*Published July 13, 2026* --- The adversarial-review prompt most people use is one sentence. Review this plan and tell me what's wrong with it. I wrote that sentence too. The version I run now is a 170-line file, and every line exists because the sentence failed in some specific way. The starting insight is real: sycophancy dies when you assign the AI a hostile role whose only job is to find the cracks. It is not enough. A hostile role with no output contract, no independence rule, and no stop condition degrades back into vibes. What follows is a dissection: each part, and what breaks without it. Even "review what, exactly" gets four specified cases; the unattended one, inside a loop with nobody to ask, must not block and must not invent: pick the most salient candidate, state the assumption, proceed. ## Who reviews decides more than how First, an independence check, on a blunt premise: "Self-review is the **weakest** review mode: you cannot reliably attack a target you just authored." A two-row routing table: low stakes, reversible, not self-authored gets one inline pass; high stakes, drafted this session, or self-strategy gets parallel read-only reviewers, so the critique is not the author's. Either route is declared in one line so the user can override it; a routine diff takes the first row, done. The bet: who is reviewing matters more than what model is reviewing. An agent that cannot spawn reviewers degrades loudly instead: sequential passes, no reuse of prior conclusions, and the flag `[reduced independence: sequential self-review, no parallel reviewers]`. ## Verify before you criticize Every finding rests on a checked fact, file and line for code, source of truth for everything else: "A finding built on an imagined line is itself the bug." Then coverage honesty: a partial review never issues a clean verdict; the report states what was inspected and what was not. ## Ten lenses, and the rules around them The middle is ten lenses: goal, assumptions, failure modes, gaps, reversibility, verification, simpler alternative, evidence, second-order effects, security. The list is the least transferable part; the rules around it carry the weight. Unfalsifiable is the highest-value finding: a failure you cannot detect is worse than one that fails visibly. The simpler-alternative lens asks about necessity, not correctness; sometimes the best finding is "delete this." Twelve recurring defect classes ride along for agent-infrastructure targets; they are the story of a separate piece, "[The Bugs That Hide Between Your Agents](https://para.ngpcloud.org/the-bugs-that-hide-between-your-agents)." ## Findings as a wire format The output is a contract; every field exists to make a silent failure loud. A VERDICT line; a `Lenses applied:` line that makes a silent skip visible; the load-bearing assumptions the reviewer extracts; findings ranked Blocker, Major, Minor, Nit. Every finding names a concrete failure scenario: "'This might be fragile' is not a finding; 'if `orders` is empty, line 42 divides by zero' is." Severity maps to verdict mechanically, first match wins. Any Blocker: REWORK. One un-accepted Major: PROCEED WITH CHANGES. Otherwise: PROCEED. One rule looks pedantic until you automate: `PROCEED` is a prefix of `PROCEED WITH CHANGES`, so any consumer parsing the verdict must match the full value, never a substring. Two calibration rules close it: lead with what the target gets right ("a pure attack piece loses calibration and credibility"); a clean pass says so plainly. ## Manufacturing independence Parallel Mode, the high-stakes route, has five requirements, each with a failure behind it. Reviewers are read-only agents of the right type: the analytical planner, never the search agent, which "doesn't review or audit" by design; its output looks like a report and critiques nothing. Every reviewer gets the target; a spawned agent shares no context, and lenses without a target review nothing. Reviewers get distinct lens clusters so they do not converge: different priors, qualitatively different coverage. Fourth, reviewers launch in one message, models rotated where possible. Fifth, a target with a producer or consumer gets one reviewer holding both sides' files, trusting neither: "Contract drift is structurally invisible to single-file review." What comes back is not trusted either: every sub-agent finding stays `[Agent Report — Unverified]` until the orchestrator confirms the fact itself. A reviewer that dies or returns prose leaves its whole cluster UNREVIEWED: "Do not silently synthesize around the gap — a false `PROCEED` is worse than a slow one." ## How the loop ends Unattended, an outer loop re-invokes the review; the model reads `VERDICT:` and decides. Stop on PROCEED. Termination hides in one definition: only the user can accept a Major, and accepted ones live in an `Accepted (won't fix):` ledger carried between passes; without it, an intended-unfixed Major reappears every pass and the loop never converges. A finding that survives three passes unchanged and un-accepted stops the loop and escalates: "the disagreement is the signal, not a bug to grind on." One honest note: the ledger and the guard are the only load-bearing rules with no origin story. Everything else was written after a failure; these were written ahead of one, and they stay suspect until a loop makes them earn their lines. ## The author never closes the loop Fixes happen outside the read-only review, and they are the loop's most dangerous ground. The file's own origin note records a four-pass convergence where three of four second-pass Majors were defects introduced by the first pass's fixes. Necessity comes before hardening: a 460-line skill that had never run was deleted rather than repaired, "the highest-value outcome of that pass." And the author never declares victory: "A fix commit is a checkpoint, not completion." Fixed is claimed by a clean delta pass from a reviewer: the verifier's sign-off is the actual definition of done, at diff scale. ## The front door The last section maps out: seven specialist skills keyed by recognition cues, strategic frameworks one way, security audits to a dedicated engine. The file deliberately carries the generic trigger phrases so it surfaces as the default. How each line earned its place, and keeps it, is the story of a companion piece, "Your Review Checklist Has Never Been Reviewed." This one claims the anatomy: one working system, dissected so you can take the parts that fit your stack. Half of them fit a one-chat-window stack: the output contract, the failure-scenario bar, and the verify-first rule need no agents at all. The one-sentence review prompt is not wrong. It is where this file started, and every line after it is a failure mode somebody already paid for.