fv-skills-baif 2.0.3 → 2.1.0

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to FVS (Formal Verification Skills) will be documented in th
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [2.1.0] - 2026-07-26
+
+### Added
+- `/fvs:crypto-review` sends an initial or follow-up crypto plan to authenticated Codex for an
+  independent pre-execution adversarial review. Codex runs xhigh, effort-only, ephemeral, and
+  read-only; the FVS wrapper persists one validated review artifact and the primary planning seat
+  records its evidence-backed response. Codex-authored/unknown-provenance plans and non-APPROVE
+  verdicts fail closed before execution.
+
+### Changed
+- `/fvs:lean-specify` and `/fvs:lean-verify` now discover and fully load the target repository's
+  style guide (configurable with `project.style_guide_path`) into both research and execution
+  prompts. A shipped post-write checker enforces the repository line limit (100-column fallback)
+  and rejects new ordinary identifiers with three or more namespace dots; verification preserves
+  legacy debt only through an explicit baseline and requires full compliance for statement edits.
+
+### Fixed
+- FVS installs now verify the shipped Aeneas `_sync-meta.json` mapping and the sync command reports
+  real update/reinstall recovery instead of a nonexistent Aeneas installer option.
+- The config template now uses the top-level model schema consumed by commands and defaults
+  `fvs-crypto-thinker` to `inherit`.
+
 ## [2.0.3] - 2026-07-04
 
 ### Changed

package/README.md

@@ -121,12 +121,18 @@ Commands are grouped into five bundles. Each bundle has a **router** command tha
 | Command | Description |
 |---------|-------------|
 | `/fvs:fc-plan` | Pick next verification targets via greedy dependency graph traversal |
-| `/fvs:lean-specify` | Generate Lean spec skeleton with `@[step]` theorem pattern |
-| `/fvs:lean-verify` | Attempt proof using domain tactics (step, simp, ring, agrind, scalar_tac) |
+| `/fvs:lean-specify` | Generate a style-checked Lean spec skeleton with `@[step]` theorem pattern |
+| `/fvs:lean-verify` | Attempt proof with domain tactics while blocking new target-style violations |
 | `/fvs:natural-language` | Generate natural language explanation of module or function with pre/post conditions |
 | `/fvs:lean-refactor` | Refactor, simplify, and decompose verified proofs (dead code removal, simp sharpening, tactic golf) — *also in Formalise* |
 | `/fvs:trust-audit` | Build-backed audit of every sorry/axiom affecting a target layer; `#print axioms` classification, fail-if-unjustified gate, dependency-ordered table |
 
+`lean-specify` and `lean-verify` load a target style guide from
+`.formalising/fvs-config.json` (`project.style_guide_path`) or discover standard files such as
+`doc/STYLE_GUIDE`. With no guide they enforce a 100-column fallback. Their post-write gate also
+rejects ordinary Lean identifiers with three or more namespace dots, steering generated code
+toward scoped namespaces, `open`, and local names.
+
 ### Formalise (Paper Track) — `/fvs:formalise`
 
 | Command | Description |
@@ -134,6 +140,7 @@ Commands are grouped into five bundles. Each bundle has a **router** command tha
 | `/fvs:lean-formalise` | Formalise paper/math content into Lean 4 specs and definitions (one-shot) |
 | `/fvs:lean-refactor` | Refactor, simplify, and decompose verified proofs — *also in Formal-Core* |
 | `/fvs:crypto-plan` | Author the next bounded, runtime-neutral plan for a topic-based crypto formalisation iteration (KB-grounded, cached under `sources/`) |
+| `/fvs:crypto-review` | Send an initial or follow-up crypto plan to authenticated Codex for independent, read-only adversarial review before execution |
 | `/fvs:crypto-execute` | Run the current iteration's bounded plan under the green-build guard |
 | `/fvs:crypto-eval` | Adversarially evaluate the iteration; ends in one of ACCEPT / FOLLOWUP / HUMAN_RULING / BLOCKED |
 | `/fvs:crypto-followup` | Convert eval findings into the next follow-up plan; HALTs on HUMAN_RULING |
@@ -184,11 +191,18 @@ This track verifies Rust that Aeneas has lowered to Lean 4. Starting from a Rust
 The paper track formalises papers directly into Lean 4 — no Rust, no Aeneas. Two entry points:
 
