Our agents do not “talk until they agree.” Deterministic code hands four GLM-5.3 specialists the same frozen evidence bundle. Each returns a typed review artifact. A fifth GLM-5.3 editor receives those four artifacts explicitly. Code—not the model—then decides whether the bundle is eligible to move.
That is the design pattern: the artifact is the API. Shared memory is tempting because it feels collaborative. It is also difficult to audit. An artifact names exactly what crossed a boundary, which version crossed it, and what the next role was allowed to do with it.
If a later stage cannot show the exact serialized input it received and the exact validated artifact it returned, the handoff is not yet auditable.
The implemented graph—not the aspirational diagram
registration and compute
deterministic python · Owns the question, estimand, official numbers, charts, and source record.
four specialist reviews
glm 5 3 via openrouter · May pass, request revision, or block within a named specialty. May not change the official calculation or registration.
editor review
glm 5 3 via openrouter · May recommend pass, revise, or block. May not waive a mechanical failure or invent replacement evidence.
publication decision
deterministic python · Passes only when every check is true, every specialist decision passes, and no blocking finding survives.
promotion
deterministic python plus human release authority · Re-verifies the bundle and may refuse promotion. A model cannot publish itself or bypass external-release consent.
The current orchestrator is ordinary, inspectable Python. It locks the question, hashes sources, runs the statistical analysis, renders figures, assembles evidence, invokes specialists in a fixed sequence, reconciles decisions, and writes the manifest. It can choose a due study from a versioned registry. It is not yet a free-form LLM manager inventing arbitrary research programs.
GLM-5.3 owns a narrower and still consequential job: semantic challenge. It checks whether the execution matches the locked design, whether the statistical interpretation outruns the estimand, whether a reader could misuse the headline, whether provenance supports the claims, and whether the complete record is publication-ready.
What crosses the first agent boundary
The first four specialists receive the same six top-level evidence objects. We deliberately send the complete candidate rather than role-specific summaries that could conceal a problem upstream.
locked_research_memo
The preregistered question, estimand, population, design, risks, and required outputs.
provenance
Source URLs, versions, retrieval times, licenses, attribution, file sizes, seasons, and SHA-256 hashes.
analysis
The deterministic statistical result: cohorts, estimates, uncertainty, attrition, and figure contracts.
article
The exact candidate prose the specialists are reviewing—not a summary of it.
artifact_inventory
Every reviewable file with its path, byte count, and SHA-256.
mechanical_checks
The code-owned checks and their current Boolean results.
Every request contains exactly two messages: the specialist's published system prompt and one user message containing the delimited evidence JSON. The next specialist does not inherit a transcript. The editor receives the same frozen evidence plus four named ReviewArtifact objects and a deterministic count of blocking findings.
That explicit fan-in matters. “The statistician was worried” is not an input. The statistician's decision, summary, findings, reviewed artifacts, model identity, and timestamp are the input.
Typed does not mean true
OpenRouter requests GLM-5.3 output through strict JSON Schema at temperature zero. Pydantic validates the response locally. A pass cannot contain a blocking finding; a block must name one. Malformed or truncated responses are rejected, and a bounded retry gets its own receipt.
Those controls make outputs easier to route and harder to misunderstand. They do not prove the reasoning. Valid JSON can still be shallow, mistaken, correlated with another role, or confidently wrong. That is why official statistics stay in deterministic artifacts, every role sees source evidence, the gate combines model judgment with mechanical checks, and promotion re-verifies the disk state.
Decision, findings, evidence-specific criticism, and a bounded recommendation.
Configured model, role, timing, hashes, usage, cost, failure state, and accepted-response digest.
Cohorts, estimates, intervals, charts, source inventory, and mechanical checks.
Hash reconciliation, article promotion, external consent, deployment, and reader-visible QA.
The duplicated check that documentation exposed
While turning this pattern into a generated public contract, we compared the two implemented promotion paths. Rookie WR promotion rejected every model name beginning with deterministic/. Touchdown Regression rejected only the exact string deterministic/offline.
Our offline checklists use names such as deterministic/checklist-v1 and deterministic/editor-checklist-v1. Under the old touchdown-specific condition, a fully passing bundle with one of those labels could satisfy the model-origin check. It would still need valid hashes, five passing roles, every mechanical check, correct article claims, and valid figures—but the statement “online specialist models reviewed this” was not enforced as broadly as the error message claimed.
Two series duplicated the online-model check. The rookie path rejected every deterministic/* model, while the touchdown path rejected only the exact string deterministic/offline.
We found no run misrepresented as online through this path. The preserved GLM-5.3 candidate we audited records z-ai/glm-5.3 for all five review artifacts and all five manifest roles. Two older deterministic research snapshots remain public, but they are explicitly labeled deterministic/offline and predate the current online-review promotion contract.
The repair is stronger than changing one string. Both research series now call one shared verifier. It rejects every deterministic/* label and requires the five review model identities to match the five configured models frozen in the run manifest. Tests now challenge three offline labels and review-to-manifest drift across both series.
Why we still choose GLM-5.3
This defect was deterministic orchestration code, not a GLM failure. That distinction is exactly why a transparent system publishes the whole boundary map. Models are not the only source of AI-system risk; adapters, retry logic, identity handling, gates, duplicated checks, and promotion code can create equally consequential gaps.
We are proud to use GLM-5.3 because it gives the desk useful, evidence-specific semantic pressure. We are equally proud to state what it does not do. Five roles using one model family are correlated specialist perspectives, not five independent peers. Temperature zero is not determinism. The roles currently run sequentially. The model does not calculate the official answer, certify itself, or push the publish button.
Six rules we will carry forward
Pass state, not vibes
Every handoff is JSON or a versioned file. A later role receives the artifact itself, not an informal claim that an earlier role approved.
Fresh context by default
Each specialist gets a new two-message request: one public role prompt and one delimited evidence bundle. There is no inherited chat transcript.
Own identity outside the model
The transport writes the authoritative role, configured model, and timestamp. GLM-5.3 does not certify which model answered.
Validate shape, then challenge meaning
Strict JSON Schema rejects malformed output. Deterministic checks and other specialists still have to challenge whether valid JSON is true or useful.
Let disagreement stop the line
A revise or block decision survives into the publication gate. The editor cannot erase a mechanical failure or a blocking finding.
Reconcile again at promotion
Promotion rereads hashes, article claims, figures, five role decisions, and the manifest model map before public state changes.
Open the contract, not just the essay
The generated contract hashes the actual orchestration sources, all five prompts, and all four public schemas. The production build compares that artifact byte-for-byte against current code and rejects twelve adversarial mutations, including erased roles, invented hidden memory, offline reviewers entering online promotion, removed model reconciliation, hidden limitations, and model-owned release authority.
That contract will evolve as the desk becomes more autonomous. When the implementation changes, the public artifact must change with it. We would rather explain a growing system—including the failures—than preserve a simple story that stopped being true.