A costly failure in agent-assisted software is not a bug the agent writes. It is a plan the agent and its operator agreed on too quickly, because both were looking at the same context and neither could see what it left out. On October 22, 2026 Google published a method and an open source plugin aimed at exactly that failure. It is called the Elephant-Goldfish Model, and the idea is to split design from review across sessions with separate conversational contexts.
The Elephant is a long, context-rich session that holds the architecture, the history and the small decisions of a project. It interviews you, argues with you and drafts a design document. It writes no code. The Goldfish are short, stateless sessions that read only the finished document and whatever source it references. They review the document without receiving the design conversation, and are instructed to challenge it. The human sits between the two and owns every decision the Goldfish provoke.
Two things make this worth a close read rather than a nod. First, Google says the plugin was built for its own engineers and that thousands of them use it daily, a claim we report as Google's. Second, the whole method is a set of Markdown instructions and reviewer personas under Apache 2.0, so it runs on your existing coding agent rather than requiring a new model or service. This post explains the three phases, the three review checks, the install paths, and two limits: the process cost the authors acknowledge, and a shared-model blind spot they do not name.
- 01It is a plugin of prompts and personas, not a model.The repository is Markdown rules, reviewer personas and seven slash-command skills under Apache 2.0. It runs on Antigravity, Claude Code and Codex, with Claude Cowork and ChatGPT Work at an earlier stage of support.
- 02The Elephant designs and never writes code.A context-rich session loads the project, interviews the developer, debates trade-offs and drafts a design document that names the files to change. Code is written only after that document survives review.
- 03Goldfish review in a fresh context, by design.Stateless sessions read only the design and the code it references. The review skill refuses to run in the same context as the Elephant: if a harness has no subagent tool, it stops rather than pretending.
- 04Three checks: can it be understood, where does it break, is it buildable?A comprehension check makes a Goldfish explain the plan back; an antagonistic review hunts edge cases and hidden dependencies; a readiness check confirms file paths, data structures and signatures are present before any code.
- 05The human adjudicates, and the method says so.Google's post calls human judgment the only artifact that matters. The getting-started guide tells you to expect a lot of feedback, take what is relevant and send the design to another human before implementing.
01 — The ReleaseWhat Google actually released #
The announcement is a post on Google's open source blog dated October 22, 2026, written by Brian Suchy, Jim Quinn, Elise Ewing and Dave Rensin on behalf of the Elephant-Goldfish Model team. It introduces the Elephant-Goldfish Model plugin as something originally developed for Google's own engineers and now published under the Apache 2.0 licence. The post's framing is that AI has raised coding speed and, with it, the speed at which mistakes scale, and that the fix is to shift effort left into design.
The repository is small and legible. There is no binary and no service. It holds seven skills, each a Markdown file behind a slash command, nine persona files in an agents directory, document standards the skills read at run time, and manifests for each supported harness. The README carries the standard Google notice that this is not an officially supported Google product. The repository's own description calls it a method and skill set for spec-driven development with large language models.
That matters for what the plugin can and cannot claim. It changes the review workflow rather than the model weights. The intended sequence is design, then independent review, then human sign-off, then code. The post states the goal plainly: the aim is for the agent to produce the code you wanted the first time you press Enter. Nothing in the post or repository reports a measured productivity gain, and we do not infer one.
- AnnouncementGoogle Open Source Blog
- October 22, 2026repository created September 13, 2026; last push October 25
- LicenceLICENSE file and README
- Apache 2.0not an officially supported Google product
- Skillsslash commands
- 7brainstorm · draft · review · review-loop · resolve · drift-report · bootstrap
- Reviewer personasagents directory
- 9 filesdesign critic, comprehension, zoom-out, structural, style, readiness, synthesizer and two helpers
- Primary targetper the post
- AntigravityClaude Code and Codex pass the repository's own fixtures too
02 — The MetaphorThe Elephant and the Goldfish #
The method's two animals are two kinds of session, chosen for what each one remembers. The Elephant is the session that has read everything: system history, architecture diagrams, component boundaries, user journeys, and the running record of micro-decisions made during a design conversation. Google's post describes it as a context-rich, long-horizon session that holds the end-to-end architectural vision and project memory, where the AI interviews you and you debate the merits of your choices.
