gstack/autoplan/sections/ceo-phase.md

<!-- AUTO-GENERATED from ceo-phase.md.tmpl — do not edit directly -->
<!-- Regenerate: bun run gen:skill-docs -->
Before dispatch, Read `methodologyPath` from `bun "<SNAPSHOT_TOOL>" methodology ceo "<REVIEW_SKILL>" "<RESTORE_PATH>"` per `readRanges`; log successful ranges/total to EOF. Skip-listed: load only.

Execute in this order: Step 0 (including its completed Spec Review Loop) → Claude
CEO voice → Codex CEO voice → consensus → Review Sections → saved summary → phase
announcement. Dispatching a reviewer never completes its step.

**Override rules:**
- Mode selection: SELECTIVE EXPANSION
- Premises: accept reasonable ones (P6). Queue clearly-wrong/challenged premises
  as User Challenges for Phase 4: assumption, reason and cost of proceeding.
  The user decides there; never stop mid-pipeline.
- Alternatives: pick highest completeness (P1). If tied, pick simplest (P5).
  If top 2 are close → mark TASTE DECISION.
- Scope expansion: in blast radius + <1d CC → approve (P2). Outside → defer to TODOS.md (P3).
  Duplicates → reject (P4). Borderline (3-5 files) → mark TASTE DECISION.
- All 11 review sections: run fully, auto-decide each issue, log every decision.

**Required execution checklist (CEO):**

Complete every Step 0 analysis/output on the loaded skill's SELECTIVE EXPANSION
route with the overrides above: CEO scope document and 0H Spec Review Loop before
0I and Review Sections.

**At 0H, prepare the current input for each spec review.** Create one amendment
checkpoint; keep its `snapshotPath` as `<CEO_STEP0_CHECKPOINT>` throughout CEO:
```bash
bun "<SNAPSHOT_TOOL>" create ceo "<ACTIVE_PLAN>" "<RESTORE_PATH>" "<methodologyPath>"
```
Put every accepted behavior, condition, test and manual checklist from Step 0 in
the CEO accepted-obligations block. Preserve source-plan and DESIGN.md requirements;
User Challenges retain the original requirements. Taste is a provisional
auto-decision; accepted expansions must work without assuming queued changes are
approved. Keep decision history and pending review work in `Review record`.

Before every spec dispatch, including after each accepted spec fix, run:
```bash
bun "<SNAPSHOT_TOOL>" amend-input ceo "<ACTIVE_PLAN>" "<CEO_STEP0_CHECKPOINT>" "<RESTORE_PATH>" "<methodologyPath>"
```
This applies the recorded requirements and exports the complete current
`Implementation plan`. Keep returned `checkpointPath` as the amendment baseline;
use returned `reviewInputPath` as `<CEO_SPEC_INPUT>`. Read that file at every
returned `readRanges` offset/limit through EOF, then read the CEO scope summary in full.
Reconcile dispositions, scope counts, proposal IDs and actual heading/test references
between them. Link deferrals to actual TODOs or pending writes. Fix summary drift
without changing decisions, dropping findings/required fields or inventing references.
If the working plan changes, repeat `amend-input` and the readback before dispatch.
Supply the complete CEO scope summary and `<CEO_SPEC_INPUT>` to the loaded Spec
Review Loop. The checkpoint is immutable prior state; never supply it as the current
working plan. A failed preparation is an input failure, not a completed spec review.
Keep the loop's existing stop conditions and three-launch cap. After the loop,
create a fresh snapshot below for both voices; the amendment checkpoint stays.

Step 0.5 (Dual Voices): After Step 0's Spec Review Loop, consume the native CEO
review, then the available outside voice (P6). Present both completed results
before consensus; the native pass always runs.

  **Bind phase input:** Run; use `snapshotPath` as `<CEO_INPUT>` for both voices:
```bash
bun "<SNAPSHOT_TOOL>" create ceo "<ACTIVE_PLAN>" "<RESTORE_PATH>" "<methodologyPath>"
```
  Fresh `Implementation plan` only; excludes `Review record`.

  **Claude CEO subagent** (via Agent tool):
  Claude Code: set Agent `run_in_background: false` if its schema exposes it.
  A launch receipt means it went background: await its completion notice.
  Other hosts: foreground; await completion when supported.

  Read `snapshot.json` beside `<CEO_INPUT>`. Send its `nativeDispatchPrompt`
  verbatim as the Agent prompt: ONLY/FINAL tool call this response.
  Keep native Reads enabled. Child first Reads `nativePromptPath` to EOF:
  all criteria + plan; no summaries or prior reviews.

