v2.2.0 — bilingual triggers, hardened wrapper

Claude↔Codex cross-verification for Claude Code, Codex, and the other agents the Skills CLI supports.

npx skills add moveju112/skill_verify

What's in this release

Bilingual. Both skills register Korean and English triggers, and replies follow whichever language you write in.

Blind cross-verification. Claude and Codex answer the same question independently — neither sees the other's work first. Findings are compared by file:line before anything is accepted, and Codex reviews the finished change in a fresh session with no anchoring.

Findings are hypotheses until verified. A three-step gate runs before any Codex finding is acted on: read the cited lines, confirm the call path is reachable, reproduce it. Measured disagreement rate is 15/23, and some of those were misread rules — so nothing is applied on the reviewer's word alone.

Token-leak-safe wrapper. Every Codex call goes through codex_ask.sh, which returns only the final verdict truncated to 6,000 characters. Raw logs stay in ~/.cache/codex-crosscheck with owner-only permissions and 14-day expiry, and never enter the agent's context. File contents and diffs are never pasted into prompts — Codex reads the repo itself in a read-only sandbox.

Hardened this release. resume accepts only an explicit session UUID, so a parallel run can never attach to someone else's thread. timeout -k 10 kills a hung Codex instead of letting it hold the caller's timeout. Response contracts (first-line verdict, numbered findings with severity, 3,000 characters, 7 bullets) are checked by the script, not just requested in the prompt. Phase D completion checks run in the background so a several-minute review doesn't block the session.

Regression tests. 18 checks run against a fake Codex — no API calls, no tokens: bash tests/codex_ask.test.sh

unit-test

Right after a code change, the skill asks whether to run unit tests and only runs on approval. Seven angles — happy path, boundary, empty, error, ordering, before/after equivalence, side effects — with a report written to <project>/test/. Claude-only; it never calls out to another model.

Requirements

crosscheck needs the Codex CLI (npm i -g @openai/codex) and a logged-in session. Without it the skill degrades to a documented Claude-only fallback rather than failing.