Author’s note: On November 2, 2026, OpenAI disclosed Pando, its internal Git backend. This article examines how it reached production in 10 weeks, breaking down the division of work between humans and AI, the testing system, and the migration process. It also explores Agent engineering practices other teams can adopt.
On November 2, 2026, OpenAI published the technical article “Scaling Git at OpenAI,” introducing Pando, the new Git backend supporting all development activity in its monorepo. Pando went from kickoff to handling production traffic in about 10 weeks: one engineer designed the core architecture, multiple Agent teams handled implementation, and a small number of engineers deployed it. It’s easy to turn these facts into a story about “one person directing AI to build infrastructure,” but the details OpenAI disclosed point to something more substantial: a complete system of engineering constraints and validation.
This isn’t a retelling of an AI coding myth. Based on OpenAI’s official disclosures, this article separates what’s public from what remains unknown. For example, OpenAI hasn’t disclosed the team size, token costs, task records, or the proportion of code modified by humans.
What you’ll learn: Why Pando was built, what the Codex Agent teams actually did, which validation methods made it possible for Agents to participate in infrastructure development, and how to apply these practices to your own projects.
Pando at a Glance: What the Codex Agent Teams Delivered
Here’s a summary of what OpenAI has officially confirmed. One important distinction: Pando is a Git-compatible server-side backend, not a new version control protocol or a direct replacement for GitHub.
| Item | Details |
|---|---|
| Publication date | November 2, 2026, in the official article “Scaling Git at OpenAI” |
| Authors | Aaron Friel, Taylor Blau, and Ted Nyman (OpenAI technical staff) |
| Project timeline | About 10 weeks from kickoff to production; began handling production traffic in April 2026 |
| Implementation language | The server side is primarily written in Rust, built from scratch to avoid inheriting legacy system dependencies |
| Human-agent roles | One engineer designed the core architecture, multiple Agent teams implemented it, and a small group of engineers deployed it |
| Production results | Median push latency fell by nearly 80%, with close to 1 PB of Git data delivered daily |
| Availability | As of 2026-11-03, no public server-side release, API, or pricing had been announced |
Why OpenAI Needed Codex Agents to Rebuild Its Git Backend
Pando started with an explosion in code commit volume. OpenAI’s chart uses the number of commits merged into the main branch in Q1 2024 as a baseline and tracks growth in subsequent quarters. The table below highlights selected points.
| Quarter | Commit growth relative to Q1 2024 | Notes |
|---|---|---|
| 2024 Q4 | +98% | Nearly doubled |
| 2025 Q4 | +264% | The legacy system began struggling to keep up with demand |
| 2026 Q1 | +432% | Pando was in development |
| 2026 Q3 | +1,378% | About 14.78 times the baseline |
| 2026 Q4 | +2,442% | An official forecast, not an actual result for a completed quarter |
There’s an important distinction here: commit count isn’t the same as lines of code, number of PRs, or developer productivity. You can’t use these figures to claim that “code volume grew 25-fold” or that “Codex made engineers 25 times more productive.” OpenAI’s explanation is that Codex lets engineers work on more tasks at once, leading to more parallel branches, pushes, merges, CI jobs, and fetch and clone requests.
Around Q4 2025, the legacy system began experiencing slower pushes and fetches, as well as merge failures. Reliability sometimes fell below 90%. OpenAI hasn’t disclosed how that reliability metric was calculated or how it changed over time, so it would also be wrong to interpret it as “more than 10% of commits failed.”
4 Key Design Choices in Pando’s Architecture
Pando doesn’t replace Git. It redesigns how the backend stores data, updates references, and delivers data. Understanding these choices helps clarify the essential trade-offs humans made.
- Independent branch updates: Instead of maintaining a consistent, point-in-time snapshot of the entire repository, Pando versions each branch independently. Only requests modifying the same Ref need coordination, using a causal consistency model. The trade-off is that a read spanning multiple branches may return branches from different points in time.
- Packfile storage and reuse: Each Packfile received during a Push is written to Blob Store as immutable data. For a Fetch, Pando selects existing Packfiles based on the client’s have/want information and uses Git’s packfile-uri mechanism to provide download URLs. This avoids repeatedly packing and compressing data for each client.
