Skip to content

changelog

125 commits, three days.

Grouped by what changed, dated from the git history, and every subject below is quoted from the commit rather than rewritten for the page. The short hashes are not links. The repository is private until the first release, so there is nowhere for them to go yet, and they are here so the page can be checked against git log the day it opens.

22 commits

The pages a company has

Docs, a changelog and a page explaining what a receipt is, then the legal surface underneath them: a privacy policy that names the file you can open to check each claim, terms, and a 404 that matches the rest of the site instead of being a dead end. One og:image bug is in here too — the cards were pointed at relative paths, which every unfurler resolves against itself and then silently drops, so no link shared anywhere had been rendering a card.

  • d2d332csite: docs, changelog and receipts — the three pages a company has
  • 30de171site: relative og:image paths, so no shared link was unfurling a card
  • 83ad112site: the trust surface — a traced privacy policy, terms, and a 404 that matches

The show stops cutting at its own joins

The terminal animation ran on three clocks that drifted apart, so the spinner jumped whenever one segment handed over to the next. One clock, one circle and one position now, which is fewer moving parts and a frame that lands where the last one left off.

  • 6955fb8theater: one clock, one circle, one position — the show stops cutting at its own joins

The reviewer starts to remember this repository

Every review leg is a fresh process with no memory, so run 40 reads exactly as well as run 1. ccx now keeps a small per-repository store of what kinds of bug this codebase has actually shipped and puts up to five of them in front of the diff, phrased as questions. They name no file and no symbol, they come only from findings the author accepted, and a prior that stops catching anything is deleted. It costs nothing per run and switches off with an environment variable.

  • cbb2902lessons: the off-switch, the unlanded review and the run's own words get tests that can fail
  • 9672d7ffeat: the reviewer learns what this repo ships, and turns off to the byte

One shell for every page

The site had grown three palettes and three navs. There is now one nav, one footer and one set of tokens shared by every page, with the front page's own values as the source. The install command on the site is the same one the README gives, and the whole thing sits behind a password until it is finished.

  • 68eb324site: finish the shell — one nav, one footer, one set of tokens
  • d86ab4bsite: the install command on the site is one a visitor can actually run
  • 4ef4574feat(site): a password over the whole site while it is being built
  • 0400f1dwip: save the shell rollout and the v10 lessons in flight
  • 11684b5chore: track the shell that index.html now references
  • ed02b56fix: restore the rewritten replay, and let /help be typed with the slash
  • c33f338feat: the baton actually crosses, and the ambient light stops repeating

The test suite stops rubber-stamping

A test that passes on broken code is worse than no test. An enum registry now holds every closed set in the codebase, with tripwires that fire on the five real bugs that motivated it — including one where the suite certified a safety property the shipped binary did not have, because the rule lived in a function nothing called.

  • 04615dcfix: the suite certified a safety property the binary broke — one argv builder now, asserted against it
  • 5e7680dtest: the enum tripwire was a rubber stamp for docket status — close it, and delete three counts that had rotted
  • 3bc1e79test: the status sweep was blind to an item born with its status, and two line numbers had already rotted
  • 3c2e12atest: models stops importing the deleted builder, and stops certifying the bug
  • 1a91730test: the enum registry, and a tripwire that fires on the five bugs that motivated it

An install a stranger can run, and a README that is true

Every claim in the README was checked against src/ and the stale ones were fixed rather than softened.

  • 62aedc8install: an install command a stranger can actually run, and the licence the manifest promised
  • 89f4212docs: verify every README claim against src/, fix the stale ones, de-slop the prose
  • a1fef9dchore: sync 2 files — claudecodex.mjs, fast-tty.test.mjs

Receipts, proven on a real run

--receipt writes the whole run as one self-contained HTML file, and --share-dry prints the exact bytes an upload would carry and sends none of them. Both landed working rather than as scaffolding. What a receipt contains →

  • ce5c45bfeat: --receipt and --share-dry, wired and proven on a real run

90 commits

The baton keeps moving

The day v1 became the product. One agent writes, the other reviews what it wrote, and the two of them keep swapping in a single terminal until the review comes back clean or a guard fires. The whole exchange is rendered as the conversation it already was, so you can watch the argument instead of a spinner.

