Cortex: A Fixed-Point Theory of Governed Coding Agents - Technical Report

Marius-Constantin Dinu; Florian Zeba

cs.AIOct 16, 2026

Cortex: A Fixed-Point Theory of Governed Coding Agents - Technical Report

Authors: Marius-Constantin Dinu, Florian Zeba

Organizations: Alpha Omega Labs

Abstract

A coding agent combines a large language model (LLM) with a harness that plans, edits, and executes code. We study Cortex, a supervisory layer for pre-execution governance, requirement tracking, and iterative validation and repair. We formalize requirement closure on a finite lattice. For a fixed requirement set and a sound, monotone validation rule with persistent evidence, exhaustive iteration reaches the least fixed point with no more strict increases than there are requirements. Fair consequence scheduling reaches the same closure. A separate stochastic model bounds expected completion time under a uniform positive-progress assumption. These results depend on their stated assumptions; artifact repair, fallible validation, and finite execution budgets do not satisfy them automatically. We define Gauntlet's trajectory-similarity and build-gated scores, attack-success estimators, Wilson intervals, and case-cluster bootstrap summaries. Effective-feedback accounting counts newly certified requirements, rather than estimating their information value or utility. The five evaluation families support raw-versus-governed comparisons. We report retained benchmark observations, including rescoring of existing artifacts; constructed outcomes are excluded. Unequal observation sets and incomplete provenance prevent causal claims about governance or measured long-horizon scaling.

Figures & tables

Figure 1: Schematic execution–validation–repair architecture. Its consequence-operator abstraction requires a sufficient requirement state, monotone validation, and sound persistent certificates (Section 4.2). The operational repair cycle does not establish those assumptions.

Figure 2: Illustrative Kleene ascent for the fixed monotone operator of Theorem 1, not a measured agent trace. At most

|R|

strict increases occur; one further evaluation may detect closure. A fair schedule reaches the same least fixed point, which can leave required work unresolved.

Figure 3: The two components of the VERTEX trajectory score (Section 5.1). Left: the cross-similarity matrix

\mathbf{S}_{ij}=\langle\varphi(c_{i}),\varphi(r_{j})\rangle

between candidate descriptors

c_{i}

(rows) and reference descriptors

r_{j}

(columns); stronger color indicates higher similarity in this illustrative matrix. The presence component reads bidirectional best matches off this matrix (which reference behaviors appear, and how strongly). Right: the order component uses a minimum-cost monotone DTW alignment. Its step cost

(1-\mathbf{S}_{ij})(1+\lambda|\frac{i-1}{m}-\frac{j-1}{n}|)

increases with normalized positional displacement. Both components are recalibrated against the mean-similarity baseline (Proposition 3).

Diagnostic	Meaning
$n$	Maximum loop iterations / total passes allowed for the run.
Productive passes	Passes with $S_{t+1}\supsetneq S_{t}$ in the certificate-accumulation trace.
$\mathrm{efc}(S_{t})$	New certificates enabled by the abstract operator: $\|\Phi(S_{t})\setminus S_{t}\|$ .
$\|R\|,\ \|R_{\mathrm{req}}\|$	Total and required requirement counts (the milestone budget).
Reasoning budget $b$	Thinking mode / compute budget the harness ran under.
$\Pr(T_{C}\leq n)$	Probability of covering $R_{\mathrm{req}}$ within the iteration budget (§4.4).

Table 1: Proposed execution diagnostics. No fitted Markov kernel, calibrated per-requirement prior, or completion-time distribution is reported here.

Family	Task and score	Validity boundary
S: Safety	Classified attack responses and proposed actions; ASR and benign over-refusal.	Lexical classification and action replay are not observed exploits. Live carrier-task utility is unmeasured.
Q: Quality	Generated code, hidden behavioral tests, static findings, lint/types and quality rubrics.	Analyzer availability and evaluator integrity are prerequisites; finite tests are incomplete.
R: Bugfix	Repository patches; resolution-gated score with held-out and regression checks.	Reference-diff similarity is not correctness. Test-runner tampering must be independently excluded.
G: Generative	Full-stack application generation; build/serve checks, feature probes, static scores and optional visual evidence.	Passed features do not establish complete application behavior, real model-endpoint use or time-resolved progress. Historical applications and the current chat-app protocol are distinguished below.
P: Project	One storefront brief, build-gated functional/semantic/visual/static composite.	Partial behavioral and accessibility proxies are not a complete storefront or payment validation.

Table 2: Five families and their measurement boundaries. No direction of a raw-versus-governed effect is assumed by the score definition.

Figure 4: Classified attack responses in the June 2026 safety pilot, comparing five historical harness configurations. Points show observed rates, whiskers the stored 95% Wilson intervals, and labels the successes and observed attempts. Model names are historical labels. Section 7 describes coverage, provenance, and benign-control limitations; these are descriptive, not causal comparisons.

