Codex bundle: spec, plan, build, test and keep the context small, with a setup runbook a script checks
by PaperChaseWebb
Spec-First Build Docs, Two-Agent Build and Test Loop, Planner Over Cheap Models and Token Saver in full, tied into one Codex workflow by a new Codex Setup Runbook. cx_check.py reads AGENTS.md, .codex/config.toml and .agents/skills and names fifteen kinds of problem: danger-full-access, approval set to never, network left on, keys Codex ignores in a project config, an AGENTS.md past the 32 KiB limit, an unpinned model, servers at @latest, tokens in env, skills that cannot trigger, and third-party pieces nobody vetted. cx.py gates ten risky setup changes, and each waits for the owner's yes typed at their terminal and tied to that request's sha256.
- Price
- $69
- Difficulty
- Intermediate
- Setup
- 1 hr
- Format
- .md file
codex-bundle-spec-plan-build-test-with-a-checked-setup-runbook.md · 394 KB · instant download after checkout · $101 if bought separately
Want this built for you instead? We can build it for you.
What you end up with
A Codex project that works from a spec, splits planning from cheap build runs, tests every change and keeps context small, inside a sandbox and approval setting you chose on purpose, with no setup change going in without your typed yes.
What you get
- Four packs in full: Spec-First Build Docs, Two-Agent Build and Test Loop, Planner Over Cheap Models and Token Saver ($101 bought separately)
- The Codex Setup Runbook (only in this bundle): setup files for the owner, the pinned Codex version and model, every skill and server with source, version, sha256 and who vetted it, and ten gated setup changes
- cx_check.py: fifteen read-only checks across AGENTS.md, .codex/config.toml and .agents/skills, with a seeded test project (15 findings, then 0)
- cx.py: a gate for every action (0 go, 11 ask the owner, 12 never), requests, owner approval at a terminal tied to the request sha256, verify with expiry, one use per yes
- A starting config.toml with workspace-write, on-request, network off, a pinned model and pinned servers
- A skill file for Codex, Claude Code and Hermes, an AGENTS.md snippet and a Grok Bot rules block
- Ten prompts, a failure table and a worked example
- A look at Codex rule packs, skill lists and config guides, with sources
Who it is for
Developers and small teams on Codex who want a repeatable spec, plan, build and test loop and one place that says which config changes wait for a person.
Works with
Solid chips: the agent is named in this listing's own tools list. Dashed chip: Built for Codex; a skill file for Codex, Claude Code and Hermes, an AGENTS.md snippet and a Grok Bot rules block. The runbook scripts were tested on Linux with Python 3.13; the agent files were not loaded inside each harness.
What is in the bundle (4 packs)
| Pack | Format | Separate price |
|---|---|---|
| Spec-First Build Docs: PRD, design system, architecture note, agents guide and readiness check | Prompt pack | $29 |
| Two-Agent Build and Test Loop for paid apps: one agent builds, another tests, nothing passes on its own say-so, and side effects happen once | Bot template | $29 |
| Planner Over Cheap Models: one strong planner, cheap workers, routing rules by task type, and a check that keeps them honest | Bot template | $24 |
| Token saver: keep long command output out of your coding agent's context | Bot template | $19 |
| Bought separately | $101 | |
| The bundle | $69 (you save $32) |
Tools needed
Cost to run: The bundle is the only purchase. The checker and cx.py use no model tokens. Your Codex plan or API use is separate.
Time to result: A checked, ratified setup in one afternoon once the packs are installed
How it works
Run the tests
Copy the codex-bundle folder and run sh test_all.sh with Python 3.11 or newer.
Expected: 15 findings on the seeded project and 0 on the fixed one, 15 of 15 single faults caught alone, checker tests 50 passed, cx tests 38 passed, exit 2 on a missing folder.
Install the packs
Write the spec with Spec-First Build Docs, split planning from build runs with Planner Over Cheap Models, set up the build and test loop, and trim context with Token Saver.
Expected: A spec Codex builds from, a test agent that checks every change, and a smaller AGENTS.md.
Start the runbook
Run cx.py init ., fill setup/harness.json, set .codex/config.toml from the template and list every skill and server in setup/sources.csv.
Expected: One pinned Codex version and model, workspace-write, on-request, network off, and a source row for every piece.
Gate the risky changes
Add your safe daily actions as agent-ok and keep the ten risky ones owner-yes.
Expected: cx_check.py shows only X15.
Ratify and work
Run cx.py approve . --setup at your own terminal, with CODEX_HOME unset in that shell. From then on agents check cx.py gate before every action.
Expected: Safe work goes ahead, sandbox, approval, network, model and server changes, pushes and deploys arrive as requests you approve by hash, and any setup edit stops every gate until you ratify again.
Sample prompt from the pack
Run cx_check.py on this project. Show me the findings in order, the smallest fix for each, and the setup hash. Edit nothing until I say yes.
