A branch before the handoff
Before a task is handed to a helper model, a branch is made for it, and the helper is pointed there. Never at main. If the work comes back wrong, the branch is deleted and the main line never saw it. Making the branch first, rather than after the work looks good, is the whole point: it means there is no moment where unreviewed work and the trunk share the same place.
Not a working tree you do not own
More than one session can be open in the same repository at once. So a side task in a repository that is not the current one never switches that repository's branches or edits its files. It goes through the hosting provider's API instead, or it stops and asks whether the repository is free. Switching a branch under another session's feet is how two agents quietly overwrite each other's work, and neither one gets an error at the time.
Handed back, then reviewed
Work that comes back from a helper is read as a change, line by line, not accepted on the strength of its summary. A summary describes what the helper meant to do. The diff is what it actually did, and only one of those two can leak a secret or ship the wrong thing. How that review is structured, and why the model that wrote the instructions cannot be the only one checking the result, is the review model.