ask-gpt

The reviewer never reads the defence.

The obvious implementation sends the second model everything: the task, the code, and the first model’s summary of what it changed. That summary is the problem. It is a closing argument — it frames every decision in the most favourable light available, and a reviewer who reads it starts from the author’s account of the work rather than the work.

So the review path is transcript-blind by construction. GPT gets the original task and the diff, and never Claude’s narration of what it did. The general question path (askgpt) does attach the dialogue, because a question about a conversation needs the conversation — but review and conversation are separate entry points over one shared layer, and only one of them carries the transcript.

The honest framing matters as much as the mechanism. It is a second-model advisory channel, not an independent gate: Claude still chooses when to run it, what it covers, and how the answer is relayed. The tool’s own instructions say so in those words, so that a review coming back clean is never reported as “independent review passed.”

The boundary was measured, and the README was wrong.

Codex runs with a read-only sandbox flag, and the natural reading of that is that it cannot see outside the repository. The first version of the documentation said something close to that. Then it got tested: on Codex 0.148.0-alpha.9, a run started with -s read-only inside this project read a file in the home directory, outside the working tree entirely.

read-only restricts writes. It does not confine reads. That makes the honest statement a much less comfortable one — treat everything the user account can read as reachable, including SSH keys, cloud credentials, and other repositories — and it is now the first section of the README rather than a footnote. There is no available setting that closes the gap, so the documentation says to use a container instead of pretending otherwise.

The correction is the part worth keeping. A security claim that was inherited from a flag’s name, believed, written down, and then contradicted by a two-minute experiment is the ordinary case, not an unusual one.

No entropy filter, because entropy doesn’t work.

Before anything is uploaded, a scan halts the run on credential-shaped strings and on sensitive filenames — and it halts rather than quietly scrubbing, because a warning printed as the request goes out is not something anyone can act on. Two separate overrides exist for the two different boundaries: one for the payload being uploaded, one for the repository Codex reads directly.

The tempting refinement is an entropy filter to drop obvious placeholders and cut the false positives. It was measured on real and fake keys and it does not separate them: 3.7–4.9 bits per character for one, 4.7–5.0 for the other, fully overlapping. A run-length rule fares worse — it would suppress a key shaped like sk-abcdefghij0123456789ABCD, which is exactly what a placeholder pasted over a real key and forgotten looks like.

So there is no cleverness in that layer at all. For a security control, a filter that usually works is worse than no filter, and the tool errs toward noise you can override rather than silence you cannot see.

A stopping rule, because a critic never runs out.

An adversarial reviewer will always find something. Without a rule for when to stop, that turns into an infinite loop dressed as diligence, and every round costs real subscription quota.

The rule is written into the tool: fix findings that are severe and come with a concrete failure scenario; verify anything doubtful before acting, because a finding nobody can reproduce is not yet real; log the rest rather than implementing them. Accepted findings are recorded with the reason, so later reviews stop re-reporting them unless the code actually changed. Review output is evidence, not a work queue.