  • 2f4c765feat: the baton keeps moving, in one terminal, until the work is clean
  • f412b86feat: give the driver a memory, and keep the reviewer blind
  • 18483e3feat: render the loop as a conversation, because it already was one
  • 087c26efeat: they work the problem together, and you can watch them do it
  • eb299d4feat: the argument and the review are one transcript
  • b4a3c93fix: every one of Codex's release blockers
  • 9a16f8cfix: the reviewer gets time proportional to what it must read
  • d6e106efix: an unmerged index could silently blind the reviewer
  • 9ec6f8bfix: a broken pipe killed the process, and a failed diff read as a clean pass
  • 200f825fix: don't animate into a pipe
  • 35c3d57test: tripwires on the invariants that fail without a signal
  • 55b52fbtest: the conversation, driven by the real loop
  • e7ba594chore: cut a speculative export, pin the collapse threshold
  • ac71615chore: sync 3 files — gitignore, launch.mjs, run.test.mjs

A finding becomes a thread

The largest group of the day, and the part that makes the loop terminate honestly. A finding is no longer a line of text handed back each round: it is a thread with a history. The author can refuse one with a reason, the reviewer owes that refusal an answer on the record, silence stops counting as agreement, and a withdrawal is final so a concession never comes back as work. The channel between them is one reason for one finding, and the reviewer still cannot see the record.

  • d722407feat: a finding is a thread, and a re-raise is an event on it
  • 33b7211feat: the airlock — one reason, for one finding the reviewer already raised
  • f42aa16feat: the reviewer answers on the record, and silence stops being an answer
  • 9d4ed26feat: the reply channel, wired — and reviewPass still cannot see a docket
  • 7a3bf62feat: a disputed finding owes an answer, and capitulation has a number
  • 3cce817feat: three seconds to take it off them, and the terminal always comes back
  • 2f3416efeat: the driver says what it will touch, and straying is reportable
  • 79382e2fix: a withdrawal is terminal, so the reviewer's concession stops coming back as work
  • 8ee6c6efix: the scanner's findings are ccx's own, and a concession is not a disagreement
  • cdf3b9afix: an abstention is a turn, and the transcript is bound to the conference
  • 87d8737fix: the reply channel fires in the round it exists for
  • a606f03fix: the hold nobody could reach, and a terminal handed back first
  • 4f8f241fix: the driver's own JSON was the second way out of a terminal state
  • 67a5165fix: the first write declares too, and two tripwires that armed at nothing
  • b0731d6fix: the thread-line comment is true of the call site, and two tests hold it
  • 4e9ca07fix: the comment says what the thread line actually buys, and the filter gets tested
  • 42b325dtest: the blind-review tripwire gets narrower, not weaker

The conference gets a length you can set

Two rounds by default, six at most, and the argument is paid for out of the same twenty-call budget the fix rounds spend from rather than being billed on top. Round two always runs, so a deadlock has to be earned instead of declared on the first exchange.

  • ac9eb40feat: /rounds, and the conference pays for itself out of the run cap
  • 1971cdafeat: round 2 always runs, and a deadlock has to be earned
  • 58b5512feat: the conference talks into the transcript, and the offer stops promising read-only
  • 3af9c2bfix: --rounds was parsed, clamped, echoed, and then dropped
  • 2dbafa8fix: drop loopBudgetFor — it had no callers and its premise was false
  • 8b231e4docs: the loop budget step was wrong — the conference already pays

A session, and a login that actually logs you in

ccx with no task used to hand your terminal to whichever agent the router liked, which left exactly one vendor in the room. It now opens a session where every line runs the full pipeline and neither agent owns the terminal. A signed-out vendor gets logged in rather than told about, and a run with only one agent live is refused outright.

  • 63b38a1feat: ccx with no task opens a session instead of handing the terminal away
  • 862e956feat: ccx signs you in instead of telling you to sign yourself in
  • 4c9e58efeat: signed in to both, or nothing runs
  • bce9ef3fix: the agent actually runs on a terminal, and both paths hold the verdict
  • b78c4bftest: the persistence and the session loop were shipped uncovered

A second reviewer that costs nothing, and a number for how it is going

A deterministic static scanner now runs alongside the model review, walled off from it so the reviewer is never anchored on what a scanner already said. Its findings go to the author only. Separately, a convergence score reads the trend across rounds — and it advises, it never ends a run.

  • 12447bafeat: a deterministic second reviewer, walled off from the reviewer
  • 28827c6feat: the run says how it is going, and the number cannot end it
  • d70f5cctest: the scanner's wall gets a live dispute channel, and three assertions get teeth
  • 78f7010test: the last two converge branches nobody was holding, and a comment that described a mutant
  • 087b3e5test: pin the branches the converge tests were only naming
  • 2fff9ffdocs: converging instead of competing, and a number for how it is going

A model per role

Driving and reviewing are different jobs and can run on different models. A model you type on the command line stands the stored preference down, because Codex refuses a duplicated flag and would have failed the run at spawn.

  • 2f7c73dfeat: a model per role, and the router decision stays cheap
  • c9b793bfix: the model you type stands the stored one down, because codex refuses the duplicate
  • 3485e57test: the contract itself is asserted, not just the name of the call

The parts a hosted tier would need

A share payload with a redactor in front of it, an Ed25519 licence, a Cloudflare Worker, a pricing page and a falsification gate that says what has to be true before any of it is switched on. None of it is reachable from the CLI, which is the point: it ships when the test passes, not before.

