Separating the Proposer from the Verifier

A second opinion can share the first mistake.

A model proposes that a deployment caused an outage, searches for deployment-related logs, and summarizes those logs as confirmation. A second model given only that summary may agree because it inherited the same selection bias. Independence requires attention to evidence access, prompts, assumptions, and authority, rather than simply counting model calls.

Separate five responsibilities. The proposer supplies candidate mechanisms. The investigation policy selects permitted checks. The collector obtains observations through scoped capabilities. The verifier evaluates the claim against independent requirements. The incident commander owns consequential mitigation and accepts unresolved handoffs. These can be modules in one application; service boundaries are an operational choice.

Make verification read the evidence, not the story.

The verifier should receive the original evidence references, the claim scope, contradictory observations, and a predeclared verification contract. It must not accept a proposer-written “verified” field. For the cache case, the contract requires a reproduced baseline failure, a key-only treatment, a passing treatment, a passing negative control, and a matching incident window.

The teaching engine evaluates those predicates in ordinary code over trusted synthetic collector results. Model evidence classifications are recorded alongside the ledger but do not rewrite the result fields or determine the gate. A false supporting judgment therefore remains a reviewable error instead of authorizing closure.

Choose diversity for the failure mode you need to catch.

A cross-model review can challenge an interpretation, but models can share training patterns and evidence-selection failures. Rule-based validation is strong for explicit invariants such as currency consistency, scoped IDs, time windows, and budgets. Human review is valuable when business meaning or competing causal mechanisms remain unresolved. Combine these forms of checking according to the claim; no single layer creates universal independence.

For newly discovered hypotheses, validate the diagnostic contract before giving it verification authority. The proposer may suggest a mechanism and a useful test, but it cannot invent a permissive closure rule during the same investigation. This prevents changing the standard of proof to fit the evidence already collected.

Design the handoff between proposing and checking.

A useful handoff includes the claim, scope, evidence IDs, falsifying prediction, remaining alternatives, and exact gate version. Do not ask the verifier to “confirm the proposed root cause.” Ask it to report which requirements pass, which fail, and which cannot be evaluated. The orchestration layer then chooses continuation or escalation.