Codex Goal Mode Masterclass: 35 Production-Ready Goal Prompts for Autonomous Long-Running Development Tasks

Codex Goal Mode Masterclass: 35 Production-Ready Goal Prompts for Autonomous Long-Running Development Tasks

By the ChatGPT AI Hub Editorial Team

Codex Goal Mode has matured into one of the most powerful autonomous development tools available to enterprise engineering teams. With OpenAI’s documented 85% task completion rate for properly scoped goals, the feature now represents a genuine shift in how senior developers can delegate complex, multi-step development work to an AI agent that plans, executes, verifies, and iterates without constant supervision. But the difference between a Goal Mode task that finishes cleanly and one that stalls, loops, or produces brittle output often comes down entirely to prompt architecture.

This masterclass delivers 35 production-ready goal prompts across seven critical development domains, paired with the structural principles that make each one work. Whether you’re orchestrating database migrations, building CI/CD pipelines, refactoring legacy codebases, or generating comprehensive test suites, the prompts here are designed to exploit Codex Goal Mode’s planning layer, its tool-use capabilities, and its documented strengths in multi-file, multi-step autonomous execution.

We’ll also cover the optimization strategies that separate teams achieving 90%+ autonomous completion from those stuck at 60%, including scope framing, constraint injection, verification checkpoints, and continuation prompts for tasks that exceed a single session context window.

Understanding Codex Goal Mode: What Makes It Architecturally Different

Before writing a single goal prompt, you need to understand what’s happening under the hood when Codex enters Goal Mode. Unlike standard completions or even multi-turn chat interactions, Goal Mode activates a planning layer that decomposes your stated objective into a dependency-ordered sequence of subtasks. Codex then executes those subtasks using its available tools — file read/write, terminal execution, web search, and code interpretation — while maintaining a working memory of completed steps and outstanding dependencies.

This architecture has three critical implications for prompt design:

• Goal decomposition quality is prompt-dependent. Vague goals produce shallow decomposition trees. Precisely scoped goals with explicit deliverables produce deep, well-ordered execution plans that Codex can execute autonomously.
• Tool invocation is triggered by context signals. If your prompt doesn’t signal that file operations, terminal commands, or external lookups are needed, Codex may default to generating code in-context rather than executing it against your actual repository.
• Verification loops require explicit permission. Codex won’t automatically run tests, lint checks, or type-checking passes unless your prompt either requests these explicitly or establishes a quality gate pattern that makes them structurally necessary.

The 85% completion rate OpenAI has documented applies to tasks that are scoped within what the team calls the “Goldilocks zone” — complex enough to require multi-step planning but constrained enough that the goal state is unambiguous. The prompts in this masterclass are engineered to hit that zone consistently.

The Four Structural Components of a High-Performance Goal Prompt

Every goal prompt that reliably achieves autonomous completion shares four structural components:

1. Objective Statement: A single, declarative sentence describing the end state, not the process. “Implement a Redis-backed rate limiting middleware for the Express API” rather than “Add rate limiting.”
2. Scope Constraints: Explicit boundaries on what Codex should and should not modify, which files are in scope, which dependencies are approved, and which architectural patterns to follow.
3. Deliverable Specification: A concrete list of artifacts that must exist when the task is complete — files created, tests passing, documentation updated, configuration changed.
4. Verification Criteria: Measurable conditions Codex can check autonomously to confirm the goal is achieved, such as test suite green, TypeScript compilation clean, or API endpoint returning expected response.

With this framework established, let’s move into the domain-specific prompt library.

Domain 1: API Development and Integration (Prompts 1–6)

Prompt 1: RESTful CRUD API with Full Test Coverage

Goal: Implement a complete RESTful CRUD API for a `Product` resource in the existing Express/TypeScript application.

Scope:
- Work within /src/routes/, /src/controllers/, /src/models/, /src/middleware/
- Use the existing Prisma ORM setup in /src/lib/prisma.ts
- Follow the controller pattern established in /src/controllers/UserController.ts
- Approved new dependencies: none (use existing stack)

Deliverables:
1. /src/models/Product.ts — Prisma model with fields: id, name, sku, price, inventory, createdAt, updatedAt
2. /src/controllers/ProductController.ts — CRUD methods: create, findAll, findById, update, delete
3. /src/routes/product.routes.ts — Route definitions with input validation middleware
4. /src/middleware/validateProduct.ts — Zod schema validation for create and update payloads
5. /src/__tests__/product.test.ts — Integration tests covering all five endpoints
6. Updated /prisma/schema.prisma with Product model
7. Migration file generated via `npx prisma migrate dev --name add_product`

Verification: Run `npm test -- --testPathPattern=product` and confirm all tests pass. Run `npx tsc --noEmit` and confirm zero type errors.

