release(0.70): batch-1 — 9 receipted rows, one CI run, one queue slot - #3707
Merged
Merged
Conversation
… — a comment classified it out of guard-tree (PMAT-3646) PRQ-013 (#2985) deleted ci.yml's receipt job and, with it, the step names that stated six of the counts this guard checks. The guard went RED ("6 row(s) disagree with the tree") and nobody saw it, because a comment at :196 naming the build tool matched guard_tree.sh's CARGO_RE. That dropped the guard from guard-tree's --no-cargo run, and guard-cargo never names it. - The site table drops the five ci.yml rows whose sentences left with the job (the roadmap records them as a STATED LOSS). ci.yml's "43-row" goes from 2 sites to 1. The bats_tests derivation is removed: no file states that count any more, and a derivation with no site checks nothing. check_pr_review_wiring.sh's "43-row" joins the table as a new site, with a self-test row (stale-wiring-rows). - The :196 comment no longer names the tool, so `guard_tree.sh --dry-run --no-cargo` prints `run: scripts/check_pr_review_counts.sh`. Restoring the old wording moves it back to --cargo-only (mutation-verified). - In --list mode, mutate-guard.sh and mutate_quorum_arm.sh now require only awk. They demanded bats/jq/minisign/check-jsonschema before printing a catalogue that uses none of them, so the counts derivation exited ENV=2 on a runner without them. Reproduced under a PATH without those four: rc=2 before, rc=0 after. guard-tree runs on the clean-room hosts, including the gx10/yoga docker runners, so wiring the guard without this would have swapped a dark guard for a red job. The real sweeps still refuse to run without the tools (rc=1). Verified: check rc=0 (22 rows); --self-test 16/16; guard_tree_test.sh 23/23; check_pr_review_wiring.sh PASS, self-test 11/11; check_guards_are_wired.sh PASS, self-test 7/7. Item 2 of #3646 needs no code. check_pr_review_receipt.sh is invoked with a receipt by check_pr_review_arm4.sh (A3 and A4), which pr-review-quorum.yml runs. The ledger line #3647 adds for this guard is deleted here once #3647 lands (the ledger is shrink-only). Refs #3646 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ounts-wired # Conflicts: # docs/roadmaps/roadmap.yaml
…ad of a fn pointer per weight float16_matmul called the decode through a `fn(u16) -> f32` pointer for every element: an indirect call plus a bounds check per weight, which nothing could inline or vectorise. On a Threadripper 7960X, Qwen2.5-0.5B-Instruct-f16 decoded at ~10 tok/s; BRICK-PROFILE put ~99% of the time in the F16 matvecs, and the 272 MB LM head read at ~27 GB/s. Each row is now one float16_row_dot over its bytes. x86_64 CPUs with avx2+fma (+f16c for F16) take a fused kernel, runtime-detected: vcvtph2ps, or u16->u32 <<16 for BF16, into four FMA accumulators. Everything else takes a chunked decode-then-dot the compiler vectorises. The loop structure is unchanged, and a row that runs past the end of the buffer is dotted over the whole elements that exist, as the per-element bounds check did. Tests: parity against an f64 reference at 16 lengths that reach every loop and tail (both kinds, and the portable path on its own); NaN, inf and subnormals at every lane position; and float16_matmul against a transcription of the pre-fix loop, including a truncated buffer with an odd trailing byte. Mutation-checked: skipping the tail, BF16 <<15, F16 routed to the BF16 kernel, dropping the portable remainder, and removing the end clamp each turn tests RED. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…d.sh + APR-RELEASE-001 §13 (#3673) Refs #3673 #3669 #3650 paiml-implement#317 Operator 2026-09-21: "we are arbitrarily going slow because each PR adds time, but in most cases 80% of PR can be batched." Code handed off by the cop (aprender-04) as an uncommitted draft; rewritten here. scripts/batch_fold.sh -- fold receipted PR branches into release/<train>-batch, --no-ff, in order. It resolves ONLY the generated set: roadmap.yaml, census.json, contracts.nt, shapes.ttl (pv extract writes it), and the README CONTRACT_COUNT blocks. Every other conflict aborts that branch: SKIP + paths. - README is merged three-way with the counts normalised out (git merge-file), so a prose conflict is a SKIP. The draft took README wholesale with --theirs, which silently dropped the batch side's prose. - A CLEAN fold that touches the generated set marks it stale: two PRs that each add a contract merge textually and the census is then off. Stale without --regen ends `REGEN REQUIRED`, exit 3, never silent. - --regen regenerates once with the tree-built pv (pv_bin.sh), asserts the three fixed points (make roadmap-aggregate-check, pv