feat(crosscheck): GLM-5.2 Foundry reviewer lane, retire the interim claude lane (R6) - #264
Merged
Conversation
… loud codex fallback
… lane, retire claude packaging
…, retired claude profile coverage
…nd retired-claude coverage
… primary and fallback families
…k the pinned GLM endpoint
…he family marker to the model
This was referenced Aug 20, 2026
ruby-dlee
added a commit
that referenced
this pull request
Aug 20, 2026
… owed R6 still read NOT DONE with a work list describing work that merged in #264 and is now serving. Records what landed, what is genuinely still owed (the live end-to-end GLM review, blocked on a 25K token-per-minute Fireworks quota that is an owner portal action; the startup-credit decrement check; the compartment lane's image rebake), and leaves the acceptance sentence unmet because it is.
ruby-dlee
added a commit
that referenced
this pull request
Aug 20, 2026
… owed (#275) * docs(azure): make the R6 status true to what landed and what is still owed R6 still read NOT DONE with a work list describing work that merged in #264 and is now serving. Records what landed, what is genuinely still owed (the live end-to-end GLM review, blocked on a 25K token-per-minute Fireworks quota that is an owner portal action; the startup-credit decrement check; the compartment lane's image rebake), and leaves the acceptance sentence unmet because it is. * docs(azure): correct the R6 status to what the artifacts actually show A verification pass found ten findings against this section, three of them merge-blocking. All ten are addressed here, docs only, one file. The image claim is refuted rather than softened. The current fm-ccm image does carry pi. Config model_image_id names gallery version 1.0.1787092687, whose source managed image img-fm7c799d-ccm-1.0.1787091895 carries the pi-tarball-sha256 and node-tarball-sha256 tags that only a build from the Pi-carrying declaration (#246) can write, its Image Builder run succeeded on 2026-08-18 between 22:26:20Z and 22:36:46Z, after #246 landed on main at 20:51:35Z, and that declaration asserts pi --version against a tracked version twice, before and after the credential purge. The digests match docs/azure-crosscheck/model-image-closure.json for pi-coding-agent 0.84.1 and Node v22.23.2. The old finding was correct about 1.0.1786915905, which the config stopped naming on 2026-08-18, and it was already stale when it was written into docs/azure-crosscheck.md on 2026-08-20. The dangling "ledger M29" provenance is dropped. The operative fact the section omitted is now stated: the lane is off because crosscheck-azure.json has enabled:false. The status line no longer overclaims. BUILT AND SERVING becomes BUILT 2026-08-20 with the fact that matters first: zero GLM reviews have ever completed, six attempts on 2026-08-20 all recorded tool-failure, and the lane's only verdict came from the pi-codex fallback. The current roster state is reflected, including the restored fallback entries with crosscheck-same-model on. Other corrections: 510K tokens was one hour reported as a day, and the measured total is 727,136; the reasoning_effort probe is restated as an unretained observation; the five-tool-turns figure is removed because no run record carries a turn count; both per-minute limits are stated and the token attribution is labelled inference; the account of what killed each attempt is replaced with what the ledger records; the C1 forward reference is dropped; the zeroed GLM cost table is recorded as a spend-visibility gap; the Cost Management implication is dropped while keeping the fact; and three Work items that appeared in neither list are now covered. R9 is left alone: it already says a pi review on the current image is unproven, which stays true and is consistent with the corrected text. * docs(azure): keep the quota wording consistent with the inference caveat * docs(azure): retire the fm-ccm no-pi claim at its source and in C1 Scope expansion approved by the coordinator: the requirement doc corrected this claim while the component doc it originated in still asserted it, and C1 (merged in #274 while this branch was open) had since built five further claims on top of it. docs/azure-crosscheck.md, where the sentence originated, now records the corrected limit with the evidence chain: the current fm-ccm image carries pi, and the lane is off because crosscheck-azure.json has enabled:false. The 2026-08-16 measurement is kept and attributed, since M29 is not a dangling reference, only one that lives in the owner's mutation ledger outside this repository, which is now said explicitly. Two neighbouring sentences depended on the false one: the instrumentation follow-up described as bound to an image rebake, and the phases paragraph attributing