Two Green Checks, One Opinion
Fabrica went up on my portfolio last Saturday. It is the small agent team I have been building for the past month, the one I said I would never have to open. It takes a goal, drafts the specs, writes the code, reviews the code, and ships the work, with me watching from a distance that keeps growing.
Publishing it meant writing a project description, and one sentence of it arrived fully formed: “The split is cross-vendor on purpose: one model writes and a different one reviews, so their blind spots don’t line up.”
I wrote it the way you write down settled things. Claude writes, Codex reviews. Of course. It sits on the page looking like the summary of a decision someone made carefully, weighing alternatives at a whiteboard.
A few days later I went looking for that decision and could not find it. There was no moment where I compared reviewers and chose the rival vendor for defensible reasons. I wired the team that way on instinct and wrote the justification afterward, in one pass, for an audience.
The sentence makes a specific claim about how review works. I published it before I ever checked it.
Review has always been borrowed eyes
Start with what review is for, because the sentence leans its whole weight on it. A code reviewer is usually not a better programmer than the writer. Half the time they know that corner of the codebase less well. What they have is a different history. Different bugs have burned them, so they carry different habits of suspicion, different places where their eyes narrow, different assumptions about where code tends to lie. When they read a diff, they read it against a different set of scars.
That difference is the entire engine. My blind spots are invisible to me; that is what makes them blind spots, and no amount of my own diligence lets me see around them. Review borrows a second not-seeing, shaped differently from mine, and bets that the two shapes fail to overlap where it counts. Everything else about the institution (the approval button, the comment thread, the etiquette of nitpicks) is scaffolding around that one ingredient.
Seen that way, putting a model in the reviewer’s chair looks like a straightforward upgrade to an old arrangement. This reviewer never gets tired, never skims the middle of a long file, never approves something to get to lunch. It reads every line of every diff with the same attention, at any hour, and it costs almost nothing to ask again. Same institution, better economics. That was the comfortable way to understand what I had built.
A second glance is not a second head
The comfortable framing survives exactly as long as you avoid asking who is in the chair.
In most agent setups, the model reviews its own output. The loop even looks rigorous from the outside: a writing pass, then a review pass with a stern prompt about being critical, then revisions, then approval. All the ceremony of review is present and running.
But the thing that produced the mistake is the thing checking for it. Whatever habit led the model to reach for the wrong idiom, to trust the wrong pattern, to hold the wrong belief about what that function returns under load, is still there, unchanged, when the model comes back to read the diff. The reviewer knows the same idioms, trusts the same patterns, holds the same wrong belief. It will reach the same conclusion with the same confidence, because it is the same head.
A clean context window does not change this. Clearing the conversation gets you the same head on a blank morning, never a different person.
Even my own self-review manages what the model cannot. When I reread code I wrote a month ago, something real has changed in the reader: I have new scars, I have forgotten my clever intentions, I arrive as a slightly different person than the one who wrote it. The model arrives identical, forever. Its second glance is its first glance, repeated.
So same-model review keeps the ritual and quietly loses the ingredient. Comments still get made, and some are even useful, because the shallow catches (typos, dead code, an unhandled error) never required a different head. Then the approval lands, the check turns green, and the green means less than it looks like it means. The blind spots were never examined. The only reader available shares every one of them.
Two vendors, and the reviewer never hears the pitch
Fabrica is wired against that, and the sentence on its page compresses two separate choices into one clause. The visible choice is the vendor split. Claude writes the code; Codex reviews it. Two companies, two training runs, two sets of habits, and at least the weights reading the work did not write it. Their not-seeing is shaped differently, and that difference is the whole point of borrowing eyes.
The other choice is the one nobody asks about, and I think it carries as much weight: the two never share a session. The pull request is the only channel between them. There is no conversation where the writer walks the reviewer through the change, answers each doubt as it forms, wears the objections down one by one. Codex meets the work the way an outside reviewer would, with only the issue and the diff, and forms its own view of what the change is before anyone tells it what to think.
That rule exists because a writer’s head is reliably good at persuasion, and persuasion is precisely what a review cannot survive. A doubt negotiated away in conversation looks identical to a doubt resolved. Keeping the two apart keeps every objection on the record, in the open, where I can read it later and decide for myself whether it was answered or just outlasted.
