# Difference Between Adversarial and Normal Review in Codex: A Complete Guide

> Understand the key differences between adversarial and normal review in Codex. Learn how each approach challenges code with distinct intents and outputs.

- Repository: [OpenAI/codex-plugin-cc](https://github.com/openai/codex-plugin-cc)
- Tags: deep-dive
- Published: 2026-07-13

---

**Adversarial review employs a skeptical prompt to challenge implementation assumptions and design trade-offs, while normal review provides a standard read-only analysis of bugs and style issues; both commands use the same underlying engine but differ in intent, steerability, and output format.**

The openai/codex-plugin-cc repository provides two distinct code review modes that share the same execution engine but serve fundamentally different purposes. While both commands invoke the same companion script at `plugins/codex/scripts/codex-companion.mjs`, they load different prompts that shape how Codex analyzes your code. Understanding these distinctions helps you choose the right tool for routine sanity checks versus high-stakes design validation.

## Core Architectural Differences

### Purpose and Intent

**Normal review** (`/codex:review`) provides a **read-only** code review that checks for bugs, style issues, and basic correctness. It serves as a quick sanity check before merging changes.

**Adversarial review** (`/codex:adversarial-review`) provides a **steerable, adversarial** review that questions implementation choices, design trade-offs, and hidden assumptions. According to the source code, this mode is explicitly designed to "break confidence" rather than validate the change, as noted in [`plugins/codex/commands/adversarial-review.md`](https://github.com/openai/codex-plugin-cc/blob/main/plugins/codex/commands/adversarial-review.md) at lines 8-11.

### Prompt Engineering

The primary distinction lies in the prompt files. Normal review uses the generic Codex reviewer prompt, while adversarial review uses a dedicated prompt located at [`plugins/codex/prompts/adversarial-review.md`](https://github.com/openai/codex-plugin-cc/blob/main/plugins/codex/prompts/adversarial-review.md). This adversarial prompt includes specialized sections such as `<operating_stance>`, `<attack_surface>`, and `<review_method>` that drive Codex to adopt a skeptical stance and actively look for failure modes.

### Command Definitions

Each command is defined in separate metadata files within the repository:

- **Normal review**: Defined in [`plugins/codex/commands/review.md`](https://github.com/openai/codex-plugin-cc/blob/main/plugins/codex/commands/review.md)
- **Adversarial review**: Defined in [`plugins/codex/commands/adversarial-review.md`](https://github.com/openai/codex-plugin-cc/blob/main/plugins/codex/commands/adversarial-review.md), which includes the setting `disable-model-invocation: true` and a distinct description making the UI display "Run a Codex review that challenges the implementation approach"

## Key Functional Differences

### Steerability and Focus Text

Normal review accepts no extra focus text—the review is fully automatic based on the target selection. Adversarial review, however, accepts **focus text** after the flags, letting you highlight specific risk areas. For example, you can append instructions like "look for race conditions" or "challenge the error-handling path" to direct the review’s attention.

### Output Contracts

The output formats differ significantly:

- **Normal review**: Returns Codex’s raw review output verbatim as unstructured text
- **Adversarial review**: Returns a **structured adversarial report** following a JSON schema defined in the `<structured_output_contract>` section of the adversarial prompt. This output emphasizes failure scenarios, concrete mitigations, and质疑 design assumptions

### Review Target Selection

Both commands support the same target selection options (working-tree, branch, or `--base`). However, only adversarial review can accept additional focus text to narrow the scope of skepticism.

## Implementation in Source Code

The architectural choices ensure that while the underlying review engine is the same Codex binary, the adversarial mode changes the prompt and therefore the nature of the feedback. Both commands invoke the same companion script (`codex-companion.mjs`) but with different sub-commands (`adversarial-review` vs `review`). The script loads the appropriate prompt from the `plugins/codex/prompts/` folder based on the sub-command invoked.

## Practical Usage Examples

### Running a Standard Review

```bash
/codex:review --base main

# or in the background

/codex:review --background

```

This returns a conventional review of all changes between `main` and the current HEAD.

### Running an Adversarial Review

```bash
/codex:adversarial-review

# With a focus on a specific risk area

/codex:adversarial-review --base main challenge whether this caching and retry design is safe

# In the background

/codex:adversarial-review --background look for race conditions and question the chosen approach

```

This returns a structured JSON report that emphasizes potential failure modes and assumptions.

### Programmatic Invocation

For advanced scripts, you can invoke either mode programmatically using Node.js:

```javascript
const { execSync } = require('child_process');

// Standard review
execSync(`node "${process.env.CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" review --base main`, { stdio: 'inherit' });

// Adversarial review with focus
execSync(`node "${process.env.CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" adversarial-review --base main "challenge the error-handling path"`, { stdio: 'inherit' });

```

## Summary

- **Normal review** (`/codex:review`) provides read-only feedback on bugs and style using the standard prompt, defined in [`plugins/codex/commands/review.md`](https://github.com/openai/codex-plugin-cc/blob/main/plugins/codex/commands/review.md)
- **Adversarial review** (`/codex:adversarial-review`) uses a skeptical prompt from [`plugins/codex/prompts/adversarial-review.md`](https://github.com/openai/codex-plugin-cc/blob/main/plugins/codex/prompts/adversarial-review.md) to challenge assumptions and accepts optional focus text for targeted analysis
- Both commands invoke `plugins/codex/scripts/codex-companion.mjs` but load different sub-commands and prompts
- Adversarial review outputs a structured JSON report emphasizing failure scenarios, while normal review returns raw text
- Neither mode applies patches; both are review-only operations

## Frequently Asked Questions

### When should I use adversarial review instead of normal review?

Use adversarial review when pressure-testing design decisions, analyzing safety-critical changes, or when you need Codex to actively look for hidden failure modes rather than validate correctness. Use normal review for routine pre-merge sanity checks and standard bug detection.

### Can adversarial review apply patches or fix code automatically?

No. Both adversarial and normal review are **review-only** operations that never apply patches. The adversarial mode explicitly frames the review to "break confidence" and question the implementation, but it does not modify your codebase.

### How do I focus the adversarial review on specific risk areas?

Append your focus text after the command flags. For example: `/codex:adversarial-review --base main "challenge the concurrency model"`. This steerability allows you to direct Codex’s skeptical analysis toward particular domains like race conditions, error handling, or security assumptions.

### Do both review types support the same target selection options?

Yes. Both commands support selecting targets via working-tree, branch names, or the `--base` flag. The key difference is that adversarial review additionally accepts focus text after these options, while normal review does not.