The mechanism

How Janus tells the difference

This page is for the person who would work inside Janus, or build against it. It answers three questions in order: how the system learns anything, what it holds about a professional, and what of that reaches anyone else.

Method

The loop is not the new part

A closed loop — act, read the result, choose the next action — is not new. Operational AI products already run one on the work itself. If that were the claim here it would be worth nothing.

What differs is the subject. Janus runs the loop on the pairing — how one person and one model reach a decision together — and revises its own belief about that pairing.

Fig. 2A closed loop is not the new part. What differs is the subject: the loop runs on one pairing, and what it revises is its own belief about that pairing.

Observe
The person’s judgment and confidence before the model speaks. The model’s recommendation. Whether the decision moved. Then the adjudicated outcome — what turned out to be true.
Hypothesize
A versioned statement bounded to this person, this model, this task class. Not this analyst over-trusts the model — nothing can test that. Closer to: on this task class, with this model, when the verdict arrives first, this person stops catching a particular kind of error.
Predict
Every hypothesis owes a claim about what a different arrangement would do. One that owes nothing is a mood, not a finding, and Janus does not keep it.
Intervene
The hypotheses that survive choose how the next decision gets run.
Revise
The outcome tests the prediction. A hypothesis that fails loses confidence or dies, and the record of having held it stays, dated, instead of being overwritten.

None of it is free. Capturing a judgment before the model speaks costs the minutes the person would have saved by reading its answer first: the evidence is bought with the time the product exists to stop wasting.

What is modelled, and what is not

Janus models professional decision-making. How someone forms a hypothesis. How well their confidence tracks their accuracy. Which of the model’s errors they catch, and which they wave through. What kind of help makes them better, and what kind turns them into an approval step.

That different people work differently with the same model is well established; it is why a rule written for a role averages away what matters. Whether a rich record of one pairing beats a simple one is not established. That is the test, and it ison another page.

It does not model the person. A finding names a pair and a situation — this person, this model, this task class, this order — and take the model or the task out of it and what is left describes nobody. A performance record is the opposite: built to survive being detached from its circumstances.

Two limits worth knowing, and a third on the page aboutwhat is not settled

In a small team, an organization-facing signal is attributable anyway.: Separation does not change arithmetic: if one person’s cases trigger a second review far above the base rate, the organization has an account of them without reading anything private.
A storage boundary is only as strong as whoever administers the store.: Scoping constrains what can be expressed; it is not cryptography. Holding against a determined administrator would take a minimum-cohort rule on aggregate reporting and a contractual bar on querying the private half. Neither is built.

Running enum / product state

Eight ways to run a decision

HUMAN_FIRSTthe person commits before the model speaks
AI_FIRSTthe model leads, the person reviews
EVIDENCE_ONLYthe material is shown, the verdict withheld
HIDE_AI_VERDICTthe model runs, its conclusion held back
CHALLENGEthe person is asked for the counterargument
SCAFFOLDthe reasoning is broken into prompted steps
SECOND_REVIEWthe case goes to a second pair of eyes
AUTOMATEthe human step is removed

AUTOMATE is in the list on purpose. A system that can only add human steps has an interest in keeping them, and is a poor instrument for asking whether a review still earns its cost. Janus can show the record on which a step stopped changing outcomes; it cannot carry the decision to remove one — that belongs to whoever owns the consequence.

It also consumes its own evidence: remove the person and you stop collecting the judgment that would say the step is needed again. Holding back a share of automated cases for review is what would answer that, and it is not built.

Design + known limits

What leaves the room

For Janus to learn anything true, a professional has to be able to be unsure without the hesitation becoming a performance record. So depth and exposure are separated at the level of what the system stores, subject to the limits above.

Stays with the professional

the reasoning history
how their confidence has tracked their accuracy
where they have disagreed with the model
recurring error classes
how they respond to a challenge or to scaffolding
what happened after past changes to the way their cases were run

Goes to the organization

that independent judgment was obtained
that a required review was completed
that a material disagreement remains
that a second review is needed
that escalation is needed
aggregate measures across the workflow

Fig. 3What crosses the seam is the fact that a checkpoint happened, not the reasoning that happened inside it.

The organization receives evidence that a checkpoint did its work at the moment the system depended on it. It does not receive an account of anyone — subject to the arithmetic above, which no design of mine removes.

The mechanism is one thing and the evidence for it is another.What runs today is the shorter page, and the honest one.