---
key: process.independent-review-rubric
title: 2026-07-21 — Independent cross-model review is mandatory on risky diffs; a skip is a stated, auditable exemption (#542)
status: active
since: '2026-07-21'
supersedes: none
superseded-by: none
rule: Run an independent review pass — preferably a different model family, otherwise a cold-context review-only agent — on any diff touching locks/concurrency, auth/security, API write-path handlers, or DB migrations, or larger than ~150 changed C# lines; skip only for a pure-SPA/docs leaf with no server-state effect, and state the skip and its reason in the PR or close comment.
signals: 'cross-model review rotation · correlated blindspots · skip rubric · self-exemption · review-only agent · quota exhaustion · reviewer does not implement · paths: n/a · issues: #542, #235, #250'
mechanics: rotation — Codex reviews Claude-authored changes, Claude reviews Codex-authored changes; use whatever native integration is installed (client helpers like `codex:rescue` are optional accelerators, not protocol dependencies). On quota/tool exhaustion, fall back to a cold-context review-only agent in the current client and retry cross-model next window. Independent reviewers do review and stuck-diagnosis work only — never implementation on the same change they review.
---

The justification is correlated blindspots: independent model families miss *different* classes of
defect, so a single reviewer on a risky diff is the gap, not a saving. #235 (a reviewer clearing a lock
as sound because it never grepped for every producer) and #250 (a vacuous negative control that
silently ran a stale dll) are both cases the second, differently-blind pass caught.

The skip clause is deliberately narrow and deliberately loud. A self-exemption is an auditable claim,
not a vibe — silence is indistinguishable from forgetting, so the exemption must be written down where
the merge record can be re-read later.
