# Codex bundle: spec, plan, build, test and keep the context small, with a setup runbook a script checks

> Spec-First Build Docs, Two-Agent Build and Test Loop, Planner Over Cheap Models and Token Saver in full, tied into one Codex workflow by a new Codex Setup Runbook. cx_check.py reads AGENTS.md, .codex/config.toml and .agents/skills and names fifteen kinds of problem: danger-full-access, approval set to never, network left on, keys Codex ignores in a project config, an AGENTS.md past the 32 KiB limit, an unpinned model, servers at @latest, tokens in env, skills that cannot trigger, and third-party pieces nobody vetted. cx.py gates ten risky setup changes, and each waits for the owner's yes typed at their terminal and tied to that request's sha256.

- URL: https://paperchasewebb.ai/bots/marketplace/items/codex-bundle-spec-plan-build-test-with-a-checked-setup-runbook/
- Type: Bundle
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Grok Bot, Hermes (named in the listing); Built for Codex; a skill file for Codex, Claude Code and Hermes, an AGENTS.md snippet and a Grok Bot rules block. The runbook scripts were tested on Linux with Python 3.13; the agent files were not loaded inside each harness
- Price: $69 USD
- Difficulty: Intermediate
- Setup time: 1 hr
- Time to result: A checked, ratified setup in one afternoon once the packs are installed
- Format: Markdown (.md) file, codex-bundle-spec-plan-build-test-with-a-checked-setup-runbook.md
- Version: 1.0, updated 2026-10-29
- License: Use on your own machines and on projects you build for yourself, clients and teams, including commercial work. Do not resell or republish the bundle itself.

## What you end up with

A Codex project that works from a spec, splits planning from cheap build runs, tests every change and keeps context small, inside a sandbox and approval setting you chose on purpose, with no setup change going in without your typed yes.

## What you get

- Four packs in full: Spec-First Build Docs, Two-Agent Build and Test Loop, Planner Over Cheap Models and Token Saver ($101 bought separately)
- The Codex Setup Runbook (only in this bundle): setup files for the owner, the pinned Codex version and model, every skill and server with source, version, sha256 and who vetted it, and ten gated setup changes
- cx_check.py: fifteen read-only checks across AGENTS.md, .codex/config.toml and .agents/skills, with a seeded test project (15 findings, then 0)
- cx.py: a gate for every action (0 go, 11 ask the owner, 12 never), requests, owner approval at a terminal tied to the request sha256, verify with expiry, one use per yes
- A starting config.toml with workspace-write, on-request, network off, a pinned model and pinned servers
- A skill file for Codex, Claude Code and Hermes, an AGENTS.md snippet and a Grok Bot rules block
- Ten prompts, a failure table and a worked example
- A look at Codex rule packs, skill lists and config guides, with sources

## Who it is for

Developers and small teams on Codex who want a repeatable spec, plan, build and test loop and one place that says which config changes wait for a person.

## Tools needed

- Codex: the main harness (CLI, IDE extension or app); its AGENTS.md, .codex/config.toml and .agents/skills are what the checker reads
- Grok Bot, Claude Code or Hermes: other agents on the same project; each reads the skill file, AGENTS.md snippet or rules block and checks cx.py gate before acting
- Python 3.11 or newer: runs cx.py (init, hash, gate, request, owner approval, verify, done) and the fifteen-check checker; standard library only (tomllib), no network
- The project's owner: pins the Codex version and model, vets third-party skills and servers, and types each yes at their own terminal
- You need: Codex, and optionally Grok Bot, Claude Code or Hermes
- You need: Python 3.11 or newer
- You need: A project in git that Codex trusts, and a terminal you control

Cost to run: The bundle is the only purchase. The checker and cx.py use no model tokens. Your Codex plan or API use is separate.

## What is in the bundle (4 packs)

| Pack | Format | Separate price |
|---|---|---|
| [Spec-First Build Docs: PRD, design system, architecture note, agents guide and readiness check](https://paperchasewebb.ai/bots/marketplace/items/spec-first-build-docs-prd-design-system-architecture-agents-guide.md) | Prompt pack | $29 |
| [Two-Agent Build and Test Loop for paid apps: one agent builds, another tests, nothing passes on its own say-so, and side effects happen once](https://paperchasewebb.ai/bots/marketplace/items/two-agent-build-and-test-loop-for-paid-apps.md) | Bot template | $29 |
| [Planner Over Cheap Models: one strong planner, cheap workers, routing rules by task type, and a check that keeps them honest](https://paperchasewebb.ai/bots/marketplace/items/planner-over-cheap-models-strong-planner-cheap-workers.md) | Bot template | $24 |
| [Token saver: keep long command output out of your coding agent's context](https://paperchasewebb.ai/bots/marketplace/items/token-saver-keep-command-output-out-of-agent-context.md) | Bot template | $19 |
| Bought separately | | $101 |
| The bundle | | $69 |

## How it works

1. **Run the tests.** Copy the codex-bundle folder and run sh test_all.sh with Python 3.11 or newer. Expected: 15 findings on the seeded project and 0 on the fixed one, 15 of 15 single faults caught alone, checker tests 50 passed, cx tests 38 passed, exit 2 on a missing folder.
2. **Install the packs.** Write the spec with Spec-First Build Docs, split planning from build runs with Planner Over Cheap Models, set up the build and test loop, and trim context with Token Saver. Expected: A spec Codex builds from, a test agent that checks every change, and a smaller AGENTS.md.
3. **Start the runbook.** Run cx.py init ., fill setup/harness.json, set .codex/config.toml from the template and list every skill and server in setup/sources.csv. Expected: One pinned Codex version and model, workspace-write, on-request, network off, and a source row for every piece.
4. **Gate the risky changes.** Add your safe daily actions as agent-ok and keep the ten risky ones owner-yes. Expected: cx_check.py shows only X15.
5. **Ratify and work.** Run cx.py approve . --setup at your own terminal, with CODEX_HOME unset in that shell. From then on agents check cx.py gate before every action. Expected: Safe work goes ahead, sandbox, approval, network, model and server changes, pushes and deploys arrive as requests you approve by hash, and any setup edit stops every gate until you ratify again.