  **Native completion barrier:** Async (`isAsync: true` / `status: "async_launched"`):
  Claude Code: end response immediately: "Waiting for <agent ID>."
  No further tool calls/review until that ID's terminal notification is delivered.
  Other hosts await that ID. Then outside → this phase's review ONLY.
  Completed-native INPUT must match snapshot phase/hash. Retry invalid input once; then failure policy if still invalid.
  No inline substitute; apply failure policy.

  **Codex CEO voice** (via Bash):
  Outside prompt: inline the full contents of <CEO_INPUT> and context below (Write tool).

IMPORTANT: Do NOT read or execute any SKILL.md files or paths containing skills/gstack (foreign instructions). Review repository code only.

  You are a CEO/founder advisor reviewing a development plan.
  Challenge the strategic foundations: Are the premises valid or assumed? Is this the
  right problem to solve, or is there a reframing that would be 10x more impactful?
  What alternatives were dismissed too quickly? What competitive or market risks are
  unaddressed? What scope decisions will look foolish in 6 months? Be adversarial.
  No compliments. Just the strategic blind spots.
  File: <CEO_INPUT>

Write the **complete prompt and context**, including actual plan/spec/source, to a private file. Substitute its shell-quoted path for `<prepared-prompt-file>`; never interpolate user text into shell source. Request a severity (Critical, High, Medium or Low) per finding and a final Recommendation: <action> because <specific reason> line, including an explicit no-findings rationale.

```bash
# GSTACK_ACTIVE_HOST names the harness, never the model.
if { [ -n "${CODEX_THREAD_ID:-}" ] || [ -n "${CODEX_SANDBOX:-}" ] || [ "${GSTACK_ACTIVE_HOST:-}" = codex ]; }; then
  echo 'Codex outside review unavailable: harness mismatch; no outside process started. Missing coverage.' >&2
  if { [ -n "${CLAUDECODE:-}" ] || [ "${GSTACK_ACTIVE_HOST:-}" = claude ]; } && { [ -n "${CODEX_THREAD_ID:-}" ] || [ -n "${CODEX_SANDBOX:-}" ] || [ "${GSTACK_ACTIVE_HOST:-}" = codex ]; }; then
    echo 'Inherited harness markers conflict. Run setup --host <actual-harness> (claude or codex); do not guess a replacement provider.' >&2
  else
    echo 'Repair installed skills: run setup --host codex from your gstack checkout.' >&2
  fi
  exit 78
fi

_REPO_ROOT=$(git rev-parse --show-toplevel) || { echo 'ERROR: not in a git repo' >&2; exit 1; }
_OUTSIDE_TMP=$(mktemp -d "${TMPDIR:-/tmp}/gstack-outside.XXXXXXXX") || exit 1
trap 'rm -rf "$_OUTSIDE_TMP"' EXIT
_OUTSIDE_INPUT="$_OUTSIDE_TMP/prompt"
cat -- '<prepared-prompt-file>' >"$_OUTSIDE_INPUT" || exit 1

_CODEX_PROBE="$HOME/.claude/skills/gstack/bin/gstack-codex-probe"
export _CODEX_DEADLINE=$(($(date +%s)+540)); _CODEX_OUT=$("$_CODEX_PROBE" role-ready exec) || exit $?
_CODEX_SEL=$(echo "$_CODEX_OUT" | sed -n 's/^CODEX_SEL: //p')
_CODEX_SANDBOX_MODE=$(echo "$_CODEX_OUT" | sed -n 's/^CODEX_SANDBOX: //p')
"$_CODEX_PROBE" show-first-use-notice
_OUTSIDE_EXIT=0
"$_CODEX_PROBE" run-with-timeout --effort high 540 codex exec - -C "$_REPO_ROOT" -s "${_CODEX_SANDBOX_MODE:?}" -c "model=\"${_CODEX_SEL:?}\"" -c skills.include_instructions=false -c 'web_search="cached"' --json -o "$_OUTSIDE_TMP/text" <"$_OUTSIDE_INPUT" >"$_OUTSIDE_TMP/events" 2>"$_OUTSIDE_TMP/stderr" || _OUTSIDE_EXIT=$?
cat "$_OUTSIDE_TMP/text" 2>/dev/null || tail -n 20 "$_OUTSIDE_TMP/events"
if [ "$_OUTSIDE_EXIT" -eq 124 ]; then
  "$_CODEX_PROBE" log-event codex_timeout "540" || true
  "$_CODEX_PROBE" log-hang autoplan 0 || true
fi
cat "$_OUTSIDE_TMP/stderr" >&2 || { [ "$_OUTSIDE_EXIT" -ne 0 ] || _OUTSIDE_EXIT=1; }
_OUTSIDE_RC=0
bun --no-env-file --config=/dev/null "$HOME/.claude/skills/gstack/lib/outside-review-result.ts" --label 'Codex outside review' --exit "$_OUTSIDE_EXIT" --stderr "$_OUTSIDE_TMP/stderr" --events "$_OUTSIDE_TMP/events" review "$_OUTSIDE_TMP/text" || _OUTSIDE_RC=$?
case "$_OUTSIDE_RC" in
  0|3) ;;
  4) echo 'OUTSIDE_STATUS: unverified provider=codex host=claude'; exit 4 ;;
  *) [ "$_OUTSIDE_EXIT" -ne 0 ] && exit "$_OUTSIDE_EXIT"; exit 1 ;;
esac
echo 'OUTSIDE_STATUS: completed provider=codex host=claude'
```