extract --check, readme_sync --check), refuses writes outside the set, commits. - refuses a dirty batch worktree; exit 0/1/2/3 documented. scripts/check_batch_fold.sh -- the case table, 21 rows over throwaway repos with stub pv/make/readme_sync, plus --self-test with 4 mutants, each RED: README wholly generated (the draft's rule), every conflict taken, a clean fold never stale, a failed fixed point ignored. It is a check_*.sh on purpose: the draft's own `--self-test)` case made check_guards_are_wired.sh RED ("NEW: batch_fold.sh", measured), and guard_tree.sh --no-cargo dispatches this file with no workflow edit. The draft, judged by this table: 13 of 21 rows RED (3 of them only on output wording). APR-RELEASE-001: - §13 (new): roles (author stops at the receipt; never arms, never merges main to stay current), assembly, the generated set, left-out rules, what needs a new quorum, push/disarm, body/arm/close, a red batch, what it costs (a SQUASH queue lands a batch as ONE commit: bisect on main stops at the batch, so the batch branch is kept until the next tag), falsifiers FX-B1..3. - hard rule 9 AMENDED. It read "No hand-squash of batches ... each PR lands as its own commit ... never hand-bisected", which the new default contradicts. The old text is kept verbatim as superseded, with the reason: the queue it described (group size 8) was not the queue we had (SQUASH, maximumEntriesToMerge=1, measured on #3658). - §8 stop "a hand-squashed batch" -> "a batch assembled by hand instead of scripts/batch_fold.sh (§13)". - revision note 2026-09-21. Gates: check_batch_fold 21/21 + self-test 4/4; bashrs 0 errors on both files; bashrs-gate PASS; guards-are-wired PASS; guard_tree dispatches it; guard_tree_test 23/0; pipe-into-grep-q at ceiling; hardcoded-paths +0; apr pinned; no-timing-in-required; check_ci_unwedge and check_ont_ratchet (read the spec) green; roadmap aggregate + sorted/unique/additive; fmt, deny, aprender-contracts --lib 1666. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
… VOID under the #317 rule Lanes gemini-3.1-pro-high / gemini-3.1-pro-low / gemini-3.6-flash-high at eebd642 (diff_sha256 33accb56…), PASS/PASS/PASS. Per APR-RELEASE-001 §13.4 (and the cop's rule while paiml-implement#317 is open), none of them counts as a measurement: no lane's agy conversation store references this worktree. lane 1 (cf256148): Cwd ~/.gemini/antigravity-cli/scratch x18, /tmp x6; rebuilt batch_fold.sh from the diff by heredoc lane 2 (bdf62808): no commands; a static read of the inline diff lane 3 (059ef063): Cwd scratch x112, scratch/wt-aprender-main x18, /tmp/tmp.* x12; ran copies of the two scripts under /tmp The seat is filled by a NON-author's measured check at the PR head, posted on #3674. Refs #3673 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…easured receipts Round-1 quorum (3/3 FAIL, correctly): the acceptance quoted in the fragment requires "a greedy-parity gate against llama.cpp on an unquantized ≤1B GGUF", and the diff had none. It also reported tok/s with nothing backing it. scripts/check_float16_greedy_parity.sh runs the pinned apr and llama-completion at the llama_pin.toml build_commit (the gate refuses any other build), greedy and CPU, over six prompts, and compares the trimmed text. `apr run` templates an instruct prompt twice (#3672), so the models are copies with tokenizer.chat_template removed; the gate refuses a model apr would template. With --baseline <pre-change apr>, a divergence the old binary reproduces byte-for-byte is KNOWN rather than FAIL. Receipts in evidence/pmat-3076-f16-bf16-matvec/: - Qwen2.5-0.5B F16: 6/6 identical to llama.cpp. - Qwen3-0.6B BF16: 5/6 identical, plus 1 KNOWN (char 83, which the pre-change binary reproduces exactly). - Negative control: a deliberately broken build (F16 sent to the BF16 kernel, BF16 <<15) FAILs 12/12 at char 0 with rc 1. - findings.json: decode A/B with raw per-rep numbers, model sha256, host and binaries. F16 goes 92.7 -> 47.2 ms/token at 48 threads, and 6.2 -> 68.6 tok/s at RAYON_NUM_THREADS=8. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…measures agreement only scripts/guard_tree.sh runs every check_*.sh bare inside a required job. The parity gate needs the models and the pinned llama.cpp, so run bare it refused (rc 2), a red row for a guard that was never given its input. It is now scripts/float16_greedy_parity.sh, alongside the other host-side probes, and it is not wired into CI: that needs models on a runner and a workflow edit. check_no_competing_harnesses.sh correctly classed the gate as a second benchmark harness, because it drove apr/llama.cpp AND recorded tok/s. The rate capture is removed. Throughput lives in the measured A/B (findings.json), and the gate judges agreement only. Receipts regenerated with the final script: F16 6/6, BF16 5/6 + 1 KNOWN, negative control 12/12 FAIL. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
