Cross-vendor LLM diversity for agentic coding
Your coding CLI is locked to one vendor. xllm brings the others in — read-only by default.
Works inside Grok Build · Claude Code · Codex — one host-neutral core.
Like genetic and social diversity in people, a mix of models yields a more robust knowledge strategy — but only when their errors are actually different. xllm gives you that mix, and the instruments to know when it helps.
Advisor freedom grows per rung. Power over your checkout stays zero on every rung.
Get one authentic answer from another vendor — or a free local model. Read-only. Its opinion lands as a persisted artifact.
The advisor returns a unified diff as a .patch. Nothing is applied — you review with git apply --check and merge.
The advisor works in an ephemeral clone — edits, builds, and runs tests there — then hands back a verified branch. Your tree is never touched.
Only what your host can't do itself. No agent-OS, no hook engine, no skill dump.
Send the identical prompt to N models, blind. Structured verdicts land in an append-only ledger before any prose — with a pairwise agreement matrix. On a split, the tiebreaker is the unconsulted model with the lowest measured agreement — never a prettier pedigree.
Models attack each other's claims; only a decisive, checkable falsifier can kill — mere disagreement never does, and no judge LLM decides. Identity is the model, not the provider: two models on one local runtime refute each other too.
Independent panel first (no anchoring, diversity measured), then hostile debate over the surfaced claims — survived / killed / unresolved. For the calls where being wrong is expensive.
Provider traits derived only from recorded evidence — seeded-defect detection as a Wilson 95% lower bound, contract adherence, live health — sample sizes always visible. No hand-written model lore. No evidence, no change.
Every synthesized claim is labeled unanimous / majority / split / single-source. Failed advisors abstain. Consensus is confidence metadata, not truth.
Light work goes to free local models; hard judgment goes to the strong tier — and measured bench quality may cross the tier line, under strict shared-opportunity gates. Tiny local models are barred from voting on security calls.
Commit messages, PR bodies, release notes — drafted by the cheapest healthy model, validated deterministically. Stop paying SOTA prices for chores.
No sandbox escape, no approval bypass. Same-vendor nesting refused. Host session env stripped. Secrets redacted from every artifact.
Probes each installed CLI for the flags xllm depends on and detects version drift; classifies failures; retries only transient ones.
xllm ships a seeded-defect benchmark that can refute its own core claim. Here's what it told us — and it keeps measuring.
On a set of well-known defects (SQL injection, XSS, plaintext passwords, TOCTOU…), two different-vendor frontier models — OpenAI's codex and xAI's grok — caught the same 10 of 11 defects and missed the identical one.
| Reviewer | Detected | Missed |
|---|---|---|
| codex (alone) | 10 / 11 | no-fail-return |
| grok (alone) | 10 / 11 | no-fail-return |
| panel (union) | 10 / 11 | no-fail-return |
Different vendors, perfectly correlated errors. On familiar bug classes, cross-vendor diversity was theater — exactly as ensemble theory predicts when errors aren't decorrelated.
That's not a failure of the mission — it sharpens it. xllm's answer is to spend diversity where decorrelation is measured, not assumed: the panel ledger tracks pairwise agreement, and tiebreakers go to the model with the lowest measured agreement — never to a prettier pedigree. An instrument that can prove its own product wrong is the honest difference from "claims benefits without evidence."
On a harder set (6 tasks, 21 subtle defects — boundary windows, retry jitter, LRU eviction, timezone edges) a five-model calibration showed the errors decorrelating: mean pairwise agreement fell from 1.0 to 0.746. A blind panel of claude / grok / gemma4 then recovered a defect the best single model missed.
| Reviewer | Detected (hard set) |
|---|---|
| claude:opus (alone) | 19 / 21 |
| grok-4.5 (alone) | 19 / 21 |
| gemma4 (alone) | 12 / 21 |
| panel (union) | 20 / 21 — dividend +1 |
claude and grok each missed two defects — but different ones, and the panel bought one back. Diversity pays exactly when errors decorrelate, and error correlation is a function of problem difficulty.
One defect remained a shared blind spot — both strong models missed it, so no union can recover it. That is the case for escalating to a fourth, measured-decorrelated model: the strong pair agrees at 0.905, while the weaker, different model decorrelates most (0.667 against each).
A rerun of the full hard set (codex vs grok, zero provider errors) confirmed the decorrelation — pairwise error correlation 0.762, one shared blind spot — but this time one panelist dominated:
| Reviewer | Detected (hard set) |
|---|---|
| codex (alone) | 15 / 21 |
| grok (alone) | 20 / 21 |
| panel (union) | 20 / 21 |
The union added nothing over the dominant single — the dividend isn't a property of "diversity" in the abstract. It depends on who your best single is. Which is a routing question.
