Plan B: PPMO+ plus GHL plus OpenAI Codex (Cody) Autonomously Controlling EnRoute Command Center

Authors: ExCom+ Unified (Betty chair, Willemena, Sade, Gemma, Vesta) with Clarise and Claudia review Marc-directive: 2026-05-18 PM, "How do we extend all thing EGP PPMO+ into EGP GHL + OpenAI Codex fully controlling EnRoute Command Center" Status: Draft v1, awaiting Marc ratify Date: 2026-05-18 Jira candidate epic: SWAT-PPMO-CODEX-CC-01

1. Executive Summary

Plan A made the Command Center the operator-facing surface for PPMO+. Plan B promotes Cody (PPMO-OA, OpenAI Codex) to be the autonomous executor behind that surface: Marc issues directives in chat or via the Directive Capture widget; Cody parses intent, plans, executes against the Command Center either through the GHL REST API or via Playwright on the GHL UI, and reports back. The recommendation is Path C (Hybrid): GHL REST API where the endpoint exists and is documented, Playwright on Command Center UI for any action GHL has not exposed via API. This preserves speed where the API is rich and removes the "no API for this" excuse that has historically stalled automation. Estimated runbook 36 working days, 5 sprints, with first autonomous action live by day 10 (Cody creates and updates contacts via API on Marc directive without human in loop).

2. Current State

[Marc directive in chat]
        |
        v
[Claude main thread] ---- tools/*.py ---- GHL REST API
        |
        v
[Manual paste of results back to Marc]

Cody exists as a persona (PPMO-OA, DD312-v2) but is not yet wired into a long-running executor with GHL credentials.
GHL API client (egp_command_center_api_client.py) exists; PIT (Private Integration Token) stored in .env.
Playwright scaffolding exists in tools/_ghl_playwright/.
Cookie bootstrap and refresh tools exist (egp_ghl_cookie_bootstrap.py, egp_ghl_cookie_refresh.py).
No autonomous decision loop yet; every API call is human-initiated through Claude.

3. Target State

[Marc directive (chat or Directive Capture widget)]
        |
        v
[Cody Intake API] -- intent classify --> [Cody Planner (Codex)]
        |                                       |
        |                                       v
        |                              [Action Selector]
        |                              /                \
        |                  [GHL REST API call]    [Playwright on CC UI]
        |                            |                   |
        +----------------------------+-------------------+
                                     |
                                     v
                          [Ship report + audit log + memory write-back]
                                     |
                                     v
                          [Command Center Activity pane + Marc email]

Cody runs as a long-lived service (cron + on-demand) with full PIT and cookie set.
Every action audited to 00148-…/04-operations/cody-action-log.jsonl and surfaced in Command Center.
Hard guardrails: customer-recipient lint (_egp_mailgun_client_recipient_lint.py), credential-not-found lint, em-dash lint, whitelabel lint, all run pre-action.

4. Runbook

Task	Owner	Effort (days)	Dependencies	Definition of Done
T-01 Cody persona service skeleton (FastAPI + queue)	Cody (build) + Claudia review	2	none	`/health` returns 200
T-02 GHL PIT and cookie surface validated end-to-end	Vesta	1	T-01	Smoke test creates and deletes test contact
T-03 Intent classifier (directive -> action category)	Claudia	3	T-01	95 percent accuracy on labelled set of 100 directives
T-04 Action library: 40 most-used GHL API actions wrapped with idempotency keys	Cody + Clarise	5	T-02	All 40 callable, all logged
T-05 Playwright executor for non-API actions (Sub-account settings, Custom Object schema edits, etc.)	Sade	4	T-02	10 non-API actions automated
T-06 Action Selector: routing rules API-first then Playwright	Claudia	2	T-04, T-05	Rule table in `cody-action-router.json`
T-07 Cody Intake API exposed at `cody.enroute.global/intake` with Cloudflare Access	Vesta	1	T-01	Marc can POST a directive and receive ack
T-08 Directive Capture widget in Command Center calls Intake API	Gemma	1	T-07, Plan A T-08	End to end widget -> action
T-09 Pre-action guardrail bus (every lint runs before any send/write)	Betty	3	T-04	HARD-FAIL on customer recipient, em-dash, whitelabel leak
T-10 Audit log + ship-report on every action	Clarise	1	T-04	JSONL + Mailgun email to Marc
T-11 Memory write-back: every shipped action appends one line to MEMORY.md index	Vesta	2	T-10	New index entry visible next session
T-12 Confluence + Jira write-back (create issue, attach evidence)	Willemena	2	T-10	Issue created in SWAT project
T-13 Long-running scheduled directives (cron-on-natural-language)	Cody	3	T-06	"Every Monday 9am audit the 110 recruiters" runs
T-14 Approval gate for high-risk actions (customer-facing send, > $X, destructive)	Betty + Sasha (Skeptic)	2	T-09	Approval prompt in chat AND widget
T-15 Telemetry dashboard (actions per day, failure rate, mean latency)	Gemma	2	T-10	Pane live in Command Center
T-16 Acceptance test with Marc (full directive -> ship in under 5 min)	Betty	1	all	5 directives shipped end to end
T-17 Hardening (retry, backoff, dead-letter queue)	Sade	2	T-16	Chaos test passes
T-18 Cutover + documentation	Willemena	1	T-17	Confluence runbook live
Slack budget	n/a	2	n/a	reserved

Total: 36 working days, 5 two-week sprints.

