Why agent agreement isn't verification

An agent writes the code, another agent reviews it: the default answer to agent safety. It looks like oversight. It demos well. And it is not verification, because a reviewer drawn from the same model family, and shown the worker's own account, is a correlated sample - not an independent check. Independence is not a headcount. It is a structure, and agreement without that structure is a mood.

Agreement is not independence

The reviewer usually shares everything that matters with the worker: the same model family, the same training data, the same failure modes. Worse, the reviewing agent is typically shown the worker's own account of what it did - so the "independent" review begins inside the worker's framing. Asking another agent to check the writer is closer to asking the writer again.

In that setup the blind spots are correlated by construction: whatever made the bug plausible to the writer makes it plausible to the reviewer. A genuinely different reviewer - another model family, other tools, no sight of the worker's account - is less correlated, and worth having. But it still judges the diff and its framing, not the execution. And adding another agent from the same distribution fixes nothing. It just makes the agreement more confident.Safety-critical fields learned this long ago: audit, aviation and drug trials all separate the doer from the checker structurally. A another opinion from the same person is not independence.

What independence actually requires

Independence is structural, not numerical. The requirements, and "another model read the diff" satisfies none of them:

• The judge does not share the worker's objective. The worker is rewarded for producing something acceptable-looking. The judge must have no stake in the answer being yes.
• The rules are fixed before work begins. Acceptance criteria written after the output exists are negotiation, not verification.
• The verdict comes from execution. Run the target's own acceptance suite, in a clean environment, against the real candidate. Tests are unimpressed by persuasive diffs.
• The worker cannot touch the evidence. The evidence store, the evaluator and the judge's authority live outside the worker's write path. If the worker can edit the receipts, the receipts are marketing.

These are requirements for Apex's intended architecture. Public component descriptions and calibration summaries do not establish that this separation operated throughout a complete runtime cycle. Primary records remain private; no authorized access procedure is established.

How we apply this

In Apex, the evaluator is stated before the run as explicit floors: machine-checkable properties the system must preserve. Verdicts are produced by the target's own test suite, not by a model's opinion. For the Packaging calibration cycles shown, a private same-engine re-evaluation from a fresh clone is recorded separately; this page does not re-run it.^{evidence summary} The signed projection verdict is COMPLETED; floor ADMITTED; acceptance PASS. It does not name a person.

We would rather stand on a boring, replayable procedure than on a committee of persuasive agents. Verification is a procedure you can re-run.