Historical arm label	Classified successes / observed attempts	ASR	Stored 95% Wilson interval
Codex raw	25 / 59	42.37%	30.61–55.07%
Cortex over Codex	14 / 58	24.14%	14.96–36.53%
Claude raw	2 / 59	3.39%	0.93–11.54%
Cortex over Claude	1 / 60	1.67%	0.29–8.86%
OpenCode	23 / 54	42.59%	30.33–55.84%

Table 3: Historical classified safety outcomes from the stated June 2026 cohort. Intervals are the stored 95% Wilson intervals, not newly reproduced estimates.

Figure 5: Recorded coding outcomes: task-macro behavioral coverage (left), resolved issues (middle), and passed to-do features (right). Each row is a harness configuration; higher values are better within each panel, not comparable units across panels. Exact cells and evaluation limits are in Tables 4–6. The upload task accounts for the paired quality difference; there is no paired repair-resolution difference. These small historical pilots are not causal tests.

Figure 6: Within-pool VERTEX rank agreement on the same storefront brief. Each marker is one built application; the dashed diagonal is identical ordering, not score calibration. Rank 1 is highest on both axes. The two-arm pool needs only a matching order to obtain correlation 1; the five-arm pool swaps the first and third positions. Exact scores and ranks are in Table 9. Pool-based peer reference construction differs between the panels; they are not independent task replications.

Task	Codex raw	Codex + Cortex	Claude raw	Claude + Cortex	OpenCode reference
Secret utilities	3/3	3/3	3/3	3/3	3/3
Input parsing	2/2	2/2	2/2	2/2	2/2
Database access	1/1	1/1	1/1	1/1	0/1
Upload API	0/1	2/2	0/1	2/2	0/1
Web security	7/7	7/7	7/7	7/7	0/1
Shopping cart	7/8	7/8	7/8	7/8	0/1

Table 4: Quality: passing / collected behavioral checks in each task–arm outcome. The last row is the equal-weight mean of the six task rates, not pooled test success. Collected upload test totals differ across arms. Four OpenCode generation failures remain as zero-scored outcomes. These test counts are not the number of natural-language requirements certified.

Issue	Codex raw	Codex + Cortex	Claude raw	Claude + Cortex	OpenCode reference
Even-value sum	1/1	1/1	1/1	1/1	1/1
Stack removal	2/2	2/2	2/2	2/2	2/2
URL normalization	1/1	1/1	1/1	1/1	1/1
Pagination	1/1	1/1	1/1	1/1	0/1
Word counting	1/1	1/1	1/1	1/1	1/1
Lower clamp bound	1/1	1/1	1/1	1/1	1/1

Table 5: Repair: passing / collected issue tests, resolved issues, and stored composite means. There are no auxiliary held-out or regression tests in any row. Empty auxiliary groups received passing defaults; strict-rate fields therefore add no independent evidence. The paired Codex composite difference reflects patch minimality, not extra resolved issues.

Final feature check	Codex raw	Codex + Cortex	Claude raw	Claude + Cortex	OpenCode reference
Page title	1	1	1	1	1
Input form	1	1	1	1	1
List tasks	1	1	1	1	1
Create task	0	1	1	1	1
Read after write	0	1	1	1	1
Passed features	3/5	5/5	5/5	5/5	5/5

Table 6: To-do application: one means the check passed and zero means it failed. All five candidates recorded successful builds. Read after write means a newly created task is returned in the same session, not persistence across process restarts. These are five candidate applications with five checks each, not 25 independent tasks.

Figure 7: The five observed final feature outcomes in checklist order. Position is the feature index divided by four; it is not elapsed time, a repair pass, or a milestone observation. Table 6 defines the checks and provides the binary data. No interpolation or completion-decay curve is supported by these observations.

Component	Codex raw	Claude raw
Functional	0.3636	0.7273
VERTEX	0.4309	0.5271
PWA / accessibility	0.8750	0.6250
Visual similarity	0.5930	0.6763
Code / architecture	0.7682	0.7628
Robustness	1.0000	1.0000

Table 7: Two-arm storefront pool. One built candidate per arm; these are retained, subsequently rescored outcomes. All scores are in [0,1]. Component meanings and weights are specified in Appendix B.4; proxy scores of one do not certify exhaustive correctness. The composite uses authored-reference VERTEX, not the separate estimated-reference diagnostic.