 - **One-shot:** `/fvs:lean-formalise` reads your PDFs / images / LaTeX (optionally grounded in a NotebookLM knowledge base via `/fvs:kb-setup`) and produces Lean definition and spec files in a single pass.
-- **Iterative crypto loop:** for larger crypto formalisations, a topic-based, restartable loop of four stages:
-
-  `/fvs:crypto-plan` → `/fvs:crypto-execute` → `/fvs:crypto-eval` → `/fvs:crypto-followup` → repeat
-
-  A high-effort thinker authors each bounded plan; the executor runs it under a green-build guard; an adversarial eval tries to refute the spec, proof, and assumptions and ends in exactly one of ACCEPT / FOLLOWUP / HUMAN_RULING / BLOCKED; follow-up turns findings into the next plan (halting for a human ruling on modeling decisions).
+- **Iterative crypto loop:** for larger crypto formalisations, a topic-based, restartable loop with
+  an independent pre-execution review gate:
+
+  `/fvs:crypto-plan` → `/fvs:crypto-review` → `/fvs:crypto-execute` → `/fvs:crypto-eval` → `/fvs:crypto-followup` → `/fvs:crypto-review` → repeat
+
+  A high-effort thinker authors each bounded plan. Before execution, authenticated Codex
+  independently attacks the plan or follow-up under a read-only sandbox and returns an
+  evidence-backed APPROVE / APPROVE-WITH-EDITS / REJECT verdict. The executor runs an approved plan
+  under a green-build guard; the post-execution adversarial eval tries to refute the spec, proof,
+  and assumptions and ends in exactly one of ACCEPT / FOLLOWUP / HUMAN_RULING / BLOCKED. Follow-up
+  turns findings into the next plan (halting for a human modeling ruling) and is reviewed again
+  before execution.
 
   **Single- vs dual-runtime (`--codex`).** By default the loop is single-runtime — the thinking stages (`crypto-plan`, `crypto-eval`, `crypto-followup`) run the in-runtime `fvs-crypto-thinker`. Pass `--codex` to hand a stage's thinking to an independent **Codex CLI** thinker instead, so the adversarial planner/evaluator runs on a *different engine* than the executor and blind spots don't correlate. `crypto-execute` is the runtime-neutral executor and takes no `--codex`. Without the Codex CLI installed, a `--codex` stage stops with an install hint rather than silently falling back.
 

package/agents/fvs-executor.md

@@ -68,6 +68,7 @@ Your parent command provides `<execution_mode>` and `<research_findings>` tags.
    - Postcondition candidates
    - Similar spec examples as patterns
    - Dependency specs
+   - The complete target repository style guide and its mechanical limits
 2. Generate a Lean specification file containing:
    - Import statements
    - Spec theorem with appropriate postconditions
@@ -75,6 +76,9 @@ Your parent command provides `<execution_mode>` and `<research_findings>` tags.
    - Comments linking to the source function
 3. Write the spec file to the project-conventional Specs/ directory
 4. Use established naming convention: `{FunctionName}_spec`
+5. Treat the target style guide as a hard output contract. Wrap at its line limit (100 columns
+   when unspecified), and replace identifiers with three or more namespace dots by a scoped
+   namespace/open or a local name/abbreviation.
 </mode>
 
 <mode name="proof-attempt">
@@ -85,6 +89,12 @@ Your parent command provides `<execution_mode>` and `<research_findings>` tags.
 
 CRITICAL BEHAVIORAL CONSTRAINT: Work ONE sorry at a time. Write small tactic blocks (have, calc, unfold + step). The user checks that Lean compiles between each step.
 
+The theorem name and statement are immutable in ordinary proof-attempt mode: replace only the
+targeted proof `sorry`. If the user explicitly authorizes a statement edit, preserve its
+mathematical meaning and apply the complete target style guide to the edited declaration. Never
+introduce a line over the configured limit or an ordinary identifier with three or more namespace
+dots.
+
 1. Read the research findings to identify:
    - Which sorry to target (first unresolved, or as directed by user)
    - Available @[step] lemmas from dependencies
@@ -119,6 +129,17 @@ For spec-generation mode:
 - Express bounds from Rust source analysis, not guesses
 - Include `sorry` placeholder -- do not attempt proof
 - Follow lean-spec-conventions from the inlined reference
+- Follow the inlined target repository style guide as a hard constraint. It takes precedence over
+  generic template presentation, but never over mathematical/source fidelity.
+- Default to at most 100 columns when the guide has no explicit limit.
+- Prefer `namespace`, `open`, and local names/abbreviations over identifiers with three or more
+  namespace dots.
+
+For proof-attempt mode:
+- Follow the inlined target repository style guide for every inserted line.
+- Do not edit a theorem name or statement unless the user explicitly requested that semantic
+  surface. An authorized statement edit must pass the full style gate, not a legacy baseline
+  exemption.
 
