v1.62.0.0 feat: add /grok skill for xAI second opinion from Claude Code

[ljodea]

Summary

Adds /grok — the /codex twin for an independent second opinion from Grok Build CLI while working in Claude Code.

Three modes, same contract as /codex:

• review — diff-scoped [P1]/[P2] findings + pass/fail gate
• challenge — adversarial failure-mode review
• consult — open Q&A with session resume (-r / -c)

Default model: grok-4.5 (overridable with -m). Always --permission-mode plan (read-only).

Why this PR (not #2016)

#2016 was the first cut. It drifted (VERSION behind main, merge conflicts, process gaps) and became hard to review. This re-lands the same product on current main as one clean commit:

• Host exclusion fixed first-class: non-Claude hosts skip /grok like /codex
• Correct VERSION claim (1.62.0.0; open title claims already use 1.61.0.0)
• Tighter surface: skill + probe + tests + review-report row + docs inventory

Out of scope (intentionally):

• Grok as a host → Add official support for grok Build (xAI) #2028 (hosts/grok-build.ts) — orthogonal
• Plan-review fallback chain when Codex fails → feat(outside-voice): add llm CLI fallback between Codex and Claude subagent #1631 — separate product decision

Implementation

Piece	Role
grok/SKILL.md.tmpl	skill workflow
bin/gstack-grok-probe	auth (~/.grok/auth.json, $XAI_API_KEY/$GROK_API_KEY), timeout, telemetry
test/grok-hardening.test.ts	probe + invocation-contract invariants
scripts/resolvers/review.ts	grok-review row in GSTACK REVIEW REPORT
hosts/*	skipSkills: [..., 'grok'] on every non-Claude host

Usage (after merge + ./setup)

/grok review
/grok challenge security
/grok Is this migration ordering safe?

Requires grok on PATH and auth via grok login or $XAI_API_KEY.

Test plan

• bun test test/grok-hardening.test.ts (11/11)
• bun test test/host-config.test.ts test/skill-validation.test.ts test/gen-skill-docs.test.ts (green; /grok Claude-only assertions)
• bun run gen:skill-docs --host all — no gstack-grok under external host output dirs
• CI free suite on this PR

Supersedes #2016.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[ljodea]

Note on the hosts-wave hold (time-attack/gstack#1): /grok was cherry-picked then dropped because the wave verifier’s Grok Build account hit 402 usage balance exhausted — not this PR’s author, not a leaked token (auth is local ~/.grok/auth.json / $XAI_API_KEY only).

This PR stays open and ready. Happy to post a live /grok review receipt when useful, or re-include once the consolidator has balance again.

[time-attack]

@ljodea will review when my grok usage limit gets reset

[time-attack]

@16francej — recommend closing this PR because it is superseded by the provider-neutral work in #619. This standalone skill duplicates provider dispatch and still has unresolved CLI behavior, timeout, session, result-handling, and safety or security problems. Credit #2241 for its Grok research, carrying forward only provider scenarios confirmed against supported versions.