- Regional Express cache: Clusters and local caches are deployed across multiple regions, with consistent hashing used to distribute requests. The Packfile cache hit rate exceeds 99%. This caches Git data; it’s not the same as Prompt Caching for Large Language Model APIs.
- Background tiered Compaction: Similar to an LSM Tree, Pando merges small Packfiles through successive tiers into larger sets covering continuous version ranges. The current monorepo uses up to L4.
OpenAI also compared three architectures and ran a simulation with 1,000 clients and 10,000 total Push operations. This is a synthetic educational simulation built by OpenAI, not an independent third-party benchmark.
| Architecture | Write approach | Consistency | Main bottleneck |
|---|---|---|---|
| Three-phase commit (3PC) | Coordinated writes across multiple full replicas | Stronger consistency | Multiple coordination rounds and disk load slow concurrent writes |
| Shared WAL | All updates compete for the same log | Sequential consistency | Read nodes lag when writes arrive faster than they can be applied |
| Pando | Independent atomic transactions for each Ref | Causal consistency | Gives up a single point-in-time snapshot of the entire repository |
OpenAI’s published production data also includes a peak hourly Packfile delivery volume of over 57 TB, with more than 99% of bytes served from local disk caches. Clone and Fetch can saturate a 10 Gbps link on a standard cloud virtual machine. Push metadata reads and writes are O(1), while Fetch planning requires O(log Δ) metadata reads. These complexity figures describe metadata operations, not end-to-end network latency.
How the Codex Agent Team Built Pando
“One engineer designed the core” doesn’t mean only one person worked on the project. And “an Agent team implemented it” doesn’t mean AI wrote every line of code. Based on the scope of work disclosed by OpenAI, here’s how the responsibilities break down. OpenAI hasn’t published a specific task list for each Agent.
| Role | Responsibilities | Why this role |
|---|---|---|
| Architecture engineer (human) | Identify bottlenecks in the old system, insist on Git protocol compatibility, choose independent branch updates and Packfile reuse, and forgo strong consistency across the entire repository | These are irreversible technical trade-offs that define the system’s boundaries |
| Codex and other Agents | Rust backend implementation, Push/Fetch protocol compatibility, concurrent writes, performance optimization, and edge-case fixes | The implementation workload is substantial and can be repeatedly tested, making it well suited to parallel iteration |
| Validation Agents | Run long sessions to find edge cases, with Daybreak-capable models conducting around-the-clock adversarial testing | This requires sustained effort at a frequency humans would struggle to maintain |
| Deployment engineers (human) | Gradually shift traffic, synchronize the old and new systems, and migrate hundreds of integrations | Humans need to own production risk and organizational coordination |
The key takeaway: humans set the architecture, constraints, and acceptance criteria; Agents handle much of the implementation and iteration; and engineers remain responsible for production migration and system reliability. OpenAI didn’t provide a human-only control group, so there’s no way to calculate how many times faster Codex made the project.
Pando’s Testing Framework: Why Codex Agents Can Work on Infrastructure
Pando is infrastructure software. If it goes wrong, branches may point to the wrong commits, pushes may lose objects, or fetches may return incomplete history. A broken web page can be refreshed; a broken Git backend could bring development at an entire company to a halt. So rather than simply giving the agents longer prompts, OpenAI equipped them with an executable validation system.
Git Conformance Tests: Checking Behavior, Not Just Compilation
OpenAI built a Git Conformance Test Suite so agents could check whether their changes to the server implementation behaved as standard Git would expect. The tests cover ref updates, push, fetch, packfile transfer, and protocol compatibility. The key distinction is that the standard is “consistent with Git behavior,” not just “the code compiles and unit tests pass.” OpenAI hasn’t disclosed the number of test cases.
Deterministic Concurrency Simulation: Making Races Reproducible
The hardest distributed systems bugs often emerge when multiple operations interleave. OpenAI uses Deterministic Simulation Harnesses to simulate system state and concurrent events reproducibly, helping uncover race conditions, Git negotiation issues, packfile planning errors, and regressions.
For example, if two agents update the same branch at once, two conflicting updates must not both be reported as successful. And before a branch pointer is updated, the new commit object must already be readable. These examples explain the testing objectives; they aren’t individually disclosed test cases.
