challenge

AgentCouncil Challenge

You are running the AgentCouncil challenge protocol. You are BOTH the orchestrator and the lead defender. Codex is the independent outside attacker, running as a persistent MCP server with session memory.

Target: $ARGUMENTS

Protocol -- follow these steps exactly

Step 1: Identify the target

Clearly state what plan/design/approach is being challenged. Identify:

• The target artifact (the plan or design under stress test)
• Key assumptions being made
• Success criteria (what "working" looks like)
• Constraints (boundaries of the system)

This frames the challenge for both agents and the user.

Step 2: Write YOUR defense first

Before Codex sees anything, write your own independent defense of the target. For each key assumption, state:

• Why you believe it holds
• What evidence supports it
• Where it might be weakest

Display it clearly labeled as Claude's Defense.

This step is critical. If you see Codex's attack before writing your own defense, the independence is gone and the whole protocol is worthless.

Step 3: Create the adversarial brief and send to Codex

Write a brief containing ONLY factual context:

• The target artifact (full plan/design/approach)
• Assumptions to attack
• Success criteria
• Relevant implementation code or details
• Constraints

CRITICAL: Do NOT include your defense strategy, confidence level, or any defensive framing. The brief must contain zero defensive content. No "I am confident", "my defense is", "the plan is strong because" -- purely factual context about what to stress-test.

Call mcp__codex__codex to start a codex session with this brief. Save the threadId.

Step 4: Share your defense with Codex

Send your full independent defense to Codex so it can attack the defense arguments. Use mcp__codex__codex-reply:

"Here is the lead agent's independent defense (written before seeing yours): {your full defense from Step 2}. Attack the defense arguments. Find weaknesses in the reasoning. Identify where the defense is based on unproven assumptions or wishful thinking."

Step 5: Exchange round (attack on defense arguments)

Default to 2 rounds (1 exchange pair). For the exchange:

Read Codex's attack on your defense. Write your counter-defense addressing their specific attacks. Send it via mcp__codex__codex-reply. Read Codex's response.

Key: Codex attacks your defense arguments, NOT the original artifact. The exchange is about whether your defense holds up, not about finding new problems with the plan.

Step 6: Get synthesis

Send the synthesis request on the same thread via mcp__codex__codex-reply:

"Based on our full attack/defense discussion, produce a final synthesis. Return JSON with these exact keys: readiness (ready/needs_hardening/not_ready), summary (string), failure_modes (array of objects with id, assumption_ref, description, severity, impact, confidence, disposition, mitigation, source_refs), surviving_assumptions (array of strings), break_conditions (array of strings), residual_risks (array of strings), next_action (string). Rules: adversarial only -- attack assumptions, do NOT propose repairs or fixes. Set readiness to ready ONLY if no credible attack found. Set disposition to must_harden/monitor/mitigated/accepted_risk/invalidated accurately."

Step 7: Present the structured result

Parse Codex's JSON response and present:

## Challenge Result

**Readiness:** {readiness}

### Summary
{summary}

### Failure Modes
For each failure mode:
- **[{id}] {assumption_ref}** (severity: {severity}, disposition: {disposition})
  Description: {description}
  Impact: {impact}
  Confidence: {confidence}

### Surviving Assumptions
- {each assumption that withstood attack}

### Break Conditions
- {each condition under which the plan fails}

### Residual Risks
- {each remaining risk}

### Next Action
{next_action}

If JSON fails to parse, report readiness as "not_ready" and show raw response.

Rules

• Default to 2 rounds (not 1 like review/decide)
• ALWAYS write your defense BEFORE sending anything to Codex
• NEVER put your defense strategy or confidence in the brief
• Adversarial only: attack assumptions, do NOT propose repairs
• Exchange rounds attack defense arguments, not the original artifact
• Codex remembers everything in the thread -- don't resend context
• Do NOT add analysis beyond the structured result