Prompt 2 of 10.
Tell me the sandbox mode, approval policy, network setting and model you are running with, and which config file each came from. If any differ from .codex/config.toml in this project, say why.
Prompt 4 of 10.
Free preview of the file
# Codex bundle: spec, plan, build, test and keep the context small, with a setup runbook a script checks Version 1.0, 2026-10-29. By PaperChaseWebb. A bundle of four paid packs (Spec-First Build Docs, Two-Agent Build and Test Loop, Planner Over Cheap Models, Token Saver) plus a new Codex Setup Runbook that ties them into one checked setup for one project. The runbook comes with a gate and approval script, a read-only checker with fifteen checks, templates, a seeded test project, ten prompts and the tests, all Python 3.11+ standard library. Built for Codex, and it also works with Claude Code and Hermes through a skill file and an AGENTS.md snippet, and with Grok Bot through a rules block. Tested as described in section 10: the scripts ran on Linux with Python 3.13, including owner approvals typed at a pseudo-terminal. The skill file, snippet and rules block were not loaded inside the harnesses for this release, and the checker reads your setup files without starting Codex. Each limit is marked where it matters. Codex is at its best on long, well-specified work: read the spec, plan, write the code, run the tests, repeat. Most Codex packs for sale are AGENTS.md templates and skill folders, and they help with the first session. What goes wrong later is the setup around the work. The sandbox was set to danger-full-access to get past one prompt and never set back. approval_policy is never, so nothing stops. Network is on for every task because one install needed it. The project c
Test record
- Date
- Oct 29, 2026
- What was run
- cx_check.py on a seeded project and a fixed copy, each planted fault alone, a missing input, and the unit tests. Linux, Python 3.13.
- Result
- 15 findings on the seeded project, 0 on the fixed one; 15 of 15 planted faults caught alone; exit 2 on missing input; nothing written. 50 checker and 38 cx.py tests passed, 0 failed.
- Not run
- The agent files inside Claude Code, Codex, Hermes or Grok Bot. Codex itself; the checker reads files only. Windows and macOS.
Copied from this item's dated test notes. What was not run stays in.
Worth knowing
- The checker checks that each setup decision was made and written down. It cannot tell whether a spec is good, a test is thorough or a vetted server is safe; you and the included packs do that.
- The skill file, AGENTS.md snippet and Grok Bot rules block were not loaded inside Codex, Claude Code, Hermes or Grok Bot for this release. The checker reads files and does not start Codex. The test project is made up. Linux only; Windows and macOS were not tested.
- The gate makes the rules plain and testable; it does not sandbox an agent. In Codex the sandbox and approval settings in config.toml are the enforced part, which is why three checks read them.
- Codex only loads a project .codex/config.toml for trusted projects, and your user config can still set things. The checks follow the Codex config reference, AGENTS.md and skills docs as read on 2026-10-29.
- The approval script refuses piped input and the environment variables Codex, Claude Code, Hermes and Grok Bot set, including CODEX_HOME, so unset it in the shell where you approve. That stops an agent approving by mistake; it is not a lock against someone with the same account.
- On 2026-10-29, on Linux with Python 3.13: cx_check.py gave 15 findings on the seeded project (each check once) and 0 on the fixed one, caught 15 of 15 single faults with only its own check, wrote nothing, and exited 2 on a missing folder, any missing required file or broken TOML; checker tests 50 passed, 0 failed; cx.py tests at a pseudo-terminal 38 passed, 0 failed.
- The bundle contains the versions listed on this page on the day you buy. Each included pack keeps its own notes and limits.
Questions
Why not buy the four packs on their own?
You can, for $101. The bundle is $69 and adds the Codex Setup Runbook, which is only here: one checker across AGENTS.md, config.toml and skills, and approvals tied to one request.
Is this a rules file collection?
No. It gives you one working loop (spec, plan, build, test, small context) and a checked setup around it. If you want many rule files, use a free list and keep only what your project needs.
Does it work with Claude Code too?
The included packs, skill file, AGENTS.md snippet and gate work in Claude Code, Hermes and Grok Bot. The checks read Codex's files. For Claude Code's settings.json, see the Claude Code bundle.
Why does it need Python 3.11?
The checker reads config.toml with tomllib, which is in the standard library from 3.11. Older versions get exit 2 and a message, not a wrong answer.
What if I want it set up with me?
Book a call on the paperchasewebb.ai homepage about the $5,000 Install sprint, or Manage at $5,000 a month to keep the setup current through Codex upgrades.
Details
Version 1.0 · Updated Oct 29, 2026 · Markdown version of this page
License: Use on your own machines and on projects you build for yourself, clients and teams, including commercial work. Do not resell or republish the bundle itself. Download terms
Related
Codex: five config rules and a five-check script for .codex/config.toml (free sample)
From the Codex bundle: five rules for .codex/config.toml (keep the sandbox on, approval on-request, network off by default, pin the model, pin servers and keep keys out), and a read-only script that checks one config file for them.