So that is what happens now: those detection cells become
trait profiles (Wilson 95% lower bounds, sample sizes attached), and the very
next judgment-role pick consumed them — pick verify moved to grok citing
LCB 0.7733 vs 0.5004 over 21 shared opportunities. What the benchmark
measured is what the router does.
Act two predicted it: when both strong models share a blind spot, escalate to a fourth, measured-decorrelated model. So we did — anchoring on grok and adding three cloud models. The LRU off-by-one that both codex and grok missed on the rerun is now caught by gemma4 and nemotron-3-super (which scored 3/3 on that task).
| Model | Surface | Detected |
|---|---|---|
| grok | cli-agentic | 18 / 21 |
| nemotron-3-super:cloud | http-completion | 16 / 21 |
| glm-5.2:cloud | http-completion | 15 / 21 |
| gemma4:cloud | http-completion | 13 / 21 |
| panel (union) | mixed | 19 / 21 — dividend +1 |
Escalation works — but diversity is not a universal solvent. One defect (a once-emitter double-fire) is now missed by every model measured across every run: a deep blind spot no panel here can buy.
Debate and council shipped on design + live e2e only — the quality claim ("plausible-but-wrong claims die, correct ones survive") was never measured. Now it is: the bench grades the actual adversarial protocol, mapping each surviving claim to the seeded defects. A grounded claim maps to a real defect; a surplus one does not.
| Bucket | Survived refutation |
|---|---|
| grounded (real-defect) claims | 20 / 23 — 0.87 |
| surplus claims | 22 / 25 — 0.88 |
| quality discrimination | −0.01 |
On a strong, aligned pair (codex vs grok), debate killed only 6 of 48 claims — and split them 3 grounded / 3 surplus. SURVIVED did not track truth. This is the debate analogue of act one: the dividend is conditional, not free.
The deliverable is not a positive result — it is that the
instrument now exists to detect when deliberation helps. Every result also tags
its measurement surface (cli-agentic vs http-completion), so a
strong CLI score is never silently mistaken for raw model quality.
Every panel so far carried a near-ceiling model whose high best-single ate the dividend.
Ensemble theory says the dividend grows when no member dominates — so we tested
it with three comparable, different-lab, all-http-completion models (no
surface confound), run three times to separate signal from run-to-run variance.
| Run | gemma4 · glm-5.2 · nemotron | best single → union | dividend |
|---|---|---|---|
| 1 | 16 · 17 · 14 | 17 → 19 / 21 | +2 |
| 2 | 14 · 16 · 17 | 17 → 19 / 21 | +2 |
| 3 | 16 · 18 · 15 | 18 → 20 / 21 | +2 |
Dividend +2 on every run (σ=0) — double the +1 of any dominated panel. The model ranks rotate run-to-run and individual scores swing ±3, yet the ensemble dividend does not move: the panel is more stable than any of its members.
Mean pairwise agreement 0.735 (the hard-set decorrelation regime, now with no surface confound), and zero permanent blind spots across the three runs. Three cheap, free, local models reached a per-run union of 19–20/21 — on par with a single frontier model. The mission hypothesis, cleanly confirmed: diversity pays when errors decorrelate and no single member dominates — measured, not assumed.
The founding question, tested head-on: does shared lineage predict correlated errors? We panelled three sizes of one family (nemotron ultra / super / nano — same lab, NVIDIA) against a different-lab model (gpt-oss:120b), 3×. Dividend rose to a mean of +2.33 (a run hit +3, the largest yet) as agreement fell to 0.691.
| Pair | Lab | Mean agreement |
|---|---|---|
| ultra ↔ super | same | 0.778 |
| super ↔ gpt-oss | cross | 0.746 |
| nano ↔ gpt-oss | cross | 0.698 |
| ultra ↔ nano | same | 0.667 |
| ultra ↔ gpt-oss | cross | 0.651 |
| super ↔ nano | same | 0.603 |
The same-lab pairs span the whole range and overlap the cross-lab ones entirely. The most decorrelated pair in the panel is same-lab (two nemotrons, 0.603); a cross-lab pair is among the most correlated. Shared lineage carries no reliable signal.