## Sample prompt: Session start (Codex, Grok Bot, Claude Code, Hermes)

```
Run cx_check.py on this project. Show me the findings in order, the smallest fix for each, and the setup hash.
Edit nothing until I say yes.
```

Prompt 2 of 10.

## Sample prompt: What am I running with (Codex)

```
Tell me the sandbox mode, approval policy, network setting and model you are running with, and which config file each came from.
If any differ from .codex/config.toml in this project, say why.
```

Prompt 4 of 10.

## Free preview of codex-bundle-spec-plan-build-test-with-a-checked-setup-runbook.md

````markdown
# Codex bundle: spec, plan, build, test and keep the context small, with a setup runbook a script checks

Version 1.0, 2026-10-29. By PaperChaseWebb. A bundle of four paid packs (Spec-First Build Docs, Two-Agent Build and Test Loop, Planner Over Cheap Models, Token Saver) plus a new Codex Setup Runbook that ties them into one checked setup for one project. The runbook comes with a gate and approval script, a read-only checker with fifteen checks, templates, a seeded test project, ten prompts and the tests, all Python 3.11+ standard library. Built for Codex, and it also works with Claude Code and Hermes through a skill file and an AGENTS.md snippet, and with Grok Bot through a rules block. Tested as described in section 10: the scripts ran on Linux with Python 3.13, including owner approvals typed at a pseudo-terminal. The skill file, snippet and rules block were not loaded inside the harnesses for this release, and the checker reads your setup files without starting Codex. Each limit is marked where it matters.

Codex is at its best on long, well-specified work: read the spec, plan, write the code, run the tests, repeat. Most Codex packs for sale are AGENTS.md templates and skill folders, and they help with the first session. What goes wrong later is the setup around the work. The sandbox was set to danger-full-access to get past one prompt and never set back. approval_policy is never, so nothing stops. Network is on for every task because one install needed it. The project c
````

## Test record

- Date: Oct 29, 2026
- What was run: cx_check.py on a seeded project and a fixed copy, each planted fault alone, a missing input, and the unit tests. Linux, Python 3.13.
- Result: 15 findings on the seeded project, 0 on the fixed one; 15 of 15 planted faults caught alone; exit 2 on missing input; nothing written. 50 checker and 38 cx.py tests passed, 0 failed.
- Not run: The agent files inside Claude Code, Codex, Hermes or Grok Bot. Codex itself; the checker reads files only. Windows and macOS.

Copied from this item's dated test notes. What was not run stays in.

## Worth knowing

- The checker checks that each setup decision was made and written down. It cannot tell whether a spec is good, a test is thorough or a vetted server is safe; you and the included packs do that.
- The skill file, AGENTS.md snippet and Grok Bot rules block were not loaded inside Codex, Claude Code, Hermes or Grok Bot for this release. The checker reads files and does not start Codex. The test project is made up. Linux only; Windows and macOS were not tested.
- The gate makes the rules plain and testable; it does not sandbox an agent. In Codex the sandbox and approval settings in config.toml are the enforced part, which is why three checks read them.
- Codex only loads a project .codex/config.toml for trusted projects, and your user config can still set things. The checks follow the Codex config reference, AGENTS.md and skills docs as read on 2026-10-29.
- The approval script refuses piped input and the environment variables Codex, Claude Code, Hermes and Grok Bot set, including CODEX_HOME, so unset it in the shell where you approve. That stops an agent approving by mistake; it is not a lock against someone with the same account.
- On 2026-10-29, on Linux with Python 3.13: cx_check.py gave 15 findings on the seeded project (each check once) and 0 on the fixed one, caught 15 of 15 single faults with only its own check, wrote nothing, and exited 2 on a missing folder, any missing required file or broken TOML; checker tests 50 passed, 0 failed; cx.py tests at a pseudo-terminal 38 passed, 0 failed.
- The bundle contains the versions listed on this page on the day you buy. Each included pack keeps its own notes and limits.

## Questions

**Why not buy the four packs on their own?** You can, for $101. The bundle is $69 and adds the Codex Setup Runbook, which is only here: one checker across AGENTS.md, config.toml and skills, and approvals tied to one request.

**Is this a rules file collection?** No. It gives you one working loop (spec, plan, build, test, small context) and a checked setup around it. If you want many rule files, use a free list and keep only what your project needs.

**Does it work with Claude Code too?** The included packs, skill file, AGENTS.md snippet and gate work in Claude Code, Hermes and Grok Bot. The checks read Codex's files. For Claude Code's settings.json, see the Claude Code bundle.

**Why does it need Python 3.11?** The checker reads config.toml with tomllib, which is in the standard library from 3.11. Older versions get exit 2 and a message, not a wrong answer.

**What if I want it set up with me?** Book a call on the paperchasewebb.ai homepage about the $5,000 Install sprint, or Manage at $5,000 a month to keep the setup current through Codex upgrades.

## How to buy

$69 one time at https://paperchasewebb.ai/bots/marketplace/items/codex-bundle-spec-plan-build-test-with-a-checked-setup-runbook/. Stripe checkout, then an instant download page; the download link is also in your emailed receipt.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com