5. SWOT

Strengths	Weaknesses
Cody and OpenAI Codex already canonical (DD312-v2)	No long-running Cody service stood up yet
GHL REST API + PIT already validated	API does not cover every GHL action (gaps need Playwright)
Playwright scaffolding already in repo	Cookie refresh fragility
Hard guardrails already canonical (lints, recipient rules)	No prior autonomous-action audit precedent

Opportunities	Threats
Removes "Marc needs to click" bottleneck across 90 percent of recurring work	Autonomous action can cause large-scale damage fast if guardrails fail
Compounding: Cody handles tier-1 directives, ExCom+ focuses on strategy	API rate limits + bot detection on UI flows
Becomes a sellable EGP AI Studio product capability	Cookie or PIT revocation by GHL with no warning
Sets pattern for Plan C (Linked-Helper)	Codex API cost at scale

6. Five Solution Paths

Path A: GHL REST API direct (no browser)

Approach: Cody only calls documented GHL REST endpoints.
Pros: fastest, no browser fragility, fully scriptable, easiest audit.
Cons: GHL API is incomplete (no programmatic edit for many sub-account-settings panes, no Custom Object schema mutation, no Marketplace App install).
Effort: 18 days.
Recommended: yes for 70 percent of action volume.

Path B: Cody via Playwright on GHL UI

Approach: Cody drives the Command Center UI in headless Chromium.
Pros: covers every GHL action a human can perform, including those without API.
Cons: slower, fragile to UI redesigns, cookie or auth drift, bot detection risk.
Effort: 25 days.
Recommended: yes for the 30 percent of actions API does not cover.

Path C: Hybrid API-first then Playwright (RECOMMENDED)

Approach: Action Selector tries API first by rule table; falls back to Playwright if no API or if API returns 4xx for documented gaps.
Pros: best of both, no "action not possible" excuse, optimal cost and speed.
Cons: requires governance over the rule table; two execution paths to maintain.
Effort: 36 days (full runbook).
Recommended: YES.

Path D: GHL Marketplace App with custom Cody-actions

Approach: package Cody as a Marketplace App that exposes Cody actions as native GHL workflow steps.
Pros: deepest integration, Marc can trigger Cody from inside a GHL workflow.
Cons: long approval and review, Marketplace constraints.
Effort: 45+ days.
Recommended: Phase 2 (after Path C is stable).

Path E: GHL Webhook -> Cody Lambda -> API

Approach: GHL workflows fire webhooks; Cody Lambda receives, executes, posts result back.
Pros: native trigger surface, low standing cost.
Cons: only reactive, no proactive Marc-directive surface, harder long-running planning.
Effort: 14 days.
Recommended: as a complementary trigger surface added during Sprint 4 of Path C, not as standalone.

7. Top-3 Risks (Path C)

Runaway autonomous action. Mitigation: T-14 approval gate; T-09 guardrail bus; daily cap (max 200 mutating actions per 24h); circuit breaker on > 5 failures in 5 minutes.
PIT or cookie revocation mid-flight. Mitigation: dual-credential failover; pre-flight credential check on every action; existing egp_ghl_cookie_expiry_alert.py repurposed as blocker.
Intent misclassification ships wrong thing to wrong audience. Mitigation: customer-recipient lint (already canonical) + Sasha (Skeptic) human-loop approval on any external send.

8. Jira Recommendation

Project: SWAT
Epic: SWAT-PPMO-CODEX-CC-01 "Cody autonomous control of EnRoute Command Center"
First sprint stories:
T-01 Cody service skeleton
T-02 PIT and cookie validation
T-03 Intent classifier v1
T-04 first 10 of 40 action wrappers
T-09 guardrail bus v1
Confluence parent: EGPSWAT space, "Cody Autonomous Executor".

9. Where We Left Off

01-strategy/strategy/2026-05-15-DD312v2-EGP-PPMO-MCP-Wave1/dd312v2-master-strategy.md (Cody persona canon)
tools/egp_command_center_api_client.py (API client baseline)
tools/_ghl_playwright/ (Playwright scaffolding)
tools/egp_ghl_cookie_bootstrap.py, egp_ghl_cookie_refresh.py
01-strategy/strategy/2026-05-13-DD242-v2-EnRoute-Command-Center-Bridge/ (auth bridge)
01-strategy/strategy/2026-05-04-DD42-PPMO-HQ-Agent-Studio-Merge-Architecture (agent studio merge precedent)
feedback_clarissa_distinct_persona_local_llm_large_2026_05_15.md (Cody persona spec)

10. Persona Attribution

Betty (chair, escalation, approval gates)
Willemena (PPMO-HQ, ops, runbook owner)
Sade (Playwright executor and hardening)
Gemma (Directive widget, telemetry pane)
Vesta (auth, memory write-back, deep-links)
Clarise (action wrappers, ship reports)
Claudia (intent classifier, action router)
Cody (the executor itself)
Sasha (Skeptic, veto on high-risk actions)