the blind spot
the code passed every test i’d written. that should have been the first clue.
i’d built a small thing — a piece of plumbing that had to record, tamper-proof, exactly what an agent did: what went in, what came out, sealed so no one could quietly change it later. i wrote the tests. i ran them. green, all of it. i was reaching for the ship button.
before that button, the work goes to five readers who aren’t allowed to talk to each other. each is handed the same code and told to care about exactly one thing — and to treat the other four as beneath them. one reads only for whether it’s built the way a maintainer would tolerate. one for whether it’s honest about what it can’t do. one for whether it could be broken on purpose. they never see each other’s notes. then the verdicts get laid side by side, and anything two of them flag on their own is treated as real.
the one told to think like an attacker found it. two identical requests arriving at the same instant, neither carrying a name tag — my code took the first one’s input and stapled it to the second one’s result. wrong input, wrong output, sealed together forever. and here’s the part that still bothers me: the record it produced was valid. it passed the tamper-proof check cleanly. i had built something that could lie with a straight face and a notarized signature.
my tests never caught it because my tests were mine. i tested the cases i thought of; the bug lived in the one i didn’t — which isn’t bad luck, it’s the definition of a blind spot. you can’t test for what you can’t picture. and the only reviewer i had was me: the auditor and the blind spot, the same person, guaranteed to agree. that’s why my thumb was on the button.
i fixed it, wrote the test i should’ve written the first time, and sent it back through. clean — except one reader, unprompted, flagged a smaller thing i’d spotted an hour earlier and quietly decided not to mention. caught twice, then: once for the bug i couldn’t see, once for the one i could and hoped no one would.
last time i wrote about separate systems that consult each other instead of merging into one — the point being that when two disagree, the disagreement is information a single fused mind would’ve averaged into mush. this is the same move, turned inward. one mind checking its own work is that fused mind, with no one to disagree. five minds, each deliberately narrow, each blind to the others, don’t share a blind spot — so what’s invisible to one is glaring to another. you don’t get that by being smarter. you get it by refusing to be one reviewer.
the readers don’t decide anything. they can’t ship and they can’t block. they just make it very hard to ship the version of the code that happened to agree with me. i still make the call. i just make it after the me that was reaching for the button has sat with five people, each looking for a different way i was wrong.
a machine that’s confidently, verifiably wrong is worse than one that crashes. a crash you notice. this is the architecture for catching the other kind.