 For map-code and plan modes:
 - Overwrite existing CODEMAP.md or PLAN.md (these are regenerated, not appended)
@@ -164,6 +185,7 @@ On failure:
 - [ ] Mode-specific output produced matching expected format
 - [ ] For proof-attempt: one sorry targeted at a time, small tactic blocks
 - [ ] For spec-generation: sorry placeholder included, correct Lean types
+- [ ] Target repository style guide followed; no new long-line or deep-qualification violation
 - [ ] For map-code/plan: complete structured document generated
 - [ ] Result returned with ## EXECUTION COMPLETE or ## NEEDS INPUT header
 - [ ] No @-references used (all context is inlined by parent)

package/agents/fvs-researcher.md

@@ -58,7 +58,9 @@ Your parent command provides a `<research_mode>` tag specifying what kind of res
 4. Check for existing stubs in .formalising/stubs/ for the target function
 5. Search for similar verified specs in the Specs/ directory to use as pattern examples
 6. Read dependency specs -- any functions called by the target that already have specs
-7. Analyze the function for:
+7. Read the inlined target repository style guide and identify its naming, namespace, line-length,
+   comment, and layout rules. Prefer repository examples that comply with that guide.
+8. Analyze the function for:
    - Control flow (branches, loops, error paths)
    - Arithmetic operations and overflow potential
    - Type dependencies
@@ -76,7 +78,9 @@ Your parent command provides a `<research_mode>` tag specifying what kind of res
 4. Gather tactic examples from similar proofs in the project
 5. Read dependency specs that may provide useful @[step] lemmas
 6. If user feedback is provided (error messages, goal state), incorporate it
-7. Return structured findings with:
+7. Apply the inlined target repository style guide when recommending tactic shapes or any
+   explicitly requested theorem-statement edit.
+8. Return structured findings with:
    - Current proof state (which sorry is targeted)
    - Available lemmas and tactics
    - Recommended proof strategy

package/bin/install.js

@@ -2909,6 +2909,32 @@ function install(isGlobal, runtime = 'claude') {
     failures.push('fv-skills');
   }
 
+  // The Aeneas sync command cannot operate without its mapping metadata. A
+  // recursive directory copy can otherwise look successful even when a
+  // packaging omission drops this single non-Markdown file, so verify both
+  // presence and the minimum schema explicitly (#29).
+  const syncMetaDest = path.join(skillDest, 'upstream', 'aeneas', '_sync-meta.json');
+  if (!verifyFileInstalled(syncMetaDest, 'Aeneas sync metadata')) {
+    failures.push('fv-skills/upstream/aeneas/_sync-meta.json');
+  } else {
+    try {
+      const syncMeta = JSON.parse(fs.readFileSync(syncMetaDest, 'utf8'));
+      if (
+        typeof syncMeta.upstream_source !== 'string' ||
+        !Array.isArray(syncMeta.mapping) ||
+        syncMeta.mapping.length === 0 ||
+        !syncMeta.tactic_renames ||
+        typeof syncMeta.tactic_renames !== 'object'
+      ) {
+        throw new Error('missing upstream_source, mapping entries, or tactic_renames');
+      }
+      console.log(`  ${green}✓${reset} Verified Aeneas sync metadata`);
+    } catch (e) {
+      console.error(`  ${yellow}✗${reset} Invalid Aeneas sync metadata: ${e.message}`);
+      failures.push('fv-skills/upstream/aeneas/_sync-meta.json (invalid)');
+    }
+  }
+
   // Copy agents to agents directory
   const agentsSrc = path.join(src, 'agents');
   if (fs.existsSync(agentsSrc)) {

package/commands/fvs/crypto-eval.md

@@ -50,8 +50,8 @@ NEVER `eval` a path.
 ```bash
 TOPIC_RAW="$1"
 case "$TOPIC_RAW" in
-  *[';|&$`()<>'*]* ) echo "FVS >> ERROR: topic contains shell metacharacters" >&2; exit 1 ;;
   *..*|*/* ) echo "FVS >> ERROR: topic contains '..' or '/' (path traversal); refusing" >&2; exit 1 ;;
+  *[![:alnum:]_[:space:]-]* ) echo "FVS >> ERROR: topic contains unsupported characters" >&2; exit 1 ;;
 esac
 SLUG=$(printf '%s' "$TOPIC_RAW" | tr -s '[:space:]' '-')
 ROOT=".formalising/fv-plans/$SLUG"
@@ -93,7 +93,7 @@ EXITS -- there is NO live cross-process bridge. The helper is EFFORT-ONLY: it pa
 
