What it is
Elpis is a home for coding agents. It keeps Codex's engine, its tools and its sandbox, and adds the controls around them: a ledger of what each agent was told, a board for teams of agents, a page that shows every request and tool call, and one place for every model you pay for, from GPT and Claude to Gemini and OpenRouter.
Why it exists
Today's coding agents load every instruction file they find and keep the whole conversation until the window fills. You cannot see what they were told, and you cannot take it back. Put several on one task and it gets worse: they write over each other's files, nobody checks the work, and you merge the result by hand.
Elpis treats both as one problem, the context an agent works in, and answers it with two rules:
You choose what each agent sees. The Context Ledger lists every instruction file, chosen file and memory with its token cost, and you include or exclude each one.
Each agent owns what it writes. In a workflow every agent has its own folder, a second agent checks its work, and the Mother agent reviews the combined result before anything reaches your project.
How it works
Elpis keeps Codex's Rust engine and sandbox and adds its controls around the chosen model. The desktop app is Electron with a Node bridge that drives each agent over the Agent Client Protocol. No model weights are bundled. State lives in /.elpis-next, or in the folder ELPISHOME names.
How a workflow orders its steps. Elpis sorts the board with Kahn's algorithm: an agent starts once everything it waits for, and that work's check, has passed. Agents in one wave run side by side. A loop is refused before any agent starts, unless you choose the Recursive pattern and a round limit. The Voting team runs in four waves:
Who may write what: ownership, as in Rust. Rust lets many readers or one writer hold a value, never both, and checks this before the program runs. Elpis applies the same rule to agents:
Rust Elpis workflow A value has one owner Each agent owns agents/ and the folders you give it; in a Git project it works in its own worktree, and a step that changed files outside its folders fails. Shared borrows read, never write Every writer is followed by a check that reads its work and writes only agents/ /check. No two mutable borrows at once Two agents linked to work alongside may not share a folder. The owner decides what lives The Mother agent reviews the combined commit and must pass it with evidence before Elpis fast-forwards your project.
A Voting team (three answering agents and one tally agent, each with its own check) finished on GPT-6 Luna and on Claude Haiku 5.5 in 74 to 100 seconds; the test is tests/canvas-live.runtime.mjs. Outside a Git project the folders are instructions, not enforced.
What Elpis builds on, and what it adds. Elpis is a fork of OpenAI's Codex (Apache-2.0): its engine, about 2.3 million lines in codex-rs/, carries Elpis's changes but stays close to upstream. Elpis's own code is about 214,000 lines, 8% of the repository: the desktop app, the bridge, the Context Ledger, workflows, the terminal additions and their tests. The Observability page is a port of the Trajectory view from DeepSeek Harness (MIT); thank you to its authors. Details: technical guide, context, sessions.
Summary
Elpis gives you the two controls today's coding agents lack: you decide what each agent sees, and each agent may change only what it was given. Install it from the latest release, open a chat, and look at its Context Ledger before you send the first message.
CONTRIBUTING.md explains how to build, test and report a bug. Upstream Codex is Apache-2.0; Elpis keeps its attribution and notices (LICENSE).
Demo
Core features
Context Ledger. Every instruction file, file and memory an agent receives, with its token cost; include or exclude each.
Workflows. Describe a job; the Mother agent does it herself or designs a team on a board you can edit. Patterns: Sequential, Parallel, Kahn graph waves, Recursive and Voting.
Observability. Every request, tool call, token and cache hit of a chat on one timeline, in the desktop app's Observability page and the terminal's /dashboard (next release).
One app for every model. GPT, Claude and Gemini, through your ChatGPT or Claude subscription or an API key; switch models without losing the thread, and import chats from Claude Code and Codex.
Two apps, one engine. A desktop app (four themes, light and dark) and a terminal app, sharing sessions and state. In the terminal, the Agent command center shows each helper under its parent chat.
Love Spot. A drawing board where Matilda, the app's companion, answers and draws with you.
Quick start
Install both apps, the desktop app and the terminal app, on Linux x8664:
Then run elpis-app for the desktop app or elpis for the terminal app, and sign in with ChatGPT or Claude, or set up a provider. Claude models run through your own Claude Code install.
Other ways to install
From the v0.5.1 release; every file has a SHA-256 checksum:
Ubuntu, Debian: sudo apt install ./elpis0.5.1amd64.deb ./elpis-desktop0.5.1amd64.deb
Fedora, Arch, Omarchy, any Linux: chmod +x Elpis-0.5.1-x8664.AppImage, then run it; add elpis to run the terminal app.
Arch, Omarchy (native package): git clone https://github.com/MasihMoafi/Elpis && cd Elpis/packaging/aur/elpis-bin && makepkg -si
Terminal app only: curl -fsSL https://raw.githubusercontent.com/MasihMoafi/Elpis/v0.5.1/scripts/install-elpis.sh | bash
Both apps share one engine and one state folder, /.elpis-next.
Where it's going
Matilda as the one agent you talk to. She routes work to the right agents, sets up workflows, keeps schedules and reminds you, on the model of DeepSeek Harness's super agent.
Automations. Prompts and workflows that run on a schedule, set with a calendar or asked for in one sentence.
A code-health dashboard. Size, churn, duplicates and agent readiness for any Git project open in Elpis.
Smart Prune and reasoning expiry are experimental. Not claimed: the whole inherited Codex test suite; macOS and Windows builds. Release CI gates each terminal release on Elpis's Rust checks, runtime evals with failing controls and clean offline installs; these checks do not prove that Elpis writes better code.