EOC — Everything OpenAI Codex Workflow OS
Turns a raw Codex agent harness into a repeatable engineering environment: 60 agents, 232 skills, 110 rules, 28 hooks, and cross-harness adapters in one open-source repo.
Per-dimension scores and reasoning
Least privilege has concrete support (minimal profile excludes hooks by default, CI uses contents:read with pinned actions). User confirmation and data-flow transparency rely on --dry-run previews, consult preview, and uninstall manifests, but actual hook interception on the host cannot be statically verified — deducted to 2. Sensitive data handling is a strength: SECURITY.md covers credential templates, leak rotation, local MCP port verification, and ephemeral system-reminder triage — near full marks. Dependency security has npm audit, IOC scans, and supply-chain docs, but only 3 runtime deps and no directly visible lockfile-audit evidence, scored 2. Rollback is thorough: install-state records, uninstall --dry-run, repair, explicit refusal to delete non-installed files. Attribution exists via LICENSE and author metadata, but the publisher is unverified and pyproject.toml carries a placeholder email, scored 2.
Self-consistency is mostly good: catalog counts are CI-enforced (catalog:check), but the repo embeds an unrelated, contradictory pyproject.toml ('llm-abstraction' with duplicate openai version pins and a placeholder email) that conflicts with the product identity — deducted to 2. Dependency availability: CI matrix covers 3 OS × 3 Node × 4 package managers, yet pnpm requires bypassing strict corepack, indicating fragile compatibility — 2. Failure messages: tests prove stdout tails are included in errors and max_turns is downgraded to non-fatal, but this is evidenced in only one skill's tests — 2.
Audience and scenarios are well covered: 12+ language ecosystems, multi-harness adapters, and non-coding skills — 3. Capability boundaries are partially declared (ecc2 labeled alpha, multi-* needs ccg-workflow, plugin cannot distribute rules), but the quality boundary of 232 skills is not statically verifiable — 2. Trigger precision: hook profiles (minimal/standard/strict) and matchers exist but matching semantics are not elaborated — 2. Environment fit is strong: Windows/macOS/Linux, PowerShell installer, six-level package-manager detection — 3.
Information architecture is excellent: execution-model table, doc navigation, loop-stage-to-surface mapping. Install notes are the repo's strongest area: single-path principle, no-stacking warnings, per-OS commands, naming migration note, reset flow — 3. Naming stability is weakened by three public identifiers (repo, eoc@eoc, @mturac/eoc); explained but still confusing with legacy aliases — 2. Examples and FAQ: usage commands and screenshots exist but no dedicated FAQ — 2. Known limitations: ecc2 alpha and multi-* dependencies declared, but the 60-agent/232-skill coverage claim has no per-item evidence — 2. License is complete MIT text consistent with metadata — 3. Versioning and changelog are detailed with a SECURITY.md support matrix — 3. Maintenance responsibility: SECURITY.md SLA (48h ack/7d update/30d fix) and weekly maintenance workflow, but a single maintainer — 2.
Output usability: status snapshots exportable as markdown, eoc status --exit-code for automation, but actual output shape needs a run — 2. Marginal value: packaging skills/hooks/rules as installable units adds real value over a bare harness, but differentiation from existing Codex config ecosystems is under-argued — 2. Cost-benefit: token-optimization docs and cost-tracking skills exist, but no quantified context-injection cost for 232 skills — 2.
Claim traceability: catalog counts CI-enforced, install manifests validated, but runtime claims ('997 internal tests passing', 'field-tested') cannot be executed here — 2. Cross-source corroboration: README, package., SECURITY.md, and CI configs agree on counts, versions, and security mechanisms, but no independent file substantiates the passing-test claims — 2. Fact/inference separation: the repo mostly separates facts from marketing ('operating system for serious Codex work'), yet promotional assertions (launch kit, demo proof listed as backlog items) are not explicitly flagged as unverified — 2.
- The embedded pyproject.toml ('llm-abstraction') is unrelated to the main product, contains duplicate openai version pins and a placeholder email — confirm its purpose before evaluation; a self-consistency concern.
- Hook scripts execute on your machine; this static review cannot verify runtime interception. Start with the minimal profile (no hooks), review hooks/ contents, then enable incrementally.
- Do not stack plugin install with the full manual installer (README warns of duplicate surfaces); if already stacked, clean up via the documented uninstall flow first.
- The npm channel (@mturac/eoc) and plugin identifier (eoc@eoc) use different names — verify identifiers at install time to avoid installing a similarly named package.
- Runtime and field claims ('997 tests passing', 'field-tested') were not executed or verified in this review; run the test suite yourself before adoption.
- Publisher is unverified by a curated registry and maintenance is single-person; assess long-term maintenance and security response before production use.
What does this agent do, and when should you use it?
EOC (Everything OpenAI Codex) is an MIT-licensed open-source repository that packages an installable workflow system for OpenAI Codex and adjacent agent harnesses including Cursor, OpenCode, Gemini, Zed, GitHub Copilot, and Trae. It is organized around a repeatable operator loop — Intake, Route, Plan, Execute, Verify, Capture, Resume — realized through concrete repo surfaces: agents/, skills/, rules/, commands/, hooks/, MCP configs, and manifest-driven install modules. The validated catalog currently ships 60 specialized subagents (planner, code-reviewer, rust-build-resolver, and more), 232 skills spanning backend, frontend, security, ML, docs, operations, and release work, 110 rules, 28 hook matchers, and 75 legacy command shims. Installation runs through the Codex plugin marketplace (eoc@eoc) or a manifest-driven manual installer (install.sh / install.ps1 / npx eoc-install), with a SQLite state store and scripts such as scripts/status.js and work-items.js managing sessions and install state. The repo also carries an in-tree alpha Rust control plane (ecc2/) exposing dashboard, session, start/stop/resume, and daemon commands, plus a Tkinter desktop dashboard.
