This note defines the stable release gate and the current stable baseline for Codex Workspace.
The target is a practical release gate:
- no placeholder shipped surfaces
- a repeatable fresh-machine bootstrap path
- automated coverage for agent-tooling detection and scaffolding
- a clear support matrix
- a migration note for the
.codex/contract
Current status:
- stable baseline verified on 2026-04-03
- automated checks passed via
bootstrap-workspace.sh, both doctor scripts, andrelease-readiness.sh - live Workspace Hub smoke checks passed for a direct-preview repo, an external WordPress repo, and a mixed-stack SwiftPM repo
Treat these as the release contract unless a real compatibility break forces a change:
AGENTS.mdis the tracked instruction surface.codex/config.tomland.codex/skills/are the official repo-local Codex surfaces.agents/skills/is a supported compatibility mirror, not the primary Codex path.workspace/agent-stack.jsonis the tracked multi-tool hint layer when needed.opencode/and.omx/stay optionaltools/ref/remains reviewed reference-only material, not a runtime dependencytools/manifests/workspace-capabilities.jsonis the tracked registry for installable workspace abilities and core services
Run these before calling a release stable or after changes that could affect the workspace contract:
tools/scripts/bootstrap-workspace.sh --runon a clean clone or fresh machinetools/scripts/doctor-workspace.shtools/scripts/doctor-agent-tooling.shtools/scripts/release-readiness.sh- Review public-facing files and metadata that should mention the change:
- root
README.md docs/README.mddocs/CHANGELOG.md- relevant repo-local docs such as
repos/workspace-hub/README.md - optional wiki/navigation pages under
docs/wiki/when public navigation should surface the feature
- root
- Open Workspace Hub and verify a direct-preview repo, an external-preview repo, and one mixed-stack repo still behave correctly
Do not skip the manual repo check just because automated verification passed.
- workspace root layout with
docs/,repos/,tools/,cache/, andshared/ repos/workspace-hub/as the tracked local dashboard- repo-native runtime handling for Vite, static, PHP, WordPress, and other conservative classifications
- tracked repo-local Codex surfaces in
.codex/ - compatibility mirroring to
.agents/skills/when a repo wants it - reviewed upstream snapshots under
tools/ref/
shared/skills/.workspace/agent-stack.json.opencode/.omx/- shared Playwright browser cache under
cache/playwright-browsers - shared shell helpers for Playwright and other workspace-wide env defaults via
tools/scripts/print-workspace-env.shandtools/scripts/run-with-workspace-env.sh - Local (or similar) for WordPress-oriented workflows
- workspace abilities under
repos/abilities/when they are explicitly installed and documented
- vendored third-party harnesses as workspace runtime dependencies
- placeholder plugins or TODO manifest surfaces
- forcing every repo into one dependency tree
- mandatory OpenCode, OMX, Bun, or Local installs
- mandatory
gh auth loginas part of baseline clone or release verification
Older workspace docs treated .agents/skills/ as the native repo-level Codex
path. The stable contract is now:
- keep official repo-local Codex skills in
.codex/skills/ - keep
.codex/config.tomlminimal and repo-specific - use
.agents/skills/only when you want a tracked compatibility mirror
For existing repos:
- Move or mirror repo-owned Codex skills into
.codex/skills/. - Keep
.agents/skills/only if another local tool or workflow still benefits from it. - Use
tools/scripts/sync-codex-skills.shwhen tracked source material needs to be copied into repo skill folders. - Verify the repo in Workspace Hub after the change.
Stable-release hardening must not rewrite existing sibling repo content by default.
Use:
- temp fixtures for tests
- dry runs for sync tools
- tracked templates and scripts for workspace-wide behavior
Do not mutate nested repos under repos/ unless the user explicitly asks for it.