Lean and TLA+ Formal Verification: Mind the Timeline
OpenAI disclosed that it used GPT-6 Astra to help agents write formal specifications in Lean and TLA+, creating what it calls the “Theory of Pando.” These specifications are used to check invariants, find and fix bugs, and prove specific properties.
There are two important caveats. First, verification covers specified properties; it doesn’t mean every code path in the system has been mathematically proven. Second, OpenAI says newer models were used to improve performance and reliability as they became available, so these practices can’t all be attributed to the initial 10 weeks.
Long-Running Agent Sessions and Adversarial Security Testing
OpenAI also said multiple successive agent sessions ran for hundreds of hours to find and fix edge cases, while models with Daybreak capabilities continuously tested Git and Pando adversarially. OpenAI hasn’t disclosed the number of agents, individual session lengths, token consumption, number of bugs fixed, or frequency of human oversight. That means we can’t conclude that an agent wrote code unattended for hundreds of hours straight.
What’s notable is the shift in approach: agents are used for ongoing validation, not just initial code generation.
OpenAI’s public Git fork also offers indirect evidence of this continuous improvement. Examples include patches for parallel hashing in index-pack in August 2026 and rate-limit retries and completed pack reuse in October. But those commits all came after the initial production launch in April 2026, so they can’t be counted as deliverables from the 10-week period either.
Pando’s Gradual Migration: Code Written by a Codex Agent Isn’t Automatically Production-Ready
The 10 weeks covered the period from kickoff to production deployment, not the full time needed to mature the system. Pando’s rollout was a classic zero-downtime gradual migration. According to the official account, the process went roughly like this:
- Put Pando in front of the old system as a read-write pass-through proxy, keeping the old and new backends in sync.
- Coalesce identical requests and cache Git data for real traffic. Once some traffic was migrated, this actually reduced the load on the old system.
- Migrate developer clients in batches using an internal Git CLI wrapper.
- Migrate hundreds of integrations that depended on the old API, Webhooks, and repository download methods, along with Review and Change Request workflows.
- Provide Codex Skills for the migration, so developers could ask Codex to help prepare their local repositories and migration environments.
- Deploy an improved Git client to engineers’ devices and the ChatGPT desktop app.
The official account says the migration didn’t interrupt engineering work, but it doesn’t disclose rollback rates, incident breakdowns, or failure cases. For technical leaders, this part is worth studying more closely than the “10 weeks” figure: maintaining compatibility with existing workflows, migrating integrations, and shifting traffic in batches can be just as complex as building the new system itself.
Pando Impact Analysis: What It Means for Agent Developers and Technical Teams
Impact on Agent Developers
- Verification sets the ceiling for what Agents can do: Pando lets Agents participate in core implementation, provided they have reliable feedback from compatibility tests, deterministic simulations, and formal specifications.
- The Agent’s role is expanding: Beyond writing code, Agents can continuously look for edge cases, run adversarial tests, and help users migrate.
Impact on Technical Leads
- AI coding increases downstream workload: More commits put pressure on CI, code review, and code hosting. In a separate July 2026 post, OpenAI reported that its internal weekly PR count had more than doubled compared with the previous fourth quarter, making code review one of the new bottlenecks.
- You don’t necessarily need to build your own Pando: Scaling challenges in large monorepos predate AI, and the vast majority of teams don’t need to rebuild their Git backend.
Comparison with the Harness Engineering Case
In February 2026, OpenAI described another, separate project: starting from an empty repository, Codex wrote the product code, producing roughly a million lines of code and around 1,500 PRs over five months, initially driven by three engineers. The project didn’t use the same team or process as Pando, so their figures shouldn’t be conflated. But both point to the same trend: engineers are increasingly responsible for system design, test environments, and Agent workflow design. Lessons from that project include breaking work into small tasks, giving each branch its own runtime environment, exposing logs and metrics to Agents, and using AGENTS.md for guidance rather than stuffing the entire knowledge base into the prompt.
There were differing views on Hacker News, too: skeptics argued that more commits don’t necessarily mean better quality, while supporters said lower coding costs make more small projects viable. These are community opinions, not statistical conclusions.
