{"id":50895199,"url":"https://github.com/prilive-com/go-tdd-pack","last_synced_at":"2026-06-15T23:31:23.635Z","repository":{"id":358745284,"uuid":"1242734186","full_name":"prilive-com/go-tdd-pack","owner":"prilive-com","description":"Continuous silent peer review between Claude Code and OpenAI Codex CLI for Go projects","archived":false,"fork":false,"pushed_at":"2026-06-08T13:35:57.000Z","size":2362,"stargazers_count":0,"open_issues_count":3,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-08T15:11:29.979Z","etag":null,"topics":["ai-assisted-development","claude-code","code-review","codex-cli","developer-tools","go","golang","peer-review","plugin","tdd"],"latest_commit_sha":null,"homepage":"https://github.com/prilive-com/go-tdd-pack","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/prilive-com.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":"MAINTAINERS.md","copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-05-18T17:48:15.000Z","updated_at":"2026-06-08T13:36:06.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/prilive-com/go-tdd-pack","commit_stats":null,"previous_names":["prilive-com/go-tdd-pack"],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/prilive-com/go-tdd-pack","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prilive-com%2Fgo-tdd-pack","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prilive-com%2Fgo-tdd-pack/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prilive-com%2Fgo-tdd-pack/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prilive-com%2Fgo-tdd-pack/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/prilive-com","download_url":"https://codeload.github.com/prilive-com/go-tdd-pack/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/prilive-com%2Fgo-tdd-pack/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34385031,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-15T02:00:07.085Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-assisted-development","claude-code","code-review","codex-cli","developer-tools","go","golang","peer-review","plugin","tdd"],"created_at":"2026-06-15T23:31:23.417Z","updated_at":"2026-06-15T23:31:23.627Z","avatar_url":"https://github.com/prilive-com.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n# Prilive Go TDD Pack\n\n**Continuous silent peer review between Claude Code and OpenAI Codex CLI for Go projects.**\n\n[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)\n[![DCO](https://img.shields.io/badge/DCO-signed--off-brightgreen)](CONTRIBUTING.md)\n[![Keep a Changelog](https://img.shields.io/badge/changelog-Keep%20a%20Changelog-orange)](CHANGELOG.md)\n\u003c!-- TODO: add CI status badge once GitHub Actions is configured on the public repo --\u003e\n\n**[Quickstart](#quickstart) · [How it works](#how-it-works) · [Install](#install) · [Monorepos](docs/MONOREPO_ADOPTION_GUIDE.md) · [Security](SECURITY.md)**\n\n\u003c/div\u003e\n\n---\n\n## The problem\n\nAI coding agents are fast, but prompt-only discipline breaks down. A model can decide that \"this change is mechanical, no review needed\" — and now the model is deciding whether its own safety process applies. That's not safe.\n\nPrilive Go TDD Pack v2.0 changes the default:\n\n\u003e **Claude does not decide whether Codex review is needed. The runner does.**\n\nThe pack runs continuous, silent peer review on every meaningful Go code change. Claude implements; Codex reviews; findings are silently injected into Claude's next turn; Claude addresses them or pushes back. The user only sees finished code, or — when Claude and Codex can't converge — a single A/B/V escalation question.\n\n---\n\n## What's different about this pack\n\n- **Codex runs with the same access as Claude** — full project read, full shell, full network, no sandbox, no copy. The \"no project writes\" rule lives in Codex's system prompt, verified by a smoke test, not by sandbox flags. Capability parity beats artificial restrictions for review quality.