Tribunal

Tribunal

A courtroom for work you are about to ship.

The reason this exists: a model that just built something is a bad reviewer of it. It carries the same assumptions it wrote the thing with, so its "critique" tends to be a polite list of nits. Asking a different model — with a different training and different blind spots — to attack the work surfaces things self-review structurally cannot.

But a hostile review alone is also not a verdict. Attackers overreach. They flag deliberate choices as bugs, invent problems the code already handles elsewhere, and pad findings to look thorough. Acting on an unchallenged accusation means "fixing" working things and breaking them.

So: prosecution, defense, and a blind judge. Five phases, starting with the one everybody forgets to name.

0. AUTHOR       Claude generated the work — code, a script, an architecture,
                an offer. Everything below follows from this.
1. PROSECUTOR   Codex — a different model — attacks it. Numbered charges.
2. DEFENSE      Claude answers every charge: admit, or deny with evidence.
3. JUDGE        A fresh Codex run sees charge/defense pairs with authorship
                stripped. Rules per charge: FIX / DISMISS / HUMAN DECISION.
4. EXECUTION    Claude repairs only what was ordered. Everything else is
                reported as dismissed, with the reason.

The roles are fixed, and the reason is the one thing worth remembering here: the author never prosecutes and never judges its own work. Claude is running this session, so Claude is the author and the defense; the outside voice has to come from somewhere else. Swap those around and this becomes a model reviewing itself with extra steps.

When the work was written by the user rather than by Claude — their own offer, their own plan — nothing about the phases changes. Claude simply defends as counsel instead of as author: it argues from what is in the files, and where a charge turns on intent it cannot verify, it says so. Those land on HUMAN DECISION, which is right, because only the person who wrote it knows what they meant.

Before you start

Check the tool exists. This skill needs the Codex CLI on the machine:

command -v codex && codex --version

Missing? Tell the user plainly:

npm install -g @openai/codex
codex login

An OpenAI account is required (a ChatGPT Plus/Pro plan or an API key). If they'd rather not install it, offer the degraded fallback described at the bottom — but say clearly that it is weaker, because the whole value here is that the critic is a different model.

Decide what is on trial. In order of preference:

1. The user named files or a folder — use that.
2. Work Claude produced in this conversation — use those paths.
3. A git repo with uncommitted work — git status --short and git diff, and say which files you picked.

State the scope in one line before proceeding, so a wrong guess costs a sentence instead of five minutes of trial over the wrong material:

Na ławie: src/auth.ts, src/session.ts — 340 linii.

The user is the only one who can catch that early, and they cannot catch what they were not shown.

Set up a working directory so the artifacts survive and can be re-read:

mkdir -p .tribunal

Use .tribunal/ in the project root. Mention it to the user; suggest gitignoring it if the project is a repo.

Phase 1 — Prosecutor

Write the prompt to a file rather than passing it as a shell argument. Prompts contain quotes, backticks and newlines that shell quoting mangles, and a mangled prompt produces a confidently wrong review.

Build .tribunal/1-prosecutor-prompt.md from references/prosecutor.md, filling in the context, the paths, and the user's focus if they gave one. Then:

codex exec -s read-only --skip-git-repo-check -C "$(pwd)" \
  -o .tribunal/2-charges.md - < .tribunal/1-prosecutor-prompt.md

-s read-only matters: the prosecutor reads and reasons, it never edits. -o writes the final message to a clean file with none of the progress chatter.

This takes minutes, not seconds, on real work. Run it with a generous timeout (600000 ms) or in the background — do not let a 2-minute default kill a review that was almost done.

Read .tribunal/2-charges.md. If it came back empty or the command failed, show the user the actual error instead of inventing charges.

Phase 2 — Defense

Answer every single charge. A charge you skip becomes a charge the judge never sees, which quietly turns the skill back into "one model's opinion".