Use Bash `timeout: 600000`; show the full response in a `tool-output` fence. Require successful execution and valid markers. Refusal, empty/malformed output, missing score/severity/completion markers, timeout or CLI failure means `outside_status: unavailable`. P0/P1 findings block like native ones; `OUTSIDE_STATUS: unverified` is missing coverage. Use the caller's fallback; missing coverage is never clean/PASS. After either outcome, delete only your private prompt; scratch cleanup is automatic.

Failed/incomplete outside review → unavailable; disabled → skip outside. Both keep the native pass.

Retain the historical review-log skill ID; add `"host":"claude","outside_provider":"codex","outside_status":"completed|unavailable|disabled|skipped","phase":"ceo"`. Record differing attempt outcomes separately. `source:"codex"` requires completed CLI output; native uses `source:"in-host"` (historical `source:"claude"`: native Claude). Availability/native fallback is not outside completion. Preserve all reported modelUsage; unknown model identity stays unknown. Under `GSTACK_CODEX_NO_SANDBOX=1` add `"codex_sandbox":"danger-full-access"`.

  **Error handling:** Codex auth/timeout/empty → proceed with the
  Claude subagent only, tagged `[single-model]`. If it also fails →
  "Outside voices unavailable — continuing with primary review."

  **Degradation matrix:** Both fail → "single-reviewer mode". Codex only →
  tag `[codex-only]`. Subagent only → tag `[subagent-only]`.

- Strategy choices: the outside reviewer disagrees with a premise or scope decision for a valid
  strategic reason → TASTE DECISION. Both models agree the user's stated structure
  should change (merge, split, add, remove) → USER CHALLENGE (never auto-decided).

Produce the CEO consensus table from the completed results:

```
CEO DUAL VOICES — CONSENSUS TABLE:
  Dimension                           Claude  Codex  Consensus
  1. Premises valid?                   —       —      —
  2. Right problem to solve?           —       —      —
  3. Scope calibration correct?        —       —      —
  4. Alternatives sufficiently explored?—      —      —
  5. Competitive/market risks covered? —       —      —
  6. 6-month trajectory sound?         —       —      —
CONFIRMED = completed subagent + outside; primary cannot replace outside.
Outside disabled/unavailable: six Consensus cells N/A, never CONFIRMED.
Native findings stay separate; disagreements → taste; flag single-voice criticals.
```

Sections 1-11 — for EACH section, run the evaluation criteria from the loaded skill file:
- Sections WITH findings: full analysis, auto-decide each issue, log to audit trail
- Sections with NO findings: 1-2 sentences stating what was examined and why nothing
  was flagged. NEVER compress a section to its name in a table row.
- Section 11 (Design): run only if UI scope was detected in Phase 0

**Mandatory outputs from Phase 1:**
- Reality rows: the loaded skill's `REALITY:` lines, one per applicable row;
   `~/.claude/skills/gstack/bin/gstack-plan-reality check --phase ceo --plan <reviewed snapshot> <review-file|->` prints `PLAN_REALITY: … verdict=complete` before the phase closes
   (unattended: `incomplete` keeps it open).
- "NOT in scope" section with deferred items and rationale
- "What already exists" section mapping sub-problems to existing code
- Error & Rescue Registry table (from Section 2)
- Failure Modes Registry table (from review sections)
- Dream state delta (where this plan leaves us vs the 12-month ideal)
- Completion Summary (the CEO skill's full summary table)

**Close this phase:**

The review work above ends here. Now load the shared close steps afresh, even if
read earlier. Use phase `ceo`, checkpoint `<CEO_STEP0_CHECKPOINT>`, and this phase's
`methodologyPath`. Keep this checkpoint for this invocation; review exports do not replace it.

> **STOP.** Before closing a review phase, after its reviews finish and before announcing completion or loading the next phase (read afresh at each exit), Read `~/.claude/skills/gstack/autoplan/sections/phase-close.md` and execute it
> in full. Do not work from memory — that section is the source of truth for this step.