Grill-Me-Codex — Get Grilled, Then Get Reviewed

Two acts, two different jobs:

• Act 1 fixes the #1 failure mode: building the wrong thing. Claude interrogates you until intent is locked — no guessing at ambiguity. (This act is Matt Pocock's grill-me, used under MIT — see THIRD-PARTY-NOTICES.md.)
• Act 2 fixes the #2 failure mode: a plan that sounds right but breaks. A different model (Codex) adversarially attacks the locked plan. Cross-model = no echo chamber.

You enter at two points only: answering the grill, and signing off the converged plan. Codex is read-only the whole time and never touches a file.

---

ACT 1 — GRILL (you ↔ Claude)

Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.

Ask the questions one at a time, waiting for my answer before continuing.

If a question can be answered by exploring the codebase, explore the codebase instead.

When the decision tree is resolved and we're aligned, write the agreed plan to PLAN.md in this structure, then move to Act 2:

# Plan: <task>
_Locked via grill — by Claude + <user>_

## Goal
<one paragraph — reflects what the grilling actually settled>

## Approach
<numbered, concrete steps>

## Key decisions & tradeoffs
<the contestable choices the grill resolved — name them so Codex has something to bite>

## Risks / open questions
<anything still genuinely open>

## Out of scope
<bounds the grill established>

Initialize PLAN-REVIEW-LOG.md:

# Plan Review Log: <task>
Act 1 (grill) complete — plan locked with the user. MAX_ROUNDS=<n>.

---

ACT 2 — REVIEW (Claude ↔ Codex)

Now hand the locked plan to Codex for adversarial review. Same engine, mechanics verified end-to-end (2026-06-04).

Prerequisites (verify once, fast)

• codex --version ≥ 0.130 (older CLIs error on the default gpt-5.5 model).
• Codex authenticated (prior codex login; ChatGPT account is fine). On auth/model error, surface it — don't silently retry.
• Do NOT pin -m. Use the config default. Pinning gpt-5.x-codex variants 400s on ChatGPT-account auth.
• Echo the active model before Round 1 so the user can confirm: read the model line from ~/.codex/config.toml (if absent, report "CLI default"). State it alongside the resolved tunables, e.g. Reviewer model: CLI default (config unpinned) — codex-cli 0.137.0. If the user objects, stop and let them adjust config before burning a review round.

Tunables (read from args, else default)

Var	Default	Meaning
MAX_ROUNDS	5	Hard cap on review rounds. The loop ALWAYS terminates here.
PLAN_FILE	PLAN.md	The plan Act 1 produced.
LOG_FILE	PLAN-REVIEW-LOG.md	Append-only argument transcript. The artifact.

If invoked with e.g. rounds=3, use that for MAX_ROUNDS. Echo resolved values before starting.

The review prompt (sent each round)

You are an adversarial reviewer for an implementation plan. Be skeptical and specific — your job is to find what breaks, not to be agreeable. Read the plan at PLAN.md and any repo files you need (you are read-only). Identify concrete flaws: security holes, race conditions, missing edge cases, schema conflicts, wrong assumptions, observability gaps, simpler alternatives. For each, give a one-line fix. Do NOT modify any files. End your reply with EXACTLY one line: VERDICT: APPROVED if the plan is sound enough to implement, or VERDICT: REVISE if it still has material problems.

Round 1 — fresh session (capture thread_id)

codex exec -s read-only --json -o /tmp/codex-verdict.txt "$(cat REVIEW_PROMPT)" \
  < /dev/null 2>/dev/null | grep '"type":"thread.started"'

Parse thread_id from the {"type":"thread.started","thread_id":"..."} line → that's THREAD_ID. The critique is in /tmp/codex-verdict.txt. Confirm success by the verdict file + a thread.started line; if neither appears, the run failed (auth/model) — stop and tell the user. 2>/dev/null suppresses cosmetic MCP/auth stderr noise. < /dev/null is mandatory: codex exec reads stdin in addition to the prompt arg, so under a non-interactive driver (Claude Code's Bash tool, CI, any non-TTY pipeline) it blocks forever waiting on stdin EOF — a silent ~0% CPU hang. The redirect gives it immediate EOF.