For each one, write to .tribunal/3-defense.md:

### Charge 3
**Position:** ADMIT | DENY | PARTIAL
**Argument:** ...
**Evidence:** path/to/file.ts:88-104 — what is actually there

Rules that make the defense worth having:

• Verify before you answer. Open the file and look. A defense written from memory of what you intended to build is worthless — the prosecutor read the real thing.
• Admit freely. There is no penalty here for being wrong, and a false denial that survives to the judge is how a real bug ships.
• Deny only with a location. "That's handled elsewhere" without a path is not a defense, and a good judge will treat it as a concession.
• PARTIAL is often the honest answer: the charge points at something real but overstates the impact or the fix.

Phase 3 — Judge

The judge must not know who wrote what. If it learns that the accusations came from a rival model and the defense from the model on trial, it starts scoring reputations instead of arguments.

So when you build .tribunal/4-judge-prompt.md from references/judge.md:

• Label the sides only as CHARGE and RESPONSE.
• Strip every mention of Claude, Codex, GPT, OpenAI, Anthropic, "the model", "the assistant", "prosecutor", "defense".
• Do not carry over the prosecutor's confidence scores or severity labels. Let the judge weigh the argument, not the swagger it was delivered with.

codex exec -s read-only --skip-git-repo-check -C "$(pwd)" \
  -o .tribunal/5-verdict.md - < .tribunal/4-judge-prompt.md

Three possible rulings per charge:

HUMAN DECISION is the default when the judge cannot decide from evidence in the files. This is deliberate. A judge that guesses in order to look decisive will order fixes to things that were fine, and the user loses trust in the whole mechanism. Being told "you need to decide this one, here's the tension" is more useful than a confident coin flip.

Phase 4 — Execution

Repair only what the judge marked FIX. Not the DISMISSED ones you privately still agree with, not the HUMAN DECISION ones you have an opinion about. The user consented to a mechanism; silently overruling it makes the verdict theatre.

Then present one table — this is the whole point of the exercise, the thing the user actually reads:

| # | Charge (short) | Ruling | Status |
|---|---|---|---|
| 1 | Brak obsługi pustej odpowiedzi API | FIX | ✅ naprawione — `api.ts:47` |
| 2 | Hasło w logach | DISMISS | ⛔ obrona: maskowane w `logger.ts:22` |
| 3 | Retry może zdublować zamówienie | HUMAN DECISION | ⚠️ Twoja decyzja |

Below the table, expand only the HUMAN DECISION rows: what each side argued, and what the user is actually choosing between. Two or three sentences each. Those rows are the deliverable — they are the things a review of any kind would otherwise bury.

Close with the artifact paths so the user can read the raw material if they want to argue with it.

Rounds

One trial is the default and is usually enough.

If the user asks for more rounds, a second round is not a re-run of the same trial. It re-prosecutes only the charges that were fixed, asking one question: did the repair actually work, or did it move the problem? Re-running the full trial mostly regenerates the same dismissed charges and burns minutes for nothing.

Stop when a round produces no new FIX rulings, and say so.

Working on non-code

Everything above holds for an offer, a landing page, a client document, a spreadsheet, a plan. Only two things change:

• Point the prosecutor at what makes that artifact fail — a promise that cannot be kept, a price that ignores an obvious cost, a claim with no basis, a step the reader cannot actually perform, a missing case in the data.
• Tell both the prosecutor and the judge to write for a non-technical reader: plain sentences, no jargon, and every claim tied to a specific place in the document.

The four phases do not change. Neither does the reason the mechanism works.

Language

Answer the user in the language they wrote to you in. The Codex prompts in references/ instruct the prosecutor and judge to do the same — if the user writes Polish, the whole trial runs in Polish.

If Codex is unavailable

Ask before falling back, because the fallback changes what the user is getting.

The fallback: run the prosecutor as a Claude subagent with the same prompt from references/prosecutor.md, in a fresh context so it has not seen the work being built. Then judge with a second, separate subagent.

Say plainly what is lost: same model, same training, same blind spots. A fresh context removes some of the self-review bias, but not the structural part. It is better than nothing and clearly worse than a real second model.