Controlled Codex execution for work that is too important to run blind.
CEWP is an unofficial, local-first supervision and evidence layer for Codex. It adds explicit scope, isolated worktrees, bounded retries, deterministic verification, independent review, recovery controls, and portable receipts while leaving code generation to Codex.
- Plan one bounded checkpoint with explicit files, checks, and stop conditions.
- Approve the proposal before any managed model operation.
- Execute in a CEWP-managed worktree through
codex-exec. - Verify scope and approved commands outside the model loop.
- Review independently, require
Decision: PASS, create the receipt, and finalize explicitly.
The result is a Codex change that cannot silently expand beyond its approved scope and carries evidence for what happened. The included demo is deterministic and credential-free: it proves the CEWP control path, not model quality.
This guarantee covers repository and managed-worktree changes under CEWP's gates. External operating-system or network side effects remain outside CEWP's control boundary.
The GIF is generated from the credential-free deterministic CLI demo. It shows the evidence path, not a benchmark of provider or model quality.
Native Codex is the right choice for small, low-risk work. CEWP is designed for changes where an undetected scope violation, failed verification, uncontrolled retry, or unverifiable result would be expensive.
| Need | CEWP control |
|---|---|
| Prevent accidental broad edits | Approved file scope and isolated worktree |
| Limit repeated model operations | Explicit operation, repair, and reviewer budgets |
| Recover without losing evidence | Pause, resume, revise, retry, and retained checkpoints |
| Verify outside the model loop | Deterministic local commands and scope inspection |
| Require a second decision | Independent reviewer PASS before finalization |
| Explain what happened | JSON and Markdown receipts with honest usage labels |
CEWP does not attach to private ChatGPT sessions, scrape interfaces, infer missing usage, route automatically between models, or merge, push, publish, tag, or release code.
Requirements:
- Node.js 22 or newer
- Git 2.39 or newer
- Codex CLI for managed execution
Check the live npm tags, then install the current stable CLI:
npm view @setrathex/codex-engineering-workflow-pack dist-tags --json
npm install -g @setrathex/codex-engineering-workflow-pack
cewp init
cewp doctorThe npm install provides the cewp and cewp-mcp commands. It does not
automatically register the CEWP Codex plugin.
The full local plugin bundles four CEWP skills, the local cewp-mcp bridge,
review-required subagent evidence hooks, and plugin metadata. After installing
the npm package globally, register its marketplace with Codex.
PowerShell:
$cewpPackage = Join-Path (npm root -g) "@setrathex\codex-engineering-workflow-pack"
codex plugin marketplace add "$cewpPackage"
codex plugin add cewp@cewp-local
codex plugin listmacOS or Linux:
codex plugin marketplace add "$(npm root -g)/@setrathex/codex-engineering-workflow-pack"
codex plugin add cewp@cewp-local
codex plugin listRefresh Codex or open a new conversation, then enable CEWP from the Plugins Directory. Existing conversations can remain open; if an already-open task still has an older skill snapshot, restart Codex later. This installs the complete plugin on the current machine from a local marketplace source; it does not list CEWP in the universal public plugin directory.
To evaluate the exact GitHub source independently of the registry publication, run it from a source checkout:
git clone https://github.com/SetraTheXX/Codex-Engineering-Workflow-Pack.git
cd Codex-Engineering-Workflow-Pack
node ./bin/cewp.js doctorThe source checkout can also be registered directly:
codex plugin marketplace add /path/to/Codex-Engineering-Workflow-Pack
codex plugin add cewp@cewp-localRun the credential-free walkthrough:
node ./bin/cewp.js demo supervisedCreate a bounded checkpoint in a disposable or reviewed repository:
cewp supervise plan \
--goal "Update the installation example" \
--scope README.md \
--verify "git diff --check" \
--stop "The example is accurate and the approved check passes"Inspect the proposal before enabling managed operations:
cewp policy set full-authority
cewp supervise approve <run-id> --yes
cewp supervise execute <run-id> --yes
cewp supervise verify <run-id>
cewp supervise review <run-id> --yes
cewp supervise receipt <run-id>
cewp supervise finalize <run-id> --yes
cewp policy resetThe advanced policy permits requested local operations; it does not disable scope, budget, verification, ownership, or reviewer gates.
The intended product interaction is a normal Codex request that explicitly selects CEWP:
Use CEWP to complete @roadmap.md. Turn it into bounded checkpoints, use
independent workers only where scopes do not overlap, verify every checkpoint,
require reviewer PASS, preserve receipts, and stop on a closed gate.
Native Codex /goal keeps a persistent objective attached to the active task.
CEWP does not replace or control that private host goal. The plugin adds an
engineering control plane around the work: source-bound planning, explicit
scope, isolated worktrees, budgets, deterministic verification, recovery,
independent review, and final evidence.
Today CEWP provides three related execution levels:
- Supervised checkpoint: the plugin plans and runs one bounded managed checkpoint at a time through CEWP Core.
- Coordinator Mode: CEWP can run two non-overlapping
codex-execworkers sequentially or in parallel, then run an independent reviewer. - Workflow runtime: CEWP validates versioned DAGs, dependencies, worker
capacity, budgets, revisions, results, reviewer gates, and can dispatch a
bounded batch of explicitly approved ready tasks through managed
codex-exec. Economy, Balanced, and Maximum resource envelopes are inspectable before approval; they bound operations without routing models automatically.
The complete one-sentence-to-finished-roadmap experience remains a product direction, not a current completion claim. The workflow compiler emits a source-bound agent request; the host agent must produce the structured workflow proposal, and approval, task selection, model/effort selection, review, and finalization remain explicit. Codex can spawn native subagents when directly requested or when plugin/project instructions request them, but CEWP currently treats native subagent hooks as optional evidence rather than canonical execution control.
CEWP Core is the authority for every completion claim:
- The operator approves bounded scope and stopping conditions.
- Managed execution uses the selected
codex-execbackend in an isolated worktree. - CEWP checks changed paths and test-authoring policy.
- Approved verification runs outside the model loop.
- An independent reviewer must return PASS.
- Receipt generation and explicit finalization close the run.
Unknown host usage remains unknown; it is never converted to zero or a
fabricated currency value. Budget or host exhaustion produces a resumable state,
not a false PASS.
- CLI: planning, execution, verification, recovery, review, receipts, and workflow operations.
- Codex plugin: four focused conversational skills, including bounded roadmap proposals.
- Local MCP: the same Core operations and gates exposed over stdio.
- Evidence hooks: optional, reviewable observations that never replace Core enforcement.
The stable managed path is managed + codex-exec. App Server remains
experimental and OpenCode remains optional and outside the golden path.
Start here:
- Product requirements
- Public product direction
- Changelog
- Installation
- Supervised workflow
- Native Codex or CEWP?
- Architecture
- Security model
- Recovery guide
- Evidence receipts
- Compatibility contract
- Validation status
- Plugin submission readiness
- Known limitations
Reference:
- Workflow runtime
- Contract index
- Contract extension example
- Adapter contract
- Operator policy
- Migration policy
- Contributing
- Security policy
The runtime has no package dependencies. From a source checkout:
node ./bin/cewp.js --help
node ./bin/cewp.js doctor
npm test
npm run check
npm run pack:dry-runCI runs on Windows and Ubuntu with Node.js 22, 24, and 26.
CEWP is stable software in the 0.14.0 release. Stable-core compatibility,
migration, recovery, security, and package lifecycle contracts are implemented.
This is a stable 0.x release; it does not make a 1.0.0 claim. Independent
external-user validation and adoption are not claimed.
See Validation Status and Release Notes for the current evidence boundary.