… serves; a model with no vocabulary refuses by name (PMAT-3609) BPETokenizer::new required `<unk>` in every vocabulary. Qwen3.5 has none: it declares tokenizer.ggml.eos_token_id and no unknown_token_id key at all. So `apr serve` refused a real, complete vocabulary, while a GGUF/APR with NO vocabulary loaded, because GH-226's placeholder synthesised `token{i}` with `<unk>` in slot 0. The less-specified input was the one accepted. This follows the operator's three constraints (#3609, 2026-09-20) and the cop's rulings (2026-09-21): - The unknown token is Option: `new(vocab, merges, impl Into<Option<&str>>)`. A named token must exist. With no unknown token, CONSTRUCTION refuses, naming the first byte that has neither a `<0xNN>` token nor a byte-level glyph token (with_merges also requires every glyph), so encode never meets an unencodable byte: nothing is dropped and nothing is synthesised. With an unknown token present, encode is unchanged. - No vocabulary refuses by name at all 13 placeholder sites (apr-cli serve x7, aprender-serve cli x6). - apr serve's tokenizer.json path uses the DECLARED model.unk_token. The vocabulary-only AppState constructors use `vocabulary_unk_token` (the vocabulary's own `<unk>`, else none), the by-name interim #3675 replaces. - Prose: the GH-226 comment, the book's api-server example and examples/model_cache.rs no longer teach `<unk>` as a requirement. - Fixtures: REAL Qwen3.5-0.8B and TinyLlama GGUF headers, every key and scalar verbatim, only the per-token arrays sliced (generate.py, MANIFEST.json with each source header's sha256). They use the `.gguf-header` extension because .gitignore ignores `*.gguf`. Verified: aprender-serve lib 15892 passed (tokenizer 215, 9 new); apr-cli lib 7283 passed; clippy -D warnings clean on both; cargo check with cuda; contracts lib 1666; deny ok. MUTANT: restoring the unconditional `get("<unk>").ok_or_else(..)` turns the real-Qwen3.5 row RED with the original error "Unknown token '<unk>' not in vocabulary". Found and filed separately: #3677 (greedy encode reads Latin-1 characters as byte-level glyph tokens, so `é` decodes to U+FFFD). Closes #3609 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
… model-backed run at pre-publish Cop ruling, no workflow edit: - scripts/float16_parity_lib.sh holds the comparison helpers (first_diff, trim, json_str). It is a sourced library and option-neutral, and check_sourced_libs_option_neutral covers it: injecting `set -e` turns that guard RED. It sits at scripts/ top level because the guard resolves sourced basenames there, and a copy under scripts/lib/ was measured as unchecked. - scripts/check_float16_greedy_parity.sh is the helpers' case table. guard_tree runs it on every PR (`--dry-run` lists it), and check_guards_are_wired PASSes again (the unwired count is back to 3). - scripts/float16_greedy_parity.sh, run with no arguments, is release mode, declared in Cargo.toml [package.metadata.dogfood]. For each committed receipt it runs the model that receipt names, checks it against the receipt's sha256, and uses the receipt as the baseline (a divergence is KNOWN only if apr's text is byte-identical to the recorded row). A model absent from the host is a FAIL. It has no --self-test arm of its own; the case table is the PR-time guard. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ad the gates list as a PR-path list Round 4 (FAIL, FAIL, PASS). Lanes 1 and 2 held that the `gates` array "runs on PRs via guard_tree.sh", and that nothing was declared under [package.metadata.dogfood]. Measured, both are wrong: - The array IS [package.metadata.dogfood].gates (the header is at Cargo.toml:606, outside the hunk's context lines). - Its only executor is scripts/dogfood.sh at release. check_verifier_pinning.sh (ci.yml:1627) scans it, and passes with this entry (rc 0; it lists the file). - guard_tree --no-cargo: 74 checks, and the only failure is the host-environment check_fleet_pv_shapes_gate, which fails identically on origin/main. The comment was the ambiguous part: "the PR-time half ... run by check_float16_greedy_parity.sh" read as though that script belonged in the list. It now states which list this is and who runs it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Round 5: gemini-3.1-pro-high, gemini-3.1-pro-low and gemini-3.6-flash-high (the trio aprender-04 ruled), three distinct conversation ids. Lane 2's store references this worktree (52 times: a measured review). Lanes 1 and 3 judged the diff text only. Under paiml-implement#317 those two seats are VOID, and are to be filled by a non-author re-run of the acceptance command at 97093d2. Earlier rounds: round 1 3/3 FAIL (the llama.cpp gate was missing; taken, the gate was built). Round 2 PASS on a head that tripped guard_tree. Round 3 PASS with a void lane 3. Round 4 FAIL/FAIL/PASS, refuted by measurement: the gates list is [package.metadata.dogfood], and the declaration comment was clarified. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…d, each checked at the PR head Refs #3609 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
