{ "schemaVersion": "1.0.0", "updatedAt": "2026-08-31T08:30:00Z", "status": "bounded_research_automation_supervised_external_change_no_autonomous_publication", "honestClaim": "Fourth Down Labs is not an autonomous publisher. It is a bounded research-automation system: deterministic code and GLM-5.3 can complete registered research and open a review pull request, while topic registration, merge, public release authority, corrections, and monetization remain human-controlled or disabled.", "model": { "configuredSlug": "z-ai/glm-5.3", "displayName": "GLM-5.3", "router": "OpenRouter", "maximumAuthorityLevel": 2, "toolsSupplied": false, "publicStateMutationAuthority": false, "registrationMutationAuthority": false, "statisticalSourceOfRecord": false, "roleCount": 5, "disclosure": "GLM-5.3 supplies bounded semantic review. It does not browse, run code, alter the registered question, calculate the official result, merge, deploy, charge, or publish." }, "summary": { "classification": "bounded_autonomous_research_with_supervised_pull_requests", "stageCount": 14, "countsByLevel": { "0": 3, "1": 4, "2": 6, "3": 1, "4": 0 }, "highestImplementedAuthorityLevel": 3, "highestImplementedExternalAction": "create_branch_push_branch_and_open_pull_request", "autonomousPublicAuthorityLevel": 0, "workflowMergesPullRequests": false, "workflowPushesMainDirectly": false, "branchProtectionVerifiedByThisContract": false, "registryDrivesScheduledSelection": false, "cadenceLabelsProgrammaticallyEnforced": false, "missingOpenRouterKeyFailsClosed": true, "offlineFallbackInScheduledDesk": false, "currentScheduledDefault": "touchdown-regression", "manualSeriesChoices": [ "touchdown-regression", "rookie-wr-hit-rates" ] }, "authorityLevels": [ { "level": 0, "id": "human_only_or_disabled", "label": "Human only / disabled", "definition": "The system has no implemented authority to perform this decision or public action." }, { "level": 1, "id": "decision_support_or_post_approval_automation", "label": "Decision support", "definition": "Code can list, validate, or execute a consequence only after a separate human-controlled decision." }, { "level": 2, "id": "bounded_automatic_execution", "label": "Bounded automatic execution", "definition": "The system can complete a preregistered internal task inside fixed inputs, outputs, permissions, and failure rules." }, { "level": 3, "id": "supervised_external_change", "label": "Supervised external change", "definition": "The system can create a reversible, reviewable external artifact such as a branch or pull request, but cannot make it public." }, { "level": 4, "id": "unsupervised_public_authority", "label": "Unsupervised public authority", "definition": "The system can publish, charge, message, merge, or otherwise affect readers without a prior human-controlled checkpoint." } ], "stages": [ { "id": "topic_and_registration_authoring", "level": 0, "actor": "human_research_owner", "status": "human_authored", "capability": "Humans add series, hypotheses, estimands, risks, cadence labels, sources, and access class to versioned files.", "boundary": "GLM-5.3 cannot create or rewrite the locked registration inside a run.", "evidence": [ "research/series/*.yaml", "research/prompts/researcher.md" ] }, { "id": "phase_and_priority_planning", "level": 1, "actor": "deterministic_python", "status": "advisory_only", "capability": "The plan command lists active series for the inferred season phase, sorted by priority.", "boundary": "The printed list does not start a run, enforce cadence against run history, or control the monthly workflow.", "evidence": [ "research/src/fourth_down_labs/registry.py", "research/src/fourth_down_labs/cli.py" ] }, { "id": "scheduled_series_selection", "level": 1, "actor": "github_actions_configuration", "status": "fixed_default_or_manual_choice", "capability": "The monthly schedule defaults to Touchdown Regression; manual dispatch can choose one of two implemented series.", "boundary": "This is not registry-driven topic selection. Cadence labels are descriptive, not an executable due-state ledger.", "evidence": [ ".github/workflows/research-desk.yml" ] }, { "id": "scheduled_run_trigger", "level": 2, "actor": "github_actions", "status": "bounded_and_automatic", "capability": "GitHub Actions starts the configured research job monthly or on manual dispatch.", "boundary": "One concurrency group, a 30-minute timeout, and a fixed two-series dispatch surface bound the run.", "evidence": [ ".github/workflows/research-desk.yml" ] }, { "id": "data_acquisition", "level": 2, "actor": "deterministic_python", "status": "bounded_and_automatic", "capability": "The selected pipeline downloads registered public assets, hashes them, and writes provenance.", "boundary": "Only