Rewrite grok delegation mechanics around verified behavior

[kelchm]

Replaces #6, whose guidance was built on two claims that don't survive testing.

Why #6 was wrong

Both of its central claims trace back to experiments run inside /tmp:

Claim in #6	Verdict
--sandbox doesn't prevent edits to the working dir	False — testing artifact
-w worktree gives "effective read-only protection"	False, and unsafe
plan mode cancels on any tool call	Partly true — it cancels repo/shell calls
Input ceiling between 119 KB and 140 KB	Does not reproduce

• The sandbox claim. Grok's read-only profile leaves /tmp, /var/tmp, /var/folders and ~/.grok writable by design, so a repo under any of those is unprotected while sandbox-events.jsonl still logs "enforced":true. The event log shows the original experiments ran under /private/tmp/.../scratchpad/. Re-run outside /tmp, grok tried the edit tool, sed -i, echo >>, and creating a new file — all four returned Operation not permitted.
• The -w claim. In headless mode (-p and --prompt-file) the flag is silently ignored: no worktree is created, pwd is the real checkout, edits land there, and nothing is printed to stderr. Combined with --always-approve, Update Grok review mechanics #6's recipe was strictly more dangerous than the one it replaced.
• The input ceiling. 151 KB (realistic content) and 204 KB (synthetic, needles at top/middle/bottom) prompts were both read in full, including under plan mode.

What else this corrects

• Grok does ship a /review skill that works headless, with --local / --branch / --pr modes — the closest analogue to codex review. The old skill asserted grok had none and hand-rolled a replacement.
• --tools / --disallowed-tools fail OPEN. One unrecognized name anywhere in the list silently restores the entire toolset (exit 0, no warning). The vendor README's tool tables are wrong: it documents bash and run_terminal_cmd; the real tool is run_terminal_command. --deny fails closed with a hard error, so the guard is built on deny rules.
• grok --sandbox read-only is not codex -s read-only. Verified: codex blocks writes in both $HOME and /tmp; grok blocks only outside its writable exceptions.
• The "physically can't hit the network" line in grok-review was false — curl returned 200 under the read-only sandbox on macOS (seccomp is Linux-only).

Changes

• CLAUDE.md — new grok Mechanics block: /review, custom-stance, and implement recipes, plus the verified traps.
• grok-review — delegates to the bundled /review instead of reinventing it; keeps a custom-stance path since /review takes no prompt; repo-scoped deny rules (a blanket Write(**) breaks /review's notes file).
• grok-implementation — new, mirroring codex-implementation. Closes a coverage gap: grok-4.5 is the designated default implementer but had no skill, while the fallback (codex) did.

Verification

Guard profiles were run against an adversarial canary prompt (modify a tracked file, create a new file, append via shell, write outside the repo, delegate to a subagent), with controls to prove a breach is detectable:

Profile	Trials	Result
deny rules + sandbox	3	HELD
deny rules + sandbox, shell allowed	3	HELD
deny rules alone, no sandbox	3	HELD
sandbox alone, repo in /tmp	2	BREACHED (enforced=true)
--tools with one bad name	1	BREACHED
--always-approve only	1	BREACHED

Findings were independently reviewed by gpt-5.6-sol, which corrected two overreaches now reflected above (plan mode does not cancel all tool calls; the prompt-offload mechanism is inferred, not established).

Caveats

• Verified on grok 0.2.118 / macOS. The installer now ships 1.0.0 — the traps above should be re-verified there, particularly /review, which is now the centerpiece.
• Linux/Landlock was not tested. Guidance is written so the portable layer (--deny) carries the guarantee and the OS sandbox is defense-in-depth only.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f51d30ee-7bec-4ae2-8e7d-48a8e10643f1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}