the lane's silence to a missing image capability. Both now name the flag. C1 depended on it five times and one of those dependencies was independently wrong: it stated the operator home has no config/crosscheck-azure.json. The file exists, carries enabled:false, and names a current model_image_id. Also corrected: the status line and order-of-work entry no longer say the phases wait on a rebake; the argument that the 75 minutes cannot have come from a compartment run after 2026-08-16 is withdrawn rather than restated, since its premise was the false claim; and unmeasurable becomes unmeasured, which is a reversible condition. C1's "known contradiction" paragraph is resolved rather than left stale: R6's status line no longer reads NOT DONE. It now carries the correction that matters to C1, which is that GLM has never completed a review, so the pi-codex fallback is what served the one measured run.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Implements R6 (decision record:
docs/azure-requirements.md, R6 final: GLM-5.2 via the Fireworks partner lane on our own Azure AI Foundry resource; interim claude reviewer context from PR #259): the Crosscheck second reviewer's sole primary family becomes GLM-5.2 (FW-GLM-5.2on resourceaif-fm7c799d-eus01), driven by pi through theazure-glmcustom provider, and the interim claude reviewer lane is retired end to end.bin/fm-crosscheck.pyallowed_profiles:("pi", "FW-GLM-5.2", "xhigh")is the primary profile;("pi", "gpt-5.6-sol", "xhigh")and("codex", "gpt-5.6-sol", "xhigh")remain the dormant fallback family;("claude", "claude-opus-5", "xhigh")is removed (retired artifact 1 of 3).PI_MODEL_PROVIDERS):FW-GLM-5.2 -> --provider azure-glm,gpt-* -> --provider openai-codex, and any unmapped model refuses by name instead of guessing.account_homeis a dedicated pi agent dir whose credential ismodels.json(newinspect_pi_glm_credential). It must parse and contain exactly theazure-glmprovider withbaseUrlequal to the pinned endpoint, apiopenai-completions(chat completions only; a Responses-API-shaped configuration is refused), usableapiKeymaterial, and theFW-GLM-5.2deployment id. The endpoint is an allowlist of exactlyhttps://aif-fm7c799d-eus01.cognitiveservices.azure.com/openai/v1, pinned as module constants with the R6 comment; any other baseUrl refuses with an exact string.credential_identifieris a NON-SECRET binding:glm-foundry-binding:sha256("aif-fm7c799d-eus01/FW-GLM-5.2\n" + pinned baseUrl). The api key and any digest of it never enter identity, ledger, or output; the ledger reviewer identity isazure-glm:aif-fm7c799d-eus01/FW-GLM-5.2.review_family_mode(glm-primaryfor GLM,codex-fallbackfor the gpt family) in the ledger reviewer record the run already writes; a fallback run prints the exact warning lineCROSSCHECK DEGRADED: codex-family fallback reviewer <harness> <model> is standing in for the GLM-5.2 primary lane; crosscheck-same-model relaxation was required|was not required, and the readable report rendersReview family: **CODEX FALLBACK**. Ledger validation admits only the two family values.bin/fm-crosscheck-azure.py"claude": api.anthropic.comleavesHARNESS_PROVIDER_HOSTS(retired artifact 2).effective_provider_hostis model-aware: a piFW-GLM-5.2review derivesaif-fm7c799d-eus01.cognitiveservices.azure.comand refuses a conflicting configuredprovider_host; the codex-family fallback keeps its existing derivation..credentials.jsoninspection, archive name,CLAUDE_CONFIG_DIRselector, or claude launch branch remains; an unknown harness refuses by name. The packaged compartment credential for the GLM profile is the api-keymodels.jsonunder the same endpoint allowlist pin, andvalidate_azure_reviewer_recordadditionally requires a GLM record'sprovider_hostto equal the pinned Foundry host.bin/fm-crosscheck-azure-model-guest.sh: claude branch deleted; the pi branch maps the model to its provider (FW-GLM-5.2 -> azure-glm,gpt-5.6-sol -> openai-codex, otherwise refuse); the credential unpack expectsmodels.jsonfor the GLM profile, verifies the pinned baseUrl, and digests the non-secret Foundry binding as the executing account.Docs:
docs/crosscheck.md,docs/azure-crosscheck.md, anddocs/configuration.mdnow name GLM-5.2 as the sole primary review family, the pi-codex fallback as loud/degraded, the claude lane as retired, and the exact endpoint binding.Why
R6 requires the merge-gate reviewer to sit outside the author's model family. Firstmate authors run on codex-family and claude models; GLM-5.2 on our own Foundry deployment reviews all authors cross-family, with reviewer identity bound to the Foundry resource + deployment (an api key names no upstream account). The claude lane existed only as the interim cross-provider stopgap and is retired per the decision record.