NOT READY. Remaining: aprender-orchestrate/src/agent/driver/realizar.rs:67 builds InferenceConfig as a struct literal and needs force_chat_template; aprender-serve lib tests have 2 compile errors to resolve; then tests, mutation, the real-binary measurement. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…uites nightly, mutants only on .rs, gate's skipped rule tightened (#3676) Refs #3676 #3668 #3658 Operator 2026-09-21: aprender releases as fast as possible, intel idle; "YES, coverage on tags release only." All five workflow items approved by Noah directly (CLAUDE.md check-in for .github/workflows edits). 1. COVERAGE -- ci.yml `skip_coverage: true` on the sovereign-ci call. That job gated nothing (no coverage_min) and measured nothing (`--lib` on the facade root: 0 tests, per the existing NOTE), at 237 s per run (main 35563537942). coverage-nightly.yml now also triggers on `push: tags: ['v*']` (COV_FLOOR via `make coverage`), concurrency per ref so a tag run and the nightly do not cancel each other. Every consumer enumerated first (the rmedia trap aprender-04 relayed): the pre-publish dogfood's `make coverage-check` (produces its own llvm-cov), the queue steward (reacts only to `failure`), two tests reading an embedded string / the Makefile, a legacy prepare-release.sh (local llvm-cov). None reads CI's number. The one output lost: that job's advisory Codecov upload. NEW scripts/check_coverage_has_producers.sh asserts the chain: R1 `make -n coverage-check` reaches llvm-cov; R2 dogfood runs it (non-comment); R3 coverage-nightly's `on:` block has schedule AND tags [v*] (comments and other top-level keys don't count); R4 numeric COV_FLOOR. 10 rows, each link broken -> RED; missing file -> ENV 2. NOT done here, stated: making T-4 WAIT on the tag's coverage run is an autopilot change, deliberately not made on the 0.69 cut day. 2. BOOK -- no change. book.yml and book-contracts.yml are already path-filtered; book-contracts watches crates/aprender-core/src/** because chapter examples run aprender-core code, which check_workflow_path_filters.sh RULE 2 requires ("a gate that runs code must watch the code it runs"). Narrowing it would break that rule. 3a. PERF GATE TABLE -- the explicit guard-tree step (405 s on main 35563537942) is replaced by NEW scripts/check_perf_gate_selftest_scoped.sh, dispatched by guard_tree.sh --no-cargo: it runs `perf_gate.sh --selftest` only when the tree diff vs origin/main touches its DERIVED scope -- every $ROOT/ path perf_gate.sh reads, followed transitively through the scripts it calls (8 paths today) -- and otherwise prints a SUMMARY skip line. Unknown comparand or a failed diff -> RUN, never skip. The table runs whole nightly (guards-nightly.yml + manifest, 405 s). 11-row case table; mutants RED: scope not transitive, renames hiding the old side, unknown -> skip, prefix-string matching. Registered in check_no_timing_in_required.sh's META_GUARDS (reads no clock). 3b. MODEL SUITES -- the PR step keeps ONLY falsification_spec_v10_tests: it holds the SATD ratchet measured against origin/main, the one property here a diff can change (and vacuous on the nightly, where HEAD == origin/main). The stress and gpu_state suites judge the whole tree; guards-nightly.yml already runs all three. check_model_tests_wired: all 3 still wired. 4. MUTANTS -- the diff step emits has_rs (`git diff --no-renames --name-only`); image pull, `cargo install cargo-mutants`, the run and the upload are gated on it. A diff with no .rs passes quickly instead of installing the tool. 5. GATE -- the mutants rule, between GATE-MUTANTS-RULE markers: on a pull_request mutants must SUCCEED (a no-.rs diff succeeds); `skipped` passes only on other events, where the job's own `if:` skips it. The old rule ("success/skipped both pass") passed a PR whose mutants never ran. NEW scripts/check_ci_gate_mutants_rule.sh EXTRACTS that block from ci.yml and executes it for 10 (event, result) pairs; its --self-test plants the old rule and it goes RED (3 rows); no block -> ENV 2. Gates: guard_tree --no-cargo: all PASS except check_fleet_pv_shapes_gate.sh, the known lambda-box fleet-pv condition (identical on main; fixed in #3669); guard_tree_test 23/0; guards-are-wired, guards-nightly-manifest (8 entries), no-timing-in-required, model-tests-wired PASS; bashrs 0 errors on the new files, bashrs-gate PASS; actionlint: the same 7 shellcheck infos as main, nothing new; roadmap aggregate idempotent; fmt, deny, contracts 1666. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
