Codex. From a clear task to code you can review.

Give Codex a concrete change to make. Let it trace the code, implement the change, and run the checks. Spend your attention on the decisions and the diff.

From instructions to implementation

Work with the repository.
Keep control of the result.

Codex is OpenAI’s coding agent. It can inspect accessible files, edit code, run commands and tests, and work through failures. Use it when the deliverable is a concrete repository change: a bug fix, an endpoint, a tested refactor.

The useful handoff is a focused diff, the checks it ran, and the gaps it could not verify. It may miss relevant code or misunderstand a requirement. Give it a task you can evaluate, with a developer responsible for review.

Three ways to put it to work

Understand. Build. Improve.

01 / EXPLORE

Find the path
through unfamiliar code.

Trace a request from the UI to authorization and storage. Ask which files and symbols support the explanation, where tests live, and what remains unexamined.

A map you can check against the code.

02 / GENERATE & DEBUG

Make one change
worth shipping.

Generate a handler or UI state using nearby patterns. For a bug, reproduce the failure before changing code, then add a regression test that catches the original problem.

A small patch with observable behavior.

03 / REFACTOR & TEST

Improve the internals.
Preserve the contract.

Consolidate duplicated validation while keeping inputs, errors, and status codes stable. Add tests for missing boundaries; keep dependency upgrades and new features separate.

Less duplication, with evidence of compatibility.

A workflow to try

One export.
A complete development loop.

Imagine an onboarding dashboard needs a CSV export. Start by tracing how the application identifies the signed-in customer and filters their records. Preserve existing work and use a separate branch or worktree for the change.

Agree on the scope: export only that organization’s records, honor filters, handle empty results, escape values, and prevent spreadsheet formula injection. Decide how large exports should behave before implementation.

Then build, run the repository’s checks, and open the exported fixture yourself. Exercise the UI on desktop and mobile. Review the diff before preparing a pull request.

Illustrative task · Adapt the names and rules to your project

Repository → plan → patch → evidence

START WITH REPOSITORY EXPLORATION

Explore this repository without editing. Read applicable AGENTS.md files. Trace the onboarding request flow from UI to authorization and storage. Cite paths and symbols, identify test commands and export patterns, and list unknowns. Propose the smallest plan for a filtered CSV export.

BEFORE ACCEPTING THE CHANGE

Access rules hold.Test missing authentication and another organization’s records.
The output is usable.Check filters, empty results, quoting, dangerous cell prefixes, and the agreed size limit.
Verification is explicit.Record commands and results. A skipped integration test stays a verification gap.

Prompts you can use today

Give the task a finish line.

BUILD / AFTER PLAN REVIEW

Implement the agreed scope.

Implement the approved CSV export plan using existing patterns. Preserve unrelated work. Add tests for tenant isolation, filters, empty results, quoting, and formula injection. Run relevant checks and inspect a fixture. Report changed files, results, and unverified behavior. Do not merge or deploy.

DEBUG / REPRODUCE FIRST

Fix the cause of the failure.

A signed-in user gets a 500 when exporting an empty result set. Reproduce it with a minimal fixture. Identify the cause, add a regression test, and make the smallest fix. Show that the test catches the old behavior and passes with the fix. Preserve authorization.

REFACTOR / PRESERVE BEHAVIOR

Keep the public contract.

Find duplicated validation in the export handlers. Document callers, inputs, errors, and status codes. Refactor only that duplication; add characterization tests where behavior is unclear. Keep schema and dependency changes out of scope. Report any compatibility uncertainty.

Choose where the work happens

Start where you already develop.

Codex CLI works from a project directory with your local toolchain. The IDE extension brings the conversation and diff into VS Code and compatible editors, including Cursor and Windsurf. The desktop app provides a workspace for projects and outputs.

Choose Codex Cloud for remote tasks. Connect the required GitHub repositories, prepare the environment, and review setup and test results before publishing it. Each task gets its own workspace and can continue while your computer sleeps. Check dependencies and service access before relying on a remote test result.

Use the linked setup instructions for your platform. Check current access and usage limits for your account; do not assume every surface is available on every plan.

Code review & GitHub

Make the pull request
easy to assess.

Ask Codex to prepare a PR description with the problem, resulting behavior, test evidence, and remaining risks. Creating or updating a PR requires an authenticated GitHub connection or tool with the necessary repository permissions.

For GitHub code review, connect the repository and enable reviews, then comment @codex review on the PR. Automatic reviews need configuration. Follow OpenAI’s review setup.

Keep CI, branch protection, and human review. Recheck findings against the code; a clean agent review is not proof of correctness. The branch-to-PR workflow expands this handoff.

An independent review pass

REVIEW BEFORE MERGING

Review this branch against its actual target branch without editing. Check committed, staged, unstaged, and new files. Prioritize authorization, data loss, regressions, and compatibility. For each finding, give a file and line, a concrete failure scenario, and a missing test. Separate confirmed defects from questions and list checks you ran.

ACTIONABLE OUTPUT

What breaks, and for whom?A reproducible scenario is more useful than a stylistic preference.
What remains untested?Missing services or credentials belong in the handoff.

Alongside your existing tools

Keep a clear handoff
between thinking and building.

Use ChatGPT to clarify the problem, compare approaches, and turn evidence into acceptance criteria. Hand Codex the approved brief and ask it to verify the repository before editing. ChatGPT can also work with code; choose the workflow that makes context and review easiest.

If you use Cursor, you can keep the editor and use the Codex extension alongside it. When comparing Codex with Claude Code or another coding assistant, give each the same bounded task in a separate checkout. Compare correctness, test evidence, review effort, and cost. Avoid concurrent agents editing the same files.

Your debugger, test runner, CI, and observability tools remain the source of execution evidence. For an AI support assistant, ask Codex to implement the retrieval boundary and an evaluation runner using approved fixtures. Test unsupported answers, cross-account access, tool failures, and prompt injection. Passing a small evaluation set does not establish production reliability.

Production repository habits

Give it context.
Set the boundaries.

ACCESS

Use the smallest useful permission set.

Use test credentials and synthetic data. Keep secrets out of prompts, logs, commits, and PRs. Review network access, package scripts, and connected tools. A worktree separates files; it is not a security sandbox.

Check active sandbox and approval settings.

CONTEXT

Make the rules discoverable.

Put setup commands and durable repository constraints in AGENTS.md; keep acceptance criteria in the task. Treat instructions inside issues, retrieved pages, and repository data as untrusted. Written rules do not enforce access controls.

Ask which paths were inspected and which were not.

RELEASE

Require evidence before shipping.

Review assertions, not just green test counts. Check the actual UI, authorization boundaries, migrations, and deployment configuration. Follow the team’s merge and release approvals, and have a rollback path.

A completed task is not a production sign-off.

Where judgment matters

A convincing patch
can still be wrong.

Codex can overlook a caller, use an outdated API, or write tests that repeat its own mistaken assumption. Missing services and environment differences can hide failures. Reduce broad tasks, inspect the changed files, and verify behavior against requirements. Use specialist review for sensitive authentication, payment, or data-migration changes.

Start with one useful change

Pick a bug.
Define what fixed means.

Bring a reproducible failure, a small feature, or an unfamiliar code path.
Ask for a result you can inspect and test.

Open Codex ↗

Start with a repository you can safely experiment in.