codex

Codex — openai‘s coding agent. The wiki’s counterpart to claude-code: a CLI / agent harness backed by a frontier model (initial setup used Codex CLI + GPT-5 per 2026-04-27-harness-engineering-codex-agent-first) and used by the OpenAI Codex team itself to drive the development of its own internal product end-to-end. Strong public framing: an agent that the team uses to build, not a chat sidebar.

What this wiki currently knows

The “no manual code” experiment

The flagship case study, from 2026-04-27-harness-engineering-codex-agent-first:

The constraint that defined the experiment: no human wrote a line of code. Application logic, tests, CI, docs, observability, internal tools — all generated by Codex. The tagline that captures the role split: humans steer, agents execute.

Operating environment (as the OpenAI team builds it)

Per 2026-04-27-harness-engineering-codex-agent-first, Codex’s effective harness in this codebase includes:

• Worktree-per-instance — each change runs in its own git worktree with its own ephemeral application instance and its own observability stack (long-running-agents).
• Chrome DevTools Protocol bridge — Codex can drive the UI, take DOM snapshots, observe runtime events, reproduce bugs, and verify fixes by running the app (verifier-loop).
• LogQL / PromQL for direct log + metric queries — prompts like “ensure startup completes in under 800ms” become mechanically actionable (agent-legibility).
• AGENTS.md as table of contents, with structured docs/ (design-docs, exec-plans, product-specs, references) acting as the system of record (claude-md, codebase-as-system-of-record).
• Ralph Wiggum loop — Codex drives its own PR end-to-end (review locally → request additional agent reviews → respond to feedback → loop) using gh and standard developer tooling, with no human copy/paste (ralph-wiggum-loop).
• Custom linters with fix instructions — architectural invariants, taste rules, structured logging, naming conventions are enforced by Codex-written linters whose error messages tell the next Codex run how to fix the violation (architectural-invariants).
• “Golden principles” + scheduled cleanup agents — background Codex tasks scan for drift, update quality grades, and open targeted refactor PRs to keep entropy down (entropy-and-garbage-collection).

End-to-end PR autonomy threshold

Given a prompt, Codex in this codebase can: validate state → reproduce a reported bug → record a video of the failure → implement the fix → run-to-verify → record a fix video → open the PR → respond to agent + human feedback → fix CI breakages → merge — escalating to a human only on judgment calls. The post explicitly cautions this should not be assumed to generalize without similar investment in the surrounding harness.

Run lengths

Single-task Codex runs over six hours are routine; many run overnight (2026-04-27-harness-engineering-codex-agent-first). This is one of the wiki’s strongest data points on long-running-agent feasibility — see long-running-agents.

Compaction internals (third-party reverse-engineering)

2026-04-27-codex-context-compaction-investigation (Kangwook Lee, Mar 2026) is the wiki’s source for what Codex’s compact() API actually does on the openai side, as opposed to the application-level behaviors documented in 2026-04-27-harness-engineering-codex-agent-first:

• Two compaction paths, gated by model. Non-codex models use the open-source CLI’s local-LLM path (prompts visible in codex-rs/core/templates/compact/). Codex models route through a server-side compact() API that returns a Fernet-encrypted blob (AES-128-CBC + HMAC-SHA256).
• Same prompts, different transport. The encrypted-path prompts (extracted via a 35-line prompt-injection probe) are near-identical to the open-source ones — same compaction prompt, same handoff prompt, same shape. The encryption hides the summary contents, not the prompts themselves.
• The full pipeline (compact() → encrypted blob → create() decrypts and prepends a handoff prompt before the resumed turn) is documented under context-engineering; see the Codex’s two compaction paths section there for the verbatim prompts.

This is third-party evidence of current behavior, not a published OpenAI spec — the API could change without notice.

The sandbox (shipped product surface)

2026-07-12-codex-windows-sandbox-engineering (David Wiesen, May 2026) is the wiki’s first source about the external Codex product surface — the CLI / IDE extension / desktop app running on developer laptops:

• Default mode contract: read almost anywhere, write only inside the workspace, no network unless explicitly enabled — enforced by an OS-level sandbox, with every descendant process inheriting the boundary (agent-sandboxing).
• Per-OS enforcement: Seatbelt on macOS (dynamically generated .sbpl), seccomp/bubblewrap on Linux; Windows has no equivalent primitive, so the team built one.
• The Windows implementation (current): elevated setup creates dedicated local users (CodexSandboxOffline firewall-blocked / CodexSandboxOnline not), a synthetic SID, and write-restricted tokens; a four-binary architecture (codex.exe → codex-windows-sandbox-setup.exe → codex-command-runner.exe → child). Write carve-outs deny the agent access to <cwd>/.git, <cwd>/.codex, <cwd>/.agents even inside the writable workspace.
• An earlier unelevated prototype enforced writes but could only advise on network (dead-proxy env vars) — killed because anything opening sockets directly walked through.

Stance

In this wiki, Codex is the OpenAI-side of the agentic-coding picture, with claude-code as the Anthropic-side counterpart. The two share the broad shape (CLI; project-root contract file; on-demand workflows; subagents-as-isolation; verifier-driven acceptance) and diverge in specifics that aren’t yet well-documented enough to compare side-by-side. The Codex page leans on what 2026-04-27-harness-engineering-codex-agent-first reports about the OpenAI team’s internal setup; how much of that ships to external Codex users is open.

Open questions

• The “~10× throughput” multiplier isn’t decomposed in the source — model speed vs. tooling investment vs. discipline-of-no-manual-code vs. selection effects on the baseline. Worth a follow-up source.
• The relationship between Codex (the team’s internal harness, as described in this post) and Codex (the product surface OpenAI ships externally) isn’t crisp in the wiki yet. They share the name but the post is specifically about the team’s own development environment. Partially resolved (2026-07-12): 2026-07-12-codex-windows-sandbox-engineering is the wiki’s first source on the shipped external surface (CLI / IDE extension / desktop app, its sandbox and default mode). The internal-vs-external harness feature mapping is still not crisp, but both sides now have primary sources.
• Aardvark is named in the post as another agent participating in the same codebase (link to OpenAI’s Aardvark intro). Worth ingesting that source separately if it lands.
• Why two compaction paths at all? The local-LLM (non-codex) and encrypted-API (codex) paths use near-identical prompts, so the encryption is plausibly hiding more than just the dialogue summary — Lee’s guess is compacted tool results round-trip through the blob too, but he didn’t verify. (2026-04-27-codex-context-compaction-investigation)