 ```bash
 # --codex mode: swap the in-runtime thinker for the FVS-owned Codex thinker (eval stage).
-node scripts/fvs-codex-think.mjs eval --topic "$ROOT" --effort xhigh
+node ~/.claude/scripts/fvs-codex-think.mjs eval --topic "$ROOT" --effort xhigh
 ```
 
 If `--codex` is passed but `codex` is unavailable, the helper surfaces its graceful install message
@@ -133,7 +133,8 @@ Review:    reviews/EVAL_{ITER}.md
 
 <codex_skill_adapter>
 The `--codex` flag swaps the thinker for a Codex thinker at THIS eval stage via the FVS-owned helper
-`scripts/fvs-codex-think.mjs` (`node scripts/fvs-codex-think.mjs eval --topic "$ROOT" --effort xhigh`).
+`~/.claude/scripts/fvs-codex-think.mjs`
+(`node ~/.claude/scripts/fvs-codex-think.mjs eval --topic "$ROOT" --effort xhigh`).
 The helper is FVS-owned and self-contained: it does NOT import or depend on the openai-codex plugin;
 it spawns `codex` via an argv array (never a shell string), is EFFORT-ONLY (passes `--effort xhigh`,
 NO `--model`), and points Codex at the topic folder as its working root. Coordination is

package/commands/fvs/crypto-execute.md

@@ -59,8 +59,8 @@ while [ $# -gt 0 ]; do
   esac
 done
 case "$TOPIC_RAW" in
-  *[';|&$`()<>'*]* ) echo "FVS >> ERROR: topic contains shell metacharacters" >&2; exit 1 ;;
   *..*|*/* ) echo "FVS >> ERROR: topic contains '..' or '/' (path traversal); refusing" >&2; exit 1 ;;
+  *[![:alnum:]_[:space:]-]* ) echo "FVS >> ERROR: topic contains unsupported characters" >&2; exit 1 ;;
 esac
 case "$ITER" in
   n[0-9]* ) : ;;
@@ -68,7 +68,7 @@ case "$ITER" in
 esac
 for FLAGVAL in "$EXEC_MODEL" "$EXEC_EFFORT"; do
   case "$FLAGVAL" in
-    *[';|&$`()<>'*]* ) echo "FVS >> ERROR: --model/--effort contains shell metacharacters" >&2; exit 1 ;;
+    *[![:alnum:]_.:/+-]* ) echo "FVS >> ERROR: --model/--effort contains unsupported characters" >&2; exit 1 ;;
   esac
 done
 SLUG=$(printf '%s' "$TOPIC_RAW" | tr -s '[:space:]' '-')

package/commands/fvs/crypto-followup.md

@@ -17,7 +17,8 @@ Convert the latest adversarial eval's findings into the next bounded follow-up p
 high-effort `fvs-crypto-thinker` (followup mode) re-derives the follow-up from the eval; this
 command body persists the returned plan under `plans/`.
 
-This command is the FOLLOWUP stage of the single-runtime loop (plan -> execute -> eval -> followup).
+This command is the FOLLOWUP stage of the loop. Every follow-up is independently reviewed before it
+is handed back to the executor.
 When the prior eval decided `HUMAN_RULING`, this command MUST HALT and ask the user for the modeling
 decision -- it NEVER fabricates a follow-up that silently picks one side of a modeling ruling.
 
@@ -51,8 +52,8 @@ shell metacharacters, QUOTE every path expansion, NEVER `eval` a path.
 ```bash
 TOPIC_RAW="$1"
 case "$TOPIC_RAW" in
-  *[';|&$`()<>'*]* ) echo "FVS >> ERROR: topic contains shell metacharacters" >&2; exit 1 ;;
   *..*|*/* ) echo "FVS >> ERROR: topic contains '..' or '/' (path traversal); refusing" >&2; exit 1 ;;
+  *[![:alnum:]_[:space:]-]* ) echo "FVS >> ERROR: topic contains unsupported characters" >&2; exit 1 ;;
 esac
 SLUG=$(printf '%s' "$TOPIC_RAW" | tr -s '[:space:]' '-')
 ROOT=".formalising/fv-plans/$SLUG"
@@ -133,7 +134,7 @@ EFFORT-ONLY: it passes `--effort xhigh` (>= xhigh enforced) and NO `--model`.
 
 ```bash
 # --codex mode: swap the in-runtime thinker for the FVS-owned Codex thinker (followup stage).
-node scripts/fvs-codex-think.mjs followup --topic "$ROOT" --effort xhigh
+node ~/.claude/scripts/fvs-codex-think.mjs followup --topic "$ROOT" --effort xhigh
 ```
 
 If `--codex` is passed but `codex` is unavailable, the helper surfaces its graceful install message
@@ -147,6 +148,15 @@ statements that must not change, allowed-`sorry` policy, stop conditions, the ve
 `nice -n 19 lake build` under the `set -o pipefail` / `${PIPESTATUS` guard, expected artifact
 updates).
 
