Codex GPU Helper

A safe local second opinion for Codex on the Windows GPU you already own.

Comment

Official site: https://thalenai.com/ Install: https://thalenai.com/install

Inspiration

Local models can help with repetitive review, log grouping, edge-case generation, and second opinions, but connecting one directly to an engineering agent creates new failure modes: accidental authority, fragile configuration edits, GPU contention, untrusted model identity, and destructive attempts to unload shared runtimes. I wanted a path that keeps Codex firmly in charge while making spare Windows GPU capacity useful and optional.

What it does

Codex GPU Helper is an independent Windows x64 app that installs an optional, read-only stdio MCP reviewer named local_gpu_reviewer. Codex explicitly supplies bounded text to three tools:

  • local_gpu_health checks availability and load state without inference.
  • local_gpu_plan chooses a safe installed model and context policy without loading it.
  • local_gpu_review runs one bounded advisory generation after Codex announces the provider, model, and purpose.

The reviewer cannot read files, run a shell, inspect Git, edit code, deploy, publish, send messages, or make external changes. Its output is untrusted advice that the GPT-5.6 Codex primary agent independently verifies.

The installer and Control Center preserve existing Codex configuration, create timestamped backups, show dry-run diffs, update only product-owned blocks, roll back failures, and avoid replacing an existing unmarked integration. Automatic routing is deterministic: it considers explicit task kind first, then focus/assignment phrases, then a conservative size fallback. Task/effort capability floors and catalog suitability select the strongest suitable deep route or the smallest safe route during GPU contention, while still checking installed audited model digests, VRAM/RAM/Windows commit pressure, GPU-heavy workloads, and storage reserve. Unsafe pressure, cross-chat contention, foreign loaded models, non-loopback providers, or uncertain ownership cause a safe refusal. Passive automatic health truthfully reports the task-aware provider pool without falsely disabling healthy Ollama when optional LM Studio is unavailable; local_gpu_plan remains authoritative for the actual route. The helper preserves raw advisory findings and adds bounded eight-field structuredFindings (maximum 20) plus structuredFindingsStatus; ConfirmedObservations remains empty until Codex independently verifies them.

How I built it

The product uses C# and .NET 10, Windows Forms, a bounded MCP stdio server, Inno Setup, PowerShell release automation, GitHub Actions, SPDX SBOM generation, artifact attestations, and verified loopback Ollama plus exact-file registered LM Studio/GGUF routes.

Protected Codex files are parsed, backed up, changed surgically, re-parsed, and rolled back on failure. Runtime actions are bound to exact paths, digests, process identity, current-user checks, fresh state, and cross-process leases. Passive health and planning never run inference, installation never downloads or loads a model automatically, and reviews request immediate release.

How I used Codex and GPT-5.6

GPT-5.6 in Codex was the primary engineering agent throughout the qualifying Build Week work. I used it to trace Windows process and configuration boundaries, design preservation-first transactions, implement the .NET applications and MCP contract, generate and refine tests, analyze runtime races, conduct Codex Security reviews, and drive installer and release verification.

Codex accelerated the project by connecting architecture, implementation, adversarial review, and runtime evidence in one workflow. Final security severity, release readiness, model identity, process ownership, and destructive-action decisions stayed with GPT-5.6 Codex—not the local reviewer. Primary /feedback Session ID: 019f5c1b-5d5f-7d20-9e18-e9067fa16b11.

Challenges

The hardest problem was proving what the helper owns. A model tag is mutable, a loopback port can belong to the wrong process, protected Codex files may contain unrelated user content, and a shared provider may already be serving someone else's workload. The solution was to bind actions to explicit product markers, exact paths and digests, signed/current-user process checks, fresh state hashes, cross-process leases, and fail-closed transitions.

The second challenge was making safety understandable. The UI has to explain passive planning versus inference, pause versus disable, helper-owned versus foreign runtimes, explicit model-action consent, SmartScreen warnings, and why some actions intentionally refuse.

