Describe Review Approve Inspect: A Coding Agent Loop Built for Control

A developer released Cue, an MIT-licensed Windows 11 Electron coding agent that uses Codex CLI for its model path and runs workspace actions under AppContainer workers. Cue freezes a human-readable "execution envelope" — the approved worktree and allowed actions — before any file mutation begins, then lets users inspect a ledger of provenance and outcomes or hit Stop to terminate the controller and workers. The project targets small, inspectable file-changing goals and explicitly does not claim syscall-enforced network isolation or nested worker child processes in v0.1.

Most local coding agents force a false choice: YOLO the desktop , or approve every tool call until you give up . Cue is built for a third path. It is a Windows 11 Electron coding agent MIT that uses Codex CLI for the model path on the host, runs workspace actions under AppContainer workers, and freezes a human-readable execution envelope before anything mutates your files. You describe a goal, review the scope, approve once, then inspect a ledger — or hit Stop. This post is about that control loop. If you want the sandbox-primitive deep dive why AppContainer is Cue’s floor , that lives in Day1 — one link at the end. Here we stay on what using it feels like. Two failure modes dominate desktop agents today. YOLO desktop. The agent gets a wide trust surface because “real developer work” needs shells, helpers, caches, and whatever the next step invents. You move fast until something lands outside the folder you thought you meant. The product rarely shows a frozen boundary you can point at later. Approval fatigue. The other extreme asks you to click through every tool, every path, every spawn. It feels safer for an afternoon, then you start auto-approving because the friction is the product. Control collapses into ritual. Neither mode is “wrong” for every threat model. But both leave a gap for people who want one human decision that actually bounds the run — not unlimited trust, and not infinite micro-prompts. Cue does not claim to “solve agent security forever.” It claims a narrower product contract: freeze the envelope before workers run, keep mutation inside the approved worktree, and make outcomes inspectable. Cue’s loop is deliberately short: Fail-closed matters as much as the happy path. If you cancel at the workspace picker, execution does not start. Cue retains cancel evidence under README Verification P12 cancel for that fail-closed behavior — this post will not reprint those tables. The security story is not “trust the model, then restrict whatever it tried.” It is “freeze the envelope, then run only inside it.” An execution envelope, in Cue, is the human-approved scope for a coding run: the worktree and allowed actions frozen before workspace workers start. After approval, the envelope does not expand. That definition is the product. Everything else is implementation detail. Practically: cwd ; the server fixes it to that worktree. Adjacent honesty from README Current limits: Cue does not remove Windows UAC/elevation friction, does not claim syscall-enforced network isolation for all paths P3-16 is detect-and-stop, not syscall forcing , and does not support nested worker child processes in v0.1. So “envelope” is not marketing fog. It is a freeze point you can review, then a hard refusal to grow after you click Approve. A control loop without an honest ending is just a prettier YOLO. Cue’s ledger surfaces provenance and outcome classes you can inspect: That triad is how Cue answers “did it stay inside what I approved?” without asking you to scrub raw logs for every run. Stop is part of the same contract. Hitting Stop terminates the active controller and workers — not a soft UI pause that leaves orphans chewing your worktree. If you care about mid-run kill-switches for coding agents, that is the behavior to verify against the README’s Stop evidence path, not a marketing slide. Watch the clip: cue-demo-en.mp4 https://github.com/zenovis2-create/cue/blob/main/docs/assets/cue-demo-en.mp4 It is a 34-second edited recording of a real small file-changing flow checklist-style generation . You should see goal → envelope review → approve → ledger. That is the proof this post leans on: the control UX, not a wall of isolation tables. What it does not prove: v0.1 is aimed at small, inspectable file-changing goals on Windows 11: Wrong-fit for now : Those limits are intentional coherence, not temporary bashfulness. If your first experiment needs nested tooling or open-ended YOLO scope, Cue will feel frustrating — correctly. Start with a disposable worktree and a one-file goal. This article intentionally does not re-litigate OpenAI’s AppContainer rejection for Codex-shaped workloads. Cue’s isolation floor capability-zero AppContainer workers, approved worktree, host vs worker split is covered here: Why Cue still uses AppContainer after Codex rejected it for Windows agents https://dev.to/ 76dca2218d5cc98e685ca/why-cue-still-uses-appcontainer-after-codex-rejected-it-for-windows-agents-5h1b For verification entry points without a Day2 evidence dump, see the README Verification section in the repo. If your pain is “I want to approve before a coding agent runs — once, with a real envelope — then inspect what happened,” Cue is for that moment. npm install then npm start Star if you want more envelope-first Windows agent work. Open an issue if an approved envelope was exceeded. That feedback is more useful than applause. The product bet only holds if the freeze point stays frozen.