The pre half — independent derivation, not review

A reviewer shown a plan can only agree or object; a reviewer shown only the problem derives its own answer, and the divergence between two independent derivations is a signal neither side authored. Anchoring destroys exactly the independence that made the second opinion worth having.

Steps

1. Write the goal file — to a scratch location or .codex-failsafe/goal-<slug>.md. Include: the goal, the constraints, and pointers to the documents or code that govern it. Do not write your plan into it, and do not describe your plan, your leanings, or your rejected options. If the user has already told you their preferred approach, leave that out too — the goal file carries the problem, never any answer.

2. Run it (before settling on an approach, never after):

   "${CLAUDE_PLUGIN_ROOT}/scripts/codex-failsafe.sh" pre <goal-file>

   It prints the raw claims path and the JSON: decisions (each with the question, the choice, the rejected alternative, what grounds it, and how to falsify it), consumers (every surface that must move), unknowns (questions only a human can decide).

3. Read any UNRESOLVED CITATIONS it prints first. Each decision names what it is grounded_in, and the runner resolves those paths against the repository. A citation is the one part of a derivation that looks equally solid whether or not the file exists, so a decision resting on a path that is not here is adjudicated against something that does exist, or as judgment. An unresolvable citation does not invalidate the run — it spoils one decision, not the pass.
4. Diff its decisions against yours.
   • Convergence is evidence — two independent derivations agreeing is worth more than one derivation reviewed.
   • Divergence is the finding — adjudicate it per reference/adjudication.md. Neither model gets the last word; a document, a command's output, or the human does.
5. Treat its consumers list as gold. It was derived from the repository rather than from your plan, which makes it the one enumeration your plan cannot contain. Merge it into your task list before implementing.
6. Surface unknowns to the user now, not after implementing — they are by construction questions the repository does not answer.

When not to run it

The pre half is the expensive half (~2 minutes). Skip it for changes that do not transmit: a local refactor, a comment fix, a change entirely inside one file with no external consumers. Deciding when it is worth two minutes is the discipline; if in doubt about whether a change transmits, that doubt is itself the signal to run it.