A full-codebase review-and-repair skill that fans work across a cost-tiered agent ladder — and refuses to call it done on anything less than the exact final SHA.
I spent the last stretch building a Codex skill that reviews a whole repository and fixes what it finds. The reviewing was the easy part. The hard part was stopping it from telling me it was finished when it wasn't.
Three things shaped how it ended up.
Enumeration isn't judgment. Don't pay the same rate for both.
Listing tracked files, building a coverage manifest, running a command and handing back the output — that's clerical work. On a whole-repo audit it's most of the tokens and almost none of the thinking, and routing it to the top-tier model is the fastest way I know to spend real money generating a file listing.
So the skill splits the work into a ladder:
- ENUMERATE —
cheap. List everything that exists. Files, modules, test coverage, the diff against main, the manifest of what we'll touch. No opinions. No judgment. - REVIEW —
mid. Walk the manifest. Group the findings. For each cluster, draft the minimal patch and a one-paragraph justification that names the failure mode it prevents. - JUDGE —
top tier only. Re-read each proposed patch against the code it touches. Authorize it, reject it, or send it back for another enumeration pass. This is where being wrong is expensive, so this is where the expensive model earns its keep: authorization paths, concurrency and cancellation, transaction and migration safety, contracts that span files.
The dashed loop on the diagram isn't decorative. A rejection from the judge doesn't end the run — it kicks the work back to the enumerator with a tighter scope. repeat until the pass comes back clean is the actual contract.
Codex sub-agents share one filesystem.
This was the part that surprised me. No isolated copies. No merge step. A write by any agent is instantly visible to every other agent — including the next one being spawned.
That changes how you have to design the workflow. There's no point having three reviewers each clone the repo and produce their own diff; whoever writes last wins, and the others' work just evaporates. Instead, the skill treats the working tree as a single shared blackboard: enumerate writes the manifest, review reads it and appends a patch file per cluster, judge reads the patches, applies the ones it authorizes, and re-runs the build. The verification step is what closes the loop.
The other consequence: the skill can't trust its own progress markers. "I've applied 14 patches" means nothing if the next agent overwrites them. So instead of trusting counters or "completed" flags, the skill gates completion on the only thing that actually survives: the exact final SHA of the working tree. When the judge signs off, the run records that SHA, and the next invocation checks the tree against it before resuming. If the SHA doesn't match what the last clean pass left behind, the run starts over from enumeration — not because the work was wrong, but because the substrate moved under it.
The status badges aren't vibes. They're the SHA.
- READY FOR MERGE — the recorded SHA matches the current tree SHA, the build passes, and the judge authorized every patch.
- INCOMPLETE — work was applied, but either the tree drifted since the last clean pass or the judge rejected one or more clusters and sent them back for re-enumeration.
- BLOCKED — the loop ran and failed; a cluster that the judge keeps rejecting, or a build that won't go green. A human looks at it.
The whole point of the ladder was to keep the cheap tier cheap, reserve the expensive tier for the places where it earns its keep, and let the verdict come from something the filesystem can't lie about.