A codex plugin for running optimization loops inside a codebase. It is useful when you have a measurable target and many possible changes to try: test runtime, build speed, bundle size, model loss, Lighthouse scores, memory use, query latency, or any other metric you can print fr
SaferSkills independently audited codex-autoresearch (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This is the one skill surface and the only Codex-facing skill. Do not route users to old subskills, slash commands, or separate dashboard/finalizer skills.
Default state machine:
setup -> doctor -> next -> log -> state -> finalize-previewThe job: make one measured improvement loop trustworthy enough that a human can follow it and a future session can resume it.
setup, doctor, next, log, state, then finalize-preview.research-start --cwd <project> --slug <slug> --goal "<goal>". It creates the scratchpad, configures quality_gap, validates the command, and records the first baseline as measure unless --no-baseline-log is passed.node scripts/autoresearch.mjs --help --all from the package root before naming a less common command.new-segment when the active segment is maxed, stale, phase-changing, or no longer comparable.autoresearch.md, autoresearch.jsonl, autoresearch.ideas.md, active last-run/progress snapshots under .git/autoresearch/ in Git repos, fallback autoresearch.last-run.json / autoresearch.progress.json outside Git, and autoresearch.research/<slug>/.METRIC name=value, packet evidence, ASI, continuation data, promotion labels, and the ledger.recommend-next --compact or state --compact; obey blockers. Compact-state field names: docs/concepts.md#state-fields.benchmark-lint must prove the primary METRIC contract before product packets are trusted.commitPaths or pass --commit-paths for kept results in Git repos.Use docs only as needed; do not load everything by default.
docs/start.md, docs/operate.md, and references/loop-operations.md.docs/trust.md, docs/architecture.md, and references/dashboard-trust.md.docs/finish.md, docs/workflows.md, and references/research-finalize.md.docs/troubleshooting.md.docs/control-plane.md.node plugins/codex-autoresearch/scripts/autoresearch.mjs .... From the package root: node scripts/autoresearch.mjs ....autoresearch.md, autoresearch.jsonl, and autoresearch.ideas.md when present.setup-plan for read-only setup guidance when essentials are unclear. Use setup only when essentials are known and files should be created.doctor --cwd <project> --check-benchmark --explain before the first trusted packet or any drift-sensitive metric.setup -> doctor -> next -> log -> state -> finalize-preview.recommend-next --compact or state --compact; obey blockers; open detailed diagnostics only when the canonical action is blocked, stale, or unclear.state --report for a terminal-first report.text. Governance fields are listed in docs/concepts.md#state-fields.serve --cwd <project>, verify liveness, and provide the live dashboard URL only when the user asks, the browser readout matters, or CLI state is not enough.task_manifest packet evidence as audit data; quarantine malformed manifests and path escapes without invalidating unrelated metric evidence.session-forensics imports benchmark-overfit or row-specific steering feedback, treat the decision capsule as a trust blocker.Happy-path CLI from plugins/codex-autoresearch:
node scripts/autoresearch.mjs setup --cwd <project> --name "<session>" --metric-name <metric> --direction lower --benchmark-command "<command>"
node scripts/autoresearch.mjs doctor --cwd <project> --check-benchmark --explain
node scripts/autoresearch.mjs next --cwd <project>
node scripts/autoresearch.mjs log --cwd <project> --from-last --status measure --description "Baseline measurement"
node scripts/autoresearch.mjs state --cwd <project> --report
node scripts/autoresearch.mjs finalize-preview --cwd <project>After next, log the packet. After log, read the returned continuation object.
next writes a reusable last-run packet. run remains a raw benchmark probe.log --from-last instead of retyping parsed metrics.keep, ordinary discard, and measure require a finite primary metric.measure for non-promotional evidence: baselines, no-change probes, environment checks, and diagnostics.crash and checks_failed can be logged without inventing sentinel metrics.review_required metrics as provisional until ASI acknowledges the review outcome.autoresearch.config.json contains fixedControl, treat the named artifact as control truth. Do not rerun commands matching forbiddenCommandPatterns unless the user explicitly accepts --allow-fixed-control-rerun; prefer reuseCommandHint.ledger-doctor --cwd <project> --json before another packet. Use ledger-doctor --repair --yes only after reviewing the JSON health summary; after repair, verify the returned backupPath.sourceCleanliness.blocks.nextPacket=false only says source dirtiness is not the blocker.continuation.shouldContinue is true, choose the next hypothesis from ASI, experiment memory, autoresearch.ideas.md, or dashboard lane guidance.continuation.forbidFinalAnswer is true, continue with progress updates instead of returning a final answer.checks-inspect before deciding.completionAudit before a parent agent calls update_goal(status="complete").codex-goal-brief and completion-audit evidence.CLI fallback:
node scripts/autoresearch.mjs next --cwd <project> --compact
node scripts/autoresearch.mjs log --cwd <project> --from-last --status keep --description "Describe the kept change"
node scripts/autoresearch.mjs state --cwd <project> --report
node scripts/autoresearch.mjs state --cwd <project> --compactUse the served dashboard when a live readout is useful:
scripts/autoresearch.mjs serve --cwd <project>.http://127.0.0.1:<port>/ URL by default.--debug-ledger is explicitly used.Use a deep-research loop for broad, qualitative, product-study, UX, architecture, or documentation prompts. Study, accept gaps, measure quality_gap, close credible candidates, then start a fresh round when the question is still alive.
research-start --cwd <project> --slug <slug> --goal "<goal>". It seeds autoresearch.research/<slug>/, configures the quality_gap benchmark, validates the command, records the first baseline as measure, and prints the resume commands. Use --no-baseline-log only when that first baseline should not be recorded.autoresearch.research/<slug>/sources.md.synthesis.md: filter hallucinations, separate evidence from inference.quality-gaps.md.quality-gap --cwd <project> --research-slug <slug> --list.gap-candidates; apply only credible high-impact gaps.quality_gap=0 only means the accepted checklist for the current round is closed. Read freshRoundSuggested, researchIntegrity, sourceCleanliness, finalization readiness, and plateau reason fields before deciding next steps.
For crashed or timed-out packets with artifact rows, use partial-results --from-last before rerunning expensive work.
Use finalization when noisy loop history has useful kept commits.
finalize-preview --cwd <project> before branch creation.status: "keep" evidence.--include-session-artifacts only when the reviewer explicitly wants them.current-tree-finalization, run finalize-current-tree --cwd <project> --exclude-session-artifacts. Do not substitute generic finalize-preview as the primary command.When Codex uses subagents to work on Autoresearch itself:
Use the narrowest relevant check while iterating. Before claiming plugin work is done, run from plugins/codex-autoresearch:
npm run checkTargeted checks:
npm test
node scripts/autoresearch.mjs --help
node scripts/autoresearch.mjs doctor --cwd . --check-benchmark --explain
node scripts/autoresearch.mjs benchmark-lint --cwd .
node scripts/autoresearch.mjs checks-inspect --cwd . --command "npm test"
git diff --check~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.