I build software with two AI systems, but they do not share the same job.
- Claude Code writes the code.
- OpenAI Codex reviews and assists with prompting.
Codex has read-only access to the OS. It can inspect the architecture, governing decisions, tests, and implementation, but the second it changes a file, the review is contaminated.
“The second Codex writes in the OS, it’s contaminated.”
It is no longer an independent reviewer. It is another implementer with its own fingerprints in the system.
And neither one decides what the software is allowed to mean.
I do.
That matters because most AI coding workflows quietly collapse implementation, review, architecture, and approval into one process.
You give an agent a request. It interprets the request, decides what the solution should be, writes the code, writes the tests, runs them, and tells you the work is complete.
That is incredibly efficient.
It is also a lot of authority concentrated in one place.
The same system that made the decisions is now presenting the evidence that those decisions were correct.
Sometimes they are not.
A passing test can still prove the wrong thing
As my application became more complex, the mistakes changed.
They stopped being obvious syntax errors or broken imports. The more dangerous failures were clean implementations of reasonable interpretations that happened to be wrong.
The code looked good.
The tests passed.
The completion summary sounded convincing.
But the implementation was proving something adjacent to what I actually needed.
That is harder to catch because the same assumption can spread through the code, tests, comments, and explanation of why the work is done. Everything agrees because everything came from the same misunderstanding.
A green test suite can make a bad assumption look like truth.
That is why I stopped asking one system to be the builder, reviewer, architect, and approver.
The division of labor
Claude Code is the production agent.
It receives an approved, bounded assignment. It writes the implementation, tests, migrations, documentation, and whatever else is explicitly inside that assignment.
It has autonomy inside the boundary.
It does not have authority to redefine the boundary.
Codex is the independent review function.
It reads the decisions, implementation, tests, failure history, and actual diff. It looks for incorrect assumptions, missing authority, weak verification, scope drift, and tests that prove something other than what they claim.
Then it produces a bounded correction prompt for Claude Code.
Codex does not fix the code itself.
That wall is not ceremonial. It is the entire point.
I remain the architect and final authority.
I decide which source owns a fact, what approval means, what happens when information is missing, where a permission boundary belongs, and whether the next piece of work is actually authorized.
Claude can propose an implementation.
Codex can challenge it.
Neither gets to decide the product by consensus.
This is not two AI models voting on truth.
The concurrency test that passed
One part of the application manages versioned client information. At any given time, a client can have one current approved version.
Changing it required two operations:
- Demote the previous current version.
- Promote the new version.
The implementation used a database savepoint to protect the promotion. A concurrency test showed that when two sessions attempted the change, only one could win.
The test passed.
But the review surfaced a deeper problem.
Only the second operation was inside the rollback boundary.
The old version could be successfully demoted, the new version could fail to promote, and the client could be left with no current version at all.
Worse, the system would report a clean concurrency denial, making the broken state look intentional.
The test proved that two callers could not both win.
It did not prove that the transition was atomic.
Those are different properties.
The correction placed both mutations inside one rollback unit. More importantly, the failure became a permanent regression test that deliberately forces the first mutation to succeed and the second to fail.
Then it checks the final state from a fresh database session.
The bug was fixed once.
The environment was strengthened permanently.
The reviewer can be wrong too
The second model is not the authority either.
Codex once treated the absence of a machine-readable service-scope record as though the entire service-scope section were missing.
Claude implemented that requirement faithfully.
The tests encoded the same assumption.
Everything passed.
But the premise was wrong.
The application had two separate concepts:
A canonical machine-owned scope record.
Human-authored narrative context about the client’s scope.
The first could be missing while the second still existed.
That was not a coding mistake.
It was an authority mistake.
The contract changed. The section stayed required, but the machine reference became optional. Missing data stayed missing instead of forcing the builder to fabricate a placeholder, skip the client, or lie.
The review process changed too.
Future prompts now have to separate law from interpretation, identify which system owns each field, and test valid, invalid, and adjacent-valid cases before implementation begins.
Claude can be wrong.
Codex can be wrong.
I can be wrong.
The goal is not to make anyone infallible.
The goal is to make it harder for one participant’s mistake to become system truth.
Autonomy is not authority
I want the agents to operate with a lot of autonomy.
I do not want to approve every file read, choose every function name, or dictate every line of code. That defeats most of the value.
But autonomy and authority are not the same thing.
Claude Code can autonomously determine how to implement an approved change. It cannot decide the assignment should be larger.
Codex can autonomously investigate a defect and prepare a correction. It cannot authorize that correction or quietly begin the next piece of work.
An agent can act independently inside a boundary without being allowed to redefine the boundary itself.
The model proposes.
Deterministic systems verify.
Humans retain authority.
This is Ratchet Development
This workflow is one expression of what I call Ratchet Development.
The goal is not to stop AI agents from making mistakes.
That is unrealistic.
The goal is to make every meaningful mistake harder to repeat.
When something fails, I do not just ask:
How do we fix this implementation?
I also ask:
What was missing from the environment that allowed this class of failure?
The answer might become a regression test, typed contract, database constraint, permission boundary, deterministic validator, approval gate, or architectural rule.
The incident is not complete until the lesson becomes durable.
Some of the most important controls in the system were earned by actual failures: fabricated citations, false claims of reading source files, anonymous approvals, stale artifacts, tests that proved the wrong property, and reviewers who encoded the wrong assumption.
Each failure became part of the environment future work inherits.
That is the ratchet.
Claude Code builds.
Codex reviews.
I retain authority.
And every time the process gets something wrong, the system should get a little harder to fool.