\n- **Tool-grounded** — `go vet`, `gofmt`, `staticcheck`, `golangci-lint`, and `govulncheck` run on every cycle. Their output goes verbatim into Codex's prompt so reviews cite tool evidence, not hallucinations.\n- **Monorepo-aware** — single-module repos, monorepos with multiple `go.mod` files at any depth, nested modules, polyglot repos, and Go files with no enclosing `go.mod` are all handled by a layout-agnostic affected-module algorithm. Discovery is driven by the diff, not by where the script is invoked from.\n- **Multi-round resume** — round 1 uses strict JSON schema; rounds 2+ resume the same Codex session via `codex exec resume`, so the reviewer remembers its prior analysis. Default cap: 5 rounds before escalation.\n- **Confidence-scored findings** — every finding includes a 1-5 confidence score so Claude can triage by certainty as well as severity. `[blocker/correctness c=4]` reads differently from `[blocker/correctness c=1]`.\n- **Quality-first defaults** — `reasoning_effort = \"xhigh\"`, full repo tree access via tools, no diff truncation, no cheap-model fallback. Token economy is not a constraint; review depth is.\n- **Free with a ChatGPT subscription** — Codex CLI uses your existing ChatGPT Plus/Pro/Team auth. No per-token billing if you're on a subscription.\n\n---\n\n## How it works\n\n```\nYou ask Claude for a change\n  ↓\nClaude implements (Edit/Write/MultiEdit)\n  ↓\nPostToolUse hook fires the runner in background (returns in \u003c50ms)\n  ↓\nRunner waits 5s for edits to settle (coalesce)\n  ↓\nRunner runs tool grounding per affected Go module:\n  gofmt -l, go vet, staticcheck, golangci-lint, govulncheck\n  ↓\nCodex round 1 — strict JSON via --output-schema\n  ↓\n  ├── approve → cycle converged → done (silent)\n  └── request_changes\n        ↓\n        Findings injected into Claude's next turn as additionalContext\n        ↓\n        Claude fixes silently OR writes a one-line rationale\n        ↓\n        Stop hook captures Claude's full response\n        ↓\n        Codex round 2 — resumes session, returns VERDICT: APPROVE | REQUEST_CHANGES\n        ↓\n        Repeat up to max_rounds (default 5)\n        ↓\n        If converged → done. If not → A/B/V escalation message to user.\n```\n\nThe user sees: finished code, or one short escalation question.\n\nThe user does NOT see: ceremony markers, plan files, approval prompts, per-edit progress updates.\n\n---\n\n## Requirements\n\n**Required:**\n- [Claude Code](https://docs.claude.com/en/docs/claude-code) 2.1.89 or newer\n- [OpenAI Codex CLI](https://github.com/openai/codex) — install and authenticate with `codex login`\n- Go 1.22 or newer\n- Git 2.25 or newer\n- `bash` 4+, `jq` 1.6+\n\n**Recommended Go tooling** (the pack degrades gracefully if missing, showing `NOT INSTALLED` in Codex's prompt):\n- `staticcheck` — `go install honnef.co/go/tools/cmd/staticcheck@latest`\n- `golangci-lint` — see [install guide](https://golangci-lint.run/welcome/install/)\n- `govulncheck` — `go install golang.org/x/vuln/cmd/govulncheck@latest`\n\nThe pack resolves tools from `PATH` and `$(go env GOPATH)/bin`.\n\n---\n\n## Install\n\n\u003e **Pick exactly ONE install path: project-copy OR plugin. Never both.** Claude\n\u003e Code stacks hook registrations across every source (project settings + plugin\n\u003e manifests), and dedup is by literal command string — so installing both ways\n\u003e runs every review twice. See\n\u003e [Claude Code hooks docs](https://code.claude.com/docs/en/hooks) and the\n\u003e warning in [`docs/ADOPTION_GUIDE.md`](docs/ADOPTION_GUIDE.md#step-3--install-the-pack).