+The artifact MUST also record:
+
+```
+Authoring runtime: {Claude Code | OpenCode | Gemini | Codex | Codex CLI}
+```
+
+Use `Codex CLI` for `--codex`; otherwise name the actual host runtime. This provenance is mandatory
+for `/fvs:crypto-review` to prove the reviewer is independent.
+
 ## Step 5: Run-end banner + next command
 
 ```
@@ -157,15 +167,15 @@ Decision:  {FOLLOWUP | HUMAN_RULING -> ruled}
 Plan:      plans/FOLLOWUP_PLAN_n{N}.md
 
 >> Next Up
-/fvs:crypto-execute <topic> n{N}
+/fvs:crypto-review <topic> n{N} --target followup
 ```
 
 </process>
 
 <codex_skill_adapter>
 The `--codex` flag swaps the thinker for a Codex thinker at THIS followup stage via the FVS-owned
-helper `scripts/fvs-codex-think.mjs`
-(`node scripts/fvs-codex-think.mjs followup --topic "$ROOT" --effort xhigh`). The helper is FVS-owned
+helper `~/.claude/scripts/fvs-codex-think.mjs`
+(`node ~/.claude/scripts/fvs-codex-think.mjs followup --topic "$ROOT" --effort xhigh`). The helper is FVS-owned
 and self-contained: it does NOT import or depend on the openai-codex plugin; it spawns `codex` via an
 argv array (never a shell string), is EFFORT-ONLY (passes `--effort xhigh`, NO `--model`), and points
 Codex at the topic folder as its working root. Coordination is ARTIFACT-MEDIATED: the Codex thinker
@@ -183,5 +193,7 @@ unchanged.
 - [ ] Latest `EVAL_nN.md` read; decision routed (`ACCEPT` stop / `BLOCKED` pause / `FOLLOWUP` author / `HUMAN_RULING` HALT).
 - [ ] On `HUMAN_RULING` the command HALTs and asks the user -- it NEVER fabricates a follow-up plan.
 - [ ] On `FOLLOWUP` the thinker is dispatched (`subagent_type="fvs-crypto-thinker"`) and the bounded follow-up plan written to `plans/`.
+- [ ] The follow-up records truthful `Authoring runtime:` provenance and routes next to
+      `/fvs:crypto-review --target followup`.
 - [ ] No bare `lake build`, no `gh` open/create, no generated-Lean write.
 </success_criteria>

package/commands/fvs/crypto-plan.md

@@ -17,7 +17,8 @@ executor plan. The high-effort `fvs-crypto-thinker` re-derives the plan from the
 the paper-grounded KB sources; this command body persists the returned plan under
 `.formalising/fv-plans/<topic>/{plans,reviews,sources,merge}`.
 
-This command is the PLAN stage of the single-runtime loop (plan -> execute -> eval -> followup).
+This command is the PLAN stage of the loop
+(plan -> independent review -> execute -> eval -> followup -> independent review).
 The plan it produces is RUNTIME-NEUTRAL: it must be executable by any runtime's executor with no
 thinker in the loop. The loop is restartable from its own on-disk records.
 
@@ -54,8 +55,8 @@ and friends), QUOTE every path expansion, and NEVER `eval` a path.
 TOPIC_RAW="$1"
 # reject shell metacharacters before the slug ever touches a path
 case "$TOPIC_RAW" in
-  *[';|&$`()<>'*]* ) echo "FVS >> ERROR: topic contains shell metacharacters" >&2; exit 1 ;;
   *..*|*/* ) echo "FVS >> ERROR: topic contains '..' or '/' (path traversal); refusing" >&2; exit 1 ;;
+  *[![:alnum:]_[:space:]-]* ) echo "FVS >> ERROR: topic contains unsupported characters" >&2; exit 1 ;;
 esac
 SLUG=$(printf '%s' "$TOPIC_RAW" | tr -s '[:space:]' '-')
 ROOT=".formalising/fv-plans/$SLUG"
@@ -64,7 +65,8 @@ mkdir -p "$ROOT/plans" "$ROOT/reviews" "$ROOT/sources" "$ROOT/merge"
 
 The four subfolders split the loop's records by role (artifact contract):
 - `plans/` -- `PLAN_nN.md` (high-level) + `EXEC_PLAN_nN.md` (bounded executor plan) + `FOLLOWUP_PLAN_nN.md`.
-- `reviews/` -- `EVAL_nN.md` (adversarial; leads with findings; decides ACCEPT / FOLLOWUP / HUMAN_RULING / BLOCKED).
+- `reviews/` -- pre-execution `PLAN_REVIEW_nN.md` / `FOLLOWUP_REVIEW_nN.md`, plus
+  post-execution `EVAL_nN.md` (decides ACCEPT / FOLLOWUP / HUMAN_RULING / BLOCKED).
 - `sources/` -- paper excerpts, theorem maps, advantage/probability normalization choices, and CACHED KB answers.
 - `merge/` -- branch integration state: the conflict files, the conflict themes, and the next safe action when an accepted iteration lands back on the project branch.
 