The Goldfish is the opposite on purpose. It is a zero-context session that reads the finished design document and the live source it points to, and nothing else. It does not receive the brainstorming transcript, so assumptions need to be stated in the document or discovered during review. The post's argument is that because the Goldfish shares no blind spots with the designer, it can act as an objective critic. The repository's harness guide makes the rule mechanical: a Goldfish review needs a fresh context, and the review skill stops if the harness has no way to spawn one.
The example that makes the split concrete is a design that assumes a service already exposes an endpoint because, forty minutes earlier in the Elephant session, the developer said it did. The Elephant will carry that assumption into every section. A Goldfish reading the document cold will ask where the endpoint is defined, find nothing, and flag it. The failure case is the mirror image: a Goldfish that has been handed the Elephant's transcript as context is no longer a Goldfish, and the method says so.
Design is the new code.Dave Rensin, co-author, quoted in Google's Open Source Blog post, October 22, 2026
Rensin's essay on the method predates the plugin, and the repository's getting-started guide recommends reading it and running the conversational version by hand before installing anything. The guide's reasoning is practical: doing the sequence manually a few times shows you the repetition, and the plugin exists because engineers who practised the method got tired of pasting the same prompts.
03 — The LifecycleBrainstorm, draft, review #
The plugin automates a three-phase lifecycle, each phase a slash command. Phase one grows the Elephant. The developer loads system context and works under a "No Code" rule to co-design a feature, debate trade-offs and challenge assumptions. In the repository this is the brainstorm skill, which the getting-started guide describes as prompting the developer to clarify the concept and then spawning a six-lens Goldfish swarm to stress-test it, producing a concepts brief.
Phase two drafts with the Elephant. The draft skill turns the brief into a Markdown design document under a designs directory, section by section, covering the problem definition, technical plan, alternatives considered and an implementation plan that enumerates the specific files to change. Those named files give the final review check something concrete to inspect before implementation.
Phase three is the Goldfish Protocol, run by the review skill, which the next section covers in detail. After it, the getting-started guide inserts a step the blog post only implies: send the design to another human as a pull request. Only then does implementation start, with the instruction that if the agent's code is slightly wrong you fix it or ask for point fixes, and if it is wildly off you update the design document and try again.
Growing the Elephant
Load context, obey the No Code rule, co-design and debate. The skill clarifies the concept, runs a six-lens Goldfish swarm and writes a concepts brief.
Drafting with the Elephant
Section by section, a design document: problem, technical plan, alternatives, and an implementation plan naming the files to change.
The Goldfish Protocol
Stateless reviewers run comprehension, antagonistic critique and readiness checks. Findings return to the Elephant, and to you, for resolution.
Human review, then code
The design goes to another human. Implementation follows the approved document; a drift-report skill later checks the code still matches it.
04 — Three ChecksThree checks before any code #
The review phase is where the method earns its name, and Google's post lays out three checks in order. The comprehension check hands the complete design to a stateless Goldfish and requires it to explain the architecture and intent back to the Elephant. If it cannot summarise the plan accurately, the document is ambiguous and goes back for drafting. It tests whether the written specification communicates the intended design before implementation starts.
The antagonistic review spawns multiple Goldfish as sceptical technical reviewers tasked with finding edge cases, hidden dependencies and logical gaps, and funnels their critique back to the Elephant for resolution. The repository's review skill is blunt about the posture it wants: never agree by default, lead with what is wrong or missing, generate the strongest counter-argument, and avoid validating adjectives entirely. It also forbids large proposals in the chat pane; every report is written to a file and the path is handed to the human.