Prompt 2: Third-Party API Integration with Retry Logic

Goal: Build a production-grade Stripe payment processing integration with exponential backoff retry logic and idempotency key management.

Scope:
- Create /src/services/StripeService.ts as the primary integration layer
- Implement webhook handler at /src/routes/webhooks/stripe.ts
- Store payment records using existing Prisma setup
- Do not modify any existing payment-related files; create new files only
- Use stripe@latest SDK already in package.json

Deliverables:
1. StripeService.ts with methods: createPaymentIntent, confirmPayment, refundPayment, retrievePaymentIntent
2. Retry wrapper with exponential backoff (max 3 retries, base delay 1000ms, jitter applied)
3. Idempotency key generation using crypto.randomUUID() stored in Redis with 24h TTL
4. Webhook signature verification middleware
5. Payment and Refund Prisma models with full audit trail fields
6. Error classes: PaymentFailedError, WebhookValidationError, IdempotencyConflictError
7. Unit tests for retry logic and idempotency key collision handling

Verification: `npm test -- --testPathPattern=stripe` all pass. No TypeScript errors. Webhook handler returns 200 for valid Stripe test events.

Prompt 3: GraphQL Schema with Resolvers and DataLoader

Goal: Implement a GraphQL API layer for the existing User and Post Prisma models using Apollo Server 4, with DataLoader to eliminate N+1 query problems.

Deliverables:
1. /src/graphql/schema/user.graphql and post.graphql — SDL type definitions
2. /src/graphql/resolvers/userResolver.ts and postResolver.ts
3. /src/graphql/dataloaders/UserLoader.ts and PostLoader.ts using facebook/dataloader
4. /src/graphql/context.ts — context factory injecting dataloaders and authenticated user
5. /src/graphql/index.ts — Apollo Server 4 configuration with Express middleware
6. Query complexity limits configured (max depth: 5, max complexity: 100)
7. Integration tests verifying DataLoader batching behavior

Verification: Apollo sandbox loads at /graphql. Executing `{ users { posts { author { name } } } }` produces exactly 2 database queries (verified via Prisma query logging).

Prompts 4–6: Additional API Patterns

The following three prompts address OAuth 2.0 implementation, API versioning migration, and rate limiting respectively. Each follows the same four-component structure but targets specific architectural challenges common in enterprise API development.

Prompt 4 — OAuth 2.0 with PKCE:
Goal: Implement OAuth 2.0 Authorization Code flow with PKCE for the existing Express API, supporting Google and GitHub as identity providers.

Scope: /src/auth/ directory only. Use passport.js (already installed). Store sessions in Redis using connect-redis. Do not modify existing JWT middleware.

Deliverables: PassportStrategy files for each provider, /src/auth/routes.ts with /auth/google, /auth/github, /auth/callback/:provider, /auth/logout, session serialization/deserialization, CSRF protection on callback routes, E2E test using supertest that mocks OAuth provider responses.

Verification: `npm test -- --testPathPattern=auth` passes. No open redirect vulnerabilities (verify callback URL validation logic).

Prompt 5 — API Versioning:
Goal: Migrate the existing v1 API routes to support parallel v1/v2 versioning without breaking existing clients.

Scope: Refactor /src/routes/ to /src/routes/v1/ and /src/routes/v2/. Create version router at /src/routes/index.ts. v2 changes: snake_case response fields become camelCase, pagination uses cursor-based instead of offset-based.

Deliverables: Version router with Accept-Version header and URL prefix support, response transformer middleware for v1 backward compatibility, cursor pagination utility, updated OpenAPI spec at /docs/openapi.yaml, migration guide at /docs/v2-migration.md.

Verification: All existing v1 integration tests pass unchanged. New v2 tests pass. OpenAPI spec validates against openapi-schema-validator.

Prompt 6 — Redis Rate Limiting:
Goal: Implement sliding window rate limiting using Redis for all authenticated API endpoints.