AGREED 3/3 PASS (gemini-3.1-pro-high, gemini-3.1-pro-low, gemini-3.6-flash-high). Worktree check against each lane's agy conversation store: no lane references the pmat-3609 worktree. Lane 3 read the stale scratch clone (wt-aprender-main 46, lane-3-check-eval 31). Lanes 1 and 2 read no repo tree and judged the prompt's diff (diff_sha256 516acb17…) alone. Seat rulings are the cop's. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…, perf-gate smoke row, gate-rule self-test independent of ci.yml (#3676) Refs #3676 Round 1 (e2d12bd) was FAIL/FAIL/PASS. The two FAIL lanes held the diff to the ticket's text and were right on three counts: 1. Item 2 says the book jobs are path-filtered "and nightly always". They were filtered, but NO path-filtered workflow had a schedule. book.yml, book-contracts.yml and install-script.yml now carry a nightly cron (22:30 / 22:45 / 23:00 UTC, ~5h early for the #3292 dispatch delay; book.yml's pages deploy stays push-only by its own `if:`). 2. Item 5 says check_workflow_path_filters.sh is updated. It gains RULE 3: a path-FILTERED workflow must also trigger on `schedule:` with a cron -- the filter is a claim that nothing outside it can break the gate, and the nightly is what re-checks it (book.yml sat dark three months, per the guard's own header). scripts/lib/workflow_path_filters.py emits a SCHEDULE row. Self-test 4 -> 6: no schedule -> RED; `schedule: []` -> RED. On the tree before the crons: 3 workflows RED; after: PASS. 3. Item 3 says "The PR path keeps a smoke row" for the perf table. On a skip, check_perf_gate_selftest_scoped.sh now requires `perf_gate.sh --list-selftests` to exit 0 and enumerate >= 1 case (109 today, ~60 ms), and says so on the SUMMARY line. Three end-to-end rows (skip + smoke; in scope -> full table; a table that cannot enumerate -> RED). 14 rows; five mutants RED (not transitive, renames, unknown -> skip, prefix match, smoke removed). Lane 1's other finding also held: check_ci_gate_mutants_rule.sh checked for ci.yml before --self-test, so its self-test could not run without the workflow. The check now sits on the bare-run path only. Gates: guard_tree --no-cargo all PASS except check_fleet_pv_shapes_gate.sh (the lambda-box fleet-pv condition, fixed in #3669); guard_tree_test 23/0; bashrs 0 errors on every changed script, bashrs-gate PASS; actionlint: no finding beyond main's shellcheck infos. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
… pv's own exit 2 is (PMAT-3671) The andon (984fc76, PMAT-3670) keyed reason=pv-env on the verdict PARSER's exit 2, which means only "lint.json did not parse". pv's own rc reached the message and nothing else, so a pinned pv that panicked (101) or was killed by a signal became UNMEASURED, exit 0. A panic can be caused by a contract in the PR's own tree: tree state, not fleet state. judge now captures pv's rc as pvrc and keys the verdict on <parser rc>:<pv rc>. 2:2 stays UNMEASURED reason=pv-env. 2:* is FAIL reason=pv-no-verdict, exit 1, and names pv's rc and its first stderr line. Case table 15 -> 19 rows: panic 101, SIGKILL 137 and rc 1 with no output are each RED. A mutant keying pv-env on the parser alone (2:2 -> 2:*) sends the panic back to UNMEASURED exit 0. Rows 13-15 failed before the fix with exactly the issue's "UNMEASURED reason=pv-env ... (rc=101) ... panicked", rc 0. Also fixed in the same rows: the existing pv-env mutant was vacuous. Its sed swapped the arm's ' for ", so the mutant was a syntax error (bash -n rc 2) that "exited non-zero" without reaching the arm. Both mutants now use a backreference, must pass bash -n, and assert their exact outcome. --help's hardcoded 2,44p range is replaced by the leading comment block. Closes #3671 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…s — a truncated GGUF is no longer "Invalid APR format" (PMAT-3661)
`CliError::InvalidFormat` Displays "Invalid APR format: {0}", and `apr inspect`
and `apr tensors` wrapped every parse failure in it, so a truncated GGUF or a
random-bytes .safetensors was reported as an invalid APR file. One of them
contradicted itself: "Invalid APR format: … Unknown model format".
