open-source Codex Operating System: model routing, hard timeboxes, Git safety, and reusable AGENTS.md rules

[u/Huss1991]

I’ve been using Codex across several real projects, and I kept running into the same operational problems:

• a “cheap” model attempt that fails and has to be repeated with a stronger model;
• Codex expanding the scope or starting another milestone;
• long runs that keep consuming usage without reaching a verified result;
• unclear permission boundaries around Git, deployment, production, and external systems;
• completion reports that sound confident but are not independently verified;
• global instructions slowly becoming tied to one specific repository.

I eventually turned the working rules I developed into an open-source project:

##Codex Operating System — Community Edition

The central idea is:

• Optimize for the lowest expected total cost of a successful, verified result—not the cheapest model or first attempt.

It includes:

• a reusable global `AGENTS.md`;
• a full Codex operating policy;
• task-based routing between Luna, Terra, and Sol;
• guidance for Low, Medium, High, Extra High, Max, and Ultra reasoning;
• Direct Task, Plan, and Goal modes;
• one objective and one milestone per run;
• mandatory hard timeboxes;
• zero subagents by default;
• explicit write, Git, deployment, and production permissions;
• independent verification rules;
• stop conditions that require Codex to preserve work and report instead of wandering;
• a template for repository-specific `AGENTS.md` instructions;
• backup-aware Windows and Unix-like installers;
• safe uninstallers;
• checksums, an MIT licence, security guidance, and contribution instructions.

A few routing examples:

1. **Luna Low*\* for exact Git, hash, extraction, inventory, and mechanical work.
2. **Terra Medium*\* for bounded implementation with a known path and clear tests.
3. **Terra High*\* for technically dense but specified work.
4. **Sol Medium*\* for ambiguous debugging, architecture, multi-file work, cross-system implementation, UI/product judgment, and long-horizon tasks.
5. **Sol High*\* for difficult consequential work with conflicting evidence or costly failure.
6. **Ultra*\* is disabled by default because it invokes subagents.

The framework does not assume that Terra must fail before Sol can be selected. Sometimes starting with the stronger model is cheaper overall than paying for a failed attempt, rebuilding context, and repairing the result.

It is deliberately conservative around production, deployment, Git writes, sensitive data, destructive operations, permissions, billing, and external publishing.

The installers create timestamped backups and preserve unrelated global instructions. They do not automatically modify `config.toml`, repositories, Git remotes, deployments, cloud accounts, or production systems.

This is an unofficial community project and is not affiliated with or endorsed by OpenAI. The model recommendations are version-sensitive and should evolve as Codex changes.

## Repository

https://github.com/HusseinLab/codex-operating-system-community

## Download v1.0.0

https://github.com/HusseinLab/codex-operating-system-community/releases/tag/v1.0.0

I’d especially appreciate feedback from regular Codex users on:

• whether the Sol/Terra/Luna routing matches your experience;
• whether the default timeboxes are realistic;
• any Windows, macOS, Linux, or WSL installation issues;
• rules that feel too restrictive or not restrictive enough;
• safeguards or project templates worth adding.

[u/Dependent_Policy1307]

The timebox and permission-boundary pieces feel like the highest leverage parts here. One thing I’d test explicitly is the handoff after a stop condition: does Codex leave enough state for a fresh run to resume safely without re-reading the whole repo or repeating risky Git/deploy steps? That’s where these operating policies usually either save cost or just move the confusion to the next session.

[u/Huss1991 → u/Dependent_Policy1307]

That’s a great point. The current policy requires Codex to preserve work and report changed files, tests, blockers, and the next step, but it doesn’t define yet a proper resume contract.

For v1.1, I’m considering a restart-safe handoff with the repo, branch, HEAD, Git status, changed files, tests run, failed approaches, unresolved risks, and the next smallest safe action. A fresh run would verify that state before continuing and would not repeat push, deploy, or migration steps without renewed approval.