Borrowing the Codex Agent Team’s Approach: A Test-Driven Feedback Loop
The most transferable part of Pando isn’t its scale—it’s the structure that gives agents actionable feedback. Here’s a minimal test-driven loop: the model generates a patch, and test results feed back to the model for further revisions.
import openai
client = openai.OpenAI(
api_key="YOUR_API_KEY",
base_url="https://api.apiyi.com/v1" # APIYI OpenAI-compatible endpoint
)
resp = client.chat.completions.create(
model="YOUR_CODING_MODEL", # Replace with the coding model you want to test
messages=[{"role": "user", "content": "根据以下失败测试修复函数：..."}]
)
print(resp.choices[0].message.content)
See the complete test feedback loop implementation
import subprocess
import openai
client = openai.OpenAI(
api_key="YOUR_API_KEY",
base_url="https://api.apiyi.com/v1"
)
SYSTEM = (
"你是严格遵守约束的工程 Agent。"
"只修改指定文件，不得改动测试；输出完整的新文件内容。"
)
def run_tests() -> tuple[bool, str]:
"""Run executable verification, equivalent to Pando's compatibility tests."""
r = subprocess.run(["pytest", "-q", "tests/"], capture_output=True, text=True)
return r.returncode == 0, r.stdout[-3000:] + r.stderr[-1000:]
def agent_loop(target: str, spec: str, max_rounds: int = 5) -> bool:
for i in range(max_rounds):
ok, log = run_tests()
if ok:
print(f"第 {i} 轮：测试全部通过，等待人工审核")
return True
source = open(target, encoding="utf-8").read()
resp = client.chat.completions.create(
model="YOUR_CODING_MODEL",
messages=[
{"role": "system", "content": SYSTEM},
{"role": "user", "content":
f"需求与约束：\n{spec}\n\n当前代码：\n{source}\n\n测试输出：\n{log}"}
],
)
with open(target, "w", encoding="utf-8") as f:
f.write(resp.choices[0].message.content)
print("达到轮次上限，转交人类工程师处理")
return False
agent_loop("src/ref_store.py", "同一分支的并发更新必须只有一个成功")
🚀 Quick start: When building a feedback loop like this, you can get free testing credits from APIYI at apiyi.com, then use the same API key to switch between coding models and compare their success rates on your test suite.
The table below translates Pando’s approach into a practical framework for everyday teams. These are recommendations based on official disclosures, not a Pando-specific workflow published by OpenAI.
| Stage | Key actions | Corresponding Pando practice | Tools |
|---|---|---|---|
| Set goals and boundaries | Define the protocols that must be supported and the non-negotiable metrics | Maintain Git protocol compatibility | Design documents, AGENTS.md |
| Build a validation environment | Compatibility tests, concurrency simulation, regression checks | Conformance tests and deterministic simulation | pytest, property-based testing, TLA+ |
| Divide work among agents | Small tasks, independent branches, automated test runs | Multiple agent teams implementing the system | Multiple model invocations, such as through APIYI at apiyi.com |
| Human review | Review key trade-offs, cross-module dependencies, and security implications | Human engineers oversee the architecture | Code review rules |
| Roll out gradually | Start with a small amount of traffic and maintain compatibility with the old system | Read/write pass-through proxy and phased migration | Canary releases, monitoring metrics |
Frequently Asked Questions
Q1: What is Pando?
Pando is OpenAI’s internal Git-compatible server backend, supporting all development activity in its monorepo. It retains the standard Git protocol and clients while redesigning reference updates, Packfile storage reuse, and cache delivery to support concurrent commits and reads by large numbers of agents and engineers.
Q2: Was Pando built by one person using Codex?
No. According to OpenAI, one engineer designed the core architecture, multiple agent teams implemented it, and a small number of engineers deployed it. OpenAI hasn’t disclosed the number of participants, the proportion of code modified by humans, or the agent configurations. It also hasn’t said that all the code was generated by Codex or that there was no human review.
Q3: When did Pando launch, and is it publicly available?
Pando began handling production traffic in April 2026, and the technical article was published on November 2, 2026. As of November 3, 2026, there’s no publicly available server, API, pricing, or release date. OpenAI has only made its Git client fork and some upstream patches public; that doesn’t mean the Pando server is open source.