\n\n### Clone into an existing Go project\n\n```bash\ngit clone https://github.com/prilive-com/go-tdd-pack.git /tmp/go-tdd-pack\n\ncp -R /tmp/go-tdd-pack/hooks .\ncp -R /tmp/go-tdd-pack/runner .\ncp -R /tmp/go-tdd-pack/prompts .\ncp -R /tmp/go-tdd-pack/schemas .\ncp -R /tmp/go-tdd-pack/test .\ncp /tmp/go-tdd-pack/tdd-pack.toml .\ncp /tmp/go-tdd-pack/CLAUDE.md .\ncp /tmp/go-tdd-pack/AGENTS.md .\n\n# Merge the hook entries from /tmp/go-tdd-pack/.claude/settings.json into\n# your project's .claude/settings.json (do NOT blind-overwrite — see\n# docs/V2_ROLLOUT_GUIDE.md §2 for the merge procedure).\n\nchmod +x hooks/*.sh runner/*.sh test/smoke-*.sh\n\n# Verify\nbash test/smoke-v2-phase2.sh        # 25 unit checks, no Codex calls\nbash test/smoke-tool-grounding.sh   # 12 fixture checks\n```\n\nThat's it. On your next Claude Code session, Codex will start reviewing changes automatically.\n\nFull step-by-step install: [`docs/ADOPTION_GUIDE.md`](docs/ADOPTION_GUIDE.md).\nRollout guide for AI assistants doing the install: [`docs/V2_ROLLOUT_GUIDE.md`](docs/V2_ROLLOUT_GUIDE.md).\n\n---\n\n## Quickstart\n\nOpen any Go project where the pack is installed and ask Claude to make a change:\n\n```\nAdd a Retry function to internal/http/client.go with exponential backoff.\n```\n\nClaude writes the code. About 5 seconds after Claude's edits settle, Codex begins reviewing in the background. You won't see this happen — it's silent by design.\n\nIf everything converges silently, you'll see finished code. If Claude and Codex disagree across all rounds, you'll see one short message:\n\n```\n[REVIEW ESCALATION — cycle \u003cid\u003e]\n\nClaude and Codex did not converge after 5 rounds.\nThe disagreement is about: \u003cone-sentence summary\u003e\n\nClaude's final view:  \u003cone paragraph\u003e\nCodex's final view:   \u003cone paragraph\u003e\n\nChoose how to proceed:\n  [A] ship Claude's version — tell me 'go with Claude'\n  [B] apply Codex's recommendations — tell me 'go with Codex'\n  [V] view full transcripts\n```\n\nThat's the entire user-facing surface. Everything else is internal.\n\nTo see the most recent review at any time, ask Claude \"show me the latest review\" — it reads `.tdd/reviews/state.json` and the latest cycle directory.\n\n---\n\n## Repository layouts supported\n\n| Layout | Status |\n|---|---|\n| Single-module Go repo (`go.mod` at root) | ✓ Fully supported |\n| Monorepo with multiple `go.mod` files at any depth | ✓ Fully supported (per-module sections) |\n| Nested modules (child `go.mod` inside parent module) | ✓ Walked nearest-first |\n| Polyglot monorepo (Go + non-Go) | ✓ Only Go-affected modules are tooled |\n| Repo with no Go code | ✓ Pack emits \"no Go modules touched\" status |\n| `vendor/`, `testdata/`, `node_modules/` | ✓ Excluded from analysis |\n| Empty `go.mod` (Grab-style exclude marker) | ✓ Honored |\n\nDetailed monorepo guide: [`docs/MONOREPO_ADOPTION_GUIDE.md`](docs/MONOREPO_ADOPTION_GUIDE.md).\n\n**Not yet supported** (no plans unless real demand surfaces): Bazel/Buck2/Pants build system orchestration, `go.work` workspace mode toggles, submodule recursion. Native per-module tooling works fine inside Bazel-managed Go repos as long as `go.mod` exists.\n\n---\n\n## Configuration\n\nThe pack reads `tdd-pack.toml` from the repo root. Defaults are tuned for quality:\n\n```toml\n[review]\nmax_rounds = 5\ncoalesce_ms = 5000\n\n[codex]\nmodel = \"\"                  # empty = use Codex CLI's current default\nreasoning_effort = \"xhigh\"  # max reasoning supported by ChatGPT Plus/Pro/Team\nweb_search = \"live\"         # enables Codex web search during review\n\n[severity]\nmin_surface = \"nit\"         # Claude sees every finding; can filter on its end\n```\n\nFull config reference: [`docs/INTEGRATION_GUIDE.md`](docs/INTEGRATION_GUIDE.md).