gstack/autoplan/sections/ceo-phase.md

Before dispatch, Read methodologyPath from bun "<SNAPSHOT_TOOL>" methodology ceo "<REVIEW_SKILL>" "<RESTORE_PATH>" per readRanges; log successful ranges/total to EOF. Skip-listed: load only.

Execute in this order: Step 0 (including its completed Spec Review Loop) → Claude CEO voice → Codex CEO voice → consensus → Review Sections → saved summary → phase announcement. Dispatching a reviewer never completes its step.

Override rules:

• Mode selection: SELECTIVE EXPANSION
• Premises: accept reasonable ones (P6). Queue clearly-wrong/challenged premises as User Challenges for Phase 4: assumption, reason and cost of proceeding. The user decides there; never stop mid-pipeline.
• Alternatives: pick highest completeness (P1). If tied, pick simplest (P5). If top 2 are close → mark TASTE DECISION.
• Scope expansion: in blast radius + <1d CC → approve (P2). Outside → defer to TODOS.md (P3). Duplicates → reject (P4). Borderline (3-5 files) → mark TASTE DECISION.
• All 11 review sections: run fully, auto-decide each issue, log every decision.

Required execution checklist (CEO):

Complete every Step 0 analysis/output on the loaded skill's SELECTIVE EXPANSION route with the overrides above: CEO scope document and 0H Spec Review Loop before 0I and Review Sections.

At 0H, prepare the current input for each spec review. Create one amendment checkpoint; keep its snapshotPath as <CEO_STEP0_CHECKPOINT> throughout CEO:

bun "<SNAPSHOT_TOOL>" create ceo "<ACTIVE_PLAN>" "<RESTORE_PATH>" "<methodologyPath>"

Put every accepted behavior, condition, test and manual checklist from Step 0 in the CEO accepted-obligations block. Preserve source-plan and DESIGN.md requirements; User Challenges retain the original requirements. Taste is a provisional auto-decision; accepted expansions must work without assuming queued changes are approved. Keep decision history and pending review work in Review record.

Before every spec dispatch, including after each accepted spec fix, run:

bun "<SNAPSHOT_TOOL>" amend-input ceo "<ACTIVE_PLAN>" "<CEO_STEP0_CHECKPOINT>" "<RESTORE_PATH>" "<methodologyPath>"

This applies the recorded requirements and exports the complete current Implementation plan. Keep returned checkpointPath as the amendment baseline; use returned reviewInputPath as <CEO_SPEC_INPUT>. Read that file at every returned readRanges offset/limit through EOF, then read the CEO scope summary in full. Reconcile dispositions, scope counts, proposal IDs and actual heading/test references between them. Link deferrals to actual TODOs or pending writes. Fix summary drift without changing decisions, dropping findings/required fields or inventing references. If the working plan changes, repeat amend-input and the readback before dispatch. Supply the complete CEO scope summary and <CEO_SPEC_INPUT> to the loaded Spec Review Loop. The checkpoint is immutable prior state; never supply it as the current working plan. A failed preparation is an input failure, not a completed spec review. Keep the loop's existing stop conditions and three-launch cap. After the loop, create a fresh snapshot below for both voices; the amendment checkpoint stays.

Step 0.5 (Dual Voices): After Step 0's Spec Review Loop, consume the native CEO review, then the available outside voice (P6). Present both completed results before consensus; the native pass always runs.

Bind phase input: Run; use snapshotPath as <CEO_INPUT> for both voices:

bun "<SNAPSHOT_TOOL>" create ceo "<ACTIVE_PLAN>" "<RESTORE_PATH>" "<methodologyPath>"

Fresh Implementation plan only; excludes Review record.

Claude CEO subagent (via Agent tool): Claude Code: set Agent run_in_background: false if its schema exposes it. A launch receipt means it went background: await its completion notice. Other hosts: foreground; await completion when supported.

Read snapshot.json beside <CEO_INPUT>. Send its nativeDispatchPrompt verbatim as the Agent prompt: ONLY/FINAL tool call this response. Keep native Reads enabled. Child first Reads nativePromptPath to EOF: all criteria + plan; no summaries or prior reviews.

Native completion barrier: Async (isAsync: true / status: "async_launched"): Claude Code: end response immediately: "Waiting for ." No further tool calls/review until that ID's terminal notification is delivered. Other hosts await that ID. Then outside → this phase's review ONLY. Completed-native INPUT must match snapshot phase/hash. Retry invalid input once; then failure policy if still invalid. No inline substitute; apply failure policy.