New variant `CliError::InvalidModelFile { format, message }`, displayed as
"Invalid {format} file: …", keeps exit 4. It is built by
`CliError::invalid_model_file(path, context, &e)`, which reads the format from
the file's magic bytes (hex.rs's existing detect_format, wrapped as
`detected_model_format`; "model" when none match) and takes a core
FormatError's message, not its Display. inspect, tensors and the SafeTensors
profile path use it. InvalidFormat itself is unchanged.
The double prefix is fixed at its source: aprender-core's
`Failed to parse GGUF: {e}` wrapped a FormatError's Display.
Case table (6 rows, the real inspect::run / tensors::run, rendered as main.rs
prints it): truncated GGUF → "Invalid GGUF file: …", random .safetensors →
"Invalid model file: …", truncated .apr → still "Invalid APR …". No row
contains "Invalid model format", and every row exits 4. Mutants: the pre-fix
call sites fail 14 checks, the old Display fails 9, and the old core wrap
fails 1.
apr-cli lib: 7294 passed. aprender-core format::tensors: 131 passed.
Follow-up #3691: six more InvalidFormat sites that name GGUF/SafeTensors
(hex, trace, the SafeTensors header reader).
Closes #3661
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…R must equal the universe as a set (PMAT-3657) publish_strict.sh asserted the 0.68.2-era universe size three times (`-eq 74` on the order, the universe and the unique count, and `$n -eq 74` at final verification). That is a literal of the class #3618 removed, and it would stop a later cascade for a reason unrelated to publish safety. Measured in a private clone: with aprender-tsp `publish = false` and dropped from the order (a legitimate universe of 73), the pre-fix script stops with "order=73 universe=73, expected 74/74". The fixed script plans all 73. N is now ${#EXPECT[@]}, the universe cascade_universe.py reads from cargo metadata of every workspace at the tag. ORDER must equal it as a SET, and each failure names crates, not counts: twice in the order, in the order but not the universe, in the universe but not the order ("so never uploaded"). Negative controls (missing / twice / extra) each stop, rc 1, naming the crate. check_release_scripts_derive_identity.sh gains R3: no numeric test against a literal of two or more digits on a non-comment line. The planted row is publish_strict.sh's own 0.68.2 line, verbatim. 23 rows (was 14). A mutant with R3 disabled turns exactly rows 12-17 red. The guard over the pre-fix tree names lines 39, 41 and 90; the old guard passed that tree. Closes #3657 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ounts-wired # Conflicts: # docs/roadmaps/roadmap.yaml
…r — guard-tree runs it now (PMAT-3646) #3644 (batch #3669) recorded check_pr_review_counts.sh in scripts/unwired_guards_baseline.txt as dark and RED on main, "so it cannot be wired until that is fixed: #3646". This branch is that fix. With main merged in, the entry and its comment are deleted, as criterion 1 asks. Measured on the merged tree: check_guards_are_wired.sh "did not grow (1 removed) vs a877fa0"; check_pr_review_counts.sh PASS, --self-test 16/16; guard_tree.sh --no-cargo 78 checks (was 76), 0 failed, including check_pr_review_counts.sh [self-test] and [run]. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…vels as a flag, not as pre-wrapped text `apr run` on an instruct model wrapped the prompt twice. apr-cli's dispatch_run (GH-638) pre-wrapped it in hard-coded ChatML, and realizar's prepare_tokens (GH-278) then applied the model's own template on top, escaping the inner special tokens to `<\u{200B}|`. Measured on Qwen2.5-0.5B-Instruct-f16: 52 prompt tokens where llama.cpp has 21 for the same conversation, with each U+200B encoded as three token-0s. - realizar: InferenceConfig::force_chat_template (plus a builder). prepare_tokens_{gguf,safetensors,apr} OR it into their one template decision, so the template is applied exactly once and is the model's own. - apr-cli: run_prompt_and_chat() returns the RAW prompt plus the chat flag (--chat, or the GH-638 instruct/chat source-name heuristic). The flag reaches InferenceConfig through RunOptions.chat_template. - The three tests that re-implemented the old ChatML wrap inline (they could not fail, and they pinned the double template as the contract) are replaced by four tests of run_prompt_and_chat. Mutation: restoring the pre-wrap turns two RED. - Every realizar InferenceConfig struct literal gains the field, including aprender-orchestrate's driver. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
