AI-Codex — QA orchestration and safe testing platform
Currently in development. AI-Codex brings project scope, test targets and scenarios, Playwright workers, quality controls, audit tools, and role permissions into one operating environment.
1 / 10
AI-Codex is an operating environment for teams that test several web systems and need firm boundaries around every run. Instead of keeping target URLs, scenarios, evidence, and results in separate tools, the platform connects them in one controlled workflow—from defining an authorised scope to handing a report to development.
The task
The central challenge was to coordinate testing across development, QA, staging, and production without allowing an active check to reach the wrong environment. Operators need a clear view of available projects and workers, while owners must be able to define domains, action policies, rate limits, roles, and release-blocking findings.
What was implemented
- An operations centre showing project coverage, active runs, pending 2FA actions, critical findings, and Playwright worker availability.
- A guided project wizard for environment, authorised HTTPS domains, and permitted action policy.
- Targets and reusable scenario templates for authentication, forms, API contracts, password recovery, and e-commerce flows.
- A quality-control workspace for regression, API, visual, performance, repeated test, and notification workflows.
- Controlled adapters for Lighthouse, Grafana k6, Nuclei, OWASP ZAP, PHP_CodeSniffer, PHPStan, and Semgrep.
- A permission matrix for Owner, Admin, Manager, Operator, and Viewer roles, including separate rights for active testing, report export, credentials, and project management.
- Built-in guidance covering a seven-step testing flow, browser video and trace evidence, and HTML, PDF, DOCX, and JSON reports.
Safety boundaries
Each project carries an explicit environment and action policy. Production targets are reserved for passive or read-only checks; dynamic, load, and security testing is directed to an expressly authorised QA or staging target. The interface makes limits, 2FA pauses, and release-blocking results visible before an operator proceeds. The public entry point also uses a protected session and restrictive browser security headers.
The result
The team gains one testing control plane for scope, scenarios, runs, findings, evidence, and reporting. Repeated checks become easier to organise, responsibilities are visible, and developers receive enough context to reproduce a failure without rebuilding the test history from scattered services.
The platform remains in active development: the main project and QA management cycle is operational, while adapters, scenarios, and reporting options continue to expand.