feat: add Crosscheck telemetry and exact-head reuse

[ruby-dlee]

Intent

Deliver and land a seamless, non-disruptive Azure Crosscheck upgrade for Firstmate using regular GLM 5.2 only: add accurate core per-run telemetry and economics reporting; schema-constrained verdicts, prompt-by-file execution, caching affinity, and exact-head reuse; preserve fail-closed identity, evidence, exact-head, and Azure isolation guarantees; do not add Fast serving, spend caps, dashboards, a benchmark corpus, speculative batching, or Codex fallback-pricing work. Include the narrow live-acceptance fix that binds Pi verdict identity to the trusted host while retaining the independently verified exact-environment receipt. Validate with no-mistakes and green CI, then roll into Azure without interrupting active work and prove the live route end to end.

What Changed

• Move Crosscheck to regular GLM 5.2 with schema-constrained Pi verdict submission, prompt-by-file execution, session affinity, and fail-closed host-bound reviewer identity validation.
• Record per-run token usage, costs, turns, latency, outcomes, finding disposition, and reuse provenance, exposed through the new economics command.
• Reuse eligible accepted reviews for unchanged exact heads while revalidating reviewer, contract, execution-proof, and Azure compartment identity guarantees.

Risk Assessment

⚠️ Medium: No material source defect was substantiated, but the change is broad and security-sensitive across telemetry, exact-head reuse, reviewer identity, and Azure execution boundaries.

Testing

The successful baseline was supplemented with focused end-to-end telemetry/economics/exact-head reuse validation and the executable Azure Crosscheck contract suite; local behavior, strict verdict handling, trusted-host Pi identity, and fail-closed isolation passed, but actual Azure rollout and live-route proof were outside this test phase and remain unverified.

Evidence: Azure Crosscheck executable contract evidence

== tests/fm-crosscheck-azure.test.sh ==
ok - Azure Crosscheck static contracts separate model, tool, verifier, identity, and cleanup
ok - the adapter and guest agree on the exact seven-parameter contract
ok - Azure selection is explicit, local-default, and unsafe config fails closed
AZURE PROMPT binds Pi through a strict tool and Codex through the exact schema
ok - the Azure model prompt ends with the exact verdict and evidence wrapper schema
PI RUNTIME executes the shipped strict-tool launch and fails closed
ok - the digest-bound Pi runtime executes one isolated strict-tool review
ok - Azure Pi review reuse is bound to the executable reviewer runtime
ok - the reviewer model derives the exact provider host and the claude host lane is retired
ARCHIVE GATE and CORE INSPECTOR agree on every drifted credential shape
TOCTOU refusal raises a persisted tool failure, not a vanishing error
ok - the Azure cross-family credential lane packages models.json under each lane's endpoint allowlist and the claude lane is gone
GUEST ACCEPTED codex with the host-admitted identity codex:acct_ABC123
GUEST REFUSED codex with a foreign executing account
GUEST REFUSED codex with no account id in the credential
GUEST ACCEPTED pi with the host-admitted identity openai-codex:acct_ABC123
GUEST REFUSED pi with a foreign executing account
GUEST REFUSED pi with no account id in the credential
GUEST REFUSED a manifest with a forged effort
GUEST REFUSED a manifest with a forged model
GUEST REFUSED a manifest with a forged harness
GUEST REFUSED a manifest with a forged review generation
GUEST REFUSED a manifest with a forged credential name
GUEST REFUSED a manifest with a forged credential digest
GUEST ACCEPTED the fireworks-glm lane credential
GUEST REFUSED a foreign endpoint in the archived credential
GUEST dispatches every registered lane
ok - the model guest derives the host's executing account, refuses foreign ones, and dispatches every registered lane
ok - wrong head, stale endpoint, shared VM, network, credential, and generation outcomes fail closed
ok - review generation binds the executing account and ambiguous cleanup never becomes absence
ok - host bridge rejects hostile evidence and requires distinct cleaned exact-head tool/verifier attempts
ok - manifest transport bounds hold through the real producer and consumer
ok - the safety-shutdown expiry script renders real newlines with the exact unit text
ok - networkless replay proves exact pytest mutations and denies command, symlink, marker, and parent substitution
ok - the model compartment reserves and releases exact shared allocator capacity and honors queued refusals
crosscheck clear: https://github.com/ruby-dlee/firstmate/pull/302 at aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
ok - a queued model reservation is released, ledgered as a tool failure, and falls through to the next reviewer
ok - reviewer lanes admit FIFO, spread families deterministically, prune dead waiters, and never write auth back
ok - image and network-policy mutations are declaration-owned and refuse without exact confirmations
ok - admission refuses a model image that does not attest the dispatched reviewer harness
ok - operator documentation enumerates malicious, concurrency, fault, force-push, and cloud-default acceptance
Azure Crosscheck tests passed.

