Consensus

Three independent scanners sweep the same codebase and each flags its own slice of candidates. Laid over one another as a Venn diagram, the punchline is the shape: a thin sliver where all three agree, three much larger private lobes where each scanner is alone. The headline number underneath — cross-tool agreement, averaged pairwise — is the same read as the shape, just as a percentage.

The twist is the second control. Re-run scanner A on the exact same input and watch its own dots reshuffle across the diagram — some leaving its circle, others drifting in from B’s or C’s. That number is self-agreement: how much A agrees with itself, one run to the next, nothing else in the world having changed. Intuition says that should be near 100% — a rock-solid floor under whatever the cross-tool number is. It isn’t; it lands only modestly above it. Nods to the Contrast Security report on AI code-review tools: ~5% cross-tool agreement, ~17% self-agreement on identical code, run twice.

Reuse

src/consensus.js is a framework-free ES module, pure set generation and overlap math — no rendering, no DOM:

• scannerBias(scannerId, id) — a scanner’s fixed “taste” for a candidate, stable across runs. Different scanners are uncorrelated by construction, which is what keeps cross-tool overlap low.
• runNoise(id, runSeed) — a run’s fresh jitter for a candidate. Rerunning the same scanner with a new runSeed reshuffles which candidates cross the flag-rate cutoff even though the underlying bias didn’t move.
• flagSet(scannerId, universeSize, runSeed, flagRate, biasWeight = 0.5) — the set of ids that scanner flags on that run, chosen by rank so the flagged count stays exactly universeSize * flagRate regardless of scanner or seed.
• jaccard(setA, setB) and pairwiseAgreement(sets) — overlap math; the demo uses the latter, averaged over all pairs, as “cross-tool agreement.”

Defaults (universeSize = 400, flagRate = 0.12, biasWeight = 0.5) were picked by sweeping biasWeight until the pairwise numbers landed close to the real report’s ~5% / ~17% — not fitted per-run, just the one constant that made the shape honest.

Gotchas

• The three-way intersection of three independent scanners is almost always tiny — three uncorrelated ~12% sets rarely all hit the same id — so “cross-tool agreement” here is the pairwise average, not |A∩B∩C| / |A∪B∪C|. The triple intersection is real in the diagram (the white dots in the center sliver) but it’s a worse headline number: it reads as ~0% even when pairwise agreement is a believable ~5-10%.
• The Venn regions in demo/index.html are geometry, not part of the reusable module — sampleInRegion rejection-samples a point matching an exact in/out signature against three fixed circles. It’s demo rendering, same split as rho’s track layout living outside src/.
• The demo bundles its own copy of consensus.js (self-contained by contract); re-copy after editing src/.