Test evidence
tests/fm-crosscheck.test.sh: full suite green, 80/80ok, rc=0 (post-change run).test_reviewer_policy_profiles_and_independence(GLM accepted as primary; claude refused with the exact profile messagemust be codex gpt-5.6-sol xhigh or pi FW-GLM-5.2 xhigh or pi gpt-5.6-sol xhigh),test_claude_reviewer_profile_is_retired,test_glm_reviewer_executes_bound_policy_profile(asserts the constructed pi argv--mode json --provider azure-glm --model FW-GLM-5.2 --thinking xhigh ...via the argv-dumping pi fixture, plus ledgerglm-primaryand the non-secret binding),test_glm_credential_binding_is_key_independent(two configs differing only in apiKey yield byte-identical identifiers; neither key nor its sha256 appears; wrong baseUrl/missing file/Responses api/multi-provider/wrong deployment each refuse with their exact strings; provider mapping refuses unmapped models),test_codex_fallback_family_is_loud_and_recorded(exact degraded warning line with and without the same-model relaxation, durable ledger marker, report marker).tests/fm-crosscheck-azure.test.sh: 15/15ok, rc=0.glm_provider_host_unit(model-aware host derivation, foreign-host refusal, claude host retired from the table and refused, adapter/core constant equality, ledger-record pinned-host enforcement),glm_credential_lane_unit(inspect_reviewer_credentialGLM shape,create_credential_archivepackagesmodels.jsonwith the allowlist pin and refuses a foreign endpoint, the claude credential lane refuses by name, GLM preflight usable/missing behavior).static_contractnow asserts the guest carries the azure-glm mapping and zero claude references.bash -non the model guest;python3 -m py_compileon both python entrypoints;bin/fm-lint.sh(pinned ShellCheck 0.11.0) green on the three changed shell files.Mutation proofs (applied, proven red, reverted; outputs recorded)
if False and base_url != GLM_ALLOWED_BASE_URL):test_glm_credential_binding_is_key_independentwent red -AssertionError: unusable GLM credential was accepted: GLM reviewer endpoint allowlist refused baseUrl 'https://aif-other.cognitiveservices.azure.com/openai/v1'; ...(rc=1). Reverted; rc=0.glm-primary):test_codex_fallback_family_is_loud_and_recordedwent red -not ok - the codex-family fallback did not announce itself with the exact degraded warning(rc=1). Reverted; rc=0.("claude", "claude-opus-5", "xhigh")intoallowed_profiles:test_claude_reviewer_profile_is_retiredwent red (not ok - the retired claude profile was not refused at reviewer preflight) andtest_reviewer_policy_profiles_and_independencewent red (AssertionError: reviewer configuration.reviewers[0] must be claude claude-opus-5 xhigh or codex ...), both rc=1. Reverted; rc=0.Review absorption (adversarial review round 1)
BLOCKER (fixed in
fix(crosscheck): refuse model-level baseUrl/api overrides that outrank the pinned GLM endpoint): pi's provider composer gives MODEL-level fields precedence over the provider level (dist/core/provider-composer.js:api = definition.api ?? providerConfig.api,baseUrl = definition.baseUrl ?? providerConfig.baseUrl, verified against the installed pi 0.84.2), so a models.json keeping the pinned endpoint at provider level while smuggling"baseUrl"/"api"inside the FW-GLM-5.2 model entry escaped the allowlist. All three gates now refuse any model entry carrying either field, even one repeating the pinned values:inspect_pi_glm_credential(core), thecreate_credential_archiveGLM branch (azure adapter), and the model guest's credential unpack. Covered by the exact exploit shape intest_glm_credential_binding_is_key_independent(foreign override AND pinned-value repeat both refuse) andglm_credential_lane_unit(inspection + archive gate), plus a guest static marker; mutation proof 4 below.NOTE 1 (fixed in
fix(crosscheck): remove the retired claude identity reader and bind the family marker to the model): the now-unreachable claude branch inaccount_identity(the last.credentials.jsonreference in the crosscheck tree) is deleted; an unknown harness refuses by name.NOTE 2 (same commit):
validate_ledgernow bindsreview_family_modeto the reviewer model in both directions -glm-primaryrequires the GLM model (provider-slot prefixes stripped viamodel_identity),codex-fallbackrequires a non-GLM one - so a forged record cannot claim the wrong family. Unit added intest_codex_fallback_family_is_loud_and_recordedcovering honest pairings (including the absent-field older-ledger shape) and both forged directions; mutation proof 5 below.Mutation proofs (round 2)
if False and (...)):test_glm_credential_binding_is_key_independentwent red -AssertionError: unusable GLM credential was accepted: model-level baseUrl/api override(rc=1). Reverted; rc=0.True or (...)in the validate_ledger require):test_codex_fallback_family_is_loud_and_recordedwent red -AssertionError: forged family glm-primary for gpt-5.6-sol validated(rc=1). Reverted; rc=0.Honest limits
model_image_id. No rebake is attempted here. The executable GLM lane tonight is the LOCAL pi reviewer.docs/azure-crosscheck/model-image.json) still pins the claude CLI closure; it is a build-input declaration, the pinned image is unchanged by this PR, and dropping the claude CLI from the bake belongs to the future rebake.