@@ -148,7 +150,7 @@ EFFORT-ONLY: it passes `--effort xhigh` (>= xhigh enforced) and NO `--model`.
 
 ```bash
 # --codex mode: swap the in-runtime thinker for the FVS-owned Codex thinker (plan stage).
-node scripts/fvs-codex-think.mjs plan --topic "$ROOT" --effort xhigh
+node ~/.claude/scripts/fvs-codex-think.mjs plan --topic "$ROOT" --effort xhigh
 ```
 
 If `--codex` is passed but the `codex` CLI is unavailable, the helper surfaces its graceful
@@ -160,6 +162,16 @@ The thinker (in-runtime or Codex) authors the plan; THIS command body writes:
 - `plans/PLAN_nN.md` -- the high-level plan.
 - `plans/EXEC_PLAN_nN.md` -- the bounded executor plan.
 
+Both artifacts MUST record a top-level metadata line:
+
+```
+Authoring runtime: {Claude Code | OpenCode | Gemini | Codex | Codex CLI}
+```
+
+Use `Codex CLI` when `--codex` authored the plan; otherwise name the actual host runtime. Never
+write a generic or guessed marker. `/fvs:crypto-review` uses it to prevent Codex self-review and
+fails closed when provenance is missing.
+
 Carry the BOUNDED-PLAN CONTRACT verbatim into `EXEC_PLAN_nN.md`:
 1. **Branch and current state** -- the branch name and what already compiles / is proven.
 2. **Exact target files and theorems** -- precise files + named theorems/defs; no "etc.".
@@ -185,14 +197,15 @@ Plans:     plans/PLAN_n{NEXT}.md, plans/EXEC_PLAN_n{NEXT}.md
 Sources:   {K} cached under sources/
 