Once installed, EOC injects reusable surfaces into Codex: Markdown subagents in agents/ handle delegated tasks (planning, code review, build-error resolution, E2E testing); SKILL.md files under skills/ define invocable and auto-suggested workflows (tdd-workflow, verification-loop, security-review, eval-harness, plus language pattern packs); rules in rules/ must be manually copied to ~/.codex/rules/ecc/; hooks/hooks. auto-loads in Codex v2.1+ and is gated at runtime via ecc_HOOK_PROFILE (minimal|standard|strict) and ecc_DISABLED_HOOKS. Two install paths exist: the Codex plugin (/plugin marketplace add https://github.com/mturac/everything-openai-codex && /plugin install eoc@eoc) or manifest-driven manual install (node scripts/install-apply.js --profile minimal --target codex), with npx eoc consult "security reviews" to discover matching components. Verification uses /quality-gate, skills/verification-loop, scripts/preview-pack-smoke.js, and manifest validators; state capture uses eoc status --markdown --write status.md, eoc work-items sync-github --repo owner/repo, and scripts/sessions-cli.js to persist and resume work across sessions.
- Engineers running long-running Codex sessions on large projects who need session memory, compaction prompts, and handoff-friendly status snapshots (eoc status, session capture, strategic-compact)
- Teams that want enforced quality gates and security review flows in Codex (/quality-gate, security-reviewer agent, supply-chain scanners, hook safety gates)
- Maintainers of polyglot codebases needing dedicated review and build-fix agents for TypeScript, Python, Go, Java, Kotlin, Rust, C++, Perl, and more
- Developers using Cursor, OpenCode, Gemini CLI, Zed, or GitHub Copilot who want one skill/rule set reused across harnesses via cross-harness adapters and install targets
- Automation-focused users orchestrating multi-service workflows or autonomous loops (/multi-plan, /multi-execute, autonomous-loops skill, PM2 commands)
- Contributors building team-specific workflows who can add components to skills/ and agents/ following the SKILL.md frontmatter convention and validate with the test suite
What are this agent's strengths and limitations?
- Verifiable, CI-enforced catalog: 60 agents, 232 skills, 110 rules, 28 hook matchers, backed by a regression suite reported at 997 passing internal tests
- Genuine cross-harness portability: one repo targets Codex, Cursor, OpenCode, Gemini, Zed, Copilot, and Trae with adapters (e.g., Cursor's adapter.js maps its 20 hook events onto shared scripts/hooks/*.js)
- Strong state and resumability story: SQLite state store, eoc status handoff snapshots, work-items sync with GitHub/Linear queues, session capture and compaction prompts
- Install, uninstall, and health flows are command-supported (install-apply, uninstall --dry-run, eoc doctor, eoc repair), and uninstall only removes files recorded in install-state
- Install paths can conflict: stacking the plugin with a full manual install creates duplicate skills and hook behavior; the README explicitly requires a single path
- Rules cannot be distributed via the Codex plugin and must be manually copied and maintained; bundled MCP servers also do not auto-enable on plugin installs
- Heavier runtime footprint: requires Node.js, a package manager, optional Python/Tkinter for the dashboard; multi-* commands additionally need the external ccg-workflow runtime
- The ecc2/ Rust control plane is explicitly alpha with immature packaging and cross-harness resume semantics; the current public release is v2.0.0-rc.1, not stable
How do you install or deploy this agent?
Recommended path (Codex plugin — pick one path only, do not stack):
- In Codex run:
/plugin marketplace add https://github.com/mturac/everything-openai-codex
/plugin install eoc@eoc- Plugins cannot distribute rules; to add them: git clone https://github.com/mturac/everything-openai-codex.git, then mkdir -p ~/.codex/rules/ecc && cp -R rules/common ~/.codex/rules/ecc/ (plus language dirs like rules/typescript as needed).
Manual/source install path:
git clone https://github.com/mturac/everything-openai-codex.git && cd everything-openai-codex && npm install
node scripts/install-apply.js --profile minimal --target codex --dry-run # preview
node scripts/install-apply.js --profile minimal --target codexOr ./install.sh --profile minimal --target codex (Windows: install.ps1, or npx eoc-install). Requires OpenAI Codex CLI v2.1.0+. Uninstall: node scripts/uninstall.js --dry-run, then run without the flag.
How do you use this agent?
After the plugin install, use the namespaced form: /eoc:plan "Add user authentication" (manual installs keep the short /plan). Common entries: /code-review, /build-fix, /quality-gate, /security-scan, /sessions. Skills are the primary workflow surface — tdd-workflow, e2e-testing, and verification-loop can be invoked directly or auto-suggested. Runtime tuning: export ecc_HOOK_PROFILE=minimal, export ecc_DISABLED_HOOKS="pre:bash:tmux-reminder", export ecc_SESSION_START_MAX_CHARS=4000. Discover components with npx eoc consult "security reviews" --target codex; list installed content with /plugin list eoc@eoc or node scripts/eoc.js list-installed. Desktop dashboard: npm run dashboard. Note: multi-* commands additionally require the ccg-workflow runtime (npx ccg-workflow).
How does this agent compare with similar options?
EOC positions itself as an operating system for Codex workflows rather than a prompt dump or single plugin: manifest-driven installs, catalog-count CI enforcement, and cross-harness adapters distinguish it from ad-hoc skill collections. The README also names adjacent ecosystem projects — codex-seo, codex-ads, codex-cybersecurity (maintained by AgriciDaniel, unbundled and unaudited) and the companion hermes-supercode-skills-codex skill pack — as related ecosystem references.