One host · independent reviewers · explicit authority
One product. Two workflows. A Multi-agent system: independent model advisors inspect one host task, while Codex or Claude Code remains the editor and integrator. that keeps one host responsible.
Start with a one-shot consultation for research, planning, or review. Opt into Panda Loop v2 only when the task needs evidence-gated readiness, bounded repair, and a durable decision record.
Product map
Panda 2.0 is the current product release, not a third workflow. Panda has one shared reviewer profile and two distinct operating modes.
Ask independent reviewers to inspect a plan, diff, or difficult engineering question. The host synthesizes the advice and remains responsible for every decision.
Bind a task and workspace, run verifiers, require every reviewer gate, and allow repair only inside explicit limits.
ready, repair_required, or escalateIndependent reviewers inspect. The host integrates. Consultation advises; Loop derives decisions from host evidence.
Shared setup
Consultation and Loop v2 use the same plugin installation and saved reviewer profile. Choose the workflow per task; do not install a second Panda.
Please install Panda as Codex and Claude Code plugins. Use the latest release: https://github.com/igcodinap/panda/releases/latest From the Panda checkout: python3.12 -m pip install -e '.[mcp]' codex plugin marketplace add /path/to/panda codex plugin add panda@panda-repo claude plugin marketplace add /path/to/panda claude plugin install panda@panda-repo Verify both plugin managers list panda@panda-repo as enabled.
I’ll install the MCP extra, add the Panda marketplaces, install the Codex and Claude Code plugins, and verify both are enabled.
codex plugin marketplace add /path/to/panda codex plugin add panda@panda-repo claude plugin marketplace add /path/to/panda claude plugin install panda@panda-repo CODEX_BIN set to an authenticated CLI
--host-profile claude-code or for
Claude-backed advisors
The minimum working setup is Python plus one host CLI. Codex is the default host/reviewer path;
Claude Code uses the claude-code host profile. OpenCode remains an optional source of
extra review pressure.
ROI recommendation: after your host CLI, the first optional paid add-on is OpenCode Go, currently listed at $5 for the first month and then $10/month. It gives Panda a separate budget for Kimi, GLM, Qwen, and other OpenCode-backed review agents.
Independent reviewers inspect a question, plan, or implementation. The host synthesizes their advice; consultation never claims the workspace is ready and never authorizes mutation.
Review this implementation plan with Panda.
Using Panda to analyze the research and plan. I will integrate the useful findings.
Panda focuses on research and plan quality before implementation, then checks the result for drift, missing tests, and inconsistencies.
Panda spends extra model attention before the host writes code, where a wrong read or weak plan can cascade into much larger implementation waste.
Once the host implements, Panda can review the diff against the research and plan to catch drift, inconsistencies, and verification gaps.
Loop is the strict execution workflow: bind the task and workspace, verify, require every reviewer gate, and repair only within explicit authority. It is not the default consultation path.
panda_loop.py preflight hashes the normalized task, freezes the reviewer profile,
runs deterministic guardrail checks, and asks Panda to critique only the instruction boundary.
panda_preflight.v2.json for later enforcement.contract_coach metadata to score the task setup.run --require-preflight fails if any task, reviewer, workspace, artifact, repair, or mutation input drifts.The loop fingerprints the workspace, records sanitized verifier evidence, and requires every frozen reviewer to return an evidence-addressable gate from a read-only role.
The default-off falsifier opens a fresh one-shot session, prefers a different model family, and classifies every registered claim exactly once. A source model cannot adjudicate its own claim.
not_found requires a recorded search scope.
Automatic repair and typed repair_steps require a structured report and stay inside path,
file, line, binary, symlink, cycle, repair, and wall-clock limits. The next evidence cycle proves the result.
inspect, safe resume, and workspace-safe abort preserve control.
Shape the task, preflight it, execute only the approved preview, then let verification and
independent review derive ready, repair_required, or escalate.
Objective, non-goals, verifiers, repair budget, and mutation limits.
task.json Uses repo context but does not edit product code yet.
Preflight is the next authority boundary.
task.json Schema v2 is hashed with the exact execution policy.
Looks for scope creep, weak tests, unsafe repair, or missing stop rules.
panda_loop.py preflight Shows findings and the Loop Contract Preview before execution.
Reviewer failures and review-time workspace drift block approval.
panda_preflight.v2.json Binds task, reviewers, workspace, evidence, repair, and mutation policy.
No means groom the contract and rerun preflight. Yes means execute the exact preview with --require-preflight.
Intervenes on ambiguity, unsafe commands, or changed intent.
Edits only through a bounded implementer and validates its repair report.
Every reviewer must cover registered evidence; the falsifier stays advisory.
panda_review_gate.v1.json Iteration evidence and replayable events bind the decision to the workspace.
Ready requires green verifiers, every reviewer, sufficient coverage, stable fingerprints, and no critical or major finding.
Sees terminal status, decision reasons, blockers, and the evidence artifact path.
No silent follow-up edit after readiness without another evidence cycle.
The host remains the sole editor and integrator.
loop_summary.md The compact summary records status, reasons, blockers, and the Panda review artifact directory.
Pin the evidence, approve the preflight preview, then run the exact approved contract.
