The instruction file is not the enforcement layer.
Gap-trap starts from an ugly, familiar failure mode: fast agent output makes humans stop reading every diff, while duplicate helpers, boundary violations, and tests-that-prove-nothing accumulate. Its answer is not a longer sermon. It generates repository-specific contracts, “proven red” checks that run new tests against old code, ratchets that allow known problems to fall but not rise, and playbooks for learned project facts.[1]
That split is the useful bit. The prose explains the rule. The gate catches the violation. A contract without a check is advice; a check without a readable contract is a land mine.
Words propose. Gates dispose.
Security work needs receipts for the misses, too.
Cloudflare’s security-audit skill describes a six-phase pipeline: reconnaissance, coverage-led hunting, candidate validation by a fresh verifier, structured findings, independent record verification, and reporting derived from those records. It keeps confirmed, needs_validation, and rejected verdicts distinct, and validates both the coverage ledger and findings records.[2]
That is better than a heroic agent dumping a confident report because it makes uncertainty inspectable. Rejected candidates are not wasted motion; they are proof that a path was tested and disproved. Coverage is not “the model seemed thorough.” It is an artifact another process can challenge.
The hybrid review stack is the grown-up answer.
Alibaba’s OpenCodeReview describes itself as a hybrid system: deterministic pipeline checks plus an LLM agent, with line-level findings and built-in rules for issues such as null-pointer errors, thread safety, XSS, and SQL injection. Its README also says it supports multiple model providers and several coding-agent surfaces.[3]
Do not read “hybrid” as boring compromise. It is division of labor. Deterministic machinery owns what can be stated as a repeatable invariant. Models own exploration, synthesis, and the weird semantic edges. Then an independent verification lane tries to break the model’s claim before the claim becomes a release decision.
Build the four-layer interlock.
Contract: name the invariant, scope, exceptions, and owner in human language. Executable gate: make the cheap, repeatable part fail locally or in CI. Adversarial verifier: ask a fresh process to disprove high-impact findings and record what it actually observed. Receipt: preserve inputs, revision, commands, results, unresolved facts, and the human decision.
The torque bench below replaces a single “AI review passed” badge with four native interlocks and a copyable release card. Closing every switch means the review package is structurally ready; it does not mean the code is correct, safe, or approved.