What they did
The Rulestack team runs a Claude Code agent that drafts replies, pages and design notes, and a subagent called deep-reviewer grades each draft against a written rubric before it goes out. Their rule was that the reviewer runs on a different model family from the writer, but it lived only in instructions. After a weak reply slipped through review, they counted subagent transcripts and found 89 of 190 reviewer launches had run on the main session's exact model. They then registered a shell script as a PreToolUse hook on the Agent tool. It reads the main session's last model from the transcript and blocks any deep-reviewer launch whose requested model would match, telling the session which model to use. A later change routed reply reviews to two same-model reviewers, plus a script that checks each verdict file against the reviewer's own transcript.
How it went
Between 27 September and 13 October the sessions made 596 reviewer launches. The hook blocked 7 real ones; six were relaunched with the named model within a minute. In the seventh, the session relaunched the same review as a general-purpose agent, which the hook ignores, and got a review on the writer's model. The verdict provenance check refused 4 verdicts, all honest cases where a reviewer had edited its own file. Re-grading the reply that started it all showed the rubric wording mattered more than which model graded it.
Worth knowing
A family alias such as opus resolves to the main session's own model when the main session is already in that family, so asking for opus from an Opus session cannot get a different model. The hook checks the requested model, not the one that answered, and lets launches through when it cannot read the transcript or if the script itself fails.