docs: describe Codex verifier workflows
diff --git a/CLAUDE.md b/CLAUDE.md index 7a55aab..21bad50 100644 --- a/CLAUDE.md +++ b/CLAUDE.md
@@ -22,7 +22,7 @@ - Use `/codex:rescue` for substantial bounded implementation, diagnosis, or a second pass when Claude is stuck; use its `--background`, `--resume`, and `--fresh` controls when needed. - When Codex should use a named TinyUSB role, select its `.codex/agents/<role>.toml` adapter; the adapter loads `.claude/agents/<role>.md` as the canonical role. - Reviews and research may run beside Claude. For write-capable delegation, use a separate worktree if Claude continues editing; otherwise yield the current worktree to Codex until it finishes. Never let both edit overlapping files in one worktree. -- `.claude/workflows/*.js` remain Claude Code-native orchestration. Codex may review or rescue work around a workflow, but no Codex-specific workflow mirror is maintained. +- `.claude/workflows/*.js` remain the canonical Claude Code orchestration. Their `code-verifier` work routes through the nested `code-verify` workflow: Codex by default, or Claude/both when a caller selects it. Do not invoke the verifier agent directly or copy the Codex bridge command. ## Ground Rules
diff --git a/docs/superpowers/plans/2026-09-06-codex-dynamic-workflow.md b/docs/superpowers/plans/2026-09-06-codex-dynamic-workflow.md index efcdbfa..8dbff2b 100644 --- a/docs/superpowers/plans/2026-09-06-codex-dynamic-workflow.md +++ b/docs/superpowers/plans/2026-09-06-codex-dynamic-workflow.md
@@ -34,7 +34,7 @@ - Consumes: `{ prompt: string, schema: object, provider?: 'codex'|'claude'|'both', label?: string }` - Produces: the requested schema for a single provider; `{ codex, claude }` for `both` -- [ ] **Step 1: Write failing router tests** +- [x] **Step 1: Write failing router tests** Create `test-code-verify.mjs` with a small harness that evaluates a workflow body inside an async function with mocked `agent` and `parallel` primitives. Add checks for: @@ -67,7 +67,7 @@ The mock identifies the native Claude call by `agentType: 'code-verifier'` and the Codex bridge by `model: 'haiku'`. -- [ ] **Step 2: Run the test and verify RED** +- [x] **Step 2: Run the test and verify RED** Run: @@ -77,7 +77,7 @@ Expected: FAIL because `.claude/workflows/code-verify.js` does not exist. -- [ ] **Step 3: Implement the minimal router** +- [x] **Step 3: Implement the minimal router** Create `code-verify.js` with: @@ -147,7 +147,7 @@ return the result file's JSON verbatim; if any command fails, do not fabricate a result ``` -- [ ] **Step 4: Run router tests and syntax check** +- [x] **Step 4: Run router tests and syntax check** Run: @@ -158,7 +158,7 @@ Expected: all router checks pass and the syntax checker prints `OK`. -- [ ] **Step 5: Register the focused pre-commit hook** +- [x] **Step 5: Register the focused pre-commit hook** Add under `repo: local`: @@ -179,7 +179,7 @@ Expected: PASS. -- [ ] **Step 6: Commit the router** +- [x] **Step 6: Commit the router** ```bash git add .claude/workflows/code-verify.js \ @@ -201,7 +201,7 @@ - Consumes: `workflow('code-verify', { prompt, schema, label })` - Produces: the same structured result each former native verifier call consumed -- [ ] **Step 1: Add the failing no-bypass test** +- [x] **Step 1: Add the failing no-bypass test** Scan every `.claude/workflows/*.js` except `code-verify.js` and fail if it matches: @@ -209,7 +209,7 @@ /agentType:\s*['"]code-verifier['"]/ ``` -- [ ] **Step 2: Run the test and verify RED** +- [x] **Step 2: Run the test and verify RED** Run: @@ -219,7 +219,7 @@ Expected: FAIL naming direct calls in `driver-review.js`, `fanout-dev.js`, and `pr-babysit.js`. -- [ ] **Step 3: Replace each direct call** +- [x] **Step 3: Replace each direct call** Use this shape without a `provider`, so Codex is selected: @@ -234,7 +234,7 @@ Keep every caller's existing null/result handling. Remove the `max` effort override from the adversarial `driver-review` call; provider adapters own the approved `xhigh` effort. -- [ ] **Step 4: Verify callers and commit** +- [x] **Step 4: Verify callers and commit** Run: @@ -264,11 +264,11 @@ - Consumes: `workflow('code-verify', { provider: 'both', prompt, schema, label })` - Produces: separate `review` and `codex` stage rows from one independent dual-provider dispatch -- [ ] **Step 1: Add a failing validate wiring check** +- [x] **Step 1: Add a failing validate wiring check** Assert that `validate.js` contains one `workflow('code-verify'` call with `provider: 'both'`, and contains neither `codex review --base` nor a direct Opus review agent. -- [ ] **Step 2: Run the test and verify RED** +- [x] **Step 2: Run the test and verify RED** Run: @@ -278,7 +278,7 @@ Expected: FAIL because `validate.js` still owns separate Claude and Codex review agents. -- [ ] **Step 3: Normalize the shared review prompt** +- [x] **Step 3: Normalize the shared review prompt** Keep the existing `REVIEW` schema but require `severity` to include both independent gate signals: @@ -297,7 +297,7 @@ /^confirmed/i.test(f.severity) && /\bP[01]\b/i.test(f.severity) ``` -- [ ] **Step 4: Dispatch and split both results** +- [x] **Step 4: Dispatch and split both results** Schedule one internal `reviews` thunk when either review stage is enabled. Select `both` when neither `review` nor `codex` is skipped; otherwise select the remaining provider. Normalize its return into the existing stage rows: @@ -318,7 +318,7 @@ Flatten stage-thunk results before updating `latest`. When building the next `toRun` set, map failed `review` or `codex` rows back to the `reviews` scheduler name. Preserve the existing `skip`, fixer evidence, retry, restart-required, and final-report contracts. -- [ ] **Step 5: Verify validate and commit** +- [x] **Step 5: Verify validate and commit** Run: @@ -346,7 +346,7 @@ - Consumes: the implemented router and migrated callers - Produces: repository guidance and fresh end-to-end evidence -- [ ] **Step 1: Update the collaboration contract** +- [x] **Step 1: Update the collaboration contract** Replace the claim that Codex only works around workflow edges with concise guidance: @@ -357,7 +357,7 @@ verifier agent directly or copy the Codex bridge command. ``` -- [ ] **Step 2: Run static and repository checks** +- [x] **Step 2: Run static and repository checks** Run: @@ -372,6 +372,11 @@ - [ ] **Step 3: Run one live read-only smoke test** +Blocked on 2026-09-06 before workflow dispatch: Claude Code returned HTTP 403 +because the organization disables subscription access. A direct run of the +same Codex subprocess path passed with `gpt-5.6-sol`, `xhigh`, the read-only +sandbox, canonical `.claude/agents/code-verifier.md`, and valid schema output. + From Claude Code, invoke `code-verify` with the default provider, a prompt that asks which canonical role file it loaded, and this schema: ```js @@ -387,7 +392,7 @@ Expected: `role` names `.claude/agents/code-verifier.md`, `readOnly` is true, the worktree stays clean, and the run reports Sol/xhigh from `.codex/agents/code-verifier.toml`. -- [ ] **Step 4: Mark the plan complete and commit documentation** +- [x] **Step 4: Mark the plan complete and commit documentation** Mark completed checkboxes in this file, then run: