cochinescu/decent-skills/council-review

User-invoked. Run only when the user asked for this skill. Arguments: $ARGUMENTS

Requires codex, agy, and grok for full coverage. A missing reviewer is reduced coverage, not a hard failure, unless the user named only that reviewer.

Fallback: if fewer than two of the three external reviewers are reachable, enable the Claude blind reviewer for that run even though it is off by default, and say so in the report. One reviewer with a known independence limit beats an empty review. If it was already selected, or the user named a single reviewer explicitly, this rule does not apply.

Target: $ARGUMENTS Orchestrator: whichever host you typed this in, be it Claude Code, Codex, or Grok. The orchestrator is the only participant allowed to read the repo: it builds the packet, adjudicates the findings against the real files, and applies fixes on fix. Every reviewer runs blind no matter which host is orchestrating, and all four reviewer types are available regardless of host. Reviewers: three by default: Codex, Antigravity, and Grok. Codex and Antigravity are the core reviewers; Grok is supplemental and cost-capped in the default multi-review run. The blind-reviewer subagent (Claude, isolated context) is OFF by default. Claude is the main orchestrator: this command is normally typed in Claude Code, which built the packet and, more often than not, wrote the code under review. A Claude reviewer is therefore the least independent of the four, sharing a vendor and a model family with the thing being checked, which is the exact failure the other three exist to avoid. It also has a history of wedging and slow runs. It joins only when Target contains "with claude" (as a supplemental reviewer) or "claude only". If Target contains "codex only", "agy only", "grok only", or "claude only", use only that reviewer and skip the others; its verdict alone decides. If Target is empty: review staged, unstaged, and untracked local changes against the base branch. Determine the base read-only (upstream merge base if set, else detect main/master). Respect repository instructions in AGENTS.md, agents.md, CLAUDE.md, and any module-level CLAUDE.md files; ask me before any command that repo rules gate or that could mutate data, state, dependencies, generated artifacts, caches, or remote systems.

Step 1: Gather context read-only.

• Plan review: full plan text + files it names.
• Implementation vs plan: plan + diff vs base + touched

and untracked files.

• Code-only: diff vs base + touched and untracked files.
• Run safe checks (tests, typecheck, lint) only if

non-mutating and permitted. Record for each: command, exit code, key output, or SKIPPED with reason (not applicable | permission required).

Step 2: Create one unique mode-0700 temp working directory outside the repo. Put every prompt, output, and diagnostic log for this review inside it, and launch every shell reviewer with that directory as its process working directory. Only the orchestrator may inspect the real repo and copy selected context into the prompt; never give a reviewer the repo as its cwd or an added directory. Write the full reviewer prompt to a unique temp file there. Codex, Antigravity, and Grok are external services; the Claude subagent (when selected) is isolated but still receives copied context. Never include secrets, tokens, .env contents, or unrelated private files in the prompt. Insert the actual plan text, diff, file excerpts, and check results inline so all selected reviewers review the identical target. Never pass the full prompt as a shell argument. Dispatch Codex, Antigravity, and Grok as parallel background shells, and, only when selected, dispatch Claude as an independent subagent:

• Codex: codex exec --skip-git-repo-check --sandbox read-only

--ephemeral --ignore-user-config --ignore-rules --cd <review-tempdir> --disable apps --disable browser_use --disable in_app_browser --disable shell_tool --disable unified_exec --disable multi_agent --disable memories -c model="gpt-5.6-sol" -c model_reasoning_effort="medium" --json --output-last-message <unique outfile> - < <promptfile> (prompt via stdin), with JSON stdout/stderr captured to a unique log file for progress and error diagnosis. (Reference model id is gpt-5.6-sol; plain "gpt-5.6" is rejected with a 400 on some ChatGPT-plan accounts. Reasoning effort medium is the documented default. Swap the pin if your account uses a different Codex model.) Model verification: if the log exposes the model actually used (banner or config event) and it differs from the pin, treat it as a Step 3 item 5 reviewer failure instead of reviewing on a silent substitute — the same rule Antigravity gets below. If the log does not expose the model, mark the reviewer MODEL-UNVERIFIED in the report and continue; never fail a reviewer merely for an absent field.

• Antigravity: agy --sandbox --mode plan

--model "Gemini 3.1 Pro (High)" --log-file <unique temp logfile> -p "BOOTSTRAP EXCEPTION ONLY: read exactly the assigned <promptfile> once to obtain the review prompt. Do not list, search, read, create, edit, or delete any other path; do not run terminal commands, browse, use network tools, or spawn agents. Then obey the isolation contract inside that file and output only the review." with stdout captured to a unique outfile. (Model pins re-verified against agy models on 2026-08-17: Gemini 3.1 Pro is still the newest Pro tier — only Flash has newer generations.) If the pinned model wedges or times out twice, retry once with --model "Gemini 3.7 Flash (High)" (the newest Flash listed by agy models as of 2026-08-17; supersedes the old 3.5 Flash fallback) and label the result FALLBACK-MODEL in the report. If agy reports a different model, rejects the model flag, or the fallback also fails, treat it as a Step 3 item 5 reviewer failure instead of reviewing on a silent fallback.