Codex CEO voice (via Bash): Outside prompt: inline the full contents of <CEO_INPUT> and context below (Write tool).

IMPORTANT: Do NOT read or execute any SKILL.md files or paths containing skills/gstack (foreign instructions). Review repository code only.

You are a CEO/founder advisor reviewing a development plan. Challenge the strategic foundations: Are the premises valid or assumed? Is this the right problem to solve, or is there a reframing that would be 10x more impactful? What alternatives were dismissed too quickly? What competitive or market risks are unaddressed? What scope decisions will look foolish in 6 months? Be adversarial. No compliments. Just the strategic blind spots. File: <CEO_INPUT>

Write the complete prompt and context, including actual plan/spec/source, to a private file. Substitute its shell-quoted path for <prepared-prompt-file>; never interpolate user text into shell source. Request a severity (Critical, High, Medium or Low) per finding and a final Recommendation: because line, including an explicit no-findings rationale.

# GSTACK_ACTIVE_HOST names the harness, never the model.
if { [ -n "${CODEX_THREAD_ID:-}" ] || [ -n "${CODEX_SANDBOX:-}" ] || [ "${GSTACK_ACTIVE_HOST:-}" = codex ]; }; then
  echo 'Codex outside review unavailable: harness mismatch; no outside process started. Missing coverage.' >&2
  if { [ -n "${CLAUDECODE:-}" ] || [ "${GSTACK_ACTIVE_HOST:-}" = claude ]; } && { [ -n "${CODEX_THREAD_ID:-}" ] || [ -n "${CODEX_SANDBOX:-}" ] || [ "${GSTACK_ACTIVE_HOST:-}" = codex ]; }; then
    echo 'Inherited harness markers conflict. Run setup --host <actual-harness> (claude or codex); do not guess a replacement provider.' >&2
  else
    echo 'Repair installed skills: run setup --host codex from your gstack checkout.' >&2
  fi
  exit 78
fi

_REPO_ROOT=$(git rev-parse --show-toplevel) || { echo 'ERROR: not in a git repo' >&2; exit 1; }
_OUTSIDE_TMP=$(mktemp -d "${TMPDIR:-/tmp}/gstack-outside.XXXXXXXX") || exit 1
trap 'rm -rf "$_OUTSIDE_TMP"' EXIT
_OUTSIDE_INPUT="$_OUTSIDE_TMP/prompt"
cat -- '<prepared-prompt-file>' >"$_OUTSIDE_INPUT" || exit 1

_CODEX_PROBE="$HOME/.claude/skills/gstack/bin/gstack-codex-probe"
export _CODEX_DEADLINE=$(($(date +%s)+540)); _CODEX_OUT=$("$_CODEX_PROBE" role-ready exec) || exit $?
_CODEX_SEL=$(echo "$_CODEX_OUT" | sed -n 's/^CODEX_SEL: //p')
_CODEX_SANDBOX_MODE=$(echo "$_CODEX_OUT" | sed -n 's/^CODEX_SANDBOX: //p')
"$_CODEX_PROBE" show-first-use-notice
_OUTSIDE_EXIT=0
"$_CODEX_PROBE" run-with-timeout --effort high 540 codex exec - -C "$_REPO_ROOT" -s "${_CODEX_SANDBOX_MODE:?}" -c "model=\"${_CODEX_SEL:?}\"" -c skills.include_instructions=false -c 'web_search="cached"' --json -o "$_OUTSIDE_TMP/text" <"$_OUTSIDE_INPUT" >"$_OUTSIDE_TMP/events" 2>"$_OUTSIDE_TMP/stderr" || _OUTSIDE_EXIT=$?
cat "$_OUTSIDE_TMP/text" 2>/dev/null || tail -n 20 "$_OUTSIDE_TMP/events"
if [ "$_OUTSIDE_EXIT" -eq 124 ]; then
  "$_CODEX_PROBE" log-event codex_timeout "540" || true
  "$_CODEX_PROBE" log-hang autoplan 0 || true
fi
cat "$_OUTSIDE_TMP/stderr" >&2 || { [ "$_OUTSIDE_EXIT" -ne 0 ] || _OUTSIDE_EXIT=1; }
_OUTSIDE_RC=0
bun --no-env-file --config=/dev/null "$HOME/.claude/skills/gstack/lib/outside-review-result.ts" --label 'Codex outside review' --exit "$_OUTSIDE_EXIT" --stderr "$_OUTSIDE_TMP/stderr" --events "$_OUTSIDE_TMP/events" review "$_OUTSIDE_TMP/text" || _OUTSIDE_RC=$?
case "$_OUTSIDE_RC" in
  0|3) ;;
  4) echo 'OUTSIDE_STATUS: unverified provider=codex host=claude'; exit 4 ;;
  *) [ "$_OUTSIDE_EXIT" -ne 0 ] && exit "$_OUTSIDE_EXIT"; exit 1 ;;
esac
echo 'OUTSIDE_STATUS: completed provider=codex host=claude'