implemented analyzers and code-authored source contracts run; planned series raise an error.", "evidence": [ "research/src/fourth_down_labs/pipeline.py", "research/src/fourth_down_labs/rookie_wr_pipeline.py" ] }, { "id": "statistical_analysis", "level": 2, "actor": "deterministic_python", "status": "bounded_and_automatic", "capability": "Code builds cohorts, fits registered models, computes uncertainty, and renders artifacts with fixed seeds.", "boundary": "GLM-5.3 does not execute the official calculation or overwrite analysis artifacts.", "evidence": [ "research/src/fourth_down_labs/analysis/", "/ai-operations-ledger.json" ] }, { "id": "specialist_review", "level": 2, "actor": "glm_5_3_via_openrouter", "status": "bounded_and_automatic", "capability": "Five GLM-5.3 roles return schema-constrained judgments over frozen evidence.", "boundary": "No tools are supplied. Roles share one model family, operate sequentially, and cannot mutate registration, calculations, or public state.", "evidence": [ "/agent-handoff-contract.json", "/evidence-boundary.json", "/methods/prompts/" ] }, { "id": "publication_gate", "level": 2, "actor": "deterministic_python", "status": "bounded_and_automatic", "capability": "Code combines every mechanical check, five role decisions, and blocking findings into one decision artifact.", "boundary": "Any failed check or non-pass role stops the run; GLM-5.3 cannot waive code-owned checks.", "evidence": [ "research/src/fourth_down_labs/pipeline.py", "research/src/fourth_down_labs/rookie_wr_pipeline.py" ] }, { "id": "branch_local_promotion", "level": 2, "actor": "deterministic_python", "status": "bounded_and_automatic", "capability": "A passing online run is hash-verified and promoted into site content inside the workflow checkout.", "boundary": "Promotion changes only the temporary branch workspace until later Git operations succeed.", "evidence": [ "research/src/fourth_down_labs/promotion.py", ".github/workflows/research-desk.yml" ] }, { "id": "review_branch_and_pull_request", "level": 3, "actor": "github_actions_bot", "status": "supervised_external_change", "capability": "The workflow can create a branch, push research artifacts, and open a reviewable pull request.", "boundary": "The implemented workflow does not merge the pull request or push to main.", "evidence": [ ".github/workflows/research-desk.yml" ] }, { "id": "main_branch_merge_and_public_release", "level": 0, "actor": "human_release_owner", "status": "human_checkpoint", "capability": "A human-controlled merge is required before research content reaches main and becomes eligible for deployment.", "boundary": "The repository workflow contains no merge command. Branch-protection enforcement is external state and is not proven by this contract.", "evidence": [ ".github/workflows/research-desk.yml", ".github/workflows/ci.yml" ] }, { "id": "production_deployment", "level": 1, "actor": "render_after_main_change", "status": "post_approval_automation_observed", "capability": "Render has been observed building main revisions after they are pushed or merged.", "boundary": "Render configuration is external to this repository; the build can verify runtime shape, not the provider trigger policy.", "evidence": [ "/operations-incidents.json", "/operations-evidence/verify-render-runtime.mjs" ] }, { "id": "monitoring_and_corrections", "level": 1, "actor": "human_plus_deterministic_verifiers", "status": "on_demand_not_autonomous", "capability": "Public ledgers and deterministic checks preserve incidents, holds, and corrections when an operator runs the release audit.", "boundary": "There is no verified always-on uptime alert, automatic correction author, or autonomous rollback loop.", "evidence": [ "/operations-incidents.json", "/corrections.json" ] }, { "id": "monetization", "level": 0, "actor": "disabled", "status": "value_gated", "capability": "No Stripe checkout, premium entitlement, or display-ad execution is enabled.", "boundary": "Stripe remains 0/4; ads remain 1/3.", "evidence": [ "/monetization-readiness.json", "/readiness" ] } ], "permissionBudget": { "glm53": [ "read one delimited evidence bundle per call", "return one ReviewArtifact", "no tool definitions", "no public-state mutation" ], "researchProcess": [ "HTTP acquisition from registered source URLs", "write run artifacts inside the job", "invoke five bounded OpenRouter reviews", "fail or create branch-local promoted content" ], "githubWorkflow": [ "contents: write", "pull-requests: write", "create research branch", "push research branch", "open pull request" ], "explicitlyAbsent": [ "merge pull request", "push main directly", "publish from GLM-5.3", "send reader messages", "run billing", "place ads" ] }, "nextAuthorityGates": [ { "capability": "registry_driven_cadence", "currentLevel": 1, "targetLevel": 2, "requirements": [ "Executable cadence semantics", "last-success and open-PR state", "planned-analyzer exclusion", "duplicate-run suppression", "dry-run output", "time-boundary tests" ] }, { "capability": "topic_proposals", "currentLevel": 0, "targetLevel": 1, "requirements": [ "GLM-5.3 may propose topics in a non-executable artifact", "human-authored registration remains required", "source-rights triage", "duplicate and novelty checks" ] }, { "capability": "verified_release_control", "currentLevel": 0, "targetLevel": 0, "requirements": [ "Freeze branch-protection evidence", "require green CI", "require editorial review", "preserve rollback and incident logging" ], "policy": "Keep public release human-controlled; higher autonomy is not currently a product goal." }, { "capability": "monitoring", "currentLevel": 1, "targetLevel": 2, "requirements": [ "Independent uptime probe", "scoped alert destination", "deduplication", "incident creation without automatic public claims", "human-authorized rollback" ] } ], "knownGaps": [ "The registry can rank phase-eligible series, but the schedule does not consume that result.", "Cadence strings are descriptive labels; no persisted due-state or last-success ledger enforces them.", "A pull-request body asks for editorial review, but this committed contract does not prove branch protection or a required reviewer exists.", "Render deployment behavior is externally configured and observed, not fully described by repository source.", "The five GLM-5.3 roles are correlated and sequential, not independent reviewers or a parallel agent society.", "No always-on audience, uptime, correction, rollback, billing, or ad-placement agent is enabled." ], "operationsEvidence": { "preservedIncidentCount": 1, "publicHref": "/operations-incidents.json", "deploymentAutomationClaim": "observed_after_main_change_not_repo_enforced" }, "buildIsolationIncident": { "id": "BUILD-001", "failedDeployId": "dep-daajo80u01pc73dsm7t0", "status": "fixed_before_publication", "readerImpact": false, "failedRevisionReachedProduction": false, "previousHealthyRevisionRemainedLive": true, "cause": "The local autonomy verifier read .github/workflows/research-desk.yml, but .dockerignore removed .github from Render’s isolated build context. The production build failed closed with ENOENT before deployment.", "repair": "The builder context now includes .github so the autonomy contract can verify the exact workflow bytes during Docker and Render builds. The final runtime image still copies only compiled output and runtime dependencies.", "lesson": "A generated evidence contract is only portable when every authoritative source it reads is present in every build context that verifies it." }, "sourceIntegrity": [ { "path": ".github/workflows/research-desk.yml", "sha256": "38d10cb19bc6acefbd87b20e41622698c6ce65da2a6f6ac92fe8405a9240e57d" }, { "path": ".github/workflows/ci.yml", "sha256": "edf11fdab40520a4d885808308ebcc96959ec65c63a3404fde402e5e193b68c0" }, { "path": "research/src/fourth_down_labs/registry.py", "sha256": "1049ccd3e062fcd6557a7ff50c824e3e7be3dbceed5e7ec5c5d786e761e3e4ff" }, { "path": "research/src/fourth_down_labs/cli.py", "sha256": "4b7f6fbbb28e4538b7c1ce9744cacf40c79e48ba7a885eb04830a0bc280c47c4" }, { "path": "research/src/fourth_down_labs/openrouter.py", "sha256": "db6ecd6324c34ee808ad79080cc0d9cabdc03b0ddeef0fbc10133993898343ac" }, { "path": "research/src/fourth_down_labs/promotion.py", "sha256": "d317892bb13b86cb1f6f093046a39e91a808e2081d2b37bebb2910b5a66424e7" }, { "path": "content/monetization-readiness.json", "sha256": "4eddfd88689eaf163e423bb6e262d5a104890313f7faaf9517b19c568070c05b" }, { "path": "content/agent-handoff-contract.json", "sha256": "8f3e0bdae607d12b770e2abdedf5ee294a90f3d5e0ca460b570ece934d7f78f9" }, { "path": "content/operations-incidents.json", "sha256": "9e94841df04f4a30861f67269e166b285dc3bed8e3a4bd7e72503cb06aec5934" }, { "path": ".dockerignore", "sha256": "9708edecadd4fad1cffacd15c48f74c1a9c774debcbef01a1c10e4ca515cf0f3" } ], "publicEvidence": { "handoffContract": "/agent-handoff-contract.json", "evidenceBoundary": "/evidence-boundary.json", "aiOperations": "/ai-operations-ledger.json", "modelEvaluations": "/agent-evaluations.json", "monetizationReadiness": "/monetization-readiness.json" }, "dataBoundary": { "newModelCallMadeForThisScorecard": false, "unpublishedResearchSentForThisScorecard": false, "credentialsIncluded": false, "statement": "This scorecard is a deterministic reading of committed code, workflows, public contracts, and preserved operational evidence. It did not invoke GLM-5.3 or send unpublished research to OpenRouter." } }