• Grok: grok -m grok-4.6 --prompt-file <promptfile>

--output-format plain --max-turns 6 --disable-web-search --cwd <review-tempdir> --sandbox workspace --no-subagents --no-memory (Sandbox changed strict -> workspace 2026-09-04. The strict profile carries a runtime-socket deny rule that cannot resolve a SYMLINKED /var/run/docker.sock; Docker Desktop recreated that socket as a symlink on 2026-09-03, so strict began refusing to start with "could not resolve runtime-socket deny path" — fails closed, no request sent. workspace still confines writes to the isolated --cwd temp dir, which is the property this review relies on, and was verified working on 2026-09-04. If a future Grok adds a stricter profile that resolves symlinks, prefer it.) --permission-mode dontAsk --no-plan --disallowed-tools "run_terminal_command,search_replace,write,grep,search_tool,use_tool,workflow,spawn_subagent,monitor,scheduler_create,scheduler_delete,scheduler_list,todo_write,web_fetch,image_gen,image_edit,image_to_video,reference_to_video", stdout captured to a unique outfile. (Tool names are the real grok 1.0.30 names from its tool_definitions.json, corrected 2026-09-16; the old list named tools that do not exist and left write/spawn_subagent/workflow allowed. Do not deny enter_plan_mode/exit_plan_mode individually: the CLI refuses to start ("exit_plan_mode requires enter_plan_mode"); --no-plan disables plan mode instead. --permission-mode dontAsk matters: in a headless run a tool permission prompt cannot be answered, and a cancelled prompt aborts the whole turn with exit 0 and empty output, which looked like a wedge on 2026-09-12. Reasoning effort is not passed, so the account default from ~/.grok/config.toml applies, currently xhigh; see the silence note in Step 2.) (Model pinned to grok-4.6, the account default and newest listed by grok models, re-verified 2026-08-17.) PROMPT DELIVERY (verified 2026-08-13): the CLI offloads large --prompt-file prompts to a file the model must fetch with read_file, so read_file and list_dir must stay ALLOWED — denying them makes the model burn every turn trying to read its own prompt and fail with "max turns reached" (the historical Grok wedge). That read of its own CLI-offloaded prompt inside the temp dir is a documented bootstrap exception, not an isolation violation. Never pass the prompt as a positional argument: that launches the interactive TUI, which dies instantly in a non-TTY shell with "Operation not permitted (os error 1)". --max-turns 6 leaves headroom for the bootstrap read plus the response; 1 starves the response turn (observed 2026-07-11). HARD COST RULE: Grok gets exactly ONE dispatch per round — never retry it for any reason (a retry can consume paid credits), never pass --best-of-n, never add flags that could enable paid overage. Sole carve-out: an instant local exec failure that provably sent no request (e.g. "Operation not permitted" at process start, exit before any network activity) is not a dispatch and may be corrected once; anything that reached the service counts. On ANY service error or empty output — and especially anything matching credit/quota/rate-limit/429/billing/ insufficient/limit-reached — mark the reviewer GROK-LIMIT (or GROK-ERROR) in the report, and continue with the remaining reviewers. In the default multi- reviewer run Grok is supplemental, so this degraded coverage does not by itself force REVIEW INCOMPLETE; when "grok only" was explicitly selected, it is a Step 3 item 5 reviewer failure. The wedge/timeout retry rules that apply to Codex and Antigravity explicitly do NOT apply to Grok.

• A Claude quota or limit message is handled exactly like

Grok's: mark the reviewer CLAUDE-LIMIT and continue, since a supplemental reviewer hitting a cap is reduced coverage, not a failed run. Top-tier models have tighter caps; that is the trade for peer-level review.

• Claude (ONLY when "with claude" or "claude only" was

selected — skip entirely otherwise): dispatch the blind-reviewer subagent on Claude's top model, so it matches the tier the other three are pinned to (Agent-tool model override "fable"), with tool access disabled when the dispatch surface supports it, and with the full reviewer prompt text as its entire input, nothing else from this conversation, no skills, memory, or inherited repo context. If tool disabling is unavailable, the isolation contract still requires zero tool calls; any observed tool call invalidates the review. Do not rely on the agent definition's empty tools list to enforce this: some harnesses read an empty allowlist as no restriction rather than no tools. Treat the returned review as invalid if it cites repo detail that was not in the packet you sent. On a host with no subagent mechanism, run the identical prompt through the Claude CLI instead: claude -p --model fable --disallowed-tools "Bash,Read,Write,Edit,Glob,Grep,WebFetch,WebSearch,Task" < <promptfile>, which returns the review text on stdout and nothing else. Run it from the review tempdir, never from the repo, exactly as Codex gets --cd: a CLI started inside the project inherits that project's context and stops being blind. User-level config still loads, so the prompt must carry every fact the reviewer needs and must never reference a path for it to open. If neither path is available, skip Claude as reduced coverage. Capture its returned message like the other reviewers' outputs. Runs concurrently with the shells if the harness allows; note in the report if it serialized. Time-bound it like the shells: if it has not returned within 600 seconds, stop waiting, mark it CLAUDE-TIMEOUT, and never retry it. In a "with claude" run Claude is supplemental like Grok: a timeout/error is reduced coverage, not a blocker; in a "claude only" run it is the selected reviewer and its failure yields REVIEW INCOMP