Deliverables: /src/middleware/rateLimiter.ts using ioredis with sliding window algorithm (not fixed window), per-user limits (100 req/15min default, configurable per route), rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset), 429 response with Retry-After header, bypass mechanism for internal service tokens, load test script using autocannon confirming limits enforce correctly.

Verification: Autocannon test confirms 101st request in window returns 429. Redis key TTL matches window size.

Domain 2: Database Operations and Migrations (Prompts 7–11)

Database tasks are among the highest-value targets for Codex Goal Mode because they involve precise, sequential operations where human error is costly and the verification criteria are objectively measurable.

This masterclass builds directly on the Goal Mode capabilities introduced in the June 2026 enterprise update. Our comprehensive overview of Codex Goal Mode and multi-agent workflows explains the architectural foundation, configuration options, and enterprise features that these advanced prompts leverage for autonomous development. Codex Goal Mode and Multi-Agent Workflows.

These prompts are designed for production database work where correctness is non-negotiable.

Prompt 7: Zero-Downtime Schema Migration

Goal: Execute a zero-downtime migration to add full-text search capabilities to the Posts table in PostgreSQL using tsvector columns and GIN indexes.

Scope: PostgreSQL 15+. Use Prisma migrate for schema changes. Application uses read replicas — migration must not lock tables for more than 100ms.

Deliverables:
1. Prisma migration using CREATE INDEX CONCURRENTLY for GIN index
2. /src/lib/search.ts — full-text search utility using ts_rank and plainto_tsquery
3. Trigger function to auto-update tsvector column on write/update
4. Rollback migration script
5. Performance test confirming search query executes under 50ms on 1M row dataset
6. Updated PostRepository with searchPosts(query, pagination) method

Verification: Migration runs without table lock. `EXPLAIN ANALYZE` on search query shows Index Scan using GIN index. Performance test passes.

Prompts 8–11: Additional Database Patterns

Domain 3: Testing and Quality Assurance (Prompts 12–17)

Test generation is where Codex Goal Mode delivers some of its most consistent value. The key is specifying not just coverage targets but the testing philosophy — what kinds of failures each test suite is designed to catch.

Prompt 12: Comprehensive Test Suite Generation

Goal: Generate a complete three-layer test suite for the OrderService module covering unit, integration, and contract testing.

Scope: /src/services/OrderService.ts and its dependencies. Use Jest for unit/integration, Pact for contract testing. Mock external dependencies using jest.mock() for unit tests; use test database for integration tests.

Deliverables:
1. /src/__tests__/unit/OrderService.unit.test.ts
   - Test every public method with happy path, edge cases, and error conditions
   - Mock: PaymentService, InventoryService, EmailService, Prisma client
   - Minimum 90% branch coverage on OrderService.ts

2. /src/__tests__/integration/OrderService.integration.test.ts
   - Test against real test database (transactions rolled back after each test)
   - Cover: concurrent order creation race conditions, inventory reservation conflicts, payment failure rollback

3. /src/__tests__/contracts/OrderService.pact.test.ts
   - Consumer-driven contracts for PaymentService and InventoryService APIs
   - Pact broker configuration for CI publishing

4. /jest.config.ts — Updated with coverage thresholds (branches: 90, functions: 95, lines: 95)
5. /src/__tests__/factories/order.factory.ts — Test data factories using @faker-js/faker

Verification: `npm test` passes with coverage thresholds met. `npm run test:pact` publishes contracts successfully.

Prompt 13: Property-Based Testing Implementation

Goal: Implement property-based tests for the pricing calculation engine using fast-check, targeting invariants that example-based tests cannot reliably discover.

Deliverables:
1. Property tests for PricingEngine covering:
   - Commutativity: discount application order doesn't affect final price
   - Idempotency: applying same discount twice equals applying once
   - Boundary invariants: price never goes negative, never exceeds list price without surcharge flag
   - Monotonicity: larger discount percentage always produces lower or equal price
2. Shrinking configuration to produce minimal failing examples
3. Seed-based reproduction for CI failures
4. Documentation of discovered edge cases and resulting fixes

Verification: `npm run test:property` runs 1000 cases per property with zero failures. Any discovered bugs are fixed before task completion.

Prompts 14–17: Additional QA Patterns

Prompt 14 — E2E Test Suite with Playwright:
Goal: Build a Playwright E2E test suite covering the five critical user journeys: registration, login, product purchase, order tracking, and account settings update.

