Behavioral Middleware: An Architectural Method for Steering Small Local LLMs Without Weight Modification

A small language model trained to be a helpful chat assistant will fight you when you ask it to be something else. We document what it takes to make a 7-billion-parameter model, on a single consumer GPU, hold the persona of a "sapling": a young agent whose near-term job is not to chat but to gather a few specific things from its user, in a restrained voice that neither performs engagement nor offers help it cannot give. We did this without touching the model's weights. Across an iterative, evaluation-gated loop, narrative quality rose from 4.2 to 7.3 out of 10, a later architectural change reached 7.7, and a parallel goal-tracking layer removed the failure mode that had capped every prior round. Three findings generalize: removing an unwanted behavior after generation is more reliable than instructing the model not to produce it (the omission/commission asymmetry); concrete good/bad exemplars outperform abstract behavioral rules; and hard generation limits enforce brevity that instructions cannot. We call the technique Behavioral Middleware: boundary-layer control over a black-box local model (prompt, deterministic routing, post-generation filtering, and state injection), evaluated by judged conversation arcs, with no weight modification. It targets the setting most research skips: black-box, local, owned hardware, no retraining. One side effect proved as telling as the control: routing behavior through codified paths makes a small model more legible and more tunable at the boundary, because every response travels a traceable path. We offer it as a bounded existence proof: in this one setting, restraint and honesty were not aspirations but properties we could build, measure, and tune. That is the groundwork for treating trustworthiness as something that can be engineered into the foundations of personal AI systems.