# Codex Adversary

> Use when the user says "codex review", "/codex-adversary", "adversarial review", "cross-model review", or asks for a different-model second opinion on a diff or plan artifact. Complements `/swarm-review` via Codex-CLI. Scopes: code-diff (default), plan-artifact (gate for `/swarm-plan`).

- **Type:** Skill
- **Install:** `agentstack add skill-grimoire-rs-grimoire-codex-adversary`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [grimoire-rs](https://agentstack.voostack.com/s/grimoire-rs)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [grimoire-rs](https://github.com/grimoire-rs)
- **Source:** https://github.com/grimoire-rs/grimoire/tree/main/.claude/skills/codex-adversary
- **Website:** https://grimoire.rs

## Install

```sh
agentstack add skill-grimoire-rs-grimoire-codex-adversary
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# /codex-adversary — Cross-Model Adversarial Review + Triage

Run Codex as adversarial reviewer (different model family →
different blind spots than Claude), then **auto-triage** findings and
drive Claude implementation of approved ones.

## When to Use This vs `/swarm-review`

| Skill | Reviewer | When |
|---|---|---|
| `/swarm-review` | Claude sub-agents (multi-perspective: security, perf, architecture, SOTA) | Fast intra-family multi-angle review. Same training data, same blind spots. |
| `/codex-adversary` | Codex CLI (GPT-5.x family) via plugin runtime | Cross-model second opinion. Slower. Catches things Claude family miss. |

Use both on big work — complement each other. `/swarm-review`
first (cheaper, faster), then `/codex-adversary` for
independent cross-model challenge before merge.

## Model selection (tiered)

Codex has three GPT-5.6 tiers (`luna`≈Haiku, `terra`≈Sonnet, `sol`≈Opus);
match model weight to review weight. Callers pass `--model ` per
tier — full alias→slug table + resolution rules:
[`references/model-selection.md`](./references/model-selection.md).
Default when `--model` omitted → `gpt-5.6-terra`.

## Context for Codex

Codex reads `AGENTS.md` at repo root every invocation. Grimoire
`AGENTS.md` already contains:

- Tech stack and golden-path choices
- Path → subsystem rule map (so Codex consults
  `.claude/rules/subsystem-*.md` before flagging)
- Language-level quality rule pointers (`.claude/rules/quality-*.md`)
- Hard-rule conventions (commits, git workflow, code patterns)
- Security attack surfaces
- Review guidance framing adversarial pass

**Do not** re-inject this context in review prompt — Codex already loads
it. Pass extra focus text only when user wants to steer review
to specific concern.

## Workflow

### 1. Scope detection

Two scope families, caller picks:

- **code-diff** (default; scopes `working-tree` / `branch` / `--base`)
  — reviews git diff. Used by `/swarm-execute` and direct user
  invocation.
- **plan-artifact** (scope `plan-artifact`, `--target-file `) —
  reviews plan / ADR / design markdown file. Invoked by
  `/swarm-plan` after Claude review panel converges. See
  [`references/plan-artifact-scope.md`](./references/plan-artifact-scope.md).

For code-diff scopes, run in parallel:

- `git status --porcelain=v1`
- `git diff --shortstat` and `git diff --shortstat --cached`
- `git log -5 --oneline`
- `git rev-parse --abbrev-ref HEAD`

Pick review scope:

- **working-tree** (default): unstaged + staged + untracked changes
- **branch**: `main..HEAD` — everything since branch diverged from main
- **--base ``**: user-supplied base
- **plan-artifact**: file path via `--target-file` is
  target; skip git probes.

If user passed focus text as argument, treat as intent (e.g.,
"security review of the new archive extractor") and pass through to
Codex unchanged. No rewrite.

### 2. Run the review via the plugin runtime

Use Codex companion script directly — same entry point plugin
`/codex:adversarial-review` command uses. Keeps Codex context
loading, auth, runtime identical to first-party command.

Resolve the `--model` alias to its slug (Model selection; default `gpt-5.6-terra`), pass as `--model `:

