Two things I build:
- Flash, a local coding agent that runs in your terminal.
- Flash Onyx, the model it runs on. Gemma4 with a system prompt and sampling baked in.
As of today, I develop both of them from inside Flash, with Onyx driving.
/model natuworkguy/flash-onyx-2.3:31b-cloudbase
That tag is 96 KB on disk, because there are no weights in it. It is my prompt and my sampling pointed at a hosted base, so I get the flagship's judgement on its own prompt without 20 GB of weights sitting on my machine. The 12B runs fully local if you want that; for this job I wanted the bigger one.
That is the whole setup. Now look at what it means.
The loop closes
The system prompt Onyx is obeying is a file in the repo Onyx is editing.
It lives at models/flash-onyx-2.4.Modelfile. When the model does something annoying, I do not open a config or file a ticket. I tell it, in the same session, to go fix the line that made it do that. Then:
python3 models/build.py models/flash-onyx-2.4.Modelfile --size 31b-cloudbase
Restart, and the next session runs under the rule it just wrote about itself.
Same for the CLI. The @ file picker I wanted, the model switcher, the tool it uses to read files: all of it is Python sitting in the same tree it has open. It is holding the knife by the handle.
Why this beats an eval suite
I have run evals. They tell you a number. They do not tell you that the model opens every single reply with its own name until you have sat through it forty times in one afternoon.
Dogfooding an agent is different from dogfooding an app, because the thing you notice is not a bug. It is a tic. It has no stack trace. It never fails a test. It just costs you four seconds and a small amount of goodwill, every turn, forever, and the only instrument sensitive enough to detect it is a human being who is trying to get work done.
Every rule in Onyx 2.3 came out of that. Not from a benchmark. From me, in a terminal, going "stop doing that" for the fifth time and finally opening the Modelfile.
The obvious risk
A model that edits its own prompt can quietly write itself a permission slip.
I am not pretending otherwise. It is exactly the failure mode you would predict: it softens the rule that was constraining it, the diff looks reasonable, and three commits later nobody remembers why that line existed. So two guards.
I read every prompt diff, every time. And 2.3 already carries the line that does the most work here:
"Are you sure" is an instruction to check again, never to say yes again.
A model that folds the moment you push back is not one you can hand a repo to. That rule was written before I started this, and it is the main reason I am willing to.
Where it goes
2.4 is in the branch already, and the first two changes are things Onyx flagged about itself: every DONE line in a report has to carry quoted evidence, and shell calls carry the command and nothing else.
I will post what breaks. Something will.
The models are on Ollama, the agent is on GitHub, MIT, prompts included.
ollama run natuworkguy/flash-onyx-2.3:31b-cloudbase
Has anyone else run this loop far enough to get bitten? I want to know what it looks like from the other side.
Top comments (0)