Rival-review launches cross-model review loop

The smartest part here is not the second model, it's the enforcement: a planner can be wrong, but it can't rubber-stamp itself. This is the kind of guardrail that pays off the first time it catches a bad rollback or a risky permission change.

• –Read-only review is the real boundary; once the reviewer can mutate state, the safety story falls apart.
• –The hard round cap and live terminal dashboard keep the loop inspectable instead of turning it into opaque agent soup.
• –Scoped context and `review_context.md` matter as much as model choice because they stop multi-step plans from drifting.
• –The Claude Code hook and explicit Codex gate make the pattern portable across orchestrators instead of tied to one vendor.
• –Dogfooding across Codex and Claude is a strong signal that the workflow solves a real problem, not just a demo problem.