This is the vindication of a core design choice: the panel tiebreaker picks by lowest measured agreement, never by vendor pedigree. Routing diversity by lineage would have discarded the panel's most decorrelated pair and kept a more correlated one. The benchmark retires cross-vendor — the original v0.1 heuristic — in favour of cross-decorrelation, measured per pair.
The opposite extreme: three frontier vendor CLIs, one per lab, all pinned to the lowest effort — claude:sonnet (Anthropic) · codex:gpt-5.6-luna (OpenAI) · grok-composer-2.5-fast (xAI). Maximally cross-vendor, same surface, hard set, 3×.
| Model @ low | Detected (mean/3) |
|---|---|
| claude:sonnet (Sonnet 5) | 19.3 |
| grok-composer-2.5-fast | 19.0 |
| codex:gpt-5.6-luna | 15.3 |
| panel (union) | 20 — dividend +0.33 |
Mean pairwise agreement 0.841 — frontier models agree, even throttled to low effort across three different labs. Two near-ceiling members (20, 19) leave no room to recover. The most cross-vendor panel produced the least diversity dividend.
The capstone: the most correlated pair in the whole benchmark is claude ↔ grok (0.920, different vendors); the most decorrelated is super ↔ nano (0.603, same lab). Pedigree diversity is here anti-correlated with decorrelation. The dividend lives in the mid-tier decorrelated regime — and only measurement tells you which panel you hold.
Every dividend so far came from cloud models, and the SOTA-heavy panels recovered the least. So we went the other way: three genuinely light models whose weights fit on one consumer GPU — ornith (5.6GB) · gemma4 (9.6GB) · qwen3-coder (18GB) — all raw HTTP completion, hard set, run 3×. A full run takes ~10 minutes and costs nothing.
| Run | ornith · qwen3-coder · gemma4 | best single → union | dividend |
|---|---|---|---|
| 1 | 15 · 13 · 8 | 15 → 19 / 21 | +4 |
| 2 | 15 · 15 · 9 | 15 → 19 / 21 | +4 |
| 3 | 14 · 11 · 7 | 14 → 16 / 21 | +2 |
Mean dividend +3.33 — the largest measured in the benchmark's history — at mean pairwise agreement 0.609, the lowest ever. Across the three runs the union covered all 21 seeded defects with zero permanent blind spots; the 5.6GB model caught the double-fire bug that every frontier model had missed.
The decorrelation–dividend curve is now four points and strictly monotonic: agreement 0.841 → dividend +0.33 (frontier trio) · 0.735 → +2.0 · 0.691 → +2.33 · 0.609 → +3.33 (this panel). The weaker and more different the members, the more the ensemble recovers — three free local models reached a union within one defect of a single frontier model. What diversity cannot buy at the frontier, it pays handsomely at the light-local end — and the panel measures which regime you are in.
The last unmeasured deliberation mode. Council (blind panel → adversarial debate over the panel's claims) ran on the same light trio over every hard task, and each surviving claim was graded against the seeded defects — does hostile refutation keep the true claims and kill the rest?
| Regime | Kill rate | True-claim survival | Discrimination |
|---|---|---|---|
| Frontier debate (act five) | 12.5% | 0.87 | −0.01 |
| Mid-tier cloud council | 10.4% | 0.88 | −0.03 |
| Light-local council (this act) | 48% | 0.50 | 0.00 |
Light models refuted aggressively — half of all claims died — but killed blind: real-defect claims and unmapped claims died at exactly the same rate. Capable models (frontier and mid-tier alike) barely kill; light models kill indiscriminately. No measured regime shows the deliberation story tracking truth on this instrument.
And deliberation costs recall: council's surviving claims covered only 8 of 21 seeded defects, versus 19 per run for the same trio as a blind union. The routing lesson is now measured, not aesthetic: for light local models, spend your calls on the blind panel (union, dividend +3.33) — the adversarial phase subtracts detections without adding measured precision. An honest instrument reports its negatives; this one just did.
Does the balanced panel's dividend grow at higher effort? Unanswerable until v0.29 taught
the ollama transport to forward @effort as the API's think
parameter. Then the act-six trio ran again at @high, three times.
| Default effort (act six) | @high (thinking on) | |
|---|---|---|
| Dividend | +2 · +2 · +2 (mean 2.0) | +3 · +4 · +2 (mean 3.0) |
| Mean pairwise agreement | 0.735 | 0.704 |
| Best single per run | 17 · 17 · 18 | 15 · 15 · 18 |
| Union per run | 19 · 19 · 20 | 18 · 19 · 20 |
Thinking did not lift the ceiling — the union stayed flat and best-single actually fell. What high effort bought was decorrelation: members diverged further, headroom widened, and the union-over-best gap grew from +2 to +3. More effort made each model noisier and the ensemble better.