 >> Next Up
-/fvs:crypto-execute <topic> n{NEXT}
+/fvs:crypto-review <topic> n{NEXT} --target plan
 ```
 
 </process>
 
 <codex_skill_adapter>
 The `--codex` flag swaps the thinker for a Codex thinker at THIS stage via the FVS-owned helper
-`scripts/fvs-codex-think.mjs` (`node scripts/fvs-codex-think.mjs plan --topic "$ROOT" --effort xhigh`).
+`~/.claude/scripts/fvs-codex-think.mjs`
+(`node ~/.claude/scripts/fvs-codex-think.mjs plan --topic "$ROOT" --effort xhigh`).
 The helper is FVS-owned and self-contained: it does NOT import or depend on the openai-codex plugin;
 it spawns `codex` via an argv array (never a shell string), is EFFORT-ONLY (passes `--effort xhigh`,
 NO `--model`), and points Codex at the topic folder as its working root. Coordination is
@@ -210,5 +223,7 @@ auto-picks a default, never writes an upstream artifact).
 - [ ] `$THINKER_MODEL` resolved via the model-profiles sequence; the thinker dispatched (`subagent_type="fvs-crypto-thinker"`) with inlined context.
 - [ ] KB grounded intensively when configured; cached under `sources/` and re-read before re-querying; loud-fail-once + labeled-degrade + `/fvs:kb-setup` when unconfigured.
 - [ ] The bounded-plan contract (stop conditions, verification commands `nice -n 19 lake build`, immutable public statements, allowed-`sorry`) is written into `EXEC_PLAN_nN.md`.
+- [ ] Both plan artifacts record truthful `Authoring runtime:` provenance; the next action is
+      independent `/fvs:crypto-review`, not direct execution.
 - [ ] No bare `lake build`, no `gh` open/create, no generated-Lean write.
 </success_criteria>

package/commands/fvs/crypto-review.md

@@ -0,0 +1,181 @@
+---
+name: fvs:crypto-review
+description: Send an initial or follow-up crypto plan to authenticated Codex for independent adversarial review
+argument-hint: "<topic> [nN] [--target plan|followup]"
+allowed-tools:
+  - Read
+  - Bash
+  - Glob
+  - Grep
+  - Write
+  - Edit
+---
+
+<objective>
+Put an FVS crypto plan through an independent, pre-execution adversarial review by the Codex CLI.
+Review either the initial `PLAN_nN.md` + `EXEC_PLAN_nN.md` pair or a
+`FOLLOWUP_PLAN_nN.md`, persist exactly one reviewer artifact under `reviews/`, then have the
+primary planning seat verify and triage every finding.
+
+This is not the post-execution `/fvs:crypto-eval` stage. It attacks the PLAN before an executor
+spends effort. Codex is the independent reviewer; it never authors or edits the plan.
+</objective>
+
+<execution_context>
+@~/.claude/fv-skills/workflows/crypto-review.md
+@~/.claude/fv-skills/references/crypto-plan-review.md
+@~/.claude/fv-skills/references/ui-brand.md
+</execution_context>
+
+<context>
+Topic and optional iteration/target: $ARGUMENTS.
+
+Default target selection is `followup` when `FOLLOWUP_PLAN_nN.md` exists, otherwise `plan`.
+The optional `--target` makes that choice explicit.
+</context>
+
+<process>
+
+## Step 0: Preflight Codex installation and authentication
+
+Before reading plan contents or doing any later work, verify that the Codex CLI is installed and
+signed in:
+
+```bash
+command -v codex >/dev/null 2>&1 \
+  && codex login status >/dev/null 2>&1 \
+  && echo "CODEX_OK" \
+  || echo "CODEX_NOT_READY"
+```
+
+If the result is `CODEX_NOT_READY`, STOP:
+
+```
+FVS >> CODEX ISN'T READY
+
+This review needs the OpenAI Codex CLI installed and signed in.
+1. Install: npm install -g @openai/codex
+2. Sign in: codex login
+3. Verify: codex login status
+
+Then re-run /fvs:crypto-review. There is no silent same-runtime fallback because that would not be
+an independent review.
+```
+
+## Step 1: Resolve topic, iteration, and target safely
+
+Treat all arguments as untrusted. Collapse topic whitespace to `-`, preserve meaningful
+capitalization, reject shell metacharacters, `..`, and `/`, quote every path, and never `eval`.
+
+```bash
+TOPIC_RAW="$1"
+case "$TOPIC_RAW" in
+  *..*|*/* ) echo "FVS >> ERROR: topic contains '..' or '/' (path traversal); refusing" >&2; exit 1 ;;
+  *[![:alnum:]_[:space:]-]* ) echo "FVS >> ERROR: topic contains unsupported characters" >&2; exit 1 ;;
+esac
+SLUG=$(printf '%s' "$TOPIC_RAW" | tr -s '[:space:]' '-')
+ROOT=".formalising/fv-plans/$SLUG"
+```
+
+Require an existing topic directory. Resolve `nN` from the explicit argument or the highest numeric
+plan/follow-up iteration; never use lexical ordering. Validate the iteration against
+`^n[1-9][0-9]*$`.
+
+Resolve the target:
+
+- `plan`: require both `plans/PLAN_nN.md` and `plans/EXEC_PLAN_nN.md`; output
+  `reviews/PLAN_REVIEW_nN.md`.
+- `followup`: require `plans/FOLLOWUP_PLAN_nN.md`; also expose the matching eval and original plan
+  when present; output `reviews/FOLLOWUP_REVIEW_nN.md`.
+- omitted/auto: choose `followup` when its file exists, otherwise `plan`.
+
+Refuse to overwrite an existing output. Preserve prior review history and ask the user to choose a
+new iteration or archive the old review deliberately.
+
+## Step 2: Enforce independent-review provenance
+
+This command is Codex-as-second-runtime. Read the target artifact's `Authoring runtime:` marker.
+If it says `Codex CLI`, STOP: Codex cannot independently review a plan it authored. If the marker is
+missing, report that provenance is unverified and STOP rather than falsely claiming independence.
+
