Chapter 18

Verify the Result Separately From the Implementation

The executor knows its own intent and tends to read the diff through it. An independent review starts from the contract and the actual patch, repeats the checks, and tries to disprove readiness. In the companion project part of this work is done by a deterministic review gate - plain code, not an opinion.

TypeScript

export function reviewChange(
  contract: TaskContract,
  changed: readonly string[],
  commandResults: readonly CommandResult[]
): ReviewReport {
  const findings: string[] = [];
  const evidence: string[] = [];
  if (changed.length === 0) {
    findings.push("No files changed");
  }
  for (const path of changed) {
    if (!allowed(path, contract)) {
      findings.push(`Changed file is outside allowed scope: ${path}`);
    }
  }
  for (const result of commandResults) {
    evidence.push(`${result.label}: exit=${String(result.code)}, timeout=${String(result.timedOut)}, outputLimited=${String(result.outputLimited)}`);
    if (result.code !== 0 || result.timedOut || result.outputLimited) {
      findings.push(`Verification failed: ${result.label}`);
    }
  }
  if (commandResults.length < contract.acceptanceChecks.length) {
    findings.push("Not every acceptance check has command evidence");
  }
  return {
    passed: findings.length === 0,
    changedFiles: [...changed],
    findings,
    evidence
  };
}

The order of an independent review goes from contract to facts: read the original task contract without the author's explanation, check the actual changed file set and every hunk, match the new behavior against the acceptance criteria, run the commands yourself or check immutable CI artifacts, look for negative cases (invalid input, concurrency, authorization, rollback), and separate a blocker from an improvement.

Here it's important not to overrate one convenient mechanism.

A checkpoint is not Git. Claude Code and Cursor document checkpoints for reverting to a state of agent edits, and both warn plainly that checkpoints don't replace version control: external commands can change files outside the mechanism. Before risky work you need a clean Git state, branch, or worktree.

The work is split between two different reviewers. The deterministic gate checks scope, exit codes, artifact presence, typecheck, and policy with plain code. The model review looks for architectural risk, a missing case, and the quality of the explanation - a separate reviewer with read-only tools.

Don't ask the author only to confirm themselves. "Make sure it's all correct" keeps the same context and assumptions. Give the reviewer the original contract, the diff, and the commands - but not the conclusion "the solution is right."

The engineering model is assembled in full. Next, three chapters break it down on concrete products - starting with Codex.

Knowledge check

Why review in a fresh context instead of asking the author to confirm themselves?

Verify the Result Separately From the Implementation

Links