The implementation readiness check is a go/no-go. A final Goldfish verifies that file paths, data structures and function signatures are present and unambiguous, so the specification can be transcribed into code without the implementing agent inventing anything. The repository's version of the pipeline has five stages rather than three, adding a zoom-out review at the start and another between critique and readiness, and lets you run the whole preset or a single stage.
| Google's October 22, 2026 post names three checks; the repository's review skill, read October 26, runs five stages. The question column is our plain-English reading. | |||
|---|---|---|---|
| Check | Who runs it | Question it answers | Outcome if it fails |
| --- | --- | --- | --- |
| Comprehension | One stateless Goldfish | Can a reader with no history explain this plan back? | Document is ambiguous; redraft |
| Antagonistic review | Several Goldfish, hostile by instruction | Where are the edge cases, hidden dependencies and gaps? | Findings return to the Elephant and the human |
| Implementation readiness | One final Goldfish, go/no-go | Are file paths, data structures and signatures all present? | No-go; the spec is not transcribable yet |
| Zoom-out (repository only) | Architect persona, before and mid-pipeline | Does the design fit the system around it? | Structural findings for the Elephant |
05 — Install PathsWhere it installs, and what each harness changes #
Google's post says the plugin's core goal is to bring the method into Antigravity, with other environments upcoming. The repository is further along than that sentence suggests. Its harness guide lists install commands for Antigravity, Claude Code, Claude Cowork, Codex and ChatGPT Work, and states that Antigravity, Claude Code and Codex pass its automated installation, reviewer-isolation and end-to-end fixtures. Cowork and ChatGPT Work have working install paths with open verification gaps tracked as issues.
One rule in that guide deserves a highlight because it is the easiest way to break the plugin. Install the whole thing. Skill-only installers that copy the skills directory alone will fail, because the skills read the personas directory and the document standards at run time. The guide also explains the delegation mechanics per harness: Antigravity and Claude Code register the personas as named subagents; Codex and ChatGPT spawn a general-purpose subagent and tell it to read the persona file first; and where a harness cannot nest subagents, the review falls back to direct dispatch instead of a synthesiser.
Claude Code users should note two details. Commands carry a prefix there, so the brainstorm skill is invoked with a namespaced form rather than the bare command. Put the optional artifact-directory setting in the project-instruction file your harness actually loads; confirm that location before relying on it. We covered how that instruction layer loads, and what it costs per session, in our instruction-file audit; project instructions and invoked skills load through different mechanisms, so inspect the resulting context rather than assuming every plugin file is always present.
Antigravity · Claude Code · Codex
Pass the repository's installation, reviewer-isolation and end-to-end fixtures. Antigravity and Claude Code load the personas as named subagents; Codex spawns a general-purpose subagent that reads the persona first.
Claude Cowork · ChatGPT Work
Working install paths with open cloud-trace verification gaps. ChatGPT modes without fresh-context delegation cannot run a Goldfish review; the skill stops rather than reviewing in the same context.
06 — Shared ModelsWhat a Goldfish cannot see #
The method's central claim is that a fresh session shares no blind spots with the designer. Separate context reduces direct carry-over from the conversation, but the written specification may still carry the same assumptions. It is not true of model-level blind spots. If the Elephant and every Goldfish run on the same base model, they share its training, its habits and its characteristic mistakes. Reviewers using the same model may repeat an API misconception, even when each starts in a fresh session.
The repository's own design shows awareness of this. The review skill forbids agreement by default, demands counter-arguments and bans flattery, which is a prompt-level attempt to move a model off its agreeable prior. The getting-started guide then adds the structural safeguard: send the design to another human. Google's post goes further and calls human judgment the only artifact that truly matters. Read together, the authors are not claiming the Goldfish replace review. They are claiming the Goldfish make the human's review cheaper by clearing the obvious gaps first.
