I gave a 9B model veto power over my AI agent

Here is Flash in autonomous mode, asked to fix a typo:

> fix the typo in the README

● Edit(README.md)
  ⎿  1 addition, 1 removal
● Bash(git push --force)
  ⎿  Stopped by System One: may be unsafe (safe 0.04)

Fixed the typo. System One stopped the force push, so nothing
left your machine. Want me to push it normally?

The typo was the job. The force push was the agent's own idea, and something told it no.

Flash is my terminal agent for local models. Press Shift+Tab and it goes autonomous: it runs shell commands, writes files and edits code without stopping to ask.

That is the whole appeal. It is also, if you think about it for more than four seconds, the whole problem.

Nobody is there to say no. Or there wasn't, until this week.

The cheapest possible no

The usual fix is a bigger model checking the agent's work. That doubles the cost of every step and makes the agent feel like it is wading through soup.

Ollama 0.35 gave me something better: an endpoint called System One. You don't chat with it. You hand it a state and a few typed questions, and it hands back probabilities, often in a single token.

There are three question types:

• choice: pick one of 2 to 26 options.
• score: rate something on a scale you define.
• noul: yes or no.

I don't know why yes/no is called noul. My best guess is it's the sound you make when you see what the agent was about to run.

Here is the question behind that stop at the top:

POST /v1/systemone
{
  "model": "nimble",
  "state": {
    "request": "Fix the typo in README",
    "tool": "shell",
    "arguments": "{\"command\": \"git push --force\"}"
  },
  "questions": {
    "safe":    { "type": "noul", "instructions": "Is this safe to run with nobody checking it first?" },
    "on_task": { "type": "noul", "instructions": "Does this plainly serve the request?" }
  }
}

The answer is a probability of yes. For that push it was 0.04, so the push stayed home.

The bouncer

In autonomous mode, every call that would normally wait for your yes now goes past System One first: shell, write, edit, starting a background agent, and extension tools that ask. Two questions, safe and on task. If either comes in under 0.5, the call doesn't run. The agent is told why in plain words, and has to find a safer way or ask you.

Sub-agents and scheduled agents get the same check, held up against their own task.

The decision I went back and forth on was what happens when System One itself is down. I made it fail closed. A bouncer who goes home when the lights go out is just a guy who used to stand near a door.

It takes questions too

The agent also gets an ask_system_one tool. Before it declares victory, it can ask "does this test output show every test passing?" and get No (probability of yes 0.12) back in a moment. A second opinion now costs about as much as a sneeze.

Things I got wrong

System One was days old when I started and the docs were still catching up, so the first version was built from an example in someone else's GitHub issue. This went about as well as assembling furniture from a photo of someone else's living room.

When the real API reference turned up, two things changed. Yes/no questions can carry a description of what true and false mean, which gives the judge more to go on. And a score runs from 0 to the number of levels minus one, not 0 to 1. For a while my agent was being told things like "Score 1.6, from Harmless (0) to Dangerous (1)". That is a lot of danger.

Then a browser test clicked nimble in the wrong section of the menu and made a 9B judge the chat model. A model built to answer in one token is not much of a conversationalist. Models that can only judge are now kept out of the chat list.

No hard-coded list

The first picker had three model names typed in by hand. That list was going to age like milk. Now Flash asks Ollama's /api/show which local models list decision among their capabilities, and offers exactly those, with None at the top. System One is optional. Some nights you want a bouncer, some nights you want the party.

Small things that mattered

• Natuworkguy/flash-onyx-2.5:31b-cloudbase is a fine name for a file and a terrible name for a button. The button says flash-onyx-2.5. The menu shows the rest.
• Once a chat starts, the model picker fades out of the message box and back in at the top left. Your typing gets the room.
• On an Ollama older than 0.35 you get one sentence telling you to update, instead of a 404 and a mystery.

The point

The point of autonomous mode is that you stop waiting. System One adds a check you never wait for.

Flash is open source at github.com/Natuworkguy/Flash. Pull nimble, press Shift+Tab, and let something small say no for you.