{
"schema_version": 2,
"objective": "Implement the requested change and keep tests passing.",
"non_goals": ["Do not refactor unrelated modules."],
"plan_reminders": ["Preserve public behavior unless the task says otherwise."],
"verification_commands": ["python3 -m pytest -q -p no:rerunfailures"],
"implementation_summary_artifact": {
"path": "implementation-summary.json",
"sha256": "0000000000000000000000000000000000000000000000000000000000000000",
"provenance_mode": "scratch"
},
"auto_repair": {
"enabled": true,
"backend": "codex",
"allow_review_only_findings": false
},
"falsifier": {
"mode": "off",
"max_runs_per_evidence": 1
},
"mutation_policy": {
"allowed_paths": ["src/", "tests/"],
"max_changed_files": 20,
"max_changed_lines": 1000,
"allow_binary_changes": false,
"allow_symlink_changes": false
},
"stop_when": {
"max_verification_cycles": 2,
"max_repairs": 1,
"max_wall_seconds": 3600,
"blocking_findings": ["critical", "major"]
}
}python3 scripts/panda_loop.py preflight \
--task-file task.json \
--workspace "$PWD" \
--privacy-mode advisory-summary \
--output-dir /tmp/panda-preflightpython3 scripts/panda_loop.py run \
--task-file task.json \
--workspace "$PWD" \
--require-preflight /tmp/panda-preflight/panda_preflight.v2.json \
--privacy-mode advisory-summary \
--output-dir /tmp/panda-looppython3 scripts/panda_loop.py inspect --output-dir /tmp/panda-loop
python3 scripts/panda_loop.py resume --output-dir /tmp/panda-loop
python3 scripts/panda_loop.py abort --output-dir /tmp/panda-loop --reason user_requested"repair_steps": [
{
"command": "python3 scripts/regenerate_clients.py",
"report_artifact": "tmp/panda-repair-report.json"
}
]
This is a policy template. Before advisory-summary preflight, create a valid
implementation-summary.json and replace the all-zero placeholder with the raw file's SHA-256.
Follow the summary evidence schema;
use full-context only when repository export is explicitly approved. Resume acquires the loop lock,
rejects task/profile/workspace drift, and never replays an ambiguous interrupted repair.
Artifact suffixes identify contract schema versions. A current file such as
panda_review_gate.v1.json is part of Loop v2; it does not mean “Loop v1.”
A strong loop task has focused scope, explicit boundaries, meaningful verifiers, bounded repair, tight stop rules, clear privacy posture, and maintainability pressure.
Use Panda Loop v2 for this change. Draft a narrow task contract first: - objective - non_goals - constraints - plan_reminders - verification_commands - implementation_summary_artifact when using advisory-summary - falsifier policy - mutation_policy - stop_when.max_verification_cycles, max_repairs, and max_wall_seconds Run preflight and show me the Loop Contract Preview. Use Contract Coach to tighten weak task boundaries. Do not execute the loop until I approve the current preview. After execution, report tests, reviewer status, artifacts, and commit state.
Core Panda consultation is not obsolete. This migration applies only to strict Loop execution authority: old inputs remain readable, but Loop v2 requires fresh workspace evidence before approval or resume.
Strict boundary
Loop v2 keeps compatibility at the parser and inspection layers while refusing to infer trust from old approvals, partial evidence, or ambiguous side effects.
max_iterations aliases verification cycles; conflicting values and
verification_passes: false are rejected.
panda_preflight.v1.json Preflight v2 binds the exact task, reviewers, privacy mode, canonical workspace, initial fingerprint, artifacts, repair policy, and mutation limits.
advisory-summary needs a valid implementation summary and raw-file SHA-256.
Full-context review needs inspected files unless the candidate explicitly made no change.
There is no quorum fallback. Missing, malformed, abstaining, timed-out, incomplete, or workspace-mutating review escalates.
Review-only repair is opt-in. Automatic and typed repairs produce reports; mutation defaults to 20 files, 1,000 lines, and no binary or symlink changes.
New runs record phase input digests and idempotency keys. Resume continues only from safe boundaries; ambiguous interrupted repair escalates.
Defaults: without repair, one verification cycle and zero repairs; with repair, two cycles and one repair. Hard ceilings are three cycles, two repairs, and 3,600 seconds. Allowed mutation paths derive from the validated implementation summary unless the task explicitly narrows or broadens them.
Shared proof
Panda's architecture is research-informed, but Panda-specific net benefit remains unproven. The evaluation record and research base constrain both workflows without turning promising experience into a product claim.
False-ready rate is primary; solve-rate lift remains an experimental question.
New experiments append to attempts.jsonl with trial identity, pair and parent links,
hashes, base commit, exposure count, tokens, cost, wall time, and tool/test calls.
semantic_ratings.jsonl.legacy.Repeated fresh attempts cover both baseline successes and failures across five fixed arms:
strong_single_agent and fresh_clean_retrypanda_v2 and evidence_gated_falsifierfull_bounded_loopThese code labels are experiment-arm IDs, not separate Panda products.
A valid task-audit must align prompt, tests, reference patch, coverage, dataset revision, auditors, and supporting evidence. Unaudited discovery requires an explicit research flag and stays outside causal metrics.
Safety first False-ready rate is primary, with finding precision/recall, false blockers, false repairs, and repair regressions.
Paired efficacy Solve-rate effect uses exact McNemar results and task-clustered bootstrap intervals; passk tracks reliability and blinded stratified ratings report human agreement.
Complete cost Stalls, iterations, latency, tokens, dollars, calls, and validated findings per 1,000 tokens remain visible.
Panda does not yet claim statistically proven solve-rate lift over Codex or Claude Code alone. The architecture is research-informed; Panda-specific net benefit remains an experimental question.
Panda uses the literature as constraint, not decoration: coordination has cost, budgets matter, external feedback beats intrinsic confidence, and benchmarks require humility.