OpenAI's Pando: How Codex Outgrew Git, Explained

§ 01Why Git started to break at OpenAI#

Codex lets one engineer work on many changes at once. The post spells out how that compounds: “One engineer now has several changes ready for CI at once, and each push can set several jobs fetching the same commit.” Starting around the end of 2025, the old system struggled, with slow fetches and pushes, failed merges, and “reliability at times falling below 90%.”

OpenAI modeled the two usual ways to scale a Git service and found the same problem in both. A three-phase commit design keeps full copies on several replicas and needs a majority of them to agree on every branch update. A write-ahead log design keeps one shared manifest in blob storage that every push must update. Either way, pushes to unrelated branches still wait on one shared point.

§ 02How Pando works, in plain terms#

Pando gives up two guarantees that most Git servers treat as fixed, and the post argues users and agents never relied on them.

• Each branch moves on its own. Pando does not keep one consistent snapshot of every branch at once. A push only conflicts with another push to the same branch. The post calls the model causal consistency: a reader fetching a branch gets the history of the writer who produced it. The cost is that “A client reading several branches cannot assume those reads describe a single point in time across the repository.”
• Packs are stored once and reused. A normal Git server builds a fresh packfile (Git’s compressed bundle of objects) for each client. Pando stores every pushed pack in blob storage and hands readers links to the stored packs they need, so “the server can serve the same bytes to many clients with little computation.”
• Small packs get merged in the background. Every push makes a small L0 pack. Background workers combine them into larger covers, up to L4 in OpenAI’s monorepo, so a client that is far behind downloads a few large packs instead of tens of thousands of small ones.

To make stored packs reusable, Pando tells a pushing client about only one branch, the trunk, instead of every branch it has. The post notes that with millions of branches, a full list “can exceed 100 MiB.” The tradeoff is that pushes carry some history the server already has, but they stay small: the median pack in OpenAI’s monorepo was under 20 KiB and the 99th percentile under 3 MiB.

§ 03The numbers OpenAI reports#

The growth chart in the post is the clearest picture of why the old system broke. Each value is commits landed on master, relative to the first quarter of 2024.

Most of that growth came in 2026, the year Codex use took off inside OpenAI. The post’s own estimate for the fourth quarter of 2026 is 2,442%, which we leave out of the chart because it is a projection.

Here is what Pando delivers in production, per the post.

The post also includes an interactive simulation of 1,000 writers pushing at once to compare Pando with the two usual designs. OpenAI labels it “Synthetic teaching models, not production benchmarks,” so the production figures above are the ones to cite.

§ 04Built by agents in 10 weeks#

The most striking line in the post is about how Pando was made: “We built Pando with Codex, moving from kick-off to production, in just 10 weeks. The core of Pando was designed by a single engineer, implemented by teams of agents, and deployed by a handful of engineers.” It began serving production traffic in April 2026.

The methods OpenAI lists for checking the work matter as much as the speed:

• A fresh codebase in Rust, with no legacy dependencies.
• A conformance test suite, “so agents could test their changes against standard Git behavior.”
• Deterministic simulation tests to find race conditions in negotiation and pack planning.
• Formal proofs written by agents. Using GPT-6 Astra, agents wrote Lean and TLA+ to formalize what OpenAI calls a theory of Pando, and long-running sessions spent “hundreds of hours finding and fixing edge cases.”
• Around-the-clock red-teaming of Git and Pando by agents running Daybreak-capable models.

The rollout followed the same pattern. Pando first ran as a proxy in front of the old system, so traffic moved over without downtime, and Codex skills let developers “simply ask Codex to migrate their development environments and services.” OpenAI also ships its own Git build to developer machines and inside the ChatGPT desktop app, and says several of its fixes are already in upstream Git.

§ 05What the post does not say#

• Availability. Pando is internal. OpenAI is “exploring ways to share the technology” but names no product, date or price. The public repository is OpenAI’s build of the Git client, not Pando itself.
• Infrastructure. The post names internal services (Express for packs, Turtle for metadata) but not the blob store or cloud behind them.
• Cost. There is no figure for what Pando costs to run beyond “a handful of CPU cores” for serving.
• Team size. One engineer designed the core and a handful of engineers deployed it; the number of agent sessions or compute used is not given.

§ 06What this means for teams running coding agents#

The useful lesson is not the storage design. It is where the bottleneck moved. When agents multiply how much code one engineer produces, the shared systems around the code (source control, CI, review) become the limit, and OpenAI hit that limit first because it runs Codex at the largest scale.

Three choices in the post carry over to any team that adds agents:

• Drop the guarantee nobody uses. Repo-wide consistency cost OpenAI throughput, and the post says users and agents “depend on the order of updates to a single reference,” not on a global order.
• Serve the same work to many readers. Most agent traffic is many jobs fetching the same commit. Reusing stored packs turned that into cache hits.
• Keep the interface people already know. Pando changed the backend and left the Git client alone, so engineers and agents moved over without new habits. Codex itself carried part of the migration through skills that prepared checkouts.

We build AI employees, including AI software engineers that write and push code for a team. The more of that work agents do, the more these shared systems matter, which is why we read posts like this one closely. For a related case of rewriting core infrastructure with agents, see our record of the Anthropic Messages API rewrite in Rust.

§ 07What we are watching#

• Pando for customers. OpenAI says: “We’re currently exploring ways to share the technology that makes Pando possible with our users.” Whether that becomes a Codex or ChatGPT feature.
• Upstream Git. Which of OpenAI’s patches (parallel pack downloads, explicit haves, packfile-uri fixes) land in mainline Git.
• Agents on one shared repository. OpenAI names “workloads where large numbers of agents need to collaborate on a shared Git repository” as a next use.

§ 08Sources#

• OpenAI: Scaling Git at OpenAI, by Aaron Friel, Taylor Blau and Ted Nyman, November 2, 2026, read the same day.
• OpenAI’s public Git build: github.com/openai/git.
• Background on the Git protocol: git-scm.com documentation.