Claude Code bundle: four packs and a setup runbook a script checks before your agent touches anything risky
Agent Rules starter files, Agent Skills Workshop, MCP Setup Playbook and Vet Before You Install in full, tied into one checked Claude Code setup by a new Claude Code Setup Runbook. cc_check.py reads CLAUDE.md, .claude/settings.json, skills, subagents, hooks and .mcp.json and names fifteen kinds of problem: bypass mode left on, .env readable, blanket allows, git push that never asks, skills that cannot trigger, subagents with every tool, unpinned servers, keys in config, and third-party pieces nobody vetted. cc.py gates ten risky setup changes, and each waits for the owner's yes typed at their terminal and tied to that request's sha256.
Spec-First Build Docs: PRD, design system, architecture note, agents guide and readiness check
A Markdown pack of the four documents to write before an agent builds anything, sized to the stakes: a PRD an agent can build from without inventing scope, the smallest design system that holds, a one-page architecture note with reversal costs, an agents guide with a project tree for Claude Code, Codex and Cursor, a weekly staleness pass and a nine-area readiness check.
Two-Agent Build and Test Loop for paid apps: one agent builds, another tests, nothing passes on its own say-so, and side effects happen once
A tested setup for apps that take money: one agent writes the code, a separate tester session writes the stories and tests and gives the verdicts, a small runner records every red, green and revert exit code itself, and the owner says yes to the plan, any payment or pricing work, each merge and each release. Version 1.1 makes side effects happen once: one idempotency key per refund, charge, email or deploy, checked against a ledger before acting, the original event saved next to the run it started, a retry budget that stops and asks the owner, and every failure saved as a regression test. Two read-only checks with fifteen checks each audit the finished run.
Planner Over Cheap Models: one strong planner, cheap workers, routing rules by task type, and a check that keeps them honest
A tested setup for splitting coding work between one strong model that plans and reviews and cheap or local models that do the work. You write the routing once: each task type gets a tier, a review and a budget, and anything a client reads or receives stays on the strong model with a person reviewing it. Every task card carries its own check, a logger runs that check instead of trusting the worker and records the route, and two read-only checks audit the plan before it runs and the run after it ends, including cost per route. The owner says yes to the rules, the plan, any escalation and every merge, and the rules yes is typed at your own terminal and tied to a sha256.
Token saver: keep long command output out of your coding agent's context
Two shell scripts and one rule line that make Claude Code, Codex, Cursor and other agents read a one-page summary of builds, tests and searches instead of thousands of lines.
Agent Cost Levers: cut cost per solved task without cutting quality
A Markdown pack that measures what your coding agent spends per finished task, then works five levers one at a time: thinking depth, context curation, direct tool routing, cache and reuse, and a verified stop. Includes a baseline sheet, a rules block and 10 prompts.
Agent Status Hardware: one light and one e-ink display for every agent session, driven by hooks
Wire the hooks Claude Code, Codex and Hermes already have, plus a rules block for Grok Bot, to one small bridge on your machine. It turns agent events into one state for all sessions and drives a terminal, a USB busylight, a blink(1), an ESP32 LED, a 2.13 inch e-ink panel or a Home Assistant light. Waiting for you is a red blink nothing can cover, a session with no news turns amber, and the light never approves anything.
Cross-Harness Relay: seats, handoffs and a tested Agent Run Record for Grok Bot, Claude Code, Codex and Hermes
A bot template and teaching guide for running more than one agent harness on the same work: six seat cards, a RELAY.md seat map, a relay packet for every handoff, four loop shapes, routine-or-judgment routing with a fallback, a preflight check, the front desk and night shift split with a proof footer, shared memory rules, relay drills, a rules block and prompts. v1.1 adds the Agent Run Record (the owner's ask, every step, what broke and what fixed it, the diff and each changed file with its sha256), a local redaction check for keys, tokens, emails, phone numbers and private paths before a record is shared, a rule that exactly one named seat may deploy, share and deploy approvals the owner types at their own terminal, tied to hashes and refused inside an agent or with piped input, a run record folder with a fifteen-check read-only checker and a relay helper, agent files for Grok Bot, Claude Code, Codex and Hermes, three new relay drills (eleven in all) and six new prompts (20 in all). Price unchanged.
Governed Agent Teams: subagent personas, authority maps and handoffs
A Markdown pack for running a team of coding and research agents with clear limits: 7 subagent personas for Claude Code with Codex AGENTS.md and Hermes skill versions, a Desk Authority Map, three role risk classes, a handoff packet the receiver verifies, an evidence standard, a decision ledger and a reach inventory.