Difference Between Adversarial and Normal Review in Codex: A Complete Guide

Adversarial review employs a skeptical prompt to challenge implementation assumptions and design trade-offs, while normal review provides a standard read-only analysis of bugs and style issues; both commands use the same underlying engine but differ in intent, steerability, and output format.

The openai/codex-plugin-cc repository provides two distinct code review modes that share the same execution engine but serve fundamentally different purposes. While both commands invoke the same companion script at plugins/codex/scripts/codex-companion.mjs, they load different prompts that shape how Codex analyzes your code. Understanding these distinctions helps you choose the right tool for routine sanity checks versus high-stakes design validation.

Core Architectural Differences

Purpose and Intent

Normal review (/codex:review) provides a read-only code review that checks for bugs, style issues, and basic correctness. It serves as a quick sanity check before merging changes.

Adversarial review (/codex:adversarial-review) provides a steerable, adversarial review that questions implementation choices, design trade-offs, and hidden assumptions. According to the source code, this mode is explicitly designed to "break confidence" rather than validate the change, as noted in plugins/codex/commands/adversarial-review.md at lines 8-11.

Prompt Engineering

The primary distinction lies in the prompt files. Normal review uses the generic Codex reviewer prompt, while adversarial review uses a dedicated prompt located at plugins/codex/prompts/adversarial-review.md. This adversarial prompt includes specialized sections such as <operating_stance>, <attack_surface>, and <review_method> that drive Codex to adopt a skeptical stance and actively look for failure modes.

Command Definitions

Each command is defined in separate metadata files within the repository:

• Normal review: Defined in plugins/codex/commands/review.md
• Adversarial review: Defined in plugins/codex/commands/adversarial-review.md, which includes the setting disable-model-invocation: true and a distinct description making the UI display "Run a Codex review that challenges the implementation approach"

Key Functional Differences

Steerability and Focus Text

Normal review accepts no extra focus text—the review is fully automatic based on the target selection. Adversarial review, however, accepts focus text after the flags, letting you highlight specific risk areas. For example, you can append instructions like "look for race conditions" or "challenge the error-handling path" to direct the review’s attention.

Output Contracts

The output formats differ significantly:

• Normal review: Returns Codex’s raw review output verbatim as unstructured text
• Adversarial review: Returns a structured adversarial report following a JSON schema defined in the <structured_output_contract> section of the adversarial prompt. This output emphasizes failure scenarios, concrete mitigations, and质疑 design assumptions

Review Target Selection

Both commands support the same target selection options (working-tree, branch, or --base). However, only adversarial review can accept additional focus text to narrow the scope of skepticism.

Implementation in Source Code

The architectural choices ensure that while the underlying review engine is the same Codex binary, the adversarial mode changes the prompt and therefore the nature of the feedback. Both commands invoke the same companion script (codex-companion.mjs) but with different sub-commands (adversarial-review vs review). The script loads the appropriate prompt from the plugins/codex/prompts/ folder based on the sub-command invoked.

Practical Usage Examples

Running a Standard Review

/codex:review --base main

# or in the background

/codex:review --background

This returns a conventional review of all changes between main and the current HEAD.

Running an Adversarial Review

/codex:adversarial-review

# With a focus on a specific risk area

/codex:adversarial-review --base main challenge whether this caching and retry design is safe

# In the background

/codex:adversarial-review --background look for race conditions and question the chosen approach

This returns a structured JSON report that emphasizes potential failure modes and assumptions.

Programmatic Invocation

For advanced scripts, you can invoke either mode programmatically using Node.js:

const { execSync } = require('child_process');

// Standard review
execSync(`node "${process.env.CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" review --base main`, { stdio: 'inherit' });

// Adversarial review with focus
execSync(`node "${process.env.CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" adversarial-review --base main "challenge the error-handling path"`, { stdio: 'inherit' });

Summary

• Normal review (/codex:review) provides read-only feedback on bugs and style using the standard prompt, defined in plugins/codex/commands/review.md
• Adversarial review (/codex:adversarial-review) uses a skeptical prompt from plugins/codex/prompts/adversarial-review.md to challenge assumptions and accepts optional focus text for targeted analysis
• Both commands invoke plugins/codex/scripts/codex-companion.mjs but load different sub-commands and prompts
• Adversarial review outputs a structured JSON report emphasizing failure scenarios, while normal review returns raw text
• Neither mode applies patches; both are review-only operations

Frequently Asked Questions

When should I use adversarial review instead of normal review?

Use adversarial review when pressure-testing design decisions, analyzing safety-critical changes, or when you need Codex to actively look for hidden failure modes rather than validate correctness. Use normal review for routine pre-merge sanity checks and standard bug detection.

Can adversarial review apply patches or fix code automatically?

No. Both adversarial and normal review are review-only operations that never apply patches. The adversarial mode explicitly frames the review to "break confidence" and question the implementation, but it does not modify your codebase.

How do I focus the adversarial review on specific risk areas?

Append your focus text after the command flags. For example: /codex:adversarial-review --base main "challenge the concurrency model". This steerability allows you to direct Codex’s skeptical analysis toward particular domains like race conditions, error handling, or security assumptions.

Do both review types support the same target selection options?

Yes. Both commands support selecting targets via working-tree, branch names, or the --base flag. The key difference is that adversarial review additionally accepts focus text after these options, while normal review does not.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}