Four AI coding agents, one repo full of rules for who gets to run

I have four AI coding tools installed: Claude Code, Codex, OpenCode and Antigravity, Google's agent app. They overlap a lot, and none of them know about the others. Each one reads its own instruction file, and each one would happily do the whole task itself.

On the morning of September 9 I made a repo to fix that. It's called ray-orchestrator and it contains no code. Its README puts the rule in bold: "Zero App Code in this Repo". An agent opened there is only supposed to work out which repo a task belongs to, pick which tool should do it, write that tool a tight brief, dispatch it, and check the result.

The first commit landed at 09:18. The eighth and last landed at 09:33. It hasn't had a commit since.

One file, four names

Every agent looks for a different file. Claude Code reads CLAUDE.md, Codex reads CODEX.md, Antigravity reads GEMINI.md, OpenCode reads OPENCODE.md. I didn't want four copies drifting apart, so there's one real file and three symlinks:

AGENTS.md
CLAUDE.md   -> AGENTS.md
CODEX.md    -> AGENTS.md
GEMINI.md   -> AGENTS.md
OPENCODE.md -> AGENTS.md

This is the part I'd keep. Whichever tool I open in that directory, it gets the same rules, and when I change a rule I change it once.

AGENTS.md opens with a prime directive, never write project code in this repo, and then a section per agent that says the same thing again in slightly different words. If you are Claude Code, do not modify files here. If you are Codex, do not modify files here. And so on, four times, which is roughly how you have to write for agents.

The repo also has an opencode.json, which points OpenCode at AGENTS.md and sets the permission for everything to allow. So the rule against editing files is enforced entirely by prose, in a directory where one of the four tools has been told it may do anything it likes.

The routing table

The routing is capability first, repo second. A task comes in, the agent looks up the target in a registry file, then picks a tool:

deep multi-file work, tricky bugs and anything that runs a test suite goes to Claude Code with claude -p
fast fixes, small scripts and PR reviews go to Codex with codex exec, or codex exec review
browser automation, MCP tools and planning that spans repos go to Antigravity as a subagent
anything that wants a model from outside those three goes to OpenCode with opencode run, through OpenRouter or Command Code

The registry lists nineteen of my personal repos, each with a stack and an assigned role with a job title, like "Trading Strategy Engineer" for the crypto strategy repo and "Cloudflare Worker Specialist" for the one with my Workers in it. It also lists a few repos from my day job, which I'm leaving out here. One personal repo got removed from the registry less than eight minutes after the first commit, which tells you how carefully the first draft was assembled.

Every dispatch is supposed to carry a contract: an absolute working directory, the objective, a scope boundary, a model and reasoning effort, and a check that proves it's done. That part is borrowed from how I already brief agents by hand, and it's the one piece that doesn't need the rest of the repo to be useful.

Banning models, three times in a minute

At 09:31 I added MODEL_SELECTION.md, a catalog of which models to use at which tier and effort. It was a reasonable-looking document. It listed GPT-6 Astra and Claude Fable 5.1 at the top, the GPT-5.6 family below them, DeepSeek V4 Pro, and a workhorse tier of Gemini 3.8 Flash and 3.7 Flash, GPT-5.4 Mini, Claude 3.7 Sonnet and one more. The cheap tier was Gemini 3.1 Flash Lite and 3.5 Flash. It even recommended GPT-5.3 Codex for coding.

Then I read it.

At 09:32:09 the first fix went in: never use GPT 5.3 or 5.4, never use any Gemini below 3.8. That wiped out most of the workhorse and cheap tiers, including a cell in the effort matrix that had quietly pointed at gpt-5.4.

At 09:32:30, 21 seconds later: no Gemini Pro models, under any circumstance. Flash only. The previous commit had still allowed a gemini-pro-latest alias, and I didn't want an agent reaching for the expensive one because the name sounded better.

At 09:33:11, 41 seconds after that: Command Code gets cheap models only. The default there became GLM 5.3 Flash, with Qwen 3.8 Flash, DeepSeek V4 Flash Fast and Gemini 3.8 Flash as the alternatives. Every frontier model that had been routed through Command Code, the GPT-5.6 family and DeepSeek V4 Pro among them, either moved to OpenRouter or disappeared. The rule is written out as "Never route expensive frontier models through Command Code".

The whole block now sits at the top of the file under a big IMPORTANT callout, with NEVER in capitals three times. Sixty-two seconds of commits, and the model catalog went from a list of what exists to a list of what I'll tolerate.

What I didn't notice until I went back to it for this post is Claude 3.7 Sonnet. It was in the 09:31 catalog. The 09:32:09 rewrite dropped it along with the old GPT and Gemini entries. Then the 09:33:11 commit, the one that finished the purge, put it back, in a new line saying Claude Code runs "Claude Fable / Claude 3.7 Sonnet". There is no floor for Claude models. So the final file bans GPT-5.4 by name as outdated and offers a much older Claude as a normal option, and it got there by removing it and re-adding it inside one minute.

What it's actually for

The honest summary of this repo is that it's a description of how I'd like to delegate, written in the format agents read. The routing table is roughly what I do by hand anyway. The floors are the useful bit. Agents pick models from whatever they remember, and they remember old model names. Without a written floor, a helpful agent will pick GPT-5.4 because it's the newest one it heard of.

It went from nothing to eight commits in fourteen and a half minutes, and nothing since. The rules still say never to write code in there, and the config still says OpenCode is allowed to.