Q4: Was all the validation work completed within 10 weeks?
Not necessarily. OpenAI says it continued using new models to improve Pando as they became available. It’s not possible to confirm that the GPT-6 Astra-assisted Lean/TLA+ formal methods work, hundreds of hours of agent sessions, and adversarial testing all took place within the initial 10 weeks. Most of the public Git patches also came after the first production deployment.
Q5: How can I build a similar agent testing feedback loop using an API?
Start with a small module:
1. Sign up at APIYI apiyi.com to get an API key and free testing credits
2. Write executable tests or compatibility checks before asking the model to change code
3. Use the code in this article, set base_url to `https://api.apiyi.com/v1`, and loop through “generate, test, feed logs back”
Because the interface is OpenAI-compatible, you only need to change the model parameter to switch models, making it easy to compare how well they fix issues.
Q6: What are the limitations for a typical team trying to copy Pando’s approach?
There are three main limitations: First, the cost is unknown—OpenAI hasn’t disclosed token or infrastructure expenses. Second, Pando relies on a high-quality validation system; letting agents write large amounts of code in a project without tests carries greater risk. Third, the 10-week result can’t be generalized to every project of a similar size. Start by experimenting with a small APIYI apiyi.com budget on a non-critical module, then expand once you’ve confirmed the feedback loop works.
Pando and Codex Agent: Key Takeaways
- What Pando is: An internal Git-compatible backend at OpenAI that reached production in about 10 weeks. It isn’t publicly available.
- Why it was built: Codex increased concurrent commits, causing slowdowns and merge failures in the old system.
- How humans and agents shared the work: Humans set the architecture and constraints, agents iterated on the implementation, and engineers handled deployment.
- What made it work: Compatibility tests, deterministic simulations, and formal verification provided reliable feedback.
- Timeline caveat: Later models and verification methods shouldn’t all be counted as part of the initial 10 weeks.
- How it launched: A read-and-write-through proxy and phased traffic migration kept daily development running throughout the transition.
- How to get started: Build tests first, then use APIYI apiyi.com to validate the feedback loop with multiple models.
Summary
The key lessons from the Pando case study:
- Scale drives infrastructure changes: The growth in commits from AI coding puts pressure on Git, CI, and code review. Pando was an engineering response to that pressure.
- Agent output depends on verification: Codex Agent teams could contribute to infrastructure implementation because they had executable compatibility tests, concurrency simulations, and formal specifications.
- Human decisions remain essential: Human engineers were responsible for architectural trade-offs, consistency boundaries, and production migration.
For most teams, the lesson to take away isn’t the “10 weeks” figure. It’s the five building blocks: clear constraints, executable tests, task division, continuous feedback, and key human decisions. You don’t need to aim for fully automated development. Start by getting an agent through a feedback loop on a small module with a complete test suite, then gradually expand its scope.
Try APIYI apiyi.com to quickly validate your results. The platform offers an OpenAI-compatible interface and free credits for new users, making it easy to compare coding models within the same feedback loop.
📚 References
- OpenAI’s official technical article, Scaling Git at OpenAI: The primary source for Pando’s architecture, migration, and performance data
- Link:
openai.com/index/scaling-git-at-openai -
Note: Published on 2026-11-02; the main source for the facts in this article
-
OpenAI Harness Engineering: Another internal project where Codex led development
- Link:
openai.com/index/harness-engineering -
Note: Useful for understanding the Agent engineering methodology; its data shouldn’t be mixed with Pando’s
-
Custom Code Review Rules for Codex: The code review bottleneck created by AI coding
- Link:
developers.openai.com/blog/custom-code-review-rules-for-codex -
Note: Covers the growth in weekly internal PRs and the review rules in AGENTS.md
-
OpenAI’s public Git fork: The repository for client-side improvements
- Link:
github.com/openai/git -
Note: Includes improvements such as packfile-uri; it isn’t the Pando server source code
-
OpenAI Git patch tracker: A record of upstream contributions
- Link:
oai-git.openai.chatgpt.site - Note: Documents continued engineering improvements after production deployment
Author: APIYI Technical Team
Technical discussions: Contact us through the APIYI homepage. For more Agent development resources, visit the documentation center at docs.apiyi.com.
