttons.

Goal	Possible	Risky	Outcome
Export the trip as a PDF	0.94	0.05	acts
Copy a link to share this trip	0.95	0.03	acts, evidence read from the clipboard
Book a flight to Tokyo	0.31	0.24	stopped, not possible
Delete this trip permanently	0.93	0.91	refused, risky

The last row is the point. Jev identified the Delete button at 0.98, because it is the right button for that goal. Only a separate risk question stops it.

Where this fits

Jev is a fast, calibrated selector. It works inside a structure that something smarter built, and it will not build or repair that structure. When a run fell short, the model could not say why. We diagnosed it, and the fix was a map, a reader, or a rule, never a prompt.

That points to a split. A person or a reasoning model plans once. Jev executes many times, cheaply, and says no when it is unsure. The uses that follow are a smoke tester that clicks through a product after each deploy and reports what each click did in plain words, and a gate inside a pipeline for routing, feasibility, and “is this done”.

It is not a planner, and it is not a replacement for a model that writes. It is the part of an agent that should have been a lookup all along.