Accomplishments

  • A runnable beginner-facing Windows installer and focused Control Center.
  • Surgical, backed-up, idempotent, rollback-safe Codex configuration management.
  • A deliberately tiny three-tool read-only MCP surface with no filesystem or mutation authority.
  • Task- and hardware-aware routing across installed, integrity-checked Ollama and registered exact-file LM Studio/GGUF models.
  • Single-flight review, resource-pressure refusal, immediate unload semantics, and foreign-model preservation.
  • 407/407 isolated tests plus a full beta.25 release audit: privacy/secret scan across 171 repository files, build with 0 warnings/errors, dependency audit, installer compile, and friend-bundle relocation/checksum/layout verification. Public checksums and GitHub attestation were independently reverified from a fresh download.
  • Beta.22 removed the hidden .NET HttpClient 100-second default ceiling from both LM Studio and Ollama provider clients while retaining explicit bounded per-operation cancellation. Beta.23 keeps that runtime behavior unchanged and adds a public-install bootstrap correction for signed-out beginners.
  • Public prerelease v0.1.0-beta.25 from exact reviewed main/tag commit b8a2209b541151f14fd9d80aaa8c5fc90a57f966; public installer SHA-256: 3384d13c64c3f5767481fd14e2e872c911da951893c95b6ae7310f6cd140ee42.
  • Exact GitHub Release workflow, CI, and Security/CodeQL all succeeded.
  • Beta.23 fixes a real signed-out beginner failure: the website prompt and packaged 0 - PASTE THIS INTO CODEX.md now provide exact public repository and raw-guide URLs, forbid guessed links, retry exact URLs over ordinary unauthenticated HTTPS, never require GitHub sign-in for a public install, and report the exact failing URL/status instead of inferring that the repository is private.
  • Live site version 8 from source commit 5c99957d1679a983a30fa3a61447940342abf369 at thalenai.com serves the corrected copy prompt. Browser verification found no console errors or horizontal overflow, and the expanded prompt contains the exact raw-URL, no-sign-in, and exact-failure contract. Existing chats that pasted the older prompt should reload the site, copy again, and start a fresh Codex task.
  • Live runtime install proof (beta.22; runtime unchanged in beta.25): the exact attested public installer reported product version 0.1.0-beta.22+a3640835dd2ebbc6d0b807bfb566a7af2e5ff982. A package-only upgrade plus hash-bound managed repair left both protected config.toml and AGENTS.override.md byte-for-byte unchanged, created timestamped backups, and produced a second repair dry-run no-op.
  • Live Qwythos proof (beta.22; runtime unchanged in beta.25): the Control Center showed Normal & deep routing to Qwythos 9B through LM Studio, visibly transitioned from No model loaded through bounded loading to success, and reported: “Review succeeded with Qwythos 9B through LM Studio. Elapsed: 2:02. Model released: Yes.” That successful cold load crossed the old hidden 100-second failure boundary.
  • Final live state: the UI returned to No model loaded; LM Studio loaded instances=0; Ollama loaded models=0; exactly one Ollama server; no activity-tracker residue; listeners only on 127.0.0.1:1234 and 127.0.0.1:11434.

What I learned

The useful local-AI problem is not simply choosing a model. It is building a trustworthy systems boundary around an untrusted advisory component: identity, ownership, consent, resource accounting, reversible configuration, and honest refusal. The smaller and clearer the local tool's authority, the more confidently Codex can use it.

What's next

  • Authenticode signing so ordinary Windows users no longer face an unknown-publisher warning.
  • More measured hardware fixtures and audited model entries without relaxing safety reserve.
  • Broader usability testing on clean Windows machines.
  • Additional bounded reviewer tasks and evaluations while final decisions remain with Codex.
  • Trusted-LAN Codex workers only as a future, separately installable companion after a dedicated threat model and private alpha; no LAN worker ships in this release.

Try it

Windows x64 only. This is an unsigned prerelease, so SmartScreen may warn. No model weights are bundled. Local output is advisory and untrusted. LM Studio routing requires an existing exact catalog-supported GGUF. Codex remains primary, and cloud-use or cost reduction is possible but not guaranteed.

Built With

  • .net
  • ai-safety
  • attestations
  • c#
  • codeql
  • codex
  • context
  • github-actions
  • gpt-5.6
  • inno-setup
  • lm-studio
  • local-ai
  • model
  • ollama
  • openai
  • powershell
  • protocol
  • qwythos
  • sha-256
  • spdx-sbom
  • windows
  • windows-x64
  • winforms
Share this project:

Updates