But who will guard the guardians? [OOP]

Design by Contract is widely accepted as a valuable software design methodology for improving software quality. Its incorporation into the Eiffel language has been largely responsible for this. However, the Eiffel language restricts the expressivity of what may be verified in the contract primarily to propositional logic. When the contract is non-trivial, if we wish to retain contract-checking then we must write our own validation routines. How can we be sure that the code that checks the correctness is itself correct? The question was first posed by Juvenal in the first century A.D. 'Sed quis custodiet ipsos custodes?'. The level of genericity now possible in C++ at last offers a possible step forward.