# Conflicts: # docs/roadmaps/roadmap.yaml
# Conflicts: # docs/roadmaps/roadmap.yaml
# Conflicts: # docs/roadmaps/roadmap.yaml
# Conflicts: # docs/roadmaps/roadmap.yaml
roadmap aggregate, pv census, pv extract (contracts.nt + shapes.ttl) and the README CONTRACT_COUNT blocks, regenerated with the pv built from this tree; fixed points asserted: make roadmap-aggregate-check, pv extract --check, readme_sync.sh --check.
# Conflicts: # docs/roadmaps/roadmap.yaml
…e number, not as an empty crate (PMAT-3696) At 6fd2416 a blank line in publish-order.txt reached the set checks as an empty string. bash printed "EXPECT: bad array subscript", and the cascade stopped with "in the publish order but not in the universe: ", naming nothing. Found by aprender-7a seat-filling #3657. Every blank or whitespace-only line is now listed by number and refused before ORDER is built: "STOP publish: blank line 36 in publish-order.txt: an empty crate name is not a crate". Measured in a private clone with --plan: the clean file still plans 74 rows, rc 0; blank at 36 gives that message, rc 1, with no subscript error; whitespace at 3 plus a blank gives "blank line 3, 37". Closes #3696 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
# Conflicts: # docs/roadmaps/roadmap.yaml
roadmap aggregate, pv census, pv extract (contracts.nt + shapes.ttl) and the README CONTRACT_COUNT blocks, regenerated with the pv built from this tree; fixed points asserted: make roadmap-aggregate-check, pv extract --check, readme_sync.sh --check.
# Conflicts: # docs/roadmaps/roadmap.yaml
roadmap aggregate, pv census, pv extract (contracts.nt + shapes.ttl) and the README CONTRACT_COUNT blocks, regenerated with the pv built from this tree; fixed points asserted: make roadmap-aggregate-check, pv extract --check, readme_sync.sh --check.
|
§13.11 rung 1 — quorum shadow verdict Shadow mode: this records a verdict and merges nothing. A refusal |
Contributor
Author
|
Cop cross-check before arming (aprender-04). At head
|
noahgift
enabled auto-merge
September 21, 2026 14:43
…prose — check_apr_bin_pinned read them as bare invocations #3707's guard-cargo (intel-clean-room-11, "Every execution-surface `apr` reference must be pinned") failed with 2 BARE-APR hits, both in PMAT-3076's scripts/float16_greedy_parity.sh, and both message text rather than invocations: line 98 `die2 "jq is required (apr --json parsing and the receipt)"` and line 206 `base_note=" (apr text identical to …)"`. PMAT-3076 never had a PR of its own, so batch-1 was the first CI run of the guard on it. The two messages now say "the pinned binary". No invocation changed. check_apr_bin_pinned.sh: rc 1 with 2 hits before, rc 0 after ("306 execution-surface file(s) scanned, every `apr` reference is pinned"). check_float16_greedy_parity.sh case table: 0 failures. Refs #3076 #3707 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
noahgift
changed the title
noahgift
added a commit
that referenced
this pull request
Sep 21, 2026
