git:20261016.2c3753e to git:20261025.83f68e3

4 added, 6 removed. Audit A to A.

---

name: codex-review

- description: Run one read-only external Codex review through T3 Code when available, otherwise ACP, and assess its findings. Use only when explicitly invoked or requested by name, including from another skill. Use codex-review-loop for iterative remediation.

+ description: Run one read-only external Codex review through T3 Code inside T3, or direct ACP in other harnesses. Use only when explicitly requested. Use codex-review-loop for review and remediation.

---

# Codex Review

- Run exactly one model-bearing review prompt in one fresh Codex root task or session. Permitted inspector children remain within the root round. Capability and authentication preflight do not count. Do not edit, remediate, publish, retry, follow up, or invoke another review. The caller owns scope and assessment.

- Read [code-review](../code-review/SKILL.md) for the frozen target, review lenses, confidence threshold, priorities, and output contract. Read [the shared external runtime](../code-review/references/external-runtime.md) to prepare the complete frozen request and select T3 Code or ACP, then read the selected runtime's reference. Explicit invocation authorizes only the minimum non-secret transfer and the documented T3 context exception; exclude credentials and unrelated data.

+ Run one advisory Codex review. Read [code-review](../code-review/SKILL.md) for scope and review lenses, then the [shared external runtime](../code-review/references/external-runtime.md) and the applicable transport reference.

- Select the requested Codex provider, not a substitute. In ACP, use the shared client with `--agent codex` and explicit `--timeout-seconds` containing the caller-selected positive finite budget. In T3, use a fresh `delegate_task` under its completion, budget, and strict terminal validation rules. Do not invoke this skill recursively inside the reviewer prompt.

+ Inside T3 Code, coordinate through T3 delegation. Outside T3, use the Codex ACP peer. Keep the handoff to requirements, repository/target, read-only scope, and important exclusions. Let the reviewer discover changes with Git and read source itself. Do not send diffs, source dumps, snapshots, or manifests, or substitute another provider.

- Assess valid completed findings and normalize to [the canonical schema](../code-review/references/review-result.schema.json). For embedded reviews or requested JSON, return one canonical `REVIEW_RESULT`. Otherwise give accepted and partial findings, declined count, inspected surface, runtime, and material limits in plain language. Skip stock headings, repeated summaries, and raw logs. Save a user report only if requested. Never commit, push, publish comments, or make remote writes without separate authorization. Clean task-owned scratch under the selected runtime's lifecycle rules.

+ Accept ordinary review text or structured output. Assess findings against source, retain useful partial findings, and state substantive limits. Formatting, missing bookkeeping fields, and Markdown do not fail a review. Do not edit or start another review within this single invocation. Do not commit, push, publish comments, or make remote writes without authorization. Clean task-owned scratch after assessment and report findings and limits concisely.