codex-debate v0.1.0: adversarial Claude-vs-Codex debates

First release of the codex-debate plugin, shipping the codex-debate skill: an iterative adversarial debate between Claude (leading agent) and the headless Codex CLI over any subject (specs, designs, plans, code, security reviews, or non-technical positions), running until both converge or a round cap is reached.

Highlights

• Debate protocol. Codex needs no counterpart skill or preloaded context: canonical, Codex-negotiated prompt fragments carry every rule (reply cap, deep-dive exemption, numbered objections, strict VERDICT: AGREEMENT / VERDICT: DISPUTE REMAINS grammar), session resume preserves Codex's memory across rounds, and Claude rules on every point independently (concede and record, revise when warranted, or rebut), tracked in a stable-ID dispute ledger. Three interaction modes: autonomous, interactive, and pause-on-deadlock; autonomous runs emit a per-round status line (round count vs cap, Codex's verbatim verdict, dispute-ledger tally) as the user's live signal between calls.
• Topic-generic by design. The templates work for any subject, technical or not: claim-structured subjects get numbered claims for citation; creative or precisely formatted text is fenced verbatim (injection-defended) with objections anchored by short quoted phrases or structural positions.
• Two rigor levels. Advisory debates deliver a considered opinion over inlined subjects or direct file reads with spot-checked file:line citations; binding debates (opt-in) produce a mutually agreed record over pinned content only: fenced bytes or SHA-pinned trees, with version manifests, an evidence channel, and repo-scale exploration mechanics in a dedicated protocol reference.
• Three debate shapes, documented. The user guide describes a ladder of ready-to-copy prompt shapes: single prosecutor (the default), pre-registered assessment, and blind commit followed by cross-attack, with split technical and non-technical example tables crossing shapes with modes and rigor, and a live-trail section for terminal multiplexers. The guide was itself refined by running blind Claude/Codex cross-attack reviews with the skill.
• Hard rule: Codex never writes. Every Codex invocation runs in a read-only sandbox with approvals disabled, verified via the run header; Codex proposes, Claude applies. No task instruction, user request, or Codex offer constructs a write-enabled call, and applying a Codex-authored patch unreviewed counts as Codex writing.
• Marketplace layout and CI. The repository is a Claude Code marketplace with the plugin under plugins/codex-debate/ (installations ship only the plugin), strict-validated manifests, per-plugin release tags, and CI running shellcheck, shfmt, markdownlint, and manifest validation on every push and pull request, hardened with pinned tool versions, checksums, and least-privilege permissions. Contributor documentation (test prerequisites, costs, pre-PR checklist) lives in CONTRIBUTING.md.
• Tested end to end. Compliance scenarios drive a real headless agent against a stubbed Codex CLI with recorded RED baselines (including sandbox write-temptation and creative-subject anchoring, the latter asserting byte-for-byte fencing and per-objection anchor resolution); a live contract check validates the canonical wording against the real Codex CLI; a triggering suite measures routing including the pure-delegation no-trigger gate; an install smoke test verifies the packaged artifact.

Full changelog: https://github.com/octanevz/codex-debate/releases/tag/codex-debate--v0.1.0