# Grill

> Twin-agent adversarial interview that locks a task or design before implementation. Two models plan independently, attack each other's plans, and only genuinely user-owned questions reach you — the locked outcome is handed to librarian to write. Use for 'grill', 'grill me', plan stress-test, design interview, new-task intake, spec lock, or a flow `needs-input` escalation.

- **Type:** Skill
- **Install:** `agentstack add skill-supermodo-skills-grill`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [supermodo](https://agentstack.voostack.com/s/supermodo)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [supermodo](https://github.com/supermodo)
- **Source:** https://github.com/supermodo/skills/tree/main/skills/grill

## Install

```sh
agentstack add skill-supermodo-skills-grill
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# grill — twin-agent adversarial interview

> **Requires:** the sibling `protocols` skill (shared protocol masters); uses `skills.config.json` when present. Missing protocols → tell the user to install the full supermodo package.

Moderator skill implementing the grilling protocol. Two planners (host model +
the OTHER provider) work the same brief independently, attack each other, and
surface only what genuinely needs the user. Output is the locked **triad**
(`spec.md`, `plan.md`, `tasks.md`) handed to librarian — **grill never writes
docs itself**.

Read `../protocols/references/grilling.md` (the master), plus `../protocols/references/cross-model.md`,
`../protocols/references/adversarial-review.md`, `../protocols/references/questions.md`. Follow the master
exactly; this file adds host mechanics.

Entry points: standalone `/supermodo:grill`, `librarian --task` intake,
`flow` stage 1 and mid-run `needs-input` escalations.

## Actors (host-neutral)

- **Moderator = you, main context.** Hold the two threads, route questions per
  the questions triage, talk to the user, record decisions via librarian. NEVER
  crawl the codebase yourself — stay tiny.
- **Local planner** — a persistent agent of the HOST model.
- **Adversary planner** — a persistent READ-ONLY CLI session of the OTHER
  provider.

Either planner unavailable → honest single-model degradation (see bottom).

## Phases (from the master)

1. **Independent plans.** Both planners get the same brief (user ask + docs
   router pointer). Each crawls code/docs, forms a plan + question list,
   WITHOUT seeing the other's output. No anchoring.
2. **Disprove rounds.** Each attacks the other's plan and proposed answers per
   the adversarial-review stance: every objection names a concrete failure
   scenario; "no material objection found" is a valid, logged outcome — never
   manufacture disagreement. Iterate to stable (1–2 rounds typical).
3. **Question routing — three classes:**
   - **(a) discoverable facts** — planners answer from code/docs; never reach
     the user.
   - **(b) technical tradeoffs** — adversary consulted first; surface to the
     user ONLY on unresolved model conflict.
   - **(c) product / scope / preference** — ALWAYS reach the user, even when
     both models agree (agreement ≠ consent).
4. **Custom answers.** A user answer that isn't one of the suggestions re-enters
   ONE disprove round (adversary attacks it with concrete scenarios); surviving
   objections shown; user confirms or amends before locking.
5. **Record.** Everything logged with both positions — including agent-to-agent
   resolutions. Durable decisions → ADRs; scope/plan → the triad. Via librarian.

### Question format to the user (mandatory)

question transport follows the shared questions protocol: chat by default,
config may override globally or per skill (uniform for every skill).
Per concept-group:

```

Q: 
  1. Claude suggests: 
  2. Codex counters:    (swap names when Codex is host;
                                          "unavailable (single-model)")
  3. More detail — verbose, link-rich expansion (files, docs, decisions),
     then this question is asked again
  4. Your own answer
  5. Defer — leave open   (only where deferral is acceptable)
```

The user answers by number or free text. Choosing (3) never consumes the
question; a (4) custom answer re-enters one disprove round before locking.
Deferred items go to the work-doc Open Questions.

## Host mechanics — Claude Code host

Local planner = a **subagent kept alive** across the whole grill:

- Spawn one general subagent with the brief; it returns its plan + question
  list. Keep it alive and continue it via **SendMessage** to run disprove
  rounds and fold in user answers — its context stays intact, no rerun.

Adversary = **`codex exec`, read-only**, one persistent thread:

- Preflight first (per cross-model): `codex --version`, auth OK. On failure
  STOP and ask: fix+retry / continue single-model / abort. Never silently
  degrade.
- First call:
  `codex exec -s read-only --skip-git-repo-check ""  -c sandbox_mode="read-only" "" < /dev/null`
  (resume rejects `-s`). Batch ~12 items per call. Give each call a 10-min
  timeout; a call whose output stopped growing at ~0 CPU for 15+ min is hung,
  not slow — kill, retry once fresh, second stall → single-model for that batch
  and record it.

## Host mechanics — Codex host (inverted)

- Local planner = the host's OWN delegation mechanism, kept alive across rounds.
- Adversary = `claude -p` with no write-capable tools, one persistent session,
  same preflight / batching / hung-detection rules. Never pin a model.
- Everything else identical; swap the `Claude suggests:` / `Codex counters:`
  labels so the HOST is the "suggests" line.

## Output — what a successful grill produces

The locked triad content, in memory, handed to librarian to WRITE:

- `spec.md` — goal, non-goals, scope, acceptance evidence.
- `plan.md` — approach, steps, risks, alternatives considered.
- `tasks.md` — checklist with immutable inline task IDs
  (`- [ ] X `).

Plus the recorded decision log (both positions per resolved question).
**grill hands this to librarian; grill creates no doc files.** Mid-flow
(`needs-input` during stages 2–6), it does NOT call librarian — it returns the
decisions as structured `decisions` notes in the stage report for the stage-7
librarian pass, preserving the stages-1-and-7-only docs rule.

## Hard rules

- Moderator never writes code, never edits docs, never crawls.
- No doc files exist until the grill resolves and the user signs off (librarian
  creates the triad at the end — standalone/intake only).
- Two models agreeing never substitutes for the user on class-(c) questions.
- Auto-resolution is class-scoped: recorded facts and durable technical
  decisions auto-resolve future runs; class-(c) answers may seed the default
  suggestion but the question STILL reaches the user.
- Disputes surface with both arguments verbatim — never silently resolved.
- Persist verdicts as they form (adversarial-review protocol).

## Tie-break

At **five** unresolved rounds on one point, or when a disagreement hinges on
product intent: present both positions verbatim and the user breaks the tie.

## Degradation (honest, never faked)

Adversary CLI absent / unauthenticated / both retries stalled → say so, run
single-model with explicitly labeled self-adversary lines
(`Codex counters: unavailable (single-model)`), and mark the whole grill
single-model in its output. Never pretend a second model reviewed.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [supermodo](https://github.com/supermodo)
- **Source:** [supermodo/skills](https://github.com/supermodo/skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** yes
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-supermodo-skills-grill
- Seller: https://agentstack.voostack.com/s/supermodo
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.