reviewing a plan
A plan can read perfectly and still be wrong. It can cite a function that does not exist, an import that moved, a dependency nobody built. Review is not a stamp on prose that sounds right. It is an adversarial read, and it happens twice: once on the plan before you build, once on the diff before you merge. The point is the same both times, and it is cheap: catch the wrong call while it is still a paragraph, not expensive code to unwind.
twice
Review lands twice, on two different things. The plan asks whether the design is right, before a line is written. The diff asks whether the implementation is actually right, adversarially, before it merges. A plan approved cleanly can still be built wrong; a green test suite can still ship the wrong behavior. Two gates, one question: is this correct, or does it only look correct.
design gate, then implementation gate, one question at each
the posture
The failure mode of review is agreement. A reviewer who reads to approve finds nothing; a reviewer who reads to refute finds the one path that does not hold. So the posture is adversarial: not "do the tests pass" but "find the ways this is wrong." Every path, symbol, and number in a plan is a claim to verify against the real code, not a fact to trust. If reality contradicts the plan, the plan is what changes; quietly coding around it is how the defect ships.
depth
Review is not one size. A low-risk plan is a self-check against the anti-patterns, a careful read by the author. A high-risk one earns a real reviewer, a round or two, and a fixed rubric so the bar is repeatable and not a mood. The rule is uncomfortable and correct: a high-risk plan approved with zero scrutiny is not fast. It is unreviewed.
the stack
Five dimensions, scored: schema conformity, architecture, dependency correctness, and the rest. Fast, repeatable, mechanical.
the floor, every planA senior reviewer's checklist made explicit: anti-hallucination, substrate verification, the roads not taken. Loadable on any model.
medium and upSeveral models from different families read the same plan and vote. Diversity catches what redundancy misses.
when being wrong is expensivegates
Two rules keep a control honest, and both are about saying in advance what will happen.
A gate, a limit, a mandatory step. It ships advisory first, gets measured against known-good and known-bad, and graduates to blocking only when the numbers clear a bar set in advance. You do not flip a gate on by fiat. That trial has a name and a shape: the soak.
evidence, then authorityA review that loops states when it stops: the agreement bar, and what happens if it is not met, which is to escalate to a human. A loop with no exit is a hang, not a process.
a stated stopping rule