RepoCodex
Git-native why next to code — with a pin check that proves it still matches.
Coding agents write syntax well and forget why. Comments rot. Instruction files (CLAUDE.md, AGENTS.md, Cursor rules) never prove they still describe live text. Tests check behavior you remembered to assert; they do not keep institutional why attached to the lines that implement it.
RepoCodex stores that why in git beside the code. Agents retrieve it before they edit. A deterministic pin check (ripgrep + git) attests the attachment. Built for repositories where coding agents make the changes.
Not a test suite. Not another instruction file. Not a linter.
Experimental. Requires Python 3.11+ and ripgrep (rg) on PATH.
Install
pip install "repocodex==<engine_version>"
# or from a local clone: pip install -e .
repocodex install
repocodex install writes the pre-commit hook, GitHub Action, agent skills, and .repocodex.toml pinned to the installed package (ENGINE_VERSION). Hook, local CLI, and CI must run that same version. The product is that loop: agents retrieve stored why before they edit, so they do not silently break existing behavior; the pin check fails the turn when why and code diverge, and a first substantive edit of an uncovered file is denied until a pinning concept is written.
repocodex context src/billing/PaymentGateway.ts # retrieve why before edit
repocodex validate --diff # attest pins still hold
Pin the engine in .repocodex.toml. Hook, local CLI, and CI resolve that pin so verdicts agree.
What a concept looks like
Types are orthogonal — one change may write more than one. Three common shapes:
TechnicalDecision (decisions/…) — why this construct exists:
---
title: Capture streams enterprise retries instead of buffering
type: TechnicalDecision
verification:
engine: ripgrep
anchors:
- path: src/billing/PaymentGateway.ts
all_of: ["yield", "ENTERPRISE", "capturePayment"]
---
Enterprise capture is a generator so retries stay backpressure-aware. Do not
replace with an in-memory list of attempts.
InvariantContract (invariants/…) — must-hold token (requires claims):
---
title: Enterprise capture grace is three attempts
type: InvariantContract
verification:
engine: ripgrep
anchors:
- path: src/billing/PaymentGateway.ts
all_of: ["ENTERPRISE", "grace", "= 3"]
claims:
- subject: enterprise_grace_attempts
literal: "3"
---
Enterprise plans get three capture retries before failure. Do not silently shrink this window.
BusinessWorkflow (workflows/…) — thin cross-package flow (one anchor per site):
---
title: Checkout capture flows api → billing → ledger
type: BusinessWorkflow
verification:
engine: ripgrep
anchors:
- path: src/api/checkout.ts
all_of: ["capturePayment", "billing"]
- path: src/billing/PaymentGateway.ts
all_of: ["capturePayment", "ledger"]
- path: src/ledger/posting.ts
all_of: ["postCapture", "idempotency"]
---
Checkout capture crosses api, billing, then ledger. Keep that order; do not
post to the ledger from the API layer.
Docs
| Doc | Job |
|---|---|
| How it works | Purpose, benefit, and the retrieve → read → edit → update why → pin-check loop |
| Memory | How to read .context/ |
| Agents | How coding agents (and optionally humans) run the loop |
| Install | CLI, pin, hook, GitHub Action, optional MCP |
| Architecture | Current engine architecture (further reading) |
License and contributing
MIT · Contributing · Security
Created by Ajay Lamba.
Metadata
Release files for repocodex 0.0.2
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| repocodex-0.0.2.tar.gz | 85.9 kB | With provenance | Details for repocodex-0.0.2.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| repocodex-0.0.2-py3-none-any.whl | Python 3 | none | any | Details for repocodex-0.0.2-py3-none-any.whl |
Total release size: 165.3 kB
Release files / repocodex-0.0.2.tar.gz
| Download URL | repocodex-0.0.2.tar.gz |
|---|---|
| Size | 85.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
867cc4803eba95407ccabded37702df16773322b61f0344510b903e25f2d822e
|
|
BLAKE2b-256 checksum How to use checksums |
7e237613319b5a74caf671cbb0558c0559c4c88a86af03bdebc71c96605c6b51
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 6, 2026.
Transparency logRelease files / repocodex-0.0.2-py3-none-any.whl
| Download URL | repocodex-0.0.2-py3-none-any.whl |
|---|---|
| Size | 79.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
ca57994def9e5d7b0d408368d1c6b3d0a5c5e17d531b279bc6337b4dfaf476fe
|
|
BLAKE2b-256 checksum How to use checksums |
7ad0271ee15685194b455833dc984cec45d7679d25920737efca86e83ba131e4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 6, 2026.
Transparency logSecurity for repocodex 0.0.2
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
Both files in this release have been uploaded with provenance metadata.
Attestation for repocodex-0.0.2.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 6, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.