Two Reviewers, One Blind
Most automated review is one model glancing at a diff and stamping it. o8 classifies risk by what the diff actually touches — schema, migrations, the lane state machine, the control plane — and routes the dangerous fraction to a second reviewer that sees only the diff and the verification it has to produce, never the first reviewer's approval.
A single reviewer anchors on the agent's own self-review and on its own first impression. Approval gets cheap.
Hand one model a diff and an agent's self-review and ask “is this good?” and you will mostly get “yes.” It anchors on the author's framing, it anchors on its own first read, and approval becomes the path of least resistance. For the ninety percent of changes that are genuinely routine, that's fine. For the ten percent that can corrupt a database or wedge the machinery that runs every other agent, a confident yes is exactly the failure you can't afford.
Approval is cheap. Independent approval, on the diffs that can hurt you, is the thing worth paying for.
So o8 doesn't treat all diffs the same, and it doesn't let one opinion be the whole story on the dangerous ones. It spends its scrutiny where the blast radius is, and it spends it in a way that can't be anchored.
Before any model looks, a cheap pass reads the shape of the diff.
The first thing that happens to a diff is not an LLM. It's a set of mechanical heuristics over the diff-stat and the patch text: how much changed, whether whole files were rewritten rather than edited, and whether anything in it matches a dangerous shape — an eval, an injection-flavored string, a mass deletion. These are pattern checks, fast and free, and they run on everything.
The mechanical pass isn't the verdict. It's the triage that decides how hard the rest of the pipeline has to look — and it feeds the one decision the whole design hangs on: how risky is this change, really?
High-risk isn't a vibe. It's a path and a pattern.
o8 classifies a diff's risk by what it touches, not by how the reviewer feels about it. Touching a database migration is high-risk by definition. Touching the function that sets lane state is high-risk. Touching the request gate, the schema, the merge machinery — high-risk, because a subtle bug there doesn't break one feature, it breaks the system every other agent depends on.
| The diff touches… | Risk | What it earns |
|---|---|---|
| Schema, migrations, the lane state machine, the control-plane gate | High | a blind second pass |
| Whole-file rewrites, dangerous patterns | High | a blind second pass |
| Ordinary feature and UI code | Standard | first review, then merge |
Standard-risk diffs get reviewed once and move on — spending a second independent pass on a button-color change is waste, and waste is its own kind of failure. The expensive machinery only switches on when the classifier says this change can actually hurt you.
For a high-risk diff, the first approval isn't a green light. It's a nomination.
Here is the move. For a standard diff, a passing review is a durable approval — it unlocks the merge. For a high-risk diff, that first approval is explicitly notdurable. The merge stays blocked. The first reviewer doesn't get to clear the change; it only gets to nominate it for a second look.
On the dangerous diffs, one model's “looks good” doesn't open the gate. It opens a second, independent review.
The merge gate, when it checks whether a high-risk change is cleared, is looking for something more than a first pass: it's looking for an independent second verdict that agrees. Until that exists, the branch does not land, no matter how glowing the first review was.
The second reviewer sees the diff and the proof it must produce — and nothing about what the first one decided.
The second pass is blind on purpose. It is handed the diff and the verification traces it's required to account for — and it is notshown the first reviewer's approval, score, or reasoning. There is nothing to anchor to. It has to look at the change and the evidence and reach its own conclusion, then emit a verdict in a fixed form: an explicit, parseable agree— or not.
Only an independent agreeturns the nomination into a cleared merge. If the second reviewer disagrees, or hedges, or can't reconcile the diff with its required traces, the change stays blocked and goes back up the chain to be steered, redispatched, or handed to a human. Two opinions, formed independently, and the dangerous change only ships when they converge on their own.
The published claim is “nothing merges unreviewed — and nothing risky merges without your sign-off.” This is the machine that makes the AI half of that real.
o8's posture is that a human approves what matters and the system earns that trust by doing the boring, rigorous review work first. A single rubber-stamp reviewer undercuts that — it hands you a “reviewed” label that means almost nothing on the changes where the label matters most.
Risk-classified, blind, two-reviewer review is how the AI tier earns its half of the sign-off honestly. It spends nothing on the routine and real scrutiny on the dangerous, and it structures that scrutiny so a second model can't simply agree with the first. It's the layer underneath the approval button — the part that makes the word “reviewed” mean something before a person ever reads it.
Risk classification lives in src/lib/lane/review-risk.ts, the blind pass in src/lib/lane/blind-second-pass-review.ts, and the durability rule in src/lib/lane/durable-review-approval.ts. This is the review mechanism; the trust surface it feeds is its own note, Governance as a Feature.