Repository navigation
feat: allowlisted cross-vendor bridge for review panels - #4
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1d057cb3f0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | `codex` | OpenAI | `codex exec --sandbox read-only --skip-git-repo-check - < "$prompt_file"` | | ||
| | `copilot` | chosen with `--model` | `copilot -p "$(cat "$prompt_file")" --model <model> -s --no-ask-user --deny-tool=write --deny-tool=shell` | | ||
|
|
||
| Bridged members are read-only reviewers: every command above runs without write or shell access. Never add flags that grant it. |
There was a problem hiding this comment.
When codex is allowlisted, the no-shell guarantee is false: /opt/codex/bin/codex exec --help describes --sandbox as selecting the policy for “model-generated shell commands,” so read-only prevents filesystem writes but does not remove the shell tool. Because the bridge feeds raw diffs and other potentially untrusted content to the model, a prompt-injected review can still execute read commands and expose local data in its output despite users being told bridged members have no shell access; use a mode that actually disables command execution or explicitly treat this bridge as shell-capable and harden it accordingly.
AGENTS.md reference: AGENTS.md:L15-L15
Useful? React with 👍 / 👎.
| 1. State the artifact each candidate is producing. | ||
| 2. Derive the rubric. State what success looks like for *this* task, then turn it into 3-6 concrete gradeable criteria. The rubric is the picker's tool in Phase D. Candidates only see the task. | ||
| 3. Pick the runners. Default to three host subagents on the strongest model. Spawn more when the arena covers multiple design directions. Same model N times when the work is generation-bound rather than judgment-sensitive. | ||
| 3. Pick the runners. Default to three host subagents on the strongest model. Add bridged runners per [the bridge](../interrogate/references/bridge.md). Spawn more when the arena covers multiple design directions. Same model N times when the work is generation-bound rather than judgment-sensitive. |
There was a problem hiding this comment.
When a different-family CLI is allowlisted and /arena (or /architect through arena) produces code, this adds that CLI as a candidate, while the next phase requires every candidate to write its artifact to an isolated output path. The mandatory bridge commands explicitly prohibit writes, so the bridged runner cannot create the artifact that Phase D must compare and will either drop out or return uncaptured prose; use bridged CLIs only for the read-only Phase C judge, or define a stdout/patch capture protocol for candidates.
AGENTS.md reference: AGENTS.md:L15-L15
Useful? React with 👍 / 👎.
Review panels (interrogate, arena, architect, reflect) can add reviewers from other model families by calling their CLIs headless, but only CLIs listed in ~/.config/tstack/bridge. Off by default. Also removes the guide illustrations.
Verified live in a scratch project: bridge off (3 lens reviewers, "Bridge: off"), codex only (an OpenAI reviewer ran, claude/copilot never called), and a listed CLI that failed (dropped and named, verdict still delivered). Stacked on #3.
🤖 Generated with Claude Code