Use Bash timeout: 600000; show the full response in a tool-output fence. Require successful execution and valid markers. Refusal, empty/malformed output, missing score/severity/completion markers, timeout or CLI failure means outside_status: unavailable. P0/P1 findings block like native ones; OUTSIDE_STATUS: unverified is missing coverage. Use the caller's fallback; missing coverage is never clean/PASS. After either outcome, delete only your private prompt; scratch cleanup is automatic.

Failed/incomplete outside review → unavailable; disabled → skip outside. Both keep the native pass.

Retain the historical review-log skill ID; add "host":"claude","outside_provider":"codex","outside_status":"completed|unavailable|disabled|skipped","phase":"ceo". Record differing attempt outcomes separately. source:"codex" requires completed CLI output; native uses source:"in-host" (historical source:"claude": native Claude). Availability/native fallback is not outside completion. Preserve all reported modelUsage; unknown model identity stays unknown. Under GSTACK_CODEX_NO_SANDBOX=1 add "codex_sandbox":"danger-full-access".

Error handling: Codex auth/timeout/empty → proceed with the Claude subagent only, tagged [single-model]. If it also fails → "Outside voices unavailable — continuing with primary review."

Degradation matrix: Both fail → "single-reviewer mode". Codex only → tag [codex-only]. Subagent only → tag [subagent-only].

• Strategy choices: the outside reviewer disagrees with a premise or scope decision for a valid strategic reason → TASTE DECISION. Both models agree the user's stated structure should change (merge, split, add, remove) → USER CHALLENGE (never auto-decided).

Produce the CEO consensus table from the completed results:

CEO DUAL VOICES — CONSENSUS TABLE:
  Dimension                           Claude  Codex  Consensus
  1. Premises valid?                   —       —      —
  2. Right problem to solve?           —       —      —
  3. Scope calibration correct?        —       —      —
  4. Alternatives sufficiently explored?—      —      —
  5. Competitive/market risks covered? —       —      —
  6. 6-month trajectory sound?         —       —      —
CONFIRMED = completed subagent + outside; primary cannot replace outside.
Outside disabled/unavailable: six Consensus cells N/A, never CONFIRMED.
Native findings stay separate; disagreements → taste; flag single-voice criticals.

Sections 1-11 — for EACH section, run the evaluation criteria from the loaded skill file:

• Sections WITH findings: full analysis, auto-decide each issue, log to audit trail
• Sections with NO findings: 1-2 sentences stating what was examined and why nothing was flagged. NEVER compress a section to its name in a table row.
• Section 11 (Design): run only if UI scope was detected in Phase 0

Mandatory outputs from Phase 1:

• Reality rows: the loaded skill's REALITY: lines, one per applicable row; ~/.claude/skills/gstack/bin/gstack-plan-reality check --phase ceo --plan <reviewed snapshot> <review-file|-> prints PLAN_REALITY: … verdict=complete before the phase closes (unattended: incomplete keeps it open).
• "NOT in scope" section with deferred items and rationale
• "What already exists" section mapping sub-problems to existing code
• Error & Rescue Registry table (from Section 2)
• Failure Modes Registry table (from review sections)
• Dream state delta (where this plan leaves us vs the 12-month ideal)
• Completion Summary (the CEO skill's full summary table)

Close this phase:

The review work above ends here. Now load the shared close steps afresh, even if read earlier. Use phase ceo, checkpoint <CEO_STEP0_CHECKPOINT>, and this phase's methodologyPath. Keep this checkpoint for this invocation; review exports do not replace it.

STOP. Before closing a review phase, after its reviews finish and before announcing completion or loading the next phase (read afresh at each exit), Read ~/.claude/skills/gstack/autoplan/sections/phase-close.md and execute it in full. Do not work from memory — that section is the source of truth for this step.