Deliverables: Page Object Model classes for each page, test fixtures with pre-seeded database state, visual regression snapshots, accessibility checks using axe-playwright on each page, CI configuration for parallel execution across 3 workers, HTML report generation.

Verification: All 5 journeys pass in headless mode. Accessibility checks report zero critical violations. Total suite runtime under 3 minutes.

Prompt 15 — Load Testing Infrastructure:
Goal: Implement a k6 load testing suite that validates the API meets SLAs under production traffic patterns.

Deliverables: k6 scripts modeling realistic traffic (70% reads, 20% writes, 10% search), ramp-up/sustain/ramp-down stages, custom metrics for business transactions, threshold configuration (p95 latency < 200ms, error rate < 0.1%), InfluxDB + Grafana dashboard configuration, GitHub Actions workflow triggering load tests on staging deployment.

Verification: Load test passes all thresholds at 500 VU sustained load.

Prompt 16 — Mutation Testing:
Goal: Configure and run Stryker mutation testing on the domain logic layer to identify gaps in test effectiveness.

Deliverables: stryker.config.json targeting /src/domain/, mutation test run with HTML report, analysis of surviving mutants with remediation plan, additional tests eliminating all surviving mutants in critical business logic files.

Verification: Mutation score for /src/domain/pricing/ and /src/domain/inventory/ reaches 85%+.

Prompt 17 — Security Testing Automation:
Goal: Integrate automated security scanning into the test pipeline covering SAST, dependency vulnerabilities, and OWASP Top 10 API checks.

Deliverables: Semgrep configuration with custom rules for project-specific patterns, npm audit integration with severity thresholds, OWASP ZAP baseline scan script against local server, GitHub Actions security workflow with PR blocking on high/critical findings, SARIF report upload to GitHub Security tab.

Verification: Security workflow runs on PR. Known intentional vulnerability in test fixture is detected and reported correctly.

Domain 4: DevOps and Infrastructure as Code (Prompts 18–22)

Infrastructure tasks benefit enormously from Goal Mode’s ability to maintain consistency across multiple configuration files simultaneously — a task that’s tedious and error-prone for humans but straightforward for Codex when properly scoped.

Goal Mode prompts work exceptionally well when combined with background task execution for continuous development workflows. Our Codex Background Tasks Masterclass provides 30 production-ready prompts for autonomous code review, refactoring, and continuous improvement that complement the goal-oriented approach covered in this guide. Codex Background Tasks Masterclass.

Prompt 18: Kubernetes Deployment Configuration

Goal: Create production-ready Kubernetes manifests for deploying the Node.js API with horizontal pod autoscaling, proper resource limits, and zero-downtime rolling deployments.

Scope: Target Kubernetes 1.28+. Use existing Helm chart structure in /infrastructure/helm/. Follow existing naming conventions. Secrets managed via External Secrets Operator (already configured in cluster).

Deliverables:
1. /infrastructure/helm/templates/deployment.yaml
   - Resource requests: 256Mi RAM, 250m CPU; limits: 512Mi RAM, 500m CPU
   - Liveness probe: GET /health, initial delay 30s, period 10s
   - Readiness probe: GET /ready, initial delay 5s, period 5s
   - Rolling update: maxUnavailable 0, maxSurge 1
   - Topology spread constraints for multi-AZ distribution

2. /infrastructure/helm/templates/hpa.yaml
   - Min replicas: 2, max: 20
   - Scale up: CPU > 70% for 2 minutes
   - Scale down: CPU < 30% for 5 minutes (stabilization window)

3. /infrastructure/helm/templates/pdb.yaml
   - minAvailable: 1 (ensures zero-downtime during node drains)

4. /infrastructure/helm/values.yaml and values.production.yaml
5. /infrastructure/helm/templates/servicemonitor.yaml for Prometheus scraping

Verification: `helm lint` passes. `helm template` produces valid YAML. `kubectl apply --dry-run=server` succeeds against staging cluster.

Prompt 19: GitHub Actions CI/CD Pipeline

Goal: Build a complete GitHub Actions CI/CD pipeline with separate workflows for PR validation, staging deployment, and production release.

