Add independently verified Codex reviews

README.md

@@ -11,6 +11,7 @@ they already have.
 
 - `/codex:review` for a normal read-only Codex review
 - `/codex:adversarial-review` for a steerable challenge review
+- `/codex:verified-review` for a native review with an independent evidence pass
 - `/codex:rescue`, `/codex:transfer`, `/codex:status`, `/codex:result`, and `/codex:cancel` to delegate work, hand off sessions, and manage background jobs
 
 ## Requirements
@@ -123,6 +124,20 @@ Examples:
 
 This command is read-only. It does not fix code.
 
+### `/codex:verified-review`
+
+Runs one native Codex review, then a fresh read-only Codex turn that independently verifies every finding. The final report labels each finding as `confirmed`, `false-positive`, `style-only`, or `unverified`, with evidence and any check output.
+
+It accepts the normal review target options, including `--base <ref>` and `--scope auto|working-tree|branch`. Add `--check "<command>"` repeatedly to authorize only those validation commands for the verification turn:
+
+```bash
+/codex:verified-review
+/codex:verified-review --base main --check "npm test" --check "npm run build"
+/codex:verified-review --background --check "npm test"
+```
+
+`--check` is a trust boundary: each command is passed exactly as user-supplied to Codex's local read-only verification sandbox and may invoke arbitrary local programs available there. The plugin does not infer or run default test, build, lint, or check commands. Without `--check`, verification uses only read-only repository inspection. Use [`/codex:status`](#codexstatus) and [`/codex:result`](#codexresult) for background work.
+
 ### `/codex:rescue`
 
 Hands a task to Codex through the `codex:codex-rescue` subagent.

plugins/codex/commands/verified-review.md

@@ -0,0 +1,68 @@
+---
+description: Run a native Codex review, then independently verify every finding
+argument-hint: '[--wait|--background] [--base <ref>] [--scope auto|working-tree|branch] [--check "<command>"]...'
+disable-model-invocation: true
+allowed-tools: Read, Glob, Grep, Bash(node:*), Bash(git:*), AskUserQuestion
+---
+
+Run a verified Codex review through the shared plugin runtime.
+
+Raw slash-command arguments:
+`$ARGUMENTS`
+
+Safe input transport:
+- Additional command context supplies `CODEX_VERIFIED_REVIEW_CAPTURE_ID=<uuid>` for these raw arguments. Treat that UUID as opaque.
+- Before any execution, find one valid `CODEX_VERIFIED_REVIEW_CAPTURE_ID` UUID marker in that context. If it is absent or invalid, fail closed: do not invoke the companion and report that the verified review cannot safely access its captured input.
+- Pass only `--captured-input "<uuid>"` to the companion. Never copy, interpolate, export, pipe, or otherwise place raw `$ARGUMENTS` in Bash, a template string, an environment variable, or stdin.
+
+Core constraint:
+- This command is review-only and read-only.
+- Do not fix issues, apply patches, or suggest that you are about to make changes.
+- Run one native Codex review, then one fresh ephemeral read-only Codex verification turn.
+- The verifier must classify every finding as `confirmed`, `false-positive`, `style-only`, or `unverified` and include its evidence.
+- Return the command stdout verbatim to the user. Do not paraphrase, summarize, or add commentary before or after it.
+
+Explicit check trust boundary:
+- Each repeated `--check "<command>"` value is an explicit user-authorized shell command for the verification turn.
+- Preserve each value exactly. Never invent, rewrite, expand, or add a default test, build, lint, or check command.
+- Those commands run in the local repository through Codex's read-only verification sandbox. Treat their text as trusted user input: they can invoke arbitrary local programs available to Codex.
+- Without `--check`, the verifier must not run validation commands; it may only inspect repository files and git state read-only.
+
+Execution mode rules:
+- If raw arguments include `--wait`, do not ask. Run in the foreground.
+- If raw arguments include `--background`, do not ask. Run in a Claude background task.
+- Otherwise, estimate review size before asking:
+  - If raw arguments explicitly select a branch with `--base` or `--scope branch`, never run Bash to size that branch; recommend background.
+  - For auto or working-tree review with no explicit branch selector, run only fixed, argument-free working-tree sizing commands: `git status --short --untracked-files=all`, `git diff --shortstat --cached`, and `git diff --shortstat`.
+  - Never copy or interpolate a raw base or ref into Bash.
+  - Treat untracked files or directories as reviewable work even when `git diff --shortstat` is empty.
+  - If the working tree is clean, the companion will fall back to branch review, or the size is unclear, recommend background.
+  - Recommend waiting only when the scoped review is clearly tiny, roughly 1-2 files total and no sign of a broader directory-sized change.
+  - In every other case, including unclear size, recommend background.
+- Then use `AskUserQuestion` exactly once with two options, putting the recommended option first and suffixing it with `(Recommended)`:
+  - `Wait for results`
+  - `Run in background`
+
+Argument handling:
+- The captured input preserves `--base`, `--scope`, every `--check`, `--wait`, and `--background` exactly.
+- `/codex:verified-review` supports only auto, working-tree, and branch review scopes. It does not support staged-only review, unstaged-only review, or focus text.
+- The companion reads the captured input and parses `--wait`, `--background`, and repeated `--check`; Claude Code's `Bash(..., run_in_background: true)` is what detaches this slash-command turn.
+
+Foreground flow:
+- Run:
+```bash
+node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" verified-review --captured-input "<uuid>"
+```
+- Return stdout verbatim, exactly as-is.
+
+Background flow:
+- Launch with `Bash` in the background:
+```typescript
+Bash({
+  command: `node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" verified-review --captured-input "<uuid>"`,
+  description: "Codex verified review",
+  run_in_background: true
+})
+```
+- Do not call `BashOutput` or wait for completion in this turn.
+- After launching, tell the user: "Codex verified review started in the background. Check `/codex:status` for progress."

