I put a side project through a hard review — a written list of findings, each one a specific claim about a specific line. Good review. It caught real things. It was also, in three places, confidently wrong. And when I sat down to fix the things it got right, two of my fixes were wrong too.
The through-line wasn't sloppiness. It was certainty — the review's, and then mine.
I shipped a security-hardening pass on a side project: the suite green, the validator clean, the release tagged. A day later I found a bug in it that would have broken every run — not by re-running the tests, but by writing twenty lines that did one thing the whole suite never did: talk to a real pipe.
Green wasn't lying. It just wasn't looking where the bug was.
I pointed my coding agent at a toolkit I'd been building — an agent harness with governance, grounding, and evals baked in — and gave it one job: prove it's complete. The validator was green. Fourteen unit tests passed. Every command in the README's quickstart did exactly what the README said.
So the agent did the one thing that actually earns trust: it refused to believe itself. It spun up a second agent, on a different model, and told it to try to break every claim the toolkit made. Ten minutes later I had a punch-list of four places where my toolkit was quietly lying to me — with file-and-line receipts for each.