\n\n**Emergency disable** for the current shell:\n\n```bash\nexport PRILIVE_REVIEW_DISABLE=1\n```\n\n---\n\n## Documentation\n\n| Topic | File |\n|---|---|\n| Install into a new or existing project | [`docs/ADOPTION_GUIDE.md`](docs/ADOPTION_GUIDE.md) |\n| How AI developers should work with the pack | [`docs/AI_DEVELOPER_GUIDE.md`](docs/AI_DEVELOPER_GUIDE.md) |\n| Hook setup, config reference, state machine | [`docs/INTEGRATION_GUIDE.md`](docs/INTEGRATION_GUIDE.md) |\n| Go monorepo specifics | [`docs/MONOREPO_ADOPTION_GUIDE.md`](docs/MONOREPO_ADOPTION_GUIDE.md) |\n| Rollout / install instructions for AI assistants | [`docs/V2_ROLLOUT_GUIDE.md`](docs/V2_ROLLOUT_GUIDE.md) |\n| v2.0 architecture spec (still load-bearing for v2.x) | [`docs/V2_IMPLEMENTATION_SPEC.md`](docs/V2_IMPLEMENTATION_SPEC.md) |\n| **v2.1 → v2.2 upgrade guide** | [`docs/UPDATE_NOTES_v2.1-to-v2.2.md`](docs/UPDATE_NOTES_v2.1-to-v2.2.md) |\n| v2.0 → v2.1 upgrade guide | [`docs/UPDATE_NOTES_v2.0-to-v2.1.md`](docs/UPDATE_NOTES_v2.0-to-v2.1.md) |\n| v2.1.0 postmortem (the schema-strict + model-pin lesson) | [`docs/POSTMORTEM-v2.1.0.md`](docs/POSTMORTEM-v2.1.0.md) |\n| v2.2 design (the opt-in ops-triage rail) | [`docs/PROPOSAL-ops-risk-triage.md`](docs/PROPOSAL-ops-risk-triage.md) |\n| Release history | [`CHANGELOG.md`](CHANGELOG.md) |\n| Claude operating rules | [`CLAUDE.md`](CLAUDE.md) |\n| Codex operating rules | [`AGENTS.md`](AGENTS.md) |\n| Security policy | [`SECURITY.md`](SECURITY.md) |\n| Contribution policy | [`CONTRIBUTING.md`](CONTRIBUTING.md) |\n| GitHub repo setup scripts (for the maintainer) | [`scripts/github-setup/RUNBOOK.md`](scripts/github-setup/RUNBOOK.md) |\n\n---\n\n## Safety and trust\n\n- **Codex never edits your project files.** The rule is in Codex's system prompt at `prompts/codex-system.md` and verified empirically by smoke tests. Run them any time you upgrade Codex CLI.\n- **No sandboxing of Codex.** Codex runs with the same machine access Claude has — your full project, your shell, your network. This is intentional: capability parity beats artificial restrictions for review quality. The \"no project writes\" rule holds because it's a clear, narrow instruction Codex respects — not because of OS-level enforcement.\n- **Emergency switch.** `PRILIVE_REVIEW_DISABLE=1` disables the entire pack for the current shell.\n- **No telemetry.** The pack doesn't phone home. Codex invocations go directly from your machine to OpenAI's Codex CLI (which uses your auth, your subscription).\n\n---\n\n## What the gate does NOT cover\n\nThe pre-write gate (`[pre_review] enabled = true` in `tdd-pack.toml`, or the per-shell `PRILIVE_PRE_REVIEW_EXPERIMENTAL=1` env override) reviews every `Write`, `Edit`, `MultiEdit`, and `NotebookEdit` action **Claude Code is about to take** through its tool API. That covers file changes — it does not cover everything.\n\n### Scope: code review by default; opt-in runtime safety in v2.2\n\nThe default code-review path reviews **file edits only** — `Write`, `Edit`, `MultiEdit`, `NotebookEdit`. v2.1 removed the v2.0-era Bash matcher from the default path because sending every `pwd` / `ls` / `git status` through Codex was wasteful for ChatGPT-subscription users (~6s per call) and an architectural mismatch with code review.\n\n**v2.2 added an opt-in Ops Risk Triage rail** for adopters who *also* want runtime-command safety inside the same pack. It is **default-off** (`[ops_triage] enabled = false` in `tdd-pack.toml`); code-review-only adopters see zero behavior change from v2.1.1. When enabled, the rail does NOT route every command through Codex — it uses a three-layer gate (deterministic parser → fast Haiku classifier → Codex deep ops-preflight on escalation only) to keep the hot path fast. See [`docs/PROPOSAL-ops-risk-triage.md`](docs/PROPOSAL-ops-risk-triage.md) and [`docs/UPDATE_NOTES_v2.1-to-v2.2.md`](docs/UPDATE_NOTES_v2.1-to-v2.2.md) for the opt-in flow.