codex-first

name	codex-first
description	Route implementation work to Codex CLI; Claude specs, reviews, verifies.

Codex First

Claude Code sessions only. Codex/other harnesses: skip; never self-delegate.

Rationale: Claude (Fable/Opus) tokens metered + expensive; Codex flat-rate. gpt-5.6-sol is usually the better and faster model at writing/implementing code; Claude wins at ergonomics - judgment, design, spec-writing, review, orchestration. So Codex types, Claude thinks and verifies.

Route

Delegate to Codex (default for hands-on work):

• implementation from a frozen spec; refactors; mechanical migrations
• bug fixes with known repro; test writing; coverage fills
• CI fixes, dependency bumps, scripts/tooling
• bulk codebase exploration where raw reading >> the answer

Keep in Claude:

• design, API design, architecture, naming, UX judgment
• tasks where writing the spec IS the work (ambiguity = design)
• tiny edits (~<20 lines, single obvious change) - delegation overhead loses
• anything needing session tools: MCP (browser/computer-use/chronicle), 1Password, secrets
• destructive/irreversible ops, releases, pushes, GitHub mutations - Claude-side per git rules
• review of Codex output - never delegated, never skipped

Mixed task: Claude designs first, freezes spec, delegates build-out. Heuristic: prompt reads as a work order -> delegate; writing it forces decisions -> design, Claude. Portfolio/multi-repo work: $maintainer-orchestrator instead.

Invoke

Prompt via temp file, never inline quoting:

P=$(mktemp); cat >"$P" <<'EOF'
<goal, repo + key paths, constraints ("don't touch X"), non-goals, proof expected, output shape>
EOF
command codex exec --sandbox workspace-write -C <repo> \
  -o /tmp/codex-last.md - <"$P" 2>/dev/null

• --sandbox workspace-write is the house default: Codex runs commands/tests freely, writes confined to the repo + tmp, network enabled via config.toml. Keep prompts scoped to the target repo.
• --yolo only when the sandbox blocks the task (writes outside the repo, sandbox-hostile tooling). Never launch it unprompted: unless the user already named approvals-off in their message, stop and ask them first — in auto mode the classifier denies --yolo without that naming, and outside auto mode it prompts anyway.
• omit model_reasoning_effort so Codex uses the configured effort from its config.
• command codex bypasses the interactive zsh wrapper; if not on PATH: fnm exec --using default -- codex
• stderr suppressed (thinking noise bloats context); drop 2>/dev/null only to debug a failing run
• read -o file for the result; don't parse the JSONL stream
• long runs: Bash run_in_background, read -o file on exit; don't kill quiet runs <30 min
• parallel independent tasks OK: separate repos/dirs, separate -o files
• outside a git repo add --skip-git-repo-check

Follow-up fixes - cheaper than fresh runs, keeps context. resume has no -C/--sandbox: run from the repo dir, override via config:

(cd <repo> && command codex exec resume --last \
  -c sandbox_mode="workspace-write" \
  -o /tmp/codex-last.md - <"$P2" 2>/dev/null)

If the run was escalated to --yolo, resume with --dangerously-bypass-approvals-and-sandbox instead (same authorization rule applies).

Prompt contract

Codex starts with zero session context. Every prompt: goal, exact repo/paths, constraints, non-goals, proof expected (exact test command), output shape ("report files changed + test output"). Spec quality decides success.

Verify (Claude, always)

• git status -sb + read the full diff; judge like a contributor PR
• run focused tests yourself or demand proof output; Codex claims are advisory
• iterate via resume; after 2 failed rounds, take over and do it directly
• normal closeout still applies: $autoreview before ship

Economics

Win = generation + exploration tokens moved to Codex; Claude spends only on spec + diff review. Don't ping-pong trivia through delegation; don't re-read what Codex already summarized.