Add independent Claude and Codex cross-review

[sarthakagrawal927]

Why

Claude and Codex have different review failure modes. Running both against the same immutable change can improve bug discovery, but CodeVetter currently records one deterministic review executor per run. A naive second-opinion feature could introduce anchoring, hide disagreements, double-count findings, or imply that model consensus is executable proof.

CodeVetter needs a Rust-owned cross-review contract that preserves independent provenance, qualifies every candidate against source, and measures whether the second reviewer adds real recall without silently weakening precision, latency, or cost reporting.

What

In scope

• Add an explicit cross-review strategy that runs Claude and Codex as two independent sequential passes over the same exact target, policy, units, and repository context.
• Prevent the second reviewer from seeing the first reviewer output.
• Preserve one manifest, attempts, raw candidates, qualification result, usage, duration, and limitations per executor.
• Produce a deterministic composite receipt that exposes corroborated, Claude-only, Codex-only, conflicting, rejected, stale, and unresolved findings.
• Base the review outcome on the union of source-qualified findings. A unique high-risk finding remains visible and blocking even when the other agent is silent.
• Project the same strategy and receipt semantics through native Review, the codevetter CLI, persisted receipts, and read-only MCP inspection.
• Benchmark cross-review against each single reviewer on the caught-bug corpus, including recall, false-positive burden, wall time, and observed usage or cost.

Out of scope

• Agent agreement does not create executable proof or upgrade a verdict to passed.
• No LLM judge merges findings or decides which reviewer is correct.
• MCP does not gain review-start, cancellation, credential, or provider authority.
• No provider credentials enter receipts, prompts, logs, or fixtures.
• No silent fallback to one reviewer when cross-review was requested.

Design

sequenceDiagram
    participant Surface as Native or CLI
    participant Rust as Rust review coordinator
    participant Claude
    participant Codex
    participant Qualifier as Deterministic qualifier
    participant Store as Receipt store

    Surface->>Rust: Exact target plus cross-review strategy
    Rust->>Claude: Immutable units and policy
    Claude-->>Rust: Provenanced candidates
    Rust->>Codex: Same immutable units and policy, no Claude output
    Codex-->>Rust: Provenanced candidates
    Rust->>Qualifier: Both candidate sets plus exact source
    Qualifier-->>Rust: Qualified union and disagreement classes
    Rust->>Store: Per-agent manifests plus composite receipt
    Rust-->>Surface: Bounded verdict, evidence, limits, usage, latency

Loading

Rust owns orchestration, exact-target binding, cancellation, qualification, reconciliation, persistence, and verdict semantics. Sequential execution avoids local resource contention and keeps cancellation ownership simple while retaining independent prompts. The composite finding key uses source-qualified identity and normalized evidence anchors; it never merges solely on title similarity. Corroboration is recorded as review coverage, not correctness proof.

If either requested executable is unavailable, the preflight is blocked before the first pass. Cancellation during Claude stops the run without starting Codex. Cancellation during Codex retains Claude evidence as an incomplete partial receipt but cannot produce a complete cross-review claim.

Native Review shows one Cross-review choice, pass progress, reviewer-specific provenance, agreement and disagreement filters, combined qualified findings, total duration, and observed usage. CLI uses the same versioned input and receipt. Read-only MCP may inspect the persisted composite and per-agent evidence only.

Specs

Requirement: Cross-review passes remain independent

CodeVetter SHALL run Claude and Codex against the same immutable target, units, policy fingerprint, and repository context without exposing either reviewer output to the other.

Scenario: The second reviewer starts

• WHEN the Claude pass completes and the Codex pass begins
• THEN Codex receives the original canonical review prompt and source context
• AND receives no Claude findings, rationale, transcript, or confidence.

Requirement: Qualified union determines review risk

CodeVetter SHALL preserve every source-qualified finding from either reviewer and SHALL NOT require reviewer agreement for a finding to remain actionable.

Scenario: Only Codex finds a high-risk bug

• WHEN Codex produces a source-qualified high-risk finding and Claude is silent
• THEN the composite receipt labels the finding Codex-only
• AND the review remains blocked or needs attention according to the existing deterministic verdict policy.

Requirement: Corroboration is not executable proof

CodeVetter SHALL report reviewer corroboration separately from runtime evidence and SHALL NOT convert agreement into a correctness pass.

Scenario: Both reviewers report no findings

• WHEN Claude and Codex complete with no qualified findings
• THEN the receipt records complete cross-review coverage
• AND correctness remains no-confidence unless executable evidence independently proves it.

Requirement: Partial execution fails closed

CodeVetter SHALL expose which passes completed and SHALL NOT label an interrupted or unavailable two-agent run as complete cross-review.

Scenario: Codex is cancelled after Claude completes

• WHEN the operator cancels during the Codex pass
• THEN the active owned process is terminated
• AND Claude evidence remains inspectable with an incomplete cross-review limitation
• AND no composite pass claim is produced.

Requirement: UI, CLI, and MCP share one contract

CodeVetter SHALL project the same strategy, agent identities, finding classes, qualification states, limitations, and receipt identity through native UI, CLI JSON, persistence, and read-only MCP inspection.

Scenario: A persisted cross-review is inspected through two surfaces

• WHEN native Review and MCP inspect the same run identifier
• THEN both expose equivalent composite and per-agent evidence
• AND MCP retains no execution or cancellation authority.

Requirement: Added value is measured

CodeVetter SHALL compare cross-review with Claude-only and Codex-only review on the same caught-bug corpus before recommending cross-review as a default.

Scenario: Cross-review adds cost but no recall

• WHEN benchmark results show no material qualified-bug recall improvement
• THEN CodeVetter keeps cross-review optional
• AND reports the measured latency, usage, and false-positive tradeoff.

Tasks

• 1. Add versioned cross-review strategy, per-agent manifest, and composite receipt schemas with fail-closed validation.
• 2. Add preflight requiring both configured local executors and one immutable target/policy binding.
• 3. Orchestrate independent sequential Claude and Codex passes with bounded progress and cancellation.
• 4. Deterministically qualify, reconcile, and persist the union without an LLM judge or title-only merging.
• 5. Add CLI arguments and JSON output while preserving single-review compatibility.
• 6. Add native Review strategy, progress, provenance, disagreement, usage, and limitation states.
• 7. Add read-only MCP inspection and same-fixture Rust, CLI, native, and MCP parity tests.
• 8. Benchmark Claude-only, Codex-only, and cross-review recall, false-positive burden, latency, and usage on the caught-bug corpus.
• 9. Record dark/light rendered evidence, cancellation/recovery proof, docs, and current product status without making a release claim.