  • abd5fd7feat: the product layer — share, licence, worker, pricing
  • d99c57cfeat: everything the hosted tier needs except the one click that needs a human
  • 2320274feat: the hands move, and the licence keypair is real
  • 69593a9feat: the falsification gate — receipt footer, /r, pricing linked
  • 5906b3afix: three hosts, three jobs — and the receipt footer was pointing at a 404
  • 383c7c3wip: lanes landed (share, license, worker, pricing) — 261 tests

The front page becomes the thesis

Two glowing wireframe hands reaching in from opposite corners of a black void, holding a small working terminal between their fingertips. Blue is Codex, orange is Claude, and the terminal between them is the product. Twenty-one commits of getting the hands, the light and the replay to say that without a word of copy.

  • 315faaefeat: the site, with a real transcript and a generated atmosphere
  • 3d0596esite: the terminal is the front page
  • 2e17e3dfeat: two hands, one baton — the thesis as a photograph
  • 39e1eb5site: hands that touch the terminal
  • 2fef343site: better hands, corner light, JPEG OG card
  • 3a7e5d5feat(site): ship the lit hands, plus the pricing nav that pointed nowhere
  • a9fafebsite: the replay shows the product that exists
  • 4a3b14afeat: the busy hand churns, and the share card shows both hands lit
  • f893c39feat: each hand surges on the one line where it actually does something
  • 2da37fcfeat: the rail — both marks at the corners, dots between them
  • 5b54768feat: one circle, two occupants — the badge variant of both marks
  • 5c1285efeat: the real marks, side by side — and the headline stops erasing their colour
  • 93caad8fix: the rail kept the screen after the run and erased the run's own results
  • 1dd50aatest: the rail is read off the painted row, not off the view's fields
  • 809ad3bfix: the intro's badge gets a guard, and one silhouette gets one source
  • 6d6d946fix: the hero headline no longer depends on its own animation finishing
  • 4128ebbfix: homepage pointed at a domain this project does not own
  • 4c898ffsite: pull in the pre-boot race fix
  • dc62b79chore: sync 3 files — pricing.html, robots.txt, sitemap.xml
  • 215ad8dchore: record the hero round that failed, and why
  • 490729cchore: sync 1 file — Icon\r

Design notes, kept in the repository

Twelve commits of written design: how the pair talks, what the doctrine actually is in the routing, which parts of another stack were worth taking and which were not, and a running record of things found wrong — including a live bug in shipped code and two premises that turned out to be false.

  • db25a27docs: v3 design, the pair that talks
  • 2f2fb24docs: how they talk, and two ways to work
  • 3acc4bddocs: the v3 build, task by task
  • ddc00bedocs: the three things codex blocked on, fixed
  • 08ab332docs: the pair unblocks itself, and says when it did
  • b79eaf1docs: the doctrine is real in the routing and stops at three doors
  • 477defadocs: you are in ccx, never in a vendor
  • 422a9e0docs: the chrome leak, found in launch.mjs, and both marks stay
  • 8aba269docs: three queued fixes, one of them a live bug in shipped code
  • ae7c291docs: the compaction step's premise was wrong too
  • 51b73f0docs: one circle, two occupants — and a shell borrowed from Claude Code
  • 7be7444docs: what to take from the flywheel stack, ranked, with reasons to skip the rest

13 commits · first day

v1: a router that picks, and a pair that argues

It started as a router called flipflop: classify a coding task, decide which of the two agents should get it, learn from every time you overruled it. By the end of the day it had a brain store, domain tagging, a scoped review that reads the change rather than your whole tree, and a conference — which the last fix of the day revealed had never actually been conferring.

  • b9f7c85chore: initial commit — flipflop as built
  • fe0eeb4feat: rename flipflop to claudecodex, add ccx alias, symlink onto PATH
  • e729069feat: tag router signals with domains, reusing them as the domain detector
  • 091285bfeat: brain store, verdict logic, parse ladder, conference legs, scoped review
  • 7d386c5feat: orchestrator, conference view, honest stats — v1 runs end to end
  • e97142bfix: the conference was never actually conferring
  • f00c02ffix: bake the real Codex mark, not the OpenAI knot
  • 2ff5877fix: keep the old-name exemption narrow to the migration constant
  • 1dcf37atest: lock the degradation matrix

The first site

The landing page, before the hands.

  • ec841d8Add generative landing site with WebGL hero effects
  • 3ab3395feat: launch site for claudeandcodex
  • 1b79367chore: ignore vercel local env in site/

A README written like a person wrote it

Run through the same anti-slop pass every other piece of prose here goes through.

  • 2ad4101docs: README, edited through no-ai-slop

Generated from git log --no-merges on 31 July 2026, at cbb2902. Version 0.1.0. Commit subjects are quoted, not paraphrased; the summary above each group is the only editorialising on this page.