The agentic coding world has a standard answer to the problem it discovered this year, and the answer does not survive contact with a test aerospace wrote down decades ago.
The problem is real and well described. Generation got cheap, so agents now produce more code than anyone can read, and the scarce thing became trustworthy checking rather than output. Martin Fowler’s harness engineering names the surrounding apparatus as the thing you actually design; Simon Willison’s rule is that you delegate fully only when you already know what the answer should look like. Both are right. But when the volume exceeds what a person can review, the practical answer almost everyone reaches for is a second model reviewing the first, and that move is where the reasoning stops.
Software assurance for spacecraft and aircraft has a formal account of what makes a check independent, and it is not one property but three. Independent verification and validation, as IEEE defines it and NASA’s programme applies it, requires technical, managerial and financial independence. Technical independence means the practitioners bring their own expertise to bear on the development processes and products, independent of the developer. Managerial independence means responsibility for the effort sits in a separate organisation from the one doing the implementation. Financial independence means the budget is vested somewhere the development organisation does not control, which is why NASA funds its IV&V programme from a separate directorate rather than from the missions it examines. What the arrangement buys, in NASA’s own words, is that the effort “independently selects the segments of the software and system to analyze and test, chooses the IV&V techniques, defines the schedule of IV&V activities, and selects the specific technical issues and problems to act upon”.
Score a reviewer model against those three and it fails all of them, and it forfeits the selection freedom entirely. Managerially it is invoked by the same pipeline that runs the producer, so it answers to the thing it audits. Financially it draws on the same token budget, which means it is the first thing trimmed when costs bite, and a check that gets cheaper exactly when work gets more expensive is not a check. It selects nothing: it is handed the diff someone else chose, in a context window someone else assembled, with a prompt that already frames what counts as a problem, and it stops when the orchestrator says so. Every degree of freedom that makes verification independent has been spent before the reviewer is invoked.
This is a design failure rather than a model failure, which is the useful part. Two of the three independences are purchasable in the harness. Give the verifier its own budget that the producer’s overruns cannot raid. Let it select its own targets rather than receiving a diff, which in practice means giving it the repository and the acceptance criteria instead of the change. Let it choose its own tools and run its own tests rather than reading a transcript of the producer’s. Let it decide when it is finished. None of that requires a better model, and all of it is currently left on the table because the reviewer is treated as a prompt rather than as a party.
What cannot be bought that way is the part underneath. Technical independence assumes the verifier brings a different mind to the problem, and two instances of the same weights do not. They share training data, failure modes, and blind spots, so the mistakes most likely to matter are exactly the ones both will make. Running the same model twice produces agreement, and agreement is being mistaken for confirmation across a great deal of current tooling. A different model from a different lab is a partial answer, and the size of the partiality has now been measured. Nine frontier judges drawn from seven model families supply roughly two independent votes’ worth of information, because three-quarters of the panel’s nominal independence disappears into the models making the same mistakes on the same items. The panel lands 8 to 22 points below what genuine independent voting would achieve, the best single judge matches or beats the whole panel, and better aggregation recovers at most a ninth of the gap. The authors’ conclusion is the one that matters here: the bottleneck is correlated judges rather than the aggregation algorithm, so scaling a panel cannot substitute for genuinely independent evaluation.
So the honest position is that most of what is called AI review today is a second opinion from an interested party with no discretion. That is worth something, and it is not verification. The distance between the two is not a modelling problem waiting on the next release. It is architecture, most of it available now, and the field has an existing vocabulary for it that predates the problem by decades.