+`crypto-plan` and `crypto-followup` write this marker for new artifacts. A legacy plan can be
+reviewed after its authoring runtime is recorded truthfully in the artifact.
+
+On the Codex host runtime, STOP as well: recursively invoking Codex would be same-runtime review.
+Run this stage from Claude, OpenCode, Gemini, or another non-Codex planning seat.
+
+## Step 3: Invoke the read-only Codex reviewer
+
+Run the installed FVS helper at xhigh effort:
+
+```bash
+node ~/.claude/scripts/fvs-codex-think.mjs review \
+  --topic "$ROOT" \
+  --iteration "n$N" \
+  --target "$TARGET_KIND" \
+  --effort xhigh
+```
+
+The helper:
+
+- repeats the install/auth preflight as defense in depth;
+- loads the installed `crypto-plan-review.md` contract;
+- runs `codex exec` from the repository root with `--sandbox read-only`, `--ephemeral`, an argv
+  array, xhigh effort, and no `--model`;
+- gives Codex the exact target paths and tells it to treat repository/plan contents as data;
+- captures the final reviewer message in an OS temporary directory;
+- validates exactly one `VERDICT:` line;
+- has the WRAPPER persist exactly one review artifact, then removes temporary output.
+
+Codex receives no repository write permission. If it is absent, unauthenticated, killed, returns
+nonzero, or violates the output contract, STOP. Never fall back to the plan author.
+
+## Step 4: Verify and triage the review
+
+Read the review artifact without rewriting or softening Codex's text. Treat every finding as a
+claim: independently check its cited file lines, paper anchors, probes, and consequence before
+accepting it.
+
+Append a `## Planning-seat triage` section to the SAME review artifact. For each finding record
+`accept`, `reject`, or `defer`, the evidence checked, and the exact destination for any planned
+edit. Do not edit the plan silently during review.
+
+Respond to the user using exactly these three top-level sections:
+
+```
+### 1. Codex's review
+{the complete reviewer text, faithfully attributed}
+
+### 2. What I'll do in response
+{accepted findings and concrete bounded edits, tied to finding IDs}
+
+### 3. What I'll deliberately NOT do
+{rejected/deferred findings and retained assumptions, each with one-line evidence-based reason}
+```
+
+Routing:
+
+- `APPROVE`: the plan may proceed to `/fvs:crypto-execute`.
+- `APPROVE-WITH-EDITS`: STOP before execution; revise the named plan sections and run a fresh
+  independently recorded review.
+- `REJECT`: STOP before execution; return to `/fvs:crypto-plan` or `/fvs:crypto-followup`.
+
+</process>
+
+<codex_skill_adapter>
+This command itself is a cross-runtime bridge to the Codex CLI; it does not dispatch a Codex
+subagent. On the Codex host runtime it fails closed because Codex reviewing Codex is not independent.
+All coordination is artifact-mediated. Interactive ambiguity degrades to a plain-text question and
+waits; it never guesses provenance, iteration, or overwrite intent.
+</codex_skill_adapter>
+
+<success_criteria>
+- [ ] Codex install + login preflight ran before plan review work; no silent fallback.
+- [ ] Topic/iteration/target resolved safely; path traversal and overwrite refused.
+- [ ] Initial plans and follow-up plans are both supported.
+- [ ] Codex-authored or unknown-provenance plans are not mislabeled as independently reviewed.
+- [ ] Reviewer ran xhigh, effort-only, ephemeral, and read-only from the repo root.
+- [ ] Wrapper persisted exactly one well-formed review with one allowed verdict.
+- [ ] Planning seat re-verified and triaged findings without softening Codex's review.
+- [ ] Non-APPROVE verdicts stop before execution.
+</success_criteria>

package/commands/fvs/formalise.md

@@ -5,7 +5,7 @@ argument-hint: ""
 allowed-tools:
   - Read
   - Skill
-requires: [lean-formalise, lean-refactor, crypto-plan, crypto-execute, crypto-eval, crypto-followup]
+requires: [lean-formalise, lean-refactor, crypto-plan, crypto-review, crypto-execute, crypto-eval, crypto-followup]
 ---
 
 Route to the appropriate paper-formalisation skill based on the user's intent.
@@ -17,10 +17,14 @@ When invoked WITH a request, match it against the table below and invoke the mat
 | Formalise a paper/topic into Lean (one-shot) | fvs:lean-formalise |
 | Refactor / simplify / decompose a proof | fvs:lean-refactor |
 | Start/plan a topic-based crypto formalisation iteration | fvs:crypto-plan |
+| Independently review an initial or follow-up crypto plan | fvs:crypto-review |
 | Run the current iteration's plan | fvs:crypto-execute |
 | Adversarially evaluate the iteration | fvs:crypto-eval |
 | Write a follow-up plan from eval findings | fvs:crypto-followup |
 
-The four `crypto-*` stages are the iteration LOOP (plan -> execute -> eval -> follow-up), restartable from records under `fv-plans/<topic>/`. `lean-formalise` stays the one-shot paper-track command; the loop sits beside it for topic-based, multi-iteration crypto work.
+The crypto iteration loop is
+plan -> independent review -> execute -> eval -> follow-up -> independent review -> repeat,
+restartable from records under `fv-plans/<topic>/`. `lean-formalise` stays the one-shot paper-track
+command; the loop sits beside it for topic-based, multi-iteration crypto work.
 
 Invoke the matched skill directly using the Skill tool.