See the work. Trace the decisions.
Actual 3.70 interface. The graph uses an offline controller run with stub responses, not live models.
Legacy 3.70.1 command. See the verified distribution boundary below for current activation limits.
npx great-cto init
Website · One real run → · Blog · Changelog
Русский · 简体中文 · 繁體中文 · 日本語 · 한국어 · Español · Português · Deutsch · Français
Keep the task, its checks and your next decision connected.
great_cto coordinates Claude Code workflows and experimental controlled Codex
runs through explicit stages, review and gates. The local board brings tasks,
recorded execution, project documents and consumption into one workspace.
Missing evidence stays unknown; a successful worker is not proof that a task
was accepted, merged or deployed. You use your own provider account;
great_cto is MIT and bills nothing.
Project focus presents eight core roles plus the selected project's required
reviewers. The full catalog of 72 agents remains available. Catalog availability is
not proof of execution or expertise.
Quick start
Verified distribution boundary (ADR-045): this implementation replaces mutable installers
with verified artifact admission. init, native plugin refresh and automatic
companion installation currently refuse activation. Plain npm self-update needs
the separately configured verifier and a signed release artifact set. This is
not evidence of an installed or published update. See
verified updates for the supported boundary.
The commands below describe the legacy 3.70.1 installation flow; they are not
an activation route for this implementation.
npx great-cto init
Restart Claude Code. Day to day there are three things:
| In Claude Code | In the terminal |
|---|
| Start work | /start "add Google login" | great-cto run "add Google login" |
| See what needs you | /inbox | great-cto status |
| Continue | /resume | great-cto resume |
/start takes a new product or a task in an existing project and picks the
workflow itself. /resume continues only what you already approved; a pending
decision still waits for you. Everything else — /review, /spec, /save,
/digest and the rest — is there when you need it:
all commands.
One project, five views
Run great-cto board to open the local board, normally at localhost:3141.
Readings such as unverifiable, unmeasured and unavailable are not passes.
| View | What you can inspect |
|---|
| Work | Tasks, acceptance criteria, the next supported action, and Overview / Execution / Evidence tabs |
| Decisions | Pending decisions and existing gate controls, without broadening their authority |
| Knowledge | Read-only project Markdown, ADRs and a bounded diagram viewer with Mermaid source fallback |
| Insights | Recorded task outcomes, project-scoped token consumption, estimates and budgets kept separate |
| Settings | Executors, Runtime, Capabilities and General controls |
Execution shows controller-recorded causal history for controlled runs, including
attempts, checks, verification, gates and repair. Native and legacy sessions stay
partial or unavailable; missing edges are not inferred. This is not a live terminal
or workflow editor. The sample graph comes from offline stub responses, not models.
A role verdict is not independent-review proof. Merge, release and deployment
need their own evidence; unknown is not zero or pass.
Documents keep their original language. The application interface is English.
The diagram describes declared architecture, not a running task.
These screenshots use isolated synthetic ACME records. They do not measure
host quality, acceptance rate or quality uplift. Capture contract.
Eight core roles, task-dependent specialists
| Responsibility | Role |
|---|
| Problem and acceptance | product-owner |
| System design and tradeoffs | architect |
| Plan and dependencies | pm |
| Implementation | senior-dev |
| Independent code review | code-reviewer |
| Verification and regressions | qa-engineer |
| Risk and ship gate | security-officer |
| Authorized deployment | devops |
These are responsibility contracts, not eight mandatory model calls or eight
concurrent agents. Project focus is a presentation view; it does not remove
specialists, change dispatch or waive required checks. Risk-specific reviewers
remain governed by project policy.
