System One decision models

Use a model for a constrained judgment, not for permissions or side effects:

authorized state + trusted typed questions -> validated model answers
-> deterministic policy -> act / wait / review / abstain -> observed outcome

Keep hard business rules, authority checks, thresholds, action execution, confirmation, and rollback in code or human control. A legal response shape does not imply a correct judgment; a high probability is not permission.

Start here

1. Inspect the real application's state source, action boundary, tests, and deployment before changing it. Preserve existing deterministic/no-key behavior unless explicitly changing it is in scope.
2. Fill templates/decision-contract.md: trusted state, question IDs/types, allowed answers, unknown/review lane, side effects, owner, deadlines, and rollback. For tool control, also use templates/action-control-contract.md. New to this model class? Start with references/worked-decision-pilot.md to choose one bounded decision, then use references/concepts-and-patterns.md for primitive semantics and composition.
3. Open only the matching reference below. Keep exact question instructions, criteria, state paths, and thresholds in trusted configuration, not user-supplied state. IDs are for application code; TypeSafe documents that Jev does not send question IDs to the model, so put complete judgment meaning in each instruction. Other providers may have different contracts. For question wording or candidate extraction, read references/question-design.md.
4. Validate response IDs, types, option sets, distributions, score rubric, and finite values before policy code; record returned model/version and enforce the pinned deployment identity. Treat malformed, unavailable, stale, or low-evidence results as the specified fallback.
5. Verify on representative held-out data and the actual delivery boundary; record provider/model, question/policy revision, outcome, and failure lane without raw secrets or unnecessary personal data.

Before expanding a cross-model battery, complete templates/decision-battery-design-review.md and review a small varied pilot. Define whether a test counts a distinct scenario, a question, or a request; freeze the answer rubric, comparison contract, and timing conditions before generating more cases. If those definitions or reviewer labels disagree, stop expansion and revise the design. Keep benchmark outputs outside this skill's tracked corpus unless publication is explicitly requested.

Route by task

For a hosted provider integration, refresh the provider's live documentation index, then read the current API or selected SDK reference and the nearest cookbook before coding. references/jev.md contains the Jev-specific route and fallback procedure; its endpoint and contract details are a dated snapshot.

Run python3 scripts/systemone_probe.py --request examples/request.json for an offline contract check. Add --live only when the user has authorized transmitting that state and incurring cost. For local Laya, scripts/laya_service.py requires a pinned local model directory and a runtime secret; it is a private reference adapter, not a public Internet service.

Cross-cutting limits

• Jev is managed/API-only; do not invent a self-hosted Jev weight download. Prefer jev-latest for general examples, but verify its resolved revision: on 2026-10-15 it is 1.13.0; the new 1.14.0 is jev-preview. Images, Box, and long context require explicit experimental opt-ins; see references/jev.md.
• Laya, CLM, and Jev can share a typed application interface, but not assumed thresholds, calibration, latency, language behavior, or model quality.
• Before enabling Laya caller traffic, keep ingress private and authenticated; define finite, application-specific caps for request bytes, question count, options per Choice, concurrency, queue wait, and total deadline. Readiness waits for the pinned model, tokenizer, actual device, and any calibration artifact the application uses. The bundled adapter's /readyz checks device residency only; extend it to cover every required artifact before routing production traffic.
• For large Laya Choice sets, check tokenized labels against the head-token budget, verifying coverage and truncation; an option-count transport cap does not prove quality. If shortlisting, measure recall and treat probabilities as conditional on exactly the retained candidate set. Prefer other, unknown, or review when labels are not exhaustive. See references/laya.md.
• Independent questions may share one call, but test the exact batched request shape on frozen cases. Dependent questions need another call when the first answer changes their state or candidate set.
• Predeclare whether a comparison holds decision semantics fixed or compares separately adapted model-plus-adapter systems. Qualify adapter polarity, schema, and overflow behavior before scoring; a compatible response shape is not evidence of semantic parity. Record the protocol in templates/benchmark-record.md.
• Validate error discrimination separately from probability calibration before confidence-based escalation. Freeze the route on selection data, then test absolute accepted risk and fallback rescue/regression on untouched units. Unsupported evidence or expired state cannot be overridden by confidence.
• A fallback judge or multi-provider agreement is not independent correctness evidence. Measure shared errors and held-out rescue/regression before claiming cascade quality gains; see references/rubric-judge-research.md.
• A semantic lint result is a model judgment, not proof that a code rule is satisfied. Keep syntax/schema checks deterministic, semantic findings reviewable, and gates advisory until independent grouped holdouts measure false passes, false blocks, abstention, drift, and complete task cost.
• A model cannot replace exact arithmetic, provenance, eligibility, safety reflexes, or irreversible approval. A text-generating model may be a separate bounded stage after a typed route, not an implicit source of authority.

Finish an integration only when its contract, held-out evaluation, failure path, deployment/readiness check, and rollback record exist. For diagnosis, stop after the smallest evidence identifies the boundary and one recheck verifies a fix, or after three non-converging passes with evidence for the owner. Do not generalize from a single demo or vendor benchmark.

When not to use

Use ml-engineering for general training strategy; docker-compose or kubernetes for their serving infrastructure; ai-governance for organization-wide authority design. Use a generative-model skill for prose, open-ended planning, or long reasoning without a typed-decision contract.

Framework handoff

The harness provides authorized, versioned state, candidate/route bounds, task goal, deadline, and the outcome to verify. This skill consumes that evidence under a pinned question/rubric/model contract and returns validated typed answers, model identity/revision, and an explicit unknown or failure lane. PydanticAI, LangGraph, and LangChain carry and route the result through their own documented seams; deterministic policy decides the next workflow step. The harness returns observed effects and accepted-task outcomes for end-to-end evaluation. Keep question/model calibration evidence inside this skill, and use harness-engineering for placement, authority, recovery, and whole-task evidence.

Authoritative business rules

For business-policy translation, route to spec-driven-development's policy recipe and release contract. Use deterministic code for approved rules; retrieval explains clauses and bounded model judgments route uncertain evidence to review. Neither a typed judgment nor eligibility grants execution authority.