Before the Agent

The problem

Coding agents have become much more capable, but the prompt before execution is still an untyped boundary. A request can be vague, skip repository discovery, ask for parallel work that is not actually separable, or forget how success should be proved. Today, the coding agent often has to infer all of that after it has already started.

We built Before the Agent, a local meta-prompting model for developers who send work to Codex. It uses a fine-tuned 26-million-parameter Needle model to suggest how a coding task should begin, then puts deterministic policy and the user in charge of what happens next.

How it works

The real product is a local CLI and browser application. It ships with a 45.8 MB Cactus CQ4 model bundle and runs on CPU without an API key or model API call.

Every request passes through five visible stages:

1. Deterministic hard gates inspect local repository and harness state.
2. Needle proposes one capability plus bounded preflight actions such as asking a question, inspecting the repository, selecting a security review, or requiring verification.
3. A validator enforces allowlists, action budgets, clarification-versus-dispatch separation, and mandatory gates for sensitive work.
4. A trusted compiler expands only reviewed, versioned recipes while preserving the user's original request word for word.
5. A Codex adapter prepares a visible command, but execution still requires explicit human confirmation.

This separation matters. For an ambiguous request such as “Make the API fast enough,” Needle recommends asking a question and no launch plan is created. For a tenant-authorization audit, the model selects security review and repository inspection but can miss verification; deterministic policy adds that required gate. For a precise one-line patch, it chooses a quick path and stays out of the way.

What we learned

We first expected the small model to enrich or rewrite prompts. The experiments changed our mind. Cactus constrained tool names and keys, but not enum values. Moving bounded choices into 14 parameterless tools restored 100% allowlist validity and turned meta-prompting into a compiler rather than a prompt ghostwriter.

We also kept an honest product boundary. On 96 prompts written outside the training generator, the final CQ4 model reached 56.5% tool-name F1 and 37.5% exact action sets. It caught 14 of 18 clarification cases, but still acted on four. That 22.2% unsafe-dispatch rate is why the model recommends while deterministic policy and the user decide. On an Apple M4, inference averaged about 350 ms and 97 MB of engine RAM.

The repository includes 21,592 auditable JSONL rows across experiment variants, CPU fine-tuning logs, scale and epoch ablations, independent product evaluation, Cactus conversion and runtime measurements, case-level outputs, the working product, tests, and the public research site.

How we used Codex and GPT-5.6

Codex with GPT-5.6 was our continuous engineering loop: primary-source research, dataset design, generation and auditing, CPU fine-tuning, ablations, Cactus runtime debugging, tests, product implementation, and the public site.

OpenAI's GPT-5.6 launch described Sol as accelerating internal AI research across training systems, experiments, and improving another model. That inspired us to ask whether Codex could guide an end-to-end fine-tuning loop for a small model in a domain we cared about. We do not claim to reproduce OpenAI's internal training system; the inspiration was the idea of an AI engineering collaborator carrying research through to a measured product.

Source: https://openai.com/index/gpt-5-6/

The final router itself makes no OpenAI model call. Codex is downstream, and the user remains in control.

What we are proud of

• We converted a runtime constraint failure into a safer product contract instead of hiding it.
• The public demo is backed by the real tuned CQ4 model rather than a browser-only simulation.
• The original request is preserved verbatim and every added instruction is visible.
• Tests cover the orchestration boundary, safety invariants, path privacy, fresh repository inspection, and every deployed page.
• The submission reports both useful results and the failure rate that prevents autonomous dispatch.

What's next

Next we would collect corrections in shadow mode, learn ask/act/abstain preferences, add calibrated per-action thresholds, resolve multiple installed coding harnesses by capability, and validate the same runtime across Windows, Linux, and mobile-class CPUs.

Built With

• c++
• cactus
• codex
• fastapi
• gpt-5.6
• jax
• needle
• next.js
• python
• typescript