```bash
node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" adversarial-review --model "" "$ARGUMENTS"
```

`CLAUDE_PLUGIN_ROOT` env var set by Claude Code harness when
Codex plugin loaded. If unset (plugin missing), stop and tell
user to install/enable Codex plugin.

Execution mode:

- `--wait` in args → foreground
- `--background` in args → Claude background Bash task
- Neither → estimate size. Small (1–2 files, no directory-wide change): ask
  via `AskUserQuestion`, two options (`Wait for results (Recommended)`
  vs `Run in background`). Bigger: default background, tell
  user check `/codex:status`.

### 3. Auto-triage (Claude's job)

When review returns, Claude processes Codex free-text output and
makes **triaged report**. No passthrough-prompt user for every
finding — filter smart.

See [`references/triage.md`](./references/triage.md) for full triage
class table (Auto-fix / Needs confirmation / Discuss / Filtered-trivia /
Filtered-stated-convention / Filtered-false-positive), heuristics for
"safe to auto-fix", and triaged report format.

### 4. Implementation (auto-fix items)

For each auto-fix item:

1. Read affected file(s) to confirm Codex description matches reality
2. Apply fix with `Edit` (not `Write`)
3. Run targeted checks — `cargo check -p ` for Rust, relevant
   `task lint:*` for markdown/config, etc.

After all auto-fixes:

4. Run `task verify` once (not per file)
5. Update report with outcome of each auto-fix (✅ applied /
   ⚠️ reverted-and-promoted / ❌ failed)

Do **not** commit. Commit always user explicit call — follow
`/commit` conventions when invoked.

### 5. Needs-confirmation items

After auto-fix batch done, walk through *needs confirmation* items
one at a time using `AskUserQuestion` with Apply / Skip / Modify options.
Apply approved fixes same way as auto-fix items (`Edit` + targeted
check + final `task verify`).

### 6. Discuss items

Present verbatim at session end. Claude may add own
read per item, but no forceful advocate — these user decisions.

## Flags

- `--wait` — foreground execution, show review as soon as returns
- `--background` — run review as Claude background Bash task, return
  immediately; user checks `/codex:status` then asks for triage
- `--base ` — review `ref..HEAD` instead of working tree
- `--scope auto|working-tree|branch|plan-artifact` — explicit scope
- `--target-file ` — required when `--scope plan-artifact`;
  plan/ADR markdown file to hand to Codex
- `--model ` — Codex model tier (see Model
  selection). Alias or full slug; default `terra` (`gpt-5.6-terra`)
- `--no-auto-fix` — skip auto-fix batch; treat every real finding as
  *needs confirmation*. Use on sensitive code or when
  want see everything before change lands.
- `--review-only` — run Codex review, dump raw output, skip triage
  entirely. Equivalent to running `/codex:adversarial-review` directly.

## Plan-artifact scope (invoked by /swarm-plan)

When called with `--scope plan-artifact --target-file
.claude/state/plans/plan_.md`, contract changes — triage
simplified (no auto-fix batch; plans edited, not compiled) and
pass one-shot. See [`references/plan-artifact-scope.md`](./references/plan-artifact-scope.md)
for full contract.

## Failure modes

See [`references/failure-modes.md`](./references/failure-modes.md) —
Codex unavailable, no changes to review, empty/garbled Codex output,
`task verify` failures after auto-fix.

## References

- `AGENTS.md` — project context Codex loads every invocation
- `/codex:adversarial-review` — first-party plugin command; this skill
  wraps with Grimoire-specific triage
- `/swarm-review` — Claude-intra-family multi-perspective review
- `.claude/rules/quality-core.md` — anti-pattern severity definitions
  (Block / Warn / Suggest) used in triaged report
- `.claude/skills/builder/SKILL.md` — implementation pattern for
  applying approved fixes
- [`references/triage.md`](./references/triage.md) — classes, heuristics, report template
- [`references/plan-artifact-scope.md`](./references/plan-artifact-scope.md) — plan-artifact contract
- [`references/failure-modes.md`](./references/failure-modes.md) — error paths

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [grimoire-rs](https://github.com/grimoire-rs)
- **Source:** [grimoire-rs/grimoire](https://github.com/grimoire-rs/grimoire)
- **License:** Apache-2.0
- **Homepage:** https://grimoire.rs

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-grimoire-rs-grimoire-codex-adversary
- Seller: https://agentstack.voostack.com/s/grimoire-rs
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.