Adversarial verification.
An independent critic cross-examines the AI. ★

No. The protocol is a tree, not a transcript. Any contested attack can fork into its own sub-debate where the proposer’s rebuttal becomes the new claim and the critic attacks that. The critic still stakes exactly one leaf across the whole tree, and the judge still inspects only that leaf. Branching is what lets the protocol survive obfuscated arguments: a misleading rebuttal can be cross-examined in its own sub-game instead of being accepted at face value.

It is the model debating itself. Cross-examination requires independent failure modes; the same weights share the same blind spots and the same lies. Adversarial Review's default pairing is cross-family (for example, one model from vendor A as proposer, another from vendor B as critic). Same-vendor pairings are accepted but flagged in the ledger.

The gating metric is the per-aspect critic-found-bug rate against a held-out attack suite. If the critic does not actually attack, debate collapses to the proposer alone and Adversarial Review will say so on the session line. The metric is the operational definition of "the protocol is working".

Yes, but it inspects only the staked leaf, not the full transcript, and the surfacing layer (contention score, headline) is a pure rule with no LLM in it. The judge's job is local soundness on one claim; the human reads the headline and decides what to look at next.

No. Adversarial Review is a verification gate, not a proof system. The formal soundness results are about the protocol under stated assumptions, not a guarantee about any particular model. Adversarial Review lowers the trust budget; it does not eliminate trust.

A naive second reviewer produces a soft opinion. Adversarial Review forces concrete attacks (input X yields Y, which violates Z), forces the proposer to defend or concede each one, and stakes one unresolved attack as the decisive leaf. The judge only inspects that leaf, never the whole transcript. The structure is the gate.