\n\nIf you don't want any runtime-command safety from this pack at all — that's the default, and your adoption story is unchanged. If you do — copy the three `.example` configs, flip `enabled = true`, and run for a week in `mode = \"observe\"` before turning the gate on. Claude Code's own permission system still covers obviously dangerous cases (`rm -rf /`, `sudo`, etc.) at the prompt layer regardless.\n\n### Out-of-band changes\n\nThe gate is a Claude Code hook. It cannot see anything that bypasses Claude's tool API:\n\n- Cron jobs running on the host.\n- Commands typed by a human in a different terminal.\n- Other agents running on the same machine.\n- File changes from `git pull`, IDE auto-save, formatter hooks fired by your editor.\n\nThese are not bugs. They are the architectural ceiling of any client-side hook approach.\n\n### What would close it\n\nIf you need full coverage of file changes across all sources (not just Claude's tool API), the real option is **OS-level audit / sandbox** — seccomp, eBPF, `auditd`, or a container with a syscall-gated runtime. That's host-level work, not pack-level. Treat the gate as defense in depth — one strong line that covers what Claude itself does — not the only line.\n\n---\n\n## Security\n\nFound a security issue? Please **do not** open a public issue.\n\n- **Preferred:** [Open a private security advisory](https://github.com/prilive-com/go-tdd-pack/security/advisories/new) via GitHub's Private Vulnerability Reporting.\n- **Fallback:** Email the address in [`SECURITY.md`](SECURITY.md).\n\nSecurity-sensitive issue categories include: hook bypass, runner convergence bypass, Codex review artifact tampering, secret leakage through review context, and Codex writing to the real repository (no-write-rule violation).\n\n---\n\n## Contributing\n\nContributions welcome.\n\n1. Sign off your commits — the project uses [Developer Certificate of Origin](https://developercertificate.org/) via the [cncf/dco2 GitHub App](https://github.com/apps/dco).\n2. Read [`CONTRIBUTING.md`](CONTRIBUTING.md) before opening a PR.\n3. High-risk changes (hooks, runner state machine, Codex prompts, tool grounding, audit artifacts, config schema, settings.json) require discussion in an issue first.\n\n```bash\ngit commit -s -m \"Your change description\"\n```\n\n---\n\n## Project status\n\n- **Current public line:** v2.3.x (v2.3.2 released 2026-06-10).\n- **License:** Apache-2.0\n- **Maintainer:** Prilive ([github.com/prilive-com](https://github.com/prilive-com))\n- **Primary audience:** Go teams using Claude Code and Codex CLI\n- **Production usage:** validated on one real Go monorepo since 2026-05-18; v2.1.0 + v2.2.0 verified via the postmortem A1/A2 live-smoke gate against post-merge clean `main` ([`docs/RELEASE_GUIDE.md`](docs/RELEASE_GUIDE.md) Phase 3a).\n- **Legacy support:** v1.x ceremony architecture is no longer maintained; v2.0.x / v2.1.0 / v2.2.x are superseded. New adoption should use v2.3.x.\n\n---\n\n## License\n\nApache License 2.0 — see [`LICENSE`](LICENSE).\n\nCopyright 2026 Prilive.\n\n---\n\n## Acknowledgements\n\nThis pack builds on:\n\n- **Anthropic** — Claude Code platform and plugin ecosystem\n- **OpenAI** — Codex CLI\n- **`honnef.co/go/tools`** (`staticcheck`) — Go static analyzer\n- **`golangci-lint`** — comprehensive linter aggregator\n- **`golang.org/x/vuln/cmd/govulncheck`** — Go vulnerability scanner\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprilive-com%2Fgo-tdd-pack","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fprilive-com%2Fgo-tdd-pack","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprilive-com%2Fgo-tdd-pack/lists"}