The cleanest way to make an AI research system trustworthy is not to hide the model or pretend it is deterministic. It is to give each kind of work an explicit owner, record every handoff, and make authority narrower than capability.
Fourth Down Labs uses GLM-5.3 because statistical research needs judgment: whether a claim exceeds an estimand, whether leakage is plausible, whether a caveat is visible enough, whether a source actually supports the sentence, and whether a fantasy reader could turn a careful average into a reckless player take. Those are not merely formatting tasks.
We do not use that judgment as the source of record for row counts, coefficients, intervals, charts, model identity, or publication status. That boundary is the design pattern: a deterministic spine surrounded by probabilistic specialists, followed by a mechanical gate and an atomic release.
GLM-5.3 may discover a problem the code did not anticipate. It may not invent evidence, change the locked question, recompute the official result, certify its own identity, or waive a failed publication check.
The four-layer publication path
Deterministic spine
Code locks the question, acquires and hashes data, builds cohorts, fits models, computes uncertainty, renders figures, and records immutable artifacts.
GLM-5.3 specialists
Five schema-constrained roles examine conformance, statistics, adversarial failure modes, citations, and the publication decision through OpenRouter.
Mechanical gate
Code verifies provenance, sample size, temporal validation, attrition, uncertainty, role completion, blockers, limitations, and figure contracts. No model can waive a failed check.
Atomic release
A passing candidate is hash-verified and promoted as one versioned bundle. A post-gate failure withholds the entire revision instead of mixing old and new evidence.
Why not ask the model to do everything?
An all-in-one prompt can look autonomous while collapsing the evidence chain. The same model chooses the question, analyzes the data, narrates the answer, reviews itself, and declares success. A fluent response can then hide which stage failed—and there may be no stable artifact to inspect.
Our statistical code can still be wrong. Determinism does not mean correctness. It means the same inputs and versioned implementation produce the same inspectable output, so a reviewer can locate the error and a test can preserve the repair. GLM-5.3 adds a different kind of coverage: semantic attacks that are difficult to enumerate exhaustively in code.
Hashes, cohorts, splits, counts, estimates, intervals, file inventories, thresholds, and atomic promotion.
Scope, ambiguity, overclaiming, causal language, missing caveats, evidence relevance, and reader misuse.
A chart can be internally valid while its title carries stale meaning. A sentence can cite a source while overstating what it says.
Valid JSON can contain placeholder judgment, fabricated reconciliation, or a false pass. Schema validity is necessary, never sufficient.
Five specialists, one named model family
Every online role currently routes to z-ai/glm-5.3 through OpenRouter at temperature zero with a strict JSON Schema. We publish the exact prompts and schemas. The transport—not the response text—writes the authoritative role, configured model, and timestamp.
Researcher
Checks the executed study against the locked registration. It may flag a departure; it cannot silently rewrite the question after seeing results.
Statistician
Attacks leakage, split design, uncertainty, attrition, and estimand scope. The source numbers remain the deterministic analysis artifacts.
Adversarial reviewer
Tries to falsify the central claim and identifies how a fantasy reader could over-apply it. A shared model family means role separation, not independent peer review.
Citation checker
Traces numeric claims, figures, sources, licenses, and recency to the evidence inventory. It does not create missing provenance.
Editor / publisher
Integrates the specialist record and decides pass, revise, or block. A pass is still subordinate to mechanical and release-quality checks.
These are correlated specialist perspectives, not five independent minds. They share a model family, evidence bundle, and system designer. We call this agent review and state the denominator: three preserved online runs created 15 configured role opportunities, and 13 role outputs exist. The missing two are part of the orchestration record, not rounded away.
Decision rights are the real architecture
Boxes and arrows explain sequence. Decision rights explain safety, accountability, and what happens when components disagree.
Two failures made the boundary sharper
Our first preserved online run exposed an orchestration failure: the researcher was allowed to replace rather than audit the registration, reviewers saw an incomplete bundle, two roles were never invoked, and model-authored identity fields were trusted. The gate rejected the candidate. We moved registration ownership and identity authority back into code, completed the evidence bundle, and required all five roles.
A later candidate passed all five GLM-5.3 roles and all nine then-current gate checks. Visual QA still found two PNG titles with stale 2024 values wrapped around current 2025 bars. We withheld the revision and added generated figure specifications, visible-claim contracts, and hash-verified atomic promotion. The lesson was not that GLM-5.3 failed or succeeded. The lesson was that the workflow lacked a boundary for rendered claims.
What the mechanical gate can—and cannot—prove
The gate can prove that required provenance exists, temporal validation is declared, sample and uncertainty thresholds pass, attrition reconciles, every specialist completed, no blocking finding remains, limitations are present, and figure contracts match. It can prove those facts only under the definitions encoded in the verifier.
It cannot prove that the research question matters, the public data captures every relevant football mechanism, GLM-5.3 found every subtle flaw, or readers will make better decisions. Those claims require continued incident collection, model evaluations, external scrutiny, and real audience outcomes. Our public scorecard therefore reports zero challenger evaluations and zero approved model swaps rather than treating a protocol as completed evidence.
Where autonomy stops
The orchestrator can select due series, acquire permitted public data, run deterministic analysis, invoke specialist roles, write artifacts, and fail closed. External disclosure of unpublished bundles requires authorization. Publication promotion remains an inspectable release action. Commercial data, ads, and paid access each have separate evidence and rights gates.
That is slower than granting one agent every credential and faster than manually repeating the whole desk. More importantly, it creates a system that can grow as models improve without rewriting what truth means. GLM-5.3 can be challenged or replaced against a frozen incident corpus. The deterministic contracts remain legible across the swap.
The pattern in one sentence
Use code to own state, GLM-5.3 to attack meaning, schemas to constrain the handoff, gates to enforce minimum evidence, humans to authorize disclosure and release, and a public ledger to show where every layer still falls short.