PlanCut

Inspiration

AI agents are excellent at executing tasks, but a misunderstood plan can create expensive rework. We wanted developers to review an agent’s intended workflow before execution and make those decisions enforceable.

What it does

PlanCut turns an AI-generated plan into editable work clips. Developers can reorder steps, narrow scope, lock files or tools, define expected outcomes, and require approvals.

After approval, PlanCut compiles the plan into immutable execution contracts. Every tool call passes through a server-side, default-deny PolicyGate. Unsafe actions are blocked, failed clips can be recut independently, and execution resumes from a trusted checkpoint with evidence showing what was proposed, approved, and completed.

How we built it

We built PlanCut as a modular Next.js application with a long-lived Node process. The core architecture includes:

• Strict TypeScript schemas and a pure plan compiler
• Server-enforced PolicyGate authorization
• Bounded filesystem and code-editing tools
• SQLite persistence through better-sqlite3
• Append-only runtime events, checkpoints, and evidence
• Playwright-based browser verification
• A React and Tailwind workbench for editing and reviewing plans
• A guarded OpenAI Agents SDK integration configured for GPT-5.6
• Vitest architecture, policy, integration, persistence, and adversarial tests

The public demo uses a deterministic Northstar Billing Portal fixture so judges can reproduce the complete safety, recut, verification, and approval journey without an API key or model spend.

Challenges we ran into

The biggest challenge was ensuring that the plan was a real runtime contract rather than just a visual plan. Model output can suggest an action, but it must never be allowed to authorize itself.

We also had to make blocked actions provable, preserve workspace state across recuts, prevent forbidden writes before they occurred, and separate trusted evidence from model claims. Finally, we had to design a useful demo while being precise about which parts were deterministic and which parts used live GPT-5.6 execution.

Accomplishments that we're proud of

• A real forbidden-write proof: globally locked files remain unchanged byte-for-byte.
• A server-side PolicyGate where global deny rules override clip permissions.
• Durable activity history showing the rough plan, approved plan, and actual execution.
• Recovery of only the failed clip instead of restarting the entire run.
• Trusted checkpoints, evidence records, verification results, and approval gates.
• A reproducible public demo that requires no API key or paid model call.
• A complete modular architecture with extensive automated verification.

What we learned

The editable plan is most valuable when it directly controls execution. A timeline UI alone is not enough; every edit must compile into a smaller, testable, enforceable contract.

We also learned that agent systems need clear boundaries between model intelligence and application authority. The model can plan, explain, and adapt, but the server must decide what is allowed and whether the result is actually verified.

What's next for PlanCut

Next, we want to complete the full live GPT-5.6 planning-to-promotion journey, add more project fixtures, improve drag-and-drop timeline editing, and support richer visual keyframes.

Longer term, PlanCut could support reusable policy templates, team approvals, stronger workspace isolation, and integrations with real repositories while preserving the same principle: edit the plan before the agent runs.

Built With

• azure-container-apps
• codex
• docker
• gpt-5.6
• next.js
• openai-agents-sdk
• playwright
• react
• sqlite-via-better-sqlite3
• tailwind-css
• typescript
• vitest
• zod