aesthetic-instrument

Ship products with the coding agent you already have.

npx great-cto init

Website · One real run → · Blog · Changelog

Русский · 简体中文 · 繁體中文 · 日本語 · 한국어 · Español · Português · Deutsch · Français

---

Your coding agent ships code. This is what checks it.

You write a spec. Your Claude Code builds against it, a second model from another family reads the same diff, and where they disagree you see the disagreement and decide. Three decisions stay yours — what gets built, how, and whether it ships. What lands is a repository you own and a URL that works.

Seven products built this way in the open benchmark: median $171 in tokens, measured 2026-07-10. You pay your own LLM provider; great_cto is MIT and bills nothing.

   describe a product
        │
   🤖  problem framed · options weighed · brief written
        ▼
   👤  checkpoint 1 — approve WHAT gets built
        │
   🤖  architecture · data model · screens · plan
        ▼
   👤  checkpoint 2 — approve HOW it gets built
        │
   🤖  scaffold → backend → frontend → tests → review → security
        ▼
   👤  checkpoint 3 — approve the deploy
        │
   🤖  deployed · repo · live URL

Three stops is the default, not the floor. One line takes it to one:

approval-level: ship-only

The board at localhost:3141 fills itself in — Decisions (what needs you), Ledger (what it cost), Fleet (which agent to stop trusting), Harness (who gave the second opinion, and what it actually did). Nothing on it renders an absence as a pass: a scan that never ran is n/a, never a green zero.

Numbers, measured

The quality score is produced by running each product's own tests, not by counting files — which is why it says 70 and not a rounder, prettier number.

Quick start

npx great-cto init

Restart Claude Code, then:

/start "build a dispatch & scheduling app for an HVAC business"

A day with great_cto:

When you need it: /review a branch before merge · /spec a feature before code · /poc a risky idea with a hard timebox · /crystallize a lesson so it never repeats · /sec security posture · /doctor when something looks off. All commands: reference.

Requires Node ≥ 18.17. Companion plugins (Superpowers, Beads) install automatically. After init, verify the host actually loaded the plugin — claude plugin list --json should show no errors for great-cto.

On OpenAI Codex (npx great-cto init --host codex) you get the skills and MCP server. Codex still has no native plugin surface for hooks, slash commands or role agents, so /start does not become a Codex slash command and Claude hooks do not silently run there. That is a limit of the host, not a setting: hooks in a plugin manifest is never read (openai/codex#16430, #39895).

The supported pipeline path is the separate controller shipped by the npm CLI:

npx --yes [email protected] codex-host doctor
npx --yes [email protected] codex-host start --dir "$PWD" --prompt "build the feature" --allow src,tests,docs
npx --yes [email protected] codex-host resume <run-uuid>

It routes the shared graph through controlled Codex role profiles, applies only validated text proposals, runs an independent verifier, preserves the run cursor outside the worker repository and enforces human gates. Optional operator-owned policies add offline Docker checks and approval-bound local or GitHub Release publication with byte verification and recovery. The boundary is deliberate: this is a controlled host runtime, not emulation of native Codex hooks, arbitrary shell deployment, npm publishing or service activation. See the Codex host guide and support contract.

Two harnesses, one review. Independently of the controlled host, Codex can also be the second opinion for a Claude Code run. From inside Claude Code it reads the same diff, and each review line carries the sha of the tree it read, so "reviewed" can be proven about this diff rather than asserted. The log holds 4 lines so far, 1 carrying a sha; no catch-rate is claimed from that, and none should be.

Since 3.26.0 Codex takes part in the pipeline as that second reviewer. Declare it once:

# .great_cto/PROJECT.md
capabilities:
  second_opinion: codex      # or: openrouter · none

and on every high-stakes change the Claude code-reviewer and codex exec (read-only sandbox, your Codex login, no API key) review the same diff at the same time. Findings merge; a P0 from either side blocks; where they disagree, both sets reach the human at the gate — the stricter one sets the verdict, and nobody averages. The board's Harness screen detects Codex, holds the choice, and shows beside it what the second opinion did: every run, including skipped ones, from .great_cto/cross-review.log. Four states, and the fourth is th