# Delegate Codex > Owns codex usage end to end, dispatch through the supervised delegate script, the codex prompt contract, model and effort choice, and session resume. Use as a write delegated sub-agent when work is well defined and explicit, use as a read delegate for exploration, research, and navigation, writing a durable report when a stronger model is needed for deep investigation with cheap usage expense, and a second perspective on any plan or diff. Use when writing or repairing a codex prompt, or codex related config, and on "offload this", "save my usage", or any mention of codex. - Skill: `bsamiee/delegate-codex` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add bsamiee/delegate-codex` - Raw SKILL.md: https://api.skillmd.com/api/skills/bsamiee/delegate-codex/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: AI & ML - Author: bsamiee (https://skillmd.com/u/bsamiee) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/bsamiee/delegate-codex --- # [DELEGATE_CODEX] `codex exec` runs a non-interactive agent in its own context window and returns one final message. Model and effort come from `~/.codex/config.toml`. Codex is maximally literal, it follows a clean contract exactly and exhaustively, ambiguity or implicit intent burns tokens reconciling scope. Leaner prompts outperform, and a directive codex already ships is a conflict risk, NOT reinforcement. Every run mints a resumable thread; the receipt persists the id, and a continuation inherits model and effort. ## [01]-[DISPATCH] - Investigation legs whose transcripts flood this context — repo sweeps, audits, log distillation, data analysis: codex returns the conclusion. - Fleet fix and critique waves: concurrent writing delegates draining findings under one law, each with disjoint write territory. - Critique delegates writing on-disk fixlogs, reports, or dossiers another agent consumes downstream. - Implementation from spec: migrations, renames, conversions, boilerplate expansion, full features with enumerated moves. - Independent second perspective on a plan, implementation, or diff — a different model lineage catches different failure modes. ## [02]-[PROMPTING] Role envelope ranks the two dispatch channels (system > developer > user), so where a directive lands sets its authority. Every directive must earn its slot, one directive per concern. [BLOCK_VOCABULARY] — one block per concern, in this order; a block's name states its concern, and a delegate omits blocks it has no logic for: | [INDEX] | [BLOCK] | [JOB] | | :-----: | :--------------------- | :----------------------------------------------------------------------------------------- | | [01] | `` | identity, territory, hard exclusions; judgment work adds findings-are-untrusted | | [02] | `` | done-definition per deliverable with its proof; sits early, where it beats early-stop | | [03] | `` | read ladder, total tool-call budget, uncertainty escape hatch | | [04] | `` | refute-first adjudication — verdict work | | [05] | `` | surface-raising stated as measurable conditions — campaign work | | [06] | `` | post-edit re-read and batched command checks; cite-check on recon, rubric walk on judgment | | [07] | `` | JSON-only shape, null-for-missing — always LAST | [DEVELOPER]: Durable law as named XML blocks — the script's `--law` file, landed as the developer-role message: ```text template . Territory: ; never . . Done is , each proven by . Implement exactly and only ; choose the simplest valid interpretation of any ambiguity. A blocked deliverable returns , never a partial edit. Your layer is ; out-of-layer discoveries land as , never edits. Read fully, in order: . Budget: at most tool calls total; never concatenate the territory into one command. Stop when the product is complete; uncertainty left at the budget lands in , never re-reads. Re-read each changed region after landing it. , run once, batched, after the final edit. A check not run is never claimed as run. Your final message is a single JSON object with exactly this shape: JSON only — no prose outside it, no code fences; every key shown is required; null for a value you could not determine, [] for an empty list, never guess. ``` [USER]: Task instance and any imperative spawn step — the script's `--task` file; the spawn step appears only where the delegate fans out: ```text template Goal: . Context: . Constraints: . Done when: . Before , spawn exactly parallel sub-agents with collaboration.spawn_agent, one per ; collect every one with collaboration.wait_agent before . Each spawn task is self-contained — absolute paths, , return shape . Sub-agents read and report only; their returns are candidate