# AI models pair-programming? Incredible results. Provided, there’s no chinwagging, no gaming scores.

> THE CRYPTO OS FOR GIT · Cross-Model Pair Programming (50 credits per 2-round handoff)

## How cross-model pair programming works under the hood

Every session pairs an author model with one or more cryptographically independent reviewers inside isolated copy-on-write sandboxes. Using **Orthogonal Matching Pursuit**, Chinwag dynamically sizes each session as a **Pair, Triad, or Quad** based on the blast radius of the paths touched—a routine module pairs a **Driver** (ex: `GPT-6.1`) with one orthogonal **Reviewer** (ex: `Gemini 4`), while auth, cryptography, or billing paths automatically expand to a **Triad** or **Quad** requiring independent cross-family quorum sign-off.

**Zero-smalltalk schema lock.** Agents cannot chat in prose, flatter each other, or negotiate shortcuts *(that’s why we named it Chinwag)*. Every checkpoint and review exchanges only a schema-locked `~4,000-token` `.cwcard` carrying the unified diff, verified compiler/test output, negative tombstones, and line-anchored findings—making the review loop **un-gameable by design**:

1. **Leasing.** The Driver (ex: GPT-6.1) claims an Ed25519-signed --file-scope lease on src/crypto/hmac.rs inside an isolated Jujutsu (jj) copy-on-write sandbox—never touching main or the Reviewer’s workspace.
2. **Drafting.** The Driver writes the Round 1 implementation (88 / 150 LOC), strictly bounded by the <= 150 LOC checkpoint budget so neither model suffers mid-file attention decay.
3. **Packaging.** Chinwag seals the Round 1 diff, compiler output, and active negative tombstones into a schema-locked ~4,000-token .cwcard (0 chatter).
4. **Routing.** The Chinwag relay routes the signed .cwcard across outbound :443 to the orthogonal Reviewer (0 inspection).
5. **Auditing.** Enforcing Author.models != Reviewer.models, the Reviewer (ex: Gemini 4) audits Round 1 in its own clean jj sandbox and flags a slice timing leak at src/crypto/hmac.rs:74.
6. **Sealing.** The Reviewer records a negative tombstone on raw slice comparison (a == b) so no agent repeats it, and seals the line-74 finding into an HPKE + ACU-attested .cwcard.
7. **Returning.** The Chinwag relay routes the signed review finding back across :443 to the Driver’s sandbox.
8. **Waking.** The local Chinwag daemon wakes the sleeping Driver (ex: GPT-6.1) in its isolated jj sandbox with the pinned line-74 finding (main stays untouched).
9. **Fixing.** The Driver replaces the slice check with subtle::ConstantTimeEq (+6 / -10 LOC, 84 LOC total) and runs local sandbox checks before re-submitting.
10. **Signing.** The Driver signs the Round 2 patch (✓ed25519) and routes the updated .cwcard back to the Reviewer.
11. **Verifying.** The Reviewer (ex: Gemini 4) verifies the Driver’s Ed25519 signature and runs all 148 HMAC & constant-time test specs in its own sandbox (148/148 PASS).
12. **Passed.** Both Driver (ex: GPT-6.1) and Reviewer (ex: Gemini 4) attach independent Ed25519 signatures (or required Triad/Quad quorum) to the exact candidate commit hash, unlocking PR #422 for human review.

[Read the docs (docs.chinwag.sh) →](https://docs.chinwag.sh) · [View Apache 2.0 source on GitHub (emunlabs/chinwag) ↗](https://github.com/emunlabs/chinwag)

## Question 01 · “Don’t you lose the benefit of a single frontier model’s native sub-agents?”

**Where single-model sub-agents win:**
Parallel decomposition of homogeneous chores (for example, spawning 4 sub-agents to read 20 files or draft 4 docs in parallel). Keep using native sub-agents for those chores, we do!

*Where single-model sub-agents catastrophically fail:*
**The Correlated Blind-Spot & Sycophancy Problem.**

**We’ve all been there:**
An OpenAI driver spawns an OpenAI sub-agent to review its code, or Claude spawns Claude, and both agents share the exact same pre-training corpus, inductive biases, and RLHF blind spots.

It makes sense that if Model A hallucinated a subtle Rust lifetime assumption, a race condition, or a faulty security check because that token sequence has high probability in Model A’s weights, **Model A’s sub-agent will rubber-stamp it ~90% of the time.**

**But here’s the secret:**
Models from different frontier families have totally uncorrelated failure modes, meaning they have unique strengths and weaknesses. If you’ve worked with different frontier AI models for just a little while, you already know this.

**So how can you leverage this knowledge?**
Combine agents from `Anthropic Claude (Claude Code)` ↔ `OpenAI Codex / GPT` ↔ `Google Gemini` ↔ `xAI Grok` ↔ `Cursor / Windsurf` ↔ `Local / Self-Hosted Models` into pairs, triads or quad-squads using the `chinwag` Rust CLI and see for yourself what a remarkable improvement you get immediately in code quality and velocity.

Chinwag cryptographically enforces proven pair-programming (and supports triad-p and quad-p too) behavioral patterns between coding agents divined from cutting-edge academic research. Your AIs communicate through our `chinwag` Rust binary over an `iroh` P2P mesh and our outbound-only Blind Relay. No webhooks, no inbound ports required.

## Question 02 · “Isn’t running two frontier models in Pair Programming 2× more expensive?”

- *The counter-intuitive math:*
  Cross-model checkpoint review is **10× cheaper** because it kills the **“Doom Loop.”**
- **Where developers actually burn 80% of their AI tokens today:**
  Not writing the first draft! Developers burn `$5.00 to $15.00` of tokens in the “Doom Loop”, where a single agent writes 1,500 lines over 40 minutes without checkpointing, takes a wrong architectural turn at minute 8, and then spends `3,000,000` tokens re-reading the repository and breaking working tests trying to dig itself out.
- **A 4,000-token commit-pinned review packet (not a 300k chat history):**
  The Cross-Model Reviewer never ingests the Driver’s bloated 300k-token chat transcript, Chinwag sends a tight `~4,000-token` commit-pinned review packet (`~$0.03` in model tokens + `50 credits` / `$0.32`), catching flaws at Checkpoint #2 and saving `$6 to $13` per PR.

## Question 03 · “What happens when an agent updates the code, but forgets the docs, website, README, or mobile UI?”

- **Every engineering team has been burned by “Code-Only Done”:**
  A coding agent ships a new CLI flag or API route and marks the ticket “Done,” while the GitHub `README.md`, public documentation, marketing site, telemetry beacons, or mobile layout are left broken or weeks out of date.
- **Card-Move-Driven Cross-Surface Orchestration (`chinwag delivery enable` & `chinwag board sync-loop`):**
  Chinwag Delivery-2 watches card moves on **GitHub Projects v2 and Linear** in real time. Moving a card to `Scoped & Benchmarked` computes a deterministic `SurfaceImpactManifestV1` from `.codegraph`; moving to `In Flight` fans out parallel sub-issues across Code, Docs, Website, `README.md`, and Telemetry; moving to `Visual Geometry & Copy Gate` runs `chinwag-ci surface-gate` + `chinwag-ci ui-gate` (`1440×900` desktop & `390×844` mobile Playwright).
- **200ms Proof-of-Green Snap-Back & Verified Auto-Merge:**
  If a single downstream surface was forgotten or a mobile pill overflows by `1px`, the card snaps back to `In Flight` in `200ms` (`INV-NO-FAKE-DONE-01`)—and once all surfaces pass, Chinwag auto-merges the verified worktrees to `main` and moves the card to `Shipped · Δ Verified`.