A coding agent is a language model wrapped in a control loop — a harness — that lets it plan, write, and run code. Left to itself, that loop optimizes for the next plausible token, not for behavior you would sign off on. That is why agents look brilliant in a demo and turn unpredictable in production. The fix is not a bigger model. It is a better loop.

The problem: the loop optimizes the wrong thing

Ask a raw agent to "add rate limiting and deploy it" and it will happily produce something that looks right. Whether it is right — whether the tests pass, the limiter is actually wired in, the deploy is reversible — is incidental to how the model was trained. The harness rarely checks. It generates, it acts, it moves on.

Cortex puts a meta-level control layer between the model and the world. Each step the agent proposes is checked against policy and against the task's own acceptance criteria before it is accepted. If a check fails, the layer feeds the specific failure back and asks for a repair, rather than letting the agent charge ahead. Plan, act, validate, repair — and only exit when nothing is left to fix.

Why "fixed point" is the right word

In our technical report, A Fixed-Point Theory of Governed Coding Agents, we model that loop formally. Each iteration applies a monotone refinement: it can only add satisfied constraints, never remove them. A loop like that is guaranteed to reach a state where another pass changes nothing — a least fixed point — in a bounded number of steps, and it gets there regardless of the order checks run in. In plain terms: it terminates, it is order-independent, and the result is stable.

That matters because it turns "the agent seems done" into "the agent is done, and here is the evidence." The exit condition is not a token budget or a vibe; it is the absence of any failing check.

the loop, in pseudocode// converge(): keep repairing until no check fails
function converge(task, state) {
  while (true) {
    const next   = agent.step(task, state)     // model proposes
    const gated  = policy.admit(next)          // capability + approval gate
    const report = validate(gated, task.checks) // tests, lint, SAST, spec
    if (report.allPass) return commit(state) // fixed point reached
    state = repair(state, report.failures)     // targeted feedback, not a redo
  }
}

The evidence

Theory is cheap, so we measured it. Our open benchmark runs the identical base model two ways — alone, and inside Cortex — across five kinds of work. With governance, the same model:

• cut successful jailbreaks by about 47% (malicious prompts that trick an agent into unsafe actions);
• raised the share of requirements its code actually meets from 81% to 98%;
• lifted generative capability by 25%, and held that quality over long tasks where raw agents drift;
• improved whole-repository build scores by 72%, reaching 98/100 overall versus 88 for the raw harness.

Across five task families, the same base model behind Cortex sharply reduces adversarial attack-success while preserving or improving capability — with the largest gains over long horizons.

The headline is not the leaderboard. It is that safety and capability stop being a trade-off once the loop is built to converge. You can have agents that are both safer and more capable — provided something is steering them. Read the full results and paper →