Rounds 2..MAX — resume the SAME session (Codex remembers its prior critiques)

# resume REJECTS -s. Force read-only via -c sandbox_mode, or Codex inherits
# config.toml (possibly danger-full-access) and could WRITE files. This is the
# single most important safety line in the skill — verified 2026-06-04.
codex exec resume "$THREAD_ID" -c sandbox_mode="read-only" --json \
  -o /tmp/codex-verdict.txt \
  "I revised the plan. Re-review PLAN.md — check whether your prior findings are addressed and flag anything new. End with VERDICT: APPROVED or VERDICT: REVISE." \
  < /dev/null 2>/dev/null >/dev/null

Both codex exec and codex exec resume support --json and -o/--output-last-message. The < /dev/null redirect is required on the resume call too — same non-interactive stdin hang as Round 1.

Timeout guard (both rounds): run every codex exec / codex exec resume with a 10-minute ceiling so any future stall fails loud instead of hanging silently. Via Claude Code's Bash tool, pass timeout: 600000 on the tool call (the default 2-minute tool timeout is too short for real reviews and would kill them mid-run). In a plain shell, prefix the command with timeout 600 (Linux / Git Bash) or gtimeout 600 (macOS via coreutils — stock macOS has no timeout). If the ceiling trips, treat it as a failed run: stop and tell the user rather than retrying blind.

Each round, after Codex returns

1. Read /tmp/codex-verdict.txt; append to LOG_FILE: ## Round <n> — Codex + the full critique.
2. Grep the last line for the verdict:
   • VERDICT: APPROVED → break to Resolution (converged).
   • VERDICT: REVISE → Claude decides what's actually worth acting on (Claude is final arbiter — Codex advises, doesn't command). Revise PLAN_FILE. Append ### Claude's response to LOG_FILE: what changed, what was rejected, why. Increment round.
3. If round > MAX_ROUNDS → break to Resolution (deadlock).

Resolution (you sign off — final gate)

• APPROVED: present the final PLAN_FILE, a 3-bullet summary of what the two acts improved, and the round count. Ask: "Grilled + survived N rounds of Codex. Implement it now — Codex builds it (/codex-build), Claude builds it, or stop here?" Code only on a yes. No code is written during either act.
• MAX_ROUNDS hit without APPROVED (deadlock): do NOT fake convergence. List each unresolved point + Claude's counter-position; hand it to the user to break the tie. A flagged disagreement beats a false "approved."

ACT 3 (optional) — BUILD (Codex ↔ Claude, roles flipped)

If the user picks Codex: invoke the codex-build skill with SPEC_FILE=PLAN.md and the same LOG_FILE — it appends ## Act 3 — Build to the log, so one artifact tells the whole story (grilled → reviewed → built → verified). Roles flip: Codex writes the code with full access, Claude reviews the diff and runs the proof. If the user picks Claude, implement directly as usual.

---

Hard rules

• Act 1 always precedes Act 2 — don't write PLAN.md until the grill has actually resolved the decision tree with the user.
• Codex is read-only EVERY round — -s read-only first call, -c sandbox_mode="read-only" on every resume (resume has no -s). It never writes.
• The loop ALWAYS terminates at MAX_ROUNDS.
• Claude is final arbiter on every REVISE — incorporate good critiques, reject bad ones with a logged reason. Don't cave to everything (defeats the cross-model check) and don't ignore it (defeats the point).
• Code only after the user's final sign-off.
• LOG_FILE is the deliverable — keep the whole argument.

What NOT to do

• Don't review already-written code — that's /codex:review.
• Don't pin a -codex model variant on ChatGPT-account auth — it 400s.
• Don't let Codex edit files. Read-only, always.
• Don't skip Act 1 — the grill is half the value.