feat(crosscheck): route GLM reviews through Fireworks Fast

[ruby-dlee]

Intent

Recover and ship the exact C1 implementation produced by Azure assignment asg-00000022 before the host crash, preserving surviving commit 3c768625d25b6f87c845561b1d4208cd53327178 rather than reimplementing it. The implementation must route the Fireworks GLM 5.2 reviewer through the Fast selector accounts/fireworks/routers/glm-5p2-fast, add terminal provider/model readback checks, and include focused executable tests, while conforming to docs/azure-requirements.md and the owning Azure pilot, runner, validation, crosscheck, and workers documents and current main. Correct only actual compatibility or validation defects with executable regression evidence, and validate with focused crosscheck tests, relevant broader tests, and bin/fm-lint.sh. Ship code only: do not manufacture acceptance evidence from local tests or configuration assertions; do not start, stop, release, surrender, reset, or delete Azure resources; do not discard the retained outcome; and do not mutate or reattach the crashed C2/C3 validation run. Clearly state that C1 remains NOT ACCEPTED until this change is merged and a separate post-merge, real-provider, measured 20-to-30-minute live run satisfies the latency requirement. Never push to the default branch and never merge the PR.

What Changed

• Route Pi-based GLM reviews through the Fireworks Fast selector and fail closed unless the terminal event reports the expected provider and model.
• Preserve historical Standard-selector ledger compatibility while rejecting that retired route for new reviews, with focused executable regression coverage.
• Update crosscheck and Azure requirements documentation to keep C1 NOT ACCEPTED until a separate post-merge, real-provider 20-to-30-minute live run meets the latency requirement.

Risk Assessment

✅ Low: The Fast selector routing, terminal provider/model readback, historical-ledger compatibility, focused executable tests, and explicit C1 NOT ACCEPTED wording are internally consistent and well bounded.

Testing

The successful baseline was supplemented with focused host tests proving exact Fireworks Fast routing and fail-closed terminal provider/model readback, plus the Azure Crosscheck behavior suite demonstrating guest credential admission, route dispatch, and hostile/mismatched input refusal. Reviewer-visible CLI transcripts were captured; no live Azure or real-provider run was attempted, and lint was not rerun because this assigned phase expressly forbids linters.

Evidence: Host Fast-route execution transcript

== tests/fm-crosscheck.test.sh ==
ok - every registered cross-family reviewer executes on its own provider slot with a non-secret binding

Evidence: Host terminal provider/model readback transcript

== tests/fm-crosscheck.test.sh ==
ok - Pi accepts only a successful terminal assistant turn

Evidence: Azure Crosscheck guest behavior transcript

== tests/fm-crosscheck-azure.test.sh ==
ok - Azure Crosscheck static contracts separate model, tool, verifier, identity, and cleanup
ok - the adapter and guest agree on the exact seven-parameter contract
ok - Azure selection is explicit, local-default, and unsafe config fails closed
AZURE PROMPT ends in the exact compact outer wrapper schema
ok - the Azure model prompt ends with the exact verdict and evidence wrapper schema
ok - the reviewer model derives the exact provider host and the claude host lane is retired
ARCHIVE GATE and CORE INSPECTOR agree on every drifted credential shape
TOCTOU refusal raises a persisted tool failure, not a vanishing error
ok - the Azure cross-family credential lane packages models.json under each lane's endpoint allowlist and the claude lane is gone
GUEST ACCEPTED codex with the host-admitted identity codex:acct_ABC123
GUEST REFUSED codex with a foreign executing account
GUEST REFUSED codex with no account id in the credential
GUEST ACCEPTED pi with the host-admitted identity openai-codex:acct_ABC123
GUEST REFUSED pi with a foreign executing account
GUEST REFUSED pi with no account id in the credential
GUEST REFUSED a manifest with a forged effort
GUEST REFUSED a manifest with a forged model
GUEST REFUSED a manifest with a forged harness
GUEST REFUSED a manifest with a forged review generation
GUEST REFUSED a manifest with a forged credential name
GUEST REFUSED a manifest with a forged credential digest
GUEST ACCEPTED the fireworks-glm lane credential
GUEST REFUSED a foreign endpoint in the archived credential
GUEST dispatches every registered lane
ok - the model guest derives the host's executing account, refuses foreign ones, and dispatches every registered lane
GUEST Pi verdict parser is byte-bound to the host and fails closed
ok - the exact model guest accepts one fenced verdict and preserves terminal-turn safety
GUEST Pi protocol correction is one-shot, clean, and output-blind
ok - the exact Pi branch performs at most one clean protocol-correction attempt
ok - wrong head, stale endpoint, shared VM, network, credential, and generation outcomes fail closed
ok - review generation binds the executing account and ambiguous cleanup never becomes absence
ok - host bridge rejects hostile evidence and requires distinct cleaned exact-head tool/verifier attempts
ok - manifest transport bounds hold through the real producer and consumer
ok - the safety-shutdown expiry script renders real newlines with the exact unit text
ok - networkless replay proves exact pytest mutations and denies command, symlink, marker, and parent substitution
ok - the model compartment reserves and releases exact shared allocator capacity and honors queued refusals
crosscheck clear: https://github.com/ruby-dlee/firstmate/pull/302 at aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
ok - a queued model reservation is released, ledgered as a tool failure, and falls through to the next reviewer
ok - reviewer lanes admit FIFO, spread families deterministically, prune dead waiters, and never write auth back
ok - image and network-policy mutations are declaration-owned and refuse without exact confirmations
ok - admission refuses a model image that does not attest the dispatched reviewer harness
ok - operator documentation enumerates malicious, concurrency, fault, force-push, and cloud-default acceptance
Azure Crosscheck tests passed.

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 2 issues found → auto-fixed ✅

• 🚨 docs/azure-requirements.md:1077 - Intent requires the change to “Clearly state that C1 remains NOT ACCEPTED,” but the rewritten acceptance section says only “NOT MET.” Preserve the required lifecycle wording explicitly, while retaining the post-merge measured-run condition.
• ⚠️ docs/configuration.md:109 - The configuration guide still instructs operators to use the retired Standard selector accounts/fireworks/models/glm-5p2. Following it now causes reviewer preflight to refuse the roster. Update this operator-facing profile to the Fast selector introduced by the change.

🔧 Fix: Align C1 status and Fast selector documentation
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• if [ "${FM_AZURE_VALIDATION_CELL:-0}" = 1 ]; then exec "$FM_AZURE_VALIDATION_SHARD_BRIDGE" behavior --count "${FM_AZURE_VALIDATION_SHARD_COUNT:-8}"; else exec bin/fm-no-mistakes-test-command.sh; fi
• Configured baseline command (already completed successfully before this phase): if [ "${FM_AZURE_VALIDATION_CELL:-0}" = 1 ]; then exec "$FM_AZURE_VALIDATION_SHARD_BRIDGE" behavior --count "${FM_AZURE_VALIDATION_SHARD_COUNT:-8}"; else exec bin/fm-no-mistakes-test-command.sh; fi
• FM_TEST_CASE=test_pi_reviewer_accepts_only_successful_terminal_turn tests/fm-crosscheck.test.sh
• FM_TEST_CASE=test_cross_family_reviewer_executes_bound_policy_profile tests/fm-crosscheck.test.sh
• tests/fm-crosscheck-azure.test.sh
• git status --short confirmed testing left no worktree artifacts

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.