Deliverables:
1. /.github/workflows/pr-validation.yml
   - Triggers: pull_request to main/develop
   - Jobs: lint, type-check, unit-tests, integration-tests (parallel), security-scan, build
   - Test results uploaded as artifacts, coverage comment posted to PR

2. /.github/workflows/staging-deploy.yml
   - Triggers: push to develop
   - Jobs: build-and-push (Docker image to ECR), helm-upgrade to staging, smoke-tests, notify-slack

3. /.github/workflows/production-release.yml
   - Triggers: release published
   - Jobs: build-and-push, helm-upgrade to production (with manual approval gate), post-deploy-verification, rollback-on-failure

4. /.github/workflows/scheduled-maintenance.yml
   - Weekly: dependency updates via npm-check-updates, security audit, stale branch cleanup

Verification: All workflow YAML validates via actionlint. PR workflow completes in under 8 minutes.

Prompts 20–22: Additional DevOps Patterns

Domain 5: Refactoring and Technical Debt (Prompts 23–27)

Refactoring is one of the most nuanced domains for autonomous AI tasks because it requires balancing behavioral preservation with structural improvement. The following prompts are engineered to make Codex’s conservative instincts work in your favor.

Prompt 23: Legacy Code Modernization

Goal: Modernize the /src/legacy/UserManager.js module from CommonJS callback-style code to TypeScript with async/await, without changing any external behavior.

Scope: Only /src/legacy/UserManager.js and its direct dependencies. Do not refactor callers — update their import paths only if module interface changes.

Constraints:
- All existing tests in /src/__tests__/legacy/UserManager.test.js must pass unchanged (do not modify test files)
- Maintain identical function signatures for all exported functions
- New file path: /src/services/UserService.ts

Process (execute in this order):
1. Analyze all callers of UserManager.js and document the public interface
2. Create UserService.ts with TypeScript types derived from usage analysis
3. Convert callbacks to async/await using promisify where appropriate
4. Replace all var with const/let, arrow functions where appropriate
5. Add JSDoc/TSDoc to all public methods
6. Update import paths in callers
7. Run existing tests to confirm behavioral equivalence
8. Generate /docs/UserService-migration.md documenting breaking changes (if any)

Verification: Existing test suite passes. TypeScript compilation clean. ESLint reports zero errors.

Prompt 24: Dependency Injection Refactor

Goal: Refactor the service layer from direct instantiation to dependency injection using tsyringe, enabling proper unit testing and improving modularity.

Scope: /src/services/ directory. Use tsyringe (add to package.json if not present). Follow the container registration pattern.

Deliverables:
1. /src/container.ts — DI container with all service registrations
2. Refactored service files with @injectable() and @inject() decorators
3. Updated controller files using constructor injection
4. /src/__tests__/setup/testContainer.ts — Test container with mock registrations
5. Existing service tests updated to use test container instead of manual mocks
6. /docs/di-architecture.md — Dependency graph documentation

Verification: All service tests pass using DI container. No `new ServiceName()` calls outside container.ts and test files.

Prompts 25–27: Additional Refactoring Patterns

Prompt 25 — Extract Microservice:
Goal: Extract the Notification subsystem (email, SMS, push) from the monolith into a standalone service with a message queue interface.

Deliverables: Standalone /services/notification-service/ with its own package.json, RabbitMQ consumer using amqplib, publisher client library for the monolith to import, Docker Compose configuration for local development, contract tests between publisher and consumer.

Constraint: Monolith must continue working during extraction — implement strangler fig pattern with feature flag.

Prompt 26 — Performance Profiling and Optimization:
Goal: Profile the five slowest API endpoints (identified in attached performance report) and implement targeted optimizations achieving 50% latency reduction.

Process: For each endpoint — profile with clinic.js flame, identify bottleneck, implement fix, benchmark before/after. Document each optimization with root cause analysis.

Deliverables: Optimization commits for each endpoint, before/after benchmark results, /docs/performance-optimizations.md with methodology.

Prompt 27 — Error Handling Standardization:
Goal: Audit and standardize error handling across the entire API layer, implementing a consistent error taxonomy and ensuring all errors are properly logged, tracked, and returned in a uniform format.

Deliverables: /src/errors/ directory with typed error hierarchy, global error handler middleware, error serialization for API responses (RFC 7807 Problem Details format), Sentry integration with error grouping configuration, runbook for each error category in /docs/runbooks/.

Verification: No unhandled promise rejections in test suite. All 4xx/5xx responses conform to Problem Details schema.

