How Adversarial Review Differs From Standard Review in Codex

Adversarial review in Codex uses a specialized skeptic prompt to challenge implementation choices and expose hidden failure modes, while standard review provides a conventional read-only assessment of bugs and style issues.

The openai/codex-plugin-cc repository provides two distinct code review modalities that share the same underlying execution engine but serve fundamentally different purposes. While standard review acts as a automated sanity checker, adversarial review forces the model to adopt a skeptical stance and interrogate design assumptions. Understanding these differences helps teams choose the appropriate review strategy for safety-critical changes or complex architectural decisions.

Architectural Differences Between Review Modes

Purpose and Operating Stance

Standard review (/codex:review) provides a read-only assessment that checks for bugs, style violations, and basic correctness. It operates as a conventional linter-plus, validating that the code functions as intended without questioning the underlying approach.

Adversarial review (/codex:adversarial-review) provides a steerable, adversarial examination that questions implementation choices, design trade-offs, and hidden assumptions. According to the source code in plugins/codex/prompts/adversarial-review.md, this mode explicitly frames the review to "break confidence" rather than validate changes, instructing Codex to look for ways the code could fail.

Command Definitions and Metadata

The commands are defined in separate markdown files within the repository:

• Standard review: Defined in plugins/codex/commands/review.md
• Adversarial review: Defined in plugins/codex/commands/adversarial-review.md with the metadata flag disable-model-invocation: true

The adversarial command description explicitly tells the UI to display "Run a Codex review that challenges the implementation approach," signaling to users that this is not a typical validation pass.

Prompt Engineering and System Instructions

The fundamental difference lies in the prompt architecture. While both commands invoke the same underlying binary, they load distinct system instructions.

Standard review uses the generic Codex reviewer prompt, which frames the model as a helpful assistant identifying issues.

Adversarial review loads plugins/codex/prompts/adversarial-review.md, which contains specialized sections such as:

• <operating_stance>: Defines the skeptic persona
• <attack_surface>: Guides the model to identify vulnerable areas
• <review_method>: Dictates the interrogation methodology

These sections appear in the first 30 lines of the adversarial prompt file and fundamentally alter the model's behavior from cooperative validation to aggressive scrutiny.

Input Parameters and Steerability

Standard review accepts standard target selection flags (--base, --background) but cannot accept additional focus text. The review scope is determined entirely by the git diff boundaries.

Adversarial review accepts focus text after the flags, allowing users to highlight specific risk areas. For example:

/codex:adversarial-review --base main challenge whether this caching and retry design is safe

You can also run it in the background with focus:

/codex:adversarial-review --background look for race conditions and question the chosen approach

This steerability makes adversarial review particularly effective for pressure-testing specific design decisions or safety-critical code paths.

Output Contracts and Report Structure

Standard review returns Codex's raw review output verbatim, presenting findings in a conversational format suitable for quick sanity checks before merges.

Adversarial review returns a structured adversarial report conforming to a JSON schema defined in the <structured_output_contract> section of the adversarial prompt. This structured output emphasizes:

• Concrete failure scenarios
• Hidden assumptions
• Explicit mitigations required

The structured format enables programmatic consumption of the review results, making it suitable for integration into CI/CD pipelines that require formal risk documentation.

Runtime Implementation

Both commands invoke the same companion script located at plugins/codex/scripts/codex-companion.mjs, but pass different sub-commands:

• Standard review passes the review sub-command
• Adversarial review passes the adversarial-review sub-command

The script loads the appropriate prompt from the plugins/codex/prompts/ folder based on the sub-command, ensuring that while the execution engine remains identical, the prompt context switches between cooperative and adversarial modes.

You can invoke these programmatically via Node.js:

const { execSync } = require('child_process');

// Standard review
execSync(`node "${process.env.CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" review --base main`, { stdio: 'inherit' });

// Adversarial review with focus
execSync(`node "${process.env.CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" adversarial-review --base main "challenge the error-handling path"`, { stdio: 'inherit' });

Summary

• Adversarial review uses a specialized prompt in plugins/codex/prompts/adversarial-review.md to force a skeptical, failure-focused perspective, while standard review uses a generic prompt for conventional validation.
• Adversarial review accepts optional focus text to steer scrutiny toward specific risk areas, whereas standard review operates automatically on the diff scope.
• Adversarial review outputs a structured JSON report emphasizing failure modes, while standard review returns raw conversational output.
• Both commands invoke plugins/codex/scripts/codex-companion.mjs with different sub-commands but share the same underlying Codex binary.
• Neither mode applies patches; both are review-only operations, but adversarial review explicitly aims to "break confidence" in the implementation.

Frequently Asked Questions

Can standard review accept focus text like adversarial review?

No. Standard review defined in plugins/codex/commands/review.md does not support additional focus text after the flags. It reviews the entire diff scope automatically. Only adversarial review accepts focus text to steer the examination toward specific concerns like race conditions or security vulnerabilities.

Does adversarial review modify code or apply patches?

No. Both standard and adversarial review are strictly read-only operations. The adversarial command metadata in plugins/codex/commands/adversarial-review.md explicitly preserves the review-only constraint. The adversarial aspect refers to the skeptical tone of the feedback, not any modification of source files.

What file defines the adversarial prompt system instructions?

The adversarial prompt is defined in plugins/codex/prompts/adversarial-review.md. This file contains the <operating_stance>, <attack_surface>, and <review_method> sections that instruct Codex to adopt a skeptical stance and output structured JSON reports according to the <structured_output_contract> schema.

How do I run an adversarial review against a specific branch comparison?

Use the --base flag to specify the comparison branch, followed by optional focus text. For example:

/codex:adversarial-review --base main check for concurrency issues in the connection pool

You can also add --background to run the review asynchronously without blocking your terminal.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}