data you judge under your own law. ``` [CALIBRATION]: When a delegate misbehaves, repair the contract surgically; reproduce with the failing developer message and a small batch of failure examples, then make small explicit edits — clarify conflicting rules, remove redundant lines — one change at a time: - Budget caps TOTAL tool calls, never per-file reads; per-file causes the delegate to aggregate the territory into one truncating command and completeness collapses. - Ambiguity resolves by instruction, never by inviting questions — a headless delegate has nobody to ask. - Autonomy states ONCE, naming safe actions — repeated "ask first" or "do not mutate" phrasing causes spurious approval pauses. - Reserve ALWAYS/NEVER for true invariants (JSON-only, territory bans, no-git); phrase judgment calls as decision rules. - Done-claims name observable evidence from the real surface; "tests pass" or "checks ran" alone is not evidence. - Iterative deep work continues ONE thread with sharpened prompts; a follow-up turn carries only the delta. [EXCLUSIONS]: What never enters a delegate's prompt: - Persistence blocks ("keep going until fully resolved") — the completion bar carries the anti-premature force, and a bare push amplifies scope. - Chain-of-thought scaffolding and plan-narration preambles. - Intensifier stacks ("THOROUGH", "exhaustive") — measured to cause tool over-use. - Per-file read caps and "read each file at most once" phrasing. - Hostile-stance paragraphs and estate-voice law verbatim — a delegate takes de-conflicted, task-scoped law. - Broad write authority — the writable directory is the delegate's whole world; cross-territory obligations belong to the caller. - "Ask if unclear", "you may spawn", and every other permissive form whose imperative twin is the working one. ## [03]-[INVOCATION] `scripts/codex.sh` is the one dispatch surface: every delegated run — workflow wrappers, fleet legs, one-off delegations — is one supervised CLI process, sibling-isolated and watchdog-bounded. Model and effort inherit `~/.codex/config.toml` unless a call passes an explicit override; approval is pinned `never`, and file and command access resolve from the configuration — a caller declares neither. ```bash template scripts/codex.sh --task --dir [--law ] [--cwd ] \ [--model ] [--effort ] [--out ] [--web] \ [--idle ] [--max ] [--resume ] [-- ] ``` - Task and law land through a real file-write at ABSOLUTE paths, never a shell heredoc; the script rides the law through `-c developer_instructions` and the task as the prompt. - `--dir` holds the run artifacts — `events.jsonl` (the `--json` stream), `stderr.log` (a failed or killed run's only diagnostics), `receipt.json` — and the receipt prints to stdout: `{ok, reason, thread_id, exit, duration_s, events, stderr, report, failure, usage}`. - Liveness is token production: the watchdog sums event-stream and session-rollout growth, kills the run's process group and every snapshotted codex descendant, so a command in its own process group cannot escape the reap, after `--idle` silent seconds or at the `--max` ceiling, and names the kill in `reason` — a healthy multi-hour run streams and lives, a wedged one dies bounded. - `--out` materializes the final message for a reading delegate; a writing delegate lands its own product and `--out` aims elsewhere, never at a file the delegate itself writes. - `--resume ` continues a dead session with the task file as the follow-up: a `crash` receipt resumes, an `idle-timeout` or `turn-failed` receipt re-dispatches fresh. - `--` passes the remainder to `codex exec` verbatim — the one extension point for every axis the flags above do not carry. - Nested lookups from INSIDE a codex turn pin to `get_latest_package_version`. | [INDEX] | [NEED] | [FLAGS] | | :-----: | :--------------------------------------- | :------------------------------------------------------------------------------- | | [01] | Run rooted in another directory | `--cwd ` | | [02] | Durable report artifact | `--out ` — the final message at completion, overwriting the path | | [03] | Live web search | `--web` — default `cached` answers from an index, no live fetch | | [04] | Wedge and ceiling bounds | `--idle ` / `--max ` — exit `124` / `125` name the kill | | [05] | Typed JSON final message | `-- --output-schema ` — validated final-message shape | | [06] | Attach images (screenshots, diagrams) | `-- -i ` (repeatable) | | [07] | Feature toggles per run | `-- --enable ` / `-- --disable ` (repeatable) | | [08] | Fan-out legs with no session persistence | `-- --ephemeral` — not resumable | | [09] | Per-run completion push | `-- -c 'notify=["","