With five panels measured, the agreement→dividend relationship stays strongly negative but gains an honest wrinkle: this panel (0.704 → +3.0) out-dividends a more decorrelated one (0.691 → +2.33) because its best single left more room to fill. Dividend = decorrelation × headroom — both drivers, measured: 0.841→+0.33 · 0.735→+2.0 · 0.704→+3.0 · 0.691→+2.33 · 0.609→+3.33.
The boundary is enforced by execution flags and sandboxes, not by asking nicely.
codex runs --sandbox read-only; no --yolo, no --dangerously-*. Mutation is an explicit opt-in.
exec works in a separate-.git clone; results return fetch-only as refs/xllm/exec/<id>.
A claude advisor inside Claude Code — or codex inside Codex — is refused by default.
Well-known key/token formats are redacted before any artifact is written; scribe never persists your diff.
xllm never runs git push, creates tags, or forwards credentials. You stay in control.
Unavailable providers fail loudly instead of emitting synthetic output; executor-green is evidence, not trust.
One repo, three hosts. Node ≥ 18. Install only the advisor CLIs you need.
Claude Code
/plugin marketplace add kimmingul/xllm
/plugin install xllm@xllm
Codex
codex plugin marketplace add \
https://github.com/kimmingul/xllm.git
codex plugin add xllm@xllm
Grok Build
grok plugin install \
kimmingul/xllm --trust
setup once per project.The plugin installs once, but xllm's state and
configuration are per-project — different projects want different advisors (pin a
strong tier for security-sensitive code, a free local model for a docs repo). So the first
time you use xllm in a project, run /xllm:setup (Grok Build:
/xllm-setup). It analyses the project locally — repository contents
are never sent to advisors — and writes only the resulting config under the project's
.xllm/.
| setup step | what it does | project-local output |
|---|---|---|
| Machine inventory | probe installed advisor CLIs, local models, tier & cost (24h cache) | ~/.xllm (per machine) |
| Marker + artifacts | let the host resolve the advisor script from this project; secret-redacting artifact dirs | .xllm/xllm-advisor-path, .xllm/artifacts/ |
| Role-pin wizard | pin provider:model@effort per role — overrides built-in routing exactly | .xllm/xllm-providers.toml |
| Discipline block (opt-in) | install a ≤25-line process-discipline block after a full-text preview; idempotent, removable | CLAUDE.md / AGENTS.md |
Skipping setup still works via built-in routing —
but without the marker, skills fall back to path heuristics, and without role pins there is
no project-tailored advisor choice. The .xllm/ runtime state is gitignored
operational output.
No new syntax to learn. Inside Claude Code or Codex, you just say what you want — the xllm skills do the rest, read-only by default.
1. Install (section above). 2. The first time in a
project, type /xllm:setup once — it checks which advisor CLIs and local
models this machine has and pins sensible defaults. 3. Then just ask, in plain
language:
> "ask codex to review this migration design"
> "get second opinions from grok and codex on my staged diff"
> "write my commit message with a free local model"
That's the whole basic loop. Each phrase triggers
a skill (/xllm:ask, /xllm:review, /xllm:scribe —
you can also type them directly), the other vendor's real answer comes back into your
session, and a copy is saved as an artifact. Advisors reuse each CLI's existing login —
no API keys. If you have ollama, local models join for free.
| You want… | Just say | Why it works (measured) |
|---|---|---|
| a review of actual code | "review my staged diff" / "review this branch against main" | the diff is collected deterministically, size-capped, never persisted |
| to find defects cheaply | "run a blind panel of three free local models on this diff" | largest measured dividend — +3.33 with three free local models (act nine) |
| to settle a disagreement | "the panel split — spend the tiebreaker" | tiebreaker = lowest measured agreement, never vendor pedigree (act seven) |
| to stress-test one claim | "debate this claim: the cache change is thread-safe" | hostile refutation of a specific claim; for finding defects use the blind panel instead (act ten) |
| a change, not an opinion | "have codex propose a patch" → "have codex implement it in an isolated clone" | a static .patch, then a verified branch — your working tree is never touched |
| routing that fits this project | "set up xllm for this project, frugal" | role pins + evidence-derived traits (sample sizes always shown) |
Grok Build uses /ask ·
/xllm · /xllm-setup. Prefer a terminal? Every flow above is one
CLI command — full flags and contracts in the
command reference.