plugins/codex/hooks/hooks.json

@@ -1,6 +1,18 @@
 {
   "description": "Optional stop-time review gate for Codex Companion.",
   "hooks": {
+    "UserPromptExpansion": [
+      {
+        "matcher": "^(?:codex:)?verified-review$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/verified-review-input-hook.mjs\"",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
     "SessionStart": [
       {
         "hooks": [

plugins/codex/prompts/verified-review.md

@@ -0,0 +1,31 @@
+<role>
+You are the independent verification pass after a native Codex review.
+</role>
+
+<task>
+Verify every finding from the native review against the current repository state.
+Target: {{TARGET_LABEL}}
+</task>
+
+<native_review>
+{{NATIVE_REVIEW_OUTPUT}}
+</native_review>
+
+<native_findings>
+{{NATIVE_FINDINGS}}
+</native_findings>
+
+<explicit_checks>
+{{EXPLICIT_CHECKS}}
+</explicit_checks>
+
+<rules>
+- Work in this fresh, read-only turn. Do not rely on the native review's conclusion without checking its evidence.
+- Classify every entry in the JSON array inside `<native_findings>` exactly once. Set each returned finding's `native_finding_id` to that entry's ID. Do not add, omit, or repeat IDs. If the array is empty, return an empty findings array.
+- Prefix every returned finding title with one of: `[confirmed]`, `[false-positive]`, `[style-only]`, or `[unverified]`.
+- Put concrete verification evidence in every finding body, including source locations, observed behavior, and any explicit-check result that applies.
+- Execute only these explicitly supplied commands as validation checks. Run each supplied command exactly once; do not infer, substitute, expand, or run a default test, build, lint, or check command.
+- You may run additional read-only inspection commands for repository files and git state. Those are inspection evidence, not validation checks. Do not edit files or execute commands that change repository state.
+- If no explicit checks were supplied, run none. If an explicit check cannot run, include its command, failure evidence, and an `[unverified]` classification where relevant.
+- Return only valid JSON matching the supplied schema. Keep findings compact and evidence-based.
+</rules>

plugins/codex/schemas/verified-review-output.schema.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["verdict", "summary", "findings", "next_steps"],
+  "properties": {
+    "verdict": { "type": "string", "enum": ["approve", "needs-attention"] },
+    "summary": { "type": "string", "minLength": 1 },
+    "findings": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["native_finding_id", "severity", "title", "body", "file", "line_start", "line_end", "confidence", "recommendation"],
+        "properties": {
+          "native_finding_id": { "type": "string", "minLength": 1 },
+          "severity": { "type": "string", "enum": ["critical", "high", "medium", "low"] },
+          "title": { "type": "string", "minLength": 1 },
+          "body": { "type": "string", "minLength": 1 },
+          "file": { "type": "string", "minLength": 1 },
+          "line_start": { "type": "integer", "minimum": 1 },
+          "line_end": { "type": "integer", "minimum": 1 },
+          "confidence": { "type": "number", "minimum": 0, "maximum": 1 },
+          "recommendation": { "type": "string" }
+        }
+      }
+    },
+    "next_steps": { "type": "array", "items": { "type": "string", "minLength": 1 } }
+  }
+}