Focused engineering context
Five versioned, opt-in domain pack candidates cover four focus areas:
| Area | Engineering invariants | Boundary |
|---|
| Money & crypto execution | Payment idempotency, ambiguous sends, scoped authority; signing boundaries, paper/live separation and chain finality | Two technical packs; no investment-performance claim |
| Telemedicine workflows | Clinician authority, prescription state transitions and evidence integrity | No clinical efficacy or certification claim |
| Venture evidence | Claim provenance, entity lineage and quarantine of unverified assertions | No investment-outcome claim |
| Mental wellbeing safety | Subject isolation, crisis escalation precedence and clinical-claim boundaries | Separate from diagnosis, treatment and clinical validation |
Packs add engineering context. They do not broaden permissions or change
required-reviewer routing. Their presence does not prove invocation, expertise
or better outcomes. No quality uplift from matched core-versus-pack trials is
established. Private project overlays are not part of the public showcase.
On OpenAI Codex
There are three distinct modes, not identical native integrations:
| Mode | Execution and authority |
|---|
| Claude Code native pipeline | Native commands, specialist roles and hooks; decisions stay in the linked host |
| Controlled Codex / mixed-host pipeline (experimental) | Controller-owned role routing, validated text proposals, verifier and explicit gates |
| Codex plugin in an ordinary session | Skills, MCP and safety hooks; installation alone does not start the controlled pipeline |
Mixed runs can assign roles to either CLI. Eligible review joins can inspect
the same frozen tree concurrently; this is not two writers editing the same
worktree. Both CLIs must be installed and authenticated. See the
host guide for routing, recovery and manual-action boundaries.
In the legacy 3.70.1 installation flow, npx great-cto init --host codex gives Codex the skills, the MCP server and six
safety guards as plugin hooks (approve them once: run codex in a terminal and
choose Trust all and continue). An ordinary Codex plugin session does not
automatically run this project's native Claude command/role lifecycle.
The Codex installation has no native plugin surface for these slash commands
or role agents. The remaining Claude workflow hooks do not silently run there.
Start the controlled pipeline through the CLI instead:
great-cto run "add Google login" --host codex --allow src,tests,docs
great-cto status --host codex
great-cto resume --host codex
The legacy 3.70.1 plugin refresh is explicit by default (great-cto upgrade codex).
In this implementation, native refresh and timer enable refuse before mutation
pending a verified no-fetch activation contract. Previously installed timers
retain their existing code until an authorized migration.
In the legacy 3.70.1 macOS flow, sh scripts/codex-auto-update.sh enable opts into a six-hour per-user timer;
status inspects it and disable removes it. Each tick validates the Git
marketplace origin before asking Codex to upgrade. It follows the configured
Git ref, not npm releases, and changed hooks still need host review in a new
session. Details, mixed runs and Codex as the second reviewer:
Codex host guide.
When it stops you
One line in .great_cto/PROJECT.md:
approval-level | Stops you at | Stops |
|---|
ship-only | the deploy — and briefs you on what gets built | 1 |
product-only | what we build · whether it ships | 2 |
gates-only (default) | what we build · the design · the deploy | 3 |
strict | the design · code review · the deploy | 3 |
auto | nothing in the pipeline | 0 |
Regulated products — fintech, healthcare, gov — keep their security, compliance
and ship gates at every level. How the gates work.
Numbers, measured
| |
|---|
| One feature, end to end, fully traced | 1h 26m · $3.40 in tokens — the receipts |
| A whole product — 7 built in the open benchmark | median $171 in tokens · 70/100 quality, measured 2026-07-10 — reproduce it |
These are historical observations, not a benchmark of the current two-host
pipeline or domain packs. No quality-uplift percentage is established.
Domain packs remain opt-in; their presence does not prove expertise or better outcomes.
Limitations
For one builder, not a team; not a hosted app builder — it needs your coding
agent; not a CI/CD system; compliance scaffolds are starting points, not
certifications; LLM output is not deterministic. The honest version of each,
and what it refuses to claim: docs/DETAILS.md.
Learn more
Docs · Getting started ·
Commands · Gates · Agents ·
FAQ · Everything else ·
Issues · Security ·
Contributing · Privacy — telemetry is off by default
MIT — LICENSE. Built by @avelikiy.
If it saved you time, a star helps other solo builders find it.
