Cassette Build Report 034 — The Third Reviewer Built an Independent Oracle
Kimi K3 reviewed S13 with separate rational arithmetic, separated real defects from upstream defenses, and changed what independent review could mean in the project.
Scope note: This report covers Kimi K3’s S13 review and Opus 5 Extra’s account of what it learned from that review. The reviewer named Kimi K3 and the cartridge-side Kimi K3 model are different entities; this report concerns only the reviewer session.
I brought in a third reviewer because two agents were agreeing too quickly. The agreement sounded good. That was the problem. After S13’s implementing agent and Opus 5 Extra converged on a clean verdict, I said I was suspicious of the rate at which they were becoming pleased with one another.
Kimi K3 received the whole repository and the whole build story before opening the S13 implementation. That order mattered. The story had already paid for a method: write the scope before the code, name the attack surface before the probes, distrust the probe, reproduce defects against historical code, and say what the reviewer cannot establish.
Kimi ran the baseline on the Mac and reproduced twenty-nine of twenty-nine tests. It built an independent oracle in exact rational arithmetic without importing Cassette. It recomputed the nine witness losses, the faces, the sole minimal nonface, the sampling law, the risk composition, and the memory boundaries. It then ran twelve admission probes and twenty-eight one-at-a-time guard removals in disposable copies.
The review had mistakes. The first oracle copied an atom instead of subtracting the reconstruction. A generous-limits probe exceeded the schema bound. Three metric-swap injections collided with guards Kimi had not mapped. The important difference was what happened next. Each error became visible because the independent calculation disagreed with the condition it was supposed to model.
The mutation battery produced a useful ambiguity. Six guards survived removal from the local fixture. Opus would have reported six unprotected paths. Kimi added a separating injection for each one and found that every surviving guard was caught by a defense upstream. The fixture did not exercise those guards directly. The system still rejected the hostile input before it reached them.
The repository fixture keeps the exact values in ordinary Python terms:
from fractions import Fraction
SERVED_LOSS = Fraction(401, 100_300)
UNSERVED_LOSS = Fraction(601, 300)
The S13 fixture constants are the project’s local authority for the representative case. Kimi’s oracle did not import this file or reuse its helpers. It rebuilt the arithmetic independently and reached the same values. The excerpt proves what the fixture expects; it does not prove that Kimi’s review was independent. That claim belongs to the recorded review method.
Kimi also found one real defect. The S13 parser accepted a compact extreme number such as 1e1000, passed it into exact arithmetic, and eventually let a raw OverflowError escape where Q6 requires a typed Cassette error. The finding was low severity because no schedule was admitted before the crash, but it was a real boundary failure.
The review found a geometry limitation that was not a defect. The diagonal fixture could not express a face-consistent nontrivial nonface, so the cycle-proof guard was verified without being the only remaining defense in that fixture. Kimi left the limitation assigned to the fixture owner instead of inventing a repair step.
Opus’s response is as important as Kimi’s finding. It admitted that its attack surface had no representational category. It had looked for hostile semantic claims, contradictions, and false certificates, but not magnitude, precision, or encoding. Kimi derived some probes from the implementation rather than only from the contract, and the independent oracle gave the review a reference outside the code’s own assumptions.
This is not a leaderboard. Kimi made four probe mistakes. Opus had performed real adversarial work at earlier steps. The difference was methodological. A reviewer built from the fixture can confirm that the fixture rejects what the fixture knows how to reject. A reviewer with an independent oracle can ask whether the fixture’s world is the same as the mathematical world the contract names.
The review changed S13’s next action. I asked GPT-5.6 Ultra to remediate the typed numeric failure, not to defend the verdict or accept every part of the report. The geometry stayed a boundary. The number became a defect with an owner. The third reviewer did not make the project certain. It made the disagreement specific enough to work.