What the arrangement buys is disagreement that means something. A same-head reviewer can only surface the doubts the writer was already capable of having. When Codex pushes back on a change, the pushback is information Claude could not have produced about itself, a reading from outside the writer’s own head.
In the week since, as I watched the team run, the sentence looked earned. Two heads, blind spots misaligned, an old institution rebuilt with better economics. It held right up until I asked where the two heads had come from.
The blind spots line up anyway
The sentence says their blind spots do not line up; the honest version is that they line up less. Two human reviewers diverge because their lives diverged. One spent five years inside embedded firmware and flinches at every unchecked buffer; the other came up through distributed systems and assumes every network call will eventually lie. Their scars are uncorrelated because their histories are. That is what made borrowed eyes work: you were borrowing a different life.
Two frontier models are not two lives. They are trained on largely the same public web, the same open-source corpora, the same popular answers to the same popular questions, with the same inherited bugs sitting in the same beloved idioms. They are tuned against similar benchmarks and ranked on the same leaderboards, and that pulls their judgment toward the same rewarded shape. In The Average of the Public Web I argued that a model’s knowledge is the average of what people chose to publish. I meant it about knowledge. It applies with at least as much force to judgment: two averages of the same web can disagree about a diff, but they cannot disagree the way two lives do.
So the vendor split buys me the difference between two training runs, when what review historically ran on was the difference between two histories. The margin is real, and I will keep it. But the blind spots rhyme. Whatever the public corpus holds wrong, both of my reviewers hold wrong together, in the same direction, with the same confidence. What neither has seen, neither can flag, and neither can tell me there was something it could not flag.
And the wiring I did at home is the wiring everyone is doing. Agent review is turning into a checkbox, a CI step, a default in the coding tools shipping this year, and each team that flips it on draws its reviewer from the same short list of vendors. Seat by seat, the industry is swapping thousands of reviewers with uncorrelated scars for a handful of heads with correlated ones. More code is being reviewed than ever, every pull request read closely, every line considered. The number of genuinely different readers has never been smaller.
Security people named this shape more than two decades ago. In 2003, Dan Geer and six co-authors argued that a computing world running one operating system had turned a private product choice into a public risk: when every machine runs the same software, every machine shares the same flaws, and one bug becomes everyone’s bug on the same day. Code review is walking into the same arithmetic. A class of bug that every frontier model misses is a class of bug that ships everywhere at once, approved, unanimous, wearing a green check.
The failure mode of a review monoculture is not louder errors. It is shared silence.
Agreement is not evidence
So the sentence turns out to be true enough for a project page, and not quite true enough for me. The split widens what the union of two heads can see, it keeps every objection in the open, and the friction between them catches things a single head reading its own work would have waved through. What it cannot do is make the two silences independent. The design was right; the confidence I typed it with was borrowed.
There is one head in the loop whose blind spots genuinely do not line up with either vendor’s, and it is mine. That is no credit to my reviewing; on thoroughness I lost to these things some time ago. My scars are simply local: this codebase, these users, the specific ways my own systems have failed me in the middle of the night. Almost none of that ever reached the public web for anyone’s model to average.
The practice I have settled on is the reverse of the one I expected to need. I do not read every diff; that was the point of building the team, and I am not walking it back. When the writer and the reviewer disagree, I mostly leave them to it. A standoff means the system is looking hard at something, and it comes to me on its own when it cannot resolve itself. The runs I have started reading are the smooth ones. When Claude writes a change that matters and Codex approves it without friction, I open the diff myself, because from inside the system, honest agreement and shared blindness look exactly the same. Only a head outside the correlation can tell one from the other, and this team has exactly one of those left.
The habit has a familiar shape; a week ago I wrote about inventing reasons to keep a hand on a finished thing. Those reasons I had to manufacture. This one was in the design before I went looking for it.
The sentence itself stays on the page. The version I keep for myself is longer and less sure of itself: two models are better than one, and further from two than they look. Their unanimous approval is either two readers agreeing or the same head twice, and nothing inside the loop can say which. When both of them sign off, I count one opinion, not two. The second is mine to give.