Comity Intuition

A verdict anyone can read. Every time your agent says "Done!", you get what changed, what could go wrong for the business, and what to ask a developer. No jargon.

tiny-shop · .intuition/reports/2026-10-21T18-18-29-b22d1d.html

• Safe to ship

  Nothing in this change needs a second look. Small, safe changes get a short review.

• Ask a developer about X

  One specific thing deserves a developer's eyes before it goes live, and Intuition names it.

• Don't ship yet

  A serious problem the reviewer is confident about, explained in terms of your product and your users.

Claude Code · tiny-shop

Review: ● Don't ship yet

In short: The staff discount and the $5 international shipping both work, but anyone can claim to be staff and get 50% off.

Things to check

- High risk (money): any shopper can get the 50% staff discount…

- Medium risk (reliability): existing checkouts will start failing…

Questions to settle

1. How will checkout confirm that someone using STAFF50 is really an employee?

Full report: .intuition/reports/2026-10-21T18-18-29-b22d1d.html

How it works. Because the reviewer is a copy of the same session, it already knows what you asked for, what the agent tried and why.

1. 01

   Your agent finishes

   You ask Claude Code or Codex for a feature. When it says it's done, Intuition works out exactly what changed during that task. If nothing changed, it stays silent.

2. 02

   A forked copy reviews it, read-only

   A copy of the session, with the full memory of the conversation, reads the changes. It can read and search files, and that's all: no edits, no commands, no internet. Your original session isn't changed.

3. 03

   You get a plain-English verdict

   Your agent shows the review in the chat, close to word for word, and saves a one-page HTML report next to it that you can open or forward to anyone.

npx comity-intuition config set secondOpinion codex

What it checks. Business risks you can point to in this change, each with how sure the reviewer is and where it is. No style nits, no generic advice.

• money

  Money

  Discount codes that stack into free orders, customers charged twice when a payment is retried, a $100 gift card sold for $1.

• security

  Security

  Admin pages anyone can open, a live payment key saved in the code, a search box that lets strangers run database commands.

• data

  Data

  A nightly cleanup that deletes paying customers, or a database change that throws away phone numbers your reminders still need.

• privacy

  Privacy

  Social Security numbers copied into logs, invoices any customer can download, a customer list open to the whole internet.

• users

  Your users

  Changes customers will feel, like a 40%-off "we miss you" email that goes out again on every release.

• reliability

  Reliability

  Existing apps and forms that stop working after the change ships, and background jobs that overload the system.

• legal

  Legal

  Marketing email to people who unsubscribed, and other changes that put consent or anti-spam rules at risk.

• cost

  Cost

  An AI feature that re-summarizes every support ticket every minute and quietly runs up a large bill.

Does it actually catch things? We built a 31-case benchmark of small real-world projects: 20 changes with a planted problem, and 11 harmless changes that should stay green.

• 20/20planted problems caught by the Claude Code reviewer
• 11/11harmless changes kept safe to ship, with no false alarm
• 8/8cases passed in real Claude Code sessions, through the hook

Final runs of October 21, 2026 (six Codex cases come from the run just before, after Codex hit its usage limit). A planted problem counts as caught when the verdict is red or yellow and the review names the problem as a medium or high risk. Reading grade is the average US school grade level of the reviews' wording (lower is easier). Codex's one miss still came back "Don't ship yet", but didn't mention that people who had unsubscribed would get the new marketing email. Every case and every review on GitHub

100% local. No account, no server, no telemetry. It runs on the AI subscription you already have.

• Runs on your computer

  Intuition is a command-line program and a pair of agent hooks. There's no Comity server, and your code never goes to Comity.

• No account, no telemetry

  Nothing to sign up for. No analytics and no tracking: nothing phones home.

• Your agent, your subscription

  Reviews go through the claude or codex program you already use, so your code goes to the same AI provider, under the same terms, as when your agent wrote it.

• A read-only reviewer

  The reviewer can read and search files, nothing more. Anything written in your code or the conversation is treated as material to review, never as instructions.

• Your repository is left alone

  Snapshots use git's own storage and don't touch your files, staging area, branches or history. Intuition never commits or pushes.

• Reports stay with you

  Every review is saved in your project's .intuition/reports folder, which keeps itself out of git. The reviewer is told never to copy secret values into a report.