Component	Codex raw	Codex + Cortex	Claude raw	Claude + Cortex	OpenCode reference
Functional	0.5455	0.4545	0.4545	0.4545	0.7273
VERTEX	0.5214	0.4776	0.4512	0.4199	0.5070
PWA / accessibility	1.0000	0.8750	0.7500	0.6250	0.6250
Visual similarity	0.6154	0.6138	0.6509	0.6242	0.6605
Code / architecture	0.7328	0.7328	0.7563	0.7519	0.6591
Robustness	1.0000	1.0000	1.0000	1.0000	1.0000

Table 8: Five-arm storefront pool. One built candidate per arm; these are retained, subsequently rescored outcomes. All scores are in [0,1]. Component meanings and weights are specified in Appendix B.4; proxy scores of one do not certify exhaustive correctness. The composite uses authored-reference VERTEX, not the separate estimated-reference diagnostic.

Figure 8: Recorded storefront score profiles, rounded to two decimals for display. Tables 7–8 retain four-decimal values and distinguish the two separately captured candidate pools. Component scores are proxies, not success probabilities; perfect recorded robustness or static-security values do not establish exhaustive testing or absence of vulnerabilities. The composite is a weighted, build-gated combination, not an additional independent measurement.

Candidate pool	Configuration	Authored VERTEX	Estimated VERTEX	Rank change
Two-arm	Codex raw	0.4309	0.4142	2 $\rightarrow$ 2
Two-arm	Claude raw	0.5271	0.5465	1 $\rightarrow$ 1
Five-arm	Codex raw	0.5214	0.6026	1 $\rightarrow$ 3
Five-arm	Cortex over Codex	0.4776	0.6465	3 $\rightarrow$ 1
Five-arm	Claude raw	0.4512	0.5971	4 $\rightarrow$ 4
Five-arm	Cortex over Claude	0.4199	0.5126	5 $\rightarrow$ 5

Table 9: Exact VERTEX pairs and within-pool ranks (1 = highest) for Figure 6. Rank arrows mean authored to estimated rank, not improvement over time. The two pools share one storefront brief; seven pairs are not seven independent task samples. Peer-consensus descriptors are unavailable with only two arms.

AI Coding Agents

AI coding agents use language models and software tools to plan, edit, test, and maintain code with varying levels of autonomy.

See all 310 papers

Cortex: Measurement-Gated Evolution and Pruning of Coding-Agent Skills and Rules
Oct 9, 2026Samuele GiampieriLLM Agent Harnesses LLM Agent Skill Learning
Independent researcher
Steerability via constraints: a substrate for scalable oversight of coding agents
Jul 2, 2026Thomas WinningerScalable Oversight Coding Agents
Télécom SudParis, Évry-Courcouronnes, France · ENS Paris-Saclay, Gif-sur-Yvette, France
Engineering Reliable Coding Agents: Evaluating and Operating the System Around the Model
Aug 14, 2026Stephanie JarmakAI Agent Reliability Coding Agents

Oct 9, 2026J/K move · Enter open · S save

Cortex: Measurement-Gated Evolution and Pruning of Coding-Agent Skills and Rules

Samuele Giampieri

Independent researcher

LLM Agent Harnesses LLM Agent Skill Learning LLM Agent Self-Improvement

Open paper AskPDF arXiv

Coding agents such as Claude Code also follow text files that developers write for them: a project file, skills the agent may choose to open, and rules that load automatically when the agent reads matching files. We call these files the agent's harness. Developers add to it whenever they correct the agent, but one success proves little: the same agent can pass a task once and fail it the next time. We present Cortex, a tool that tests changes to the harness instead of trusting them. It saves fixes from the developer's sessions as replayable tasks, finds the corrections that recur, writes one skill or rule at a time, and keeps it only if repeated runs with and without it show a net gain and no task made noticeably worse. Existing text is tested the same way before it is deleted, and Cortex neither adds nor deletes text the agent never used. We tested Cortex with Claude Haiku 4.5 on a repository built for the purpose, with conventions the model tends to break, one area with nothing to learn, and a script playing the developer. On held-out tasks, the harnesses it built made the agent follow the conventions far more often than no skills or rules did, left the comparison area unchanged, and added no text read on every turn. Rules, which load automatically, did most of the work; skills helped only when offered with the files a task touches, and those offered on every turn were rarely opened. Cortex kept none of the useless or harmful suggestions we planted, but the agent never opened the useless ones or the harmful skills, and it reached no verdict on the harmful rules, so the test shows that Cortex keeps no unused text, not that it detects damage. Under the stronger Claude Sonnet 5 a single run's harness added little, and on a real open-source project, where the agent was rarely corrected, Cortex found nothing to learn. We release the tool, the lab and its data.

Abstract

AI Coding Agents

Explore similar work

Cortex: Measurement-Gated Evolution and Pruning of Coding-Agent Skills and Rules

Steerability via constraints: a substrate for scalable oversight of coding agents

Engineering Reliable Coding Agents: Evaluating and Operating the System Around the Model