Domain 6: Documentation and Code Generation (Prompts 28–31)

Prompt 28: OpenAPI Specification Generation

Goal: Generate a complete OpenAPI 3.1 specification from the existing Express route definitions and TypeScript types, with example payloads and error schemas.

Deliverables:
1. /docs/openapi.yaml — Full spec with all endpoints documented
2. /src/middleware/requestValidator.ts — Runtime validation against OpenAPI schemas using @apidevtools/swagger-parser
3. Swagger UI served at /docs (development only)
4. Redoc static HTML at /docs/api.html
5. GitHub Actions step to validate spec on each PR
6. Postman collection exported from spec

Verification: Spec validates against OpenAPI 3.1 schema. All existing endpoints appear in spec. Example requests in spec return expected responses against running server.

Prompts 29–31: Additional Documentation Patterns

Domain 7: Security and Compliance (Prompts 32–35)

Prompt 32: GDPR Compliance Implementation

Goal: Implement technical GDPR compliance features: right to erasure, data portability export, consent management, and data retention automation.

Scope: User data across User, Order, AuditLog, and Session tables. Do not delete data permanently — implement soft deletion with anonymization.

Deliverables:
1. /src/services/GDPRService.ts with methods:
   - anonymizeUser(userId): replaces PII with hashed/generic values, returns anonymization report
   - exportUserData(userId): generates JSON export of all user data across all tables
   - recordConsent(userId, consentType, granted): stores timestamped consent records
   - getConsentHistory(userId): returns full consent audit trail

2. /src/jobs/DataRetentionJob.ts — Scheduled job (cron: 0 2 * * *) deleting/anonymizing data per retention policy
3. /src/routes/gdpr.routes.ts — Authenticated endpoints for data export and deletion requests
4. Retention policy configuration in /src/config/retention.ts (configurable per data type)
5. /docs/data-processing-register.md — Technical documentation of all data processing activities

Verification: anonymizeUser() leaves zero queryable PII in database. exportUserData() produces valid JSON containing all user data. DataRetentionJob runs without errors in test environment.

Prompt 33: Authentication Security Hardening

Goal: Harden the existing JWT authentication system against OWASP authentication vulnerabilities: token theft, session fixation, brute force, and credential stuffing.

Deliverables:
1. Token rotation: implement refresh token rotation with family tracking (invalidate entire family on reuse detection)
2. Device fingerprinting: bind tokens to device fingerprint (user agent + IP subnet), flag anomalies
3. Brute force protection: progressive delays + account lockout after 5 failures in 15 minutes
4. Credential stuffing: HaveIBeenPwned API integration for password breach checking on registration/password change
5. Suspicious activity detection: concurrent session limit (5 devices), geographic anomaly flagging
6. Security event logging: all auth events logged with structured data for SIEM integration

Verification: OWASP Authentication Testing Guide checklist items OTG-AUTHN-001 through OTG-AUTHN-010 pass. Penetration test script confirms token reuse invalidates family.

Prompt 34: Secrets Management Migration

Goal: Migrate all hardcoded and .env-based secrets to HashiCorp Vault with dynamic secret generation for database credentials.

Deliverables:
1. /src/lib/vault.ts — Vault client with AppRole authentication, secret caching with TTL, automatic renewal
2. Dynamic PostgreSQL credentials: Vault database secrets engine configuration, credential rotation every 1 hour
3. Migration script: scan codebase for hardcoded secrets using truffleHog patterns, report findings
4. Updated application bootstrap to fetch secrets from Vault on startup
5. Local development: docker-compose.vault.yml with Vault dev server pre-configured
6. Emergency break-glass procedure documented in /docs/vault-emergency.md

Verification: Application starts with zero environment variable secrets. Database credentials rotate without application restart (verified with 2-hour test run).

Prompt 35: Compliance Audit Automation

Goal: Build an automated compliance checking system that continuously validates SOC 2 Type II technical controls and generates audit-ready evidence.

Deliverables:
1. /src/compliance/ directory with control check implementations:
   - Access control: verify MFA enforcement, session timeout, privilege access logging
   - Change management: verify all deployments go through CI/CD (no direct pushes to production)
   - Monitoring: verify alerting rules cover all critical paths
   - Encryption: verify TLS 1.2+ on all endpoints, encryption at rest on all data stores

2. /src/jobs/ComplianceAuditJob.ts — Daily automated checks with pass/fail/warning status
3. Evidence collection: screenshots, API responses, log samples stored in /compliance-evidence/ with timestamps
4. /src/routes/compliance.ts — Internal endpoint returning current compliance posture (admin only)
5. Slack notification for any control failures
6. Monthly compliance report generator producing PDF via puppeteer

Verification: Compliance job runs successfully. Intentionally misconfigured test environment produces correct failure reports.