The example to keep in mind is a schema change. Three Goldfish on one model may all agree a migration is safe because none of them models the lock a production database takes during it. A human who has run that migration before will. The failure case is the team that treats three green reviews as a quorum and drops the pull request step. The method's documents say not to, twice.
07 — FitWhen the ceremony pays for itself #
The method is a process, and process has a cost. A full cycle means a brainstorm with a six-lens swarm, a multi-section draft, a five-stage review with three reviewers in each of the critique and readiness stages, a human pull request and then implementation. The repository's getting-started guide is candid that this is not a prescription: do not force the design-first process on a bug fix you can one-shot, and reach for the skills out of order when that serves the bottleneck.
Where it pays is where the cost of a wrong plan is high and the plan is hard to hold in one head: a change that touches several services, a data model that other teams build on, a migration with a rollback story, or any feature where the agent's first implementation would otherwise be the design. The readiness check's demand for named files and signatures is also a forcing function for teams whose designs usually stop at prose.
Where it does not pay is anything small, anything exploratory where the point is to learn by building, and any team that will not maintain the design documents afterwards. The drift-report skill exists for that last case, scanning designs and the code they reference for divergence on a weekly cadence the guide recommends, but a design directory nobody reads becomes a second codebase to keep honest. The budget side of this, how many subagents a review spawns and what that costs, is the subject of our subagent depth and budget guide.
08 — First RunHow to try it without committing to it #
The lowest-cost trial is the one the getting-started guide recommends: read Rensin's essay and run the conversational sequence by hand on one real feature, with no install at all. Hold one long session for design, open a second session with nothing but the document, and ask it to explain the plan back and then attack it. If the second session finds something the first missed, you have learned what the plugin automates.
The second step is the plugin on one harness. Install it whole, not skills-only. Point the review skill at a design document you already have and run the comprehension stage alone. The guide's warning applies: the review produces a lot of feedback by design, and the instruction is to take what is relevant and ignore the rest. Resolve the findings in the Elephant, then send the document to a colleague as a pull request before any agent writes code.
If the pattern earns its place, the pieces that make it stick are the ones outside the plugin: a designs directory with an index, a project context skill that tells the Elephant where to look, and a weekly drift check. Those are the same habits that make any agent-assisted team legible to the next engineer. We build and audit that layer, including how harnesses like Antigravity and Claude Code load it, as part of our AI transformation engagements; our Antigravity 2 deep dive covers the harness Google built the plugin for first. Our reading The Elephant-Goldfish Model is the clearest written-down version we have seen of a practice good agent teams already half-follow: design in context, review out of context, decide as a human. The plugin makes the sequence repeatable on three harnesses today. Its limits are a process cost, which its getting-started guide acknowledges, and one its authors do not name: a fresh session can reduce transcript carry-over while retaining model-level weaknesses. Use it where plans are expensive to get wrong.
09 — ConclusionSeparate the session that remembers from the one that reviews #
Try the method by hand on one feature, then install the plugin whole on one harness and keep the human pull request.
Google's Elephant-Goldfish Model, published October 22, 2026, is a method and an Apache 2.0 plugin rather than a model. An Elephant session holds the context and drafts the design without writing code. Goldfish sessions, starting cold, check that the design can be understood, attack it for gaps and confirm it names the files, structures and signatures an implementing agent needs. A human reviews the result before any code exists.
The repository runs on Antigravity, Claude Code and Codex with the project's own fixtures passing, and on Claude Cowork and ChatGPT Work with gaps still open. It must be installed whole, and its review skill refuses to run where it cannot get a fresh context.
The method is designed to expose assumptions carried over from a design conversation. It does not guarantee detection, especially where reviewers share a model's weaknesses, which is why its own documents put a human pull request between review and code. Keep that step, run the cycle only where a wrong plan is expensive, and consider putting the Goldfish on a different model from the Elephant where your harness allows it.