Evidence: Telemetry, economics, and exact-head reuse evidence

++ dirname tests/fm-crosscheck.test.sh
+ . tests/test-entry.sh
++ fm_test_entry_script=tests/fm-crosscheck.test.sh
++ case "$fm_test_entry_script" in
++ fm_test_entry_script=/Users/dongkeun/.no-mistakes/worktrees/b174997b7206/01M0TBVP63QDP7XC3ENMVM9HB9/tests/fm-crosscheck.test.sh
++++ dirname /Users/dongkeun/.no-mistakes/worktrees/b174997b7206/01M0TBVP63QDP7XC3ENMVM9HB9/tests/fm-crosscheck.test.sh
+++ cd /Users/dongkeun/.no-mistakes/worktrees/b174997b7206/01M0TBVP63QDP7XC3ENMVM9HB9/tests
+++ pwd -P
++ fm_test_entry_dir=/Users/dongkeun/.no-mistakes/worktrees/b174997b7206/01M0TBVP63QDP7XC3ENMVM9HB9/tests
+++ basename /Users/dongkeun/.no-mistakes/worktrees/b174997b7206/01M0TBVP63QDP7XC3ENMVM9HB9/tests/fm-crosscheck.test.sh
++ fm_test_entry_script=/Users/dongkeun/.no-mistakes/worktrees/b174997b7206/01M0TBVP63QDP7XC3ENMVM9HB9/tests/fm-crosscheck.test.sh
+++ cd /Users/dongkeun/.no-mistakes/worktrees/b174997b7206/01M0TBVP63QDP7XC3ENMVM9HB9/tests/..
+++ pwd -P
++ fm_test_entry_root=/Users/dongkeun/.no-mistakes/worktrees/b174997b7206/01M0TBVP63QDP7XC3ENMVM9HB9
++ '[' '' '!=' firstmate-test-runner-v1 ']'
++ exec /Users/dongkeun/.no-mistakes/worktrees/b174997b7206/01M0TBVP63QDP7XC3ENMVM9HB9/tests/run.sh /Users/dongkeun/.no-mistakes/worktrees/b174997b7206/01M0TBVP63QDP7XC3ENMVM9HB9/tests/fm-crosscheck.test.sh
== tests/fm-crosscheck.test.sh ==
ok - telemetry, economics, and exact-head reuse remain provenance-bound and fail closed

- Outcome: ⚠️ 1 warning across 1 run (2h54m21s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed ✅

• 🚨 tests/fm-crosscheck-azure.test.sh:88 - This newly added assertion only reads the guest implementation and searches for a command string, violating the test-quality rule; it can pass for dead or unreachable text. Remove it or invoke the guest/public launcher and assert that the Pi reviewer runtime is actually executed with the expected observable result.

🔧 Fix: Replace source-only Pi runtime assertion with behavioral coverage
✅ Re-checked - no issues remain.

⚠️ **Test** - 1 warning

• ⚠️ The local executable paths pass, but this assigned test phase cannot demonstrate the required rollout into the actual Azure environment or an uninterrupted live end-to-end route. The outer deployment/acceptance phase must supply live Azure receipts and route evidence before the complete author intent can be considered proven.
• if [ "${FM_AZURE_VALIDATION_CELL:-0}" = 1 ]; then exec "$FM_AZURE_VALIDATION_SHARD_BRIDGE" behavior --count "${FM_AZURE_VALIDATION_SHARD_COUNT:-8}"; else exec bin/fm-no-mistakes-test-command.sh; fi
• Baseline already completed successfully by the outer executor: if [ "${FM_AZURE_VALIDATION_CELL:-0}" = 1 ]; then exec "$FM_AZURE_VALIDATION_SHARD_BRIDGE" behavior --count "${FM_AZURE_VALIDATION_SHARD_COUNT:-8}"; else exec bin/fm-no-mistakes-test-command.sh; fi
• FM_TEST_CASE=test_telemetry_economics_and_exact_head_reuse bash -x tests/fm-crosscheck.test.sh
• tests/fm-crosscheck-azure.test.sh
• Manual inspection of the Azure evidence transcript for prompt-by-file execution, strict schema binding, regular GLM provider routing, trusted-host Pi identity, exact-head isolation, telemetry, and fail-closed rejection cases
• git status --short to confirm testing left the worktree unchanged

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

Size Justification

The protocol implementation, adversarial tests, and operator docs are one coupled fail-closed change; splitting them would allow the host request, guest runtime, schema, reuse digest, and evidence contracts to drift across intermediate merges.