Goal Mode Optimization Strategies: Achieving 90%+ Autonomous Completion

The 35 prompts above are designed to work at the upper end of Codex Goal Mode’s capability range, but the strategies that get you from 85% to 90%+ autonomous completion are worth examining explicitly.

Strategy 1: Continuation Prompts for Long-Running Tasks

When a Goal Mode task exceeds a single context window — common for Domain 4 and Domain 7 tasks — you need a continuation prompt that reconstructs working context without restarting from scratch. The following template is effective:

Goal Continuation: Resume the [TASK NAME] goal. 

Completed steps (do not repeat):
- [List completed deliverables]

Current state:
- [Describe what exists now]

Remaining deliverables:
- [List outstanding items from original goal]

Resume from: [Specific next step]

Constraints remain unchanged from original goal specification.

Strategy 2: Scope Anchoring to Prevent Scope Creep

Codex Goal Mode’s planning layer will sometimes identify related improvements outside your specified scope and attempt to implement them. This is helpful in interactive sessions but problematic for autonomous runs. Add an explicit scope anchor to your prompts:

SCOPE BOUNDARY: Do not modify any files not listed in the Deliverables section above. If you identify improvements outside this scope, document them in /docs/future-improvements.md but do not implement them.

Strategy 3: Checkpoint Verification Pattern

For tasks with five or more deliverables, adding explicit verification checkpoints between logical groups of deliverables dramatically reduces the chance of late-stage failures cascading from early errors:

Execute deliverables 1-3, then run verification checkpoint A before proceeding:
Checkpoint A: `npx tsc --noEmit` returns zero errors. If checkpoint fails, fix errors before continuing to deliverables 4-7.

Strategy 4: Failure Mode Specification

Tell Codex explicitly what to do when it encounters an unexpected condition. Without this, Goal Mode may make assumptions that are difficult to reverse:

If you encounter: 
- A missing dependency: add it to package.json and document the addition
- A conflicting file: create the new file with a .new extension and document the conflict
- A failing test in existing code: document the failure in /docs/pre-existing-failures.md and continue
- An ambiguous requirement: implement the most conservative interpretation and document your choice

Strategy 5: Atomic Deliverable Ordering

Order your deliverables so each one is independently testable and doesn’t depend on later deliverables being complete. This allows Codex to verify progress incrementally rather than only at the end of the full task, which is the primary driver of the documented 85% completion rate for properly structured goals.

Measuring and Improving Your Codex Goal Mode Performance

Teams running Codex Goal Mode at scale should track four metrics to continuously improve their autonomous completion rates:

Conclusion: Building a Goal Mode Prompt Library for Your Organization

The 35 prompts in this masterclass represent a starting point, not a ceiling. The most effective enterprise teams using Codex Goal Mode treat prompt development as a first-class engineering activity — maintaining a version-controlled prompt library, running A/B tests on prompt variations, and systematically capturing learnings from failed or partial completions.

The structural principles underlying every prompt in this guide — objective statements, scope constraints, deliverable specifications, and verification criteria — form a portable framework you can apply to any development task in your organization. The domains covered here (API development, database operations, testing, DevOps, refactoring, documentation, and security) represent the highest-value targets for autonomous execution, but the same framework applies equally to data pipeline construction, machine learning model evaluation, mobile development, and frontend component generation.

What makes Codex Goal Mode genuinely transformative for enterprise development isn’t any single capability — it’s the combination of multi-step planning, tool use, and autonomous verification that allows senior developers to operate at a fundamentally higher level of abstraction. Instead of writing code, they write goals. Instead of debugging implementations, they define verification criteria. The 85% autonomous completion rate documented by OpenAI is not a ceiling — it’s a baseline for teams that haven’t yet optimized their prompt architecture. With the strategies and examples in this masterclass, 90%+ is consistently achievable on well-scoped production tasks.

The shift from developer-as-implementer to developer-as-goal-architect is already underway. The teams building their Goal Mode prompt libraries now are establishing the institutional knowledge that will define engineering productivity for the next decade of AI-assisted development.