…— `coverage_on: tag` on the merged #77 pin, not `skip_coverage: true` (PMAT-3676) `skip_coverage: true` on sovereign-ci@70e51ec made `ci / gate` RED on every PR: that reusable's gate counts a skipped coverage job as a mandatory failure ("coverage did not succeed (result: skipped)"). #3688's own CI (run 35585906113) and batch-1 #3707 both hit it, and #3707 left this row out. - sovereign-ci is pinned to paiml/.github f713290c86fcd70d6f26a0faab14e67e6713586f: #74's `coverage_on` input, plus #77, which keeps #73's roadmap-fragment-parity NOT-ACTIVE while roadmap.yaml is tracked at the base (aprender still commits it; #3709 migrates it). - `coverage_on: tag` replaces `skip_coverage: true`, and ci.yml gets `push: tags: ['v*']`, the reusable's second required edit. - coverage-nightly's v* tag trigger is removed, so ci.yml measures each tag once. - check_coverage_has_producers.sh R3/R5 assert all of this. Self-test 16/16, including "skip_coverage: true instead of coverage_on -> RED". On f7b25a6 it reports R3+R5 RED; after the change it PASSES. - ci.yml now runs `check_pr_closes_issue.sh --self-test` beside `--body` (guard_tree skips it as wired-with-args, so its case table ran in no job; found by aprender-f0), and the comment claiming otherwise is corrected. Local: guard_tree --no-cargo 82/0 (after merging main 225b2a9). The proof before re-folding into batch-2 is this PR's own CI: green, with the gate logging `coverage: NOT MEASURED` and `roadmap-fragment-parity: NOT-ACTIVE`. Refs #3676 #3707 #3709 paiml/.github#77 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…S.md check_no_claim_literals.sh (guard-cargo) went red on batch-1: mod_app_state_gpu.rs carried "755+ tok/s (2.6x Ollama)" twice and "~1-10 tok/s" once. Their baseline entries were keyed on the pre-shift lines :193/:317/:456, so once the lines moved the entries stopped matching and the literals counted as new. The docs now point at docs/BEATS.md (the gated scoreboard) instead of quoting a number, and the three dead baseline lines are pruned. The ratchet shrinks 441 -> 441 known, 3 removed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
github-merge-queue
Bot
removed this pull request from the merge queue due to a conflict with the base branch
Sep 21, 2026
…d as the union The only conflict was docs/roadmaps/roadmap.yaml: PMAT-3696 (batch-1) and PMAT-3704 (#3706) were inserted at the same spot. Both entries are kept whole, in id order. check_roadmap_sorted / ids_unique / diff_additive all PASS; the merge adds 21 lines relative to batch-1's head, all of them the PMAT-3704 entry. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
noahgift
enabled auto-merge
September 21, 2026 16:59
Contributor
Author
|
Cop: merged origin/main (#3706) as 9ac424e. The only conflict was docs/roadmaps/roadmap.yaml, resolved as the union of PMAT-3696 and PMAT-3704, both entries whole. check_roadmap_sorted, check_roadmap_ids_unique and check_roadmap_diff_additive all PASS. Pre-push: |
12 tasks
noahgift
added a commit
that referenced
this pull request
Sep 21, 2026
… 428 migrated, and the marker guard makes an undeclared one RED #3745 S1.2 + S1.3. S1.2 — the migration. Every argument of apr-cli's own clap tree whose value was a raw PathBuf, or a raw String with no finite value set (428: 242 path, 186 text), is now built through a role type: ModelPath/ModelRef (77 model args — run SOURCE, chat, serve run, code --model, qa, inspect, tensors, trace, diff, merge, distill, finetune, the rosetta subcommands, pull/rm/import, …), PromptText (14, incl. run --prompt and the positional PROMPT), InputFile, OutputPath, DirPath, ConfigPath, FreeText. Each role was read from the arg's help and use, not its name (`tune --model` is a model SIZE → FreeText; `publish DIR` and `encrypt FILE` never load a model → DirPath/InputFile). Per the cop's ruling, the two model args in foreign CLIs are typed here too: `pv verify-structure --model` (ModelPath) and `rag transcribe --model` (ModelRef). The role types Deref to Path/str — the targets PathBuf/String deref to — and Debug as the inner value, so `.as_deref()` and `{:?}` read exactly as before. Call sites convert at the dispatch boundary; command modules are unchanged. dispatch_run.rs gets 7 conversion edits in the serve/rosetta arms only (cop notified and approved; disjoint from #3707's hunk). S1.3 — the marker guard (surface::guard). It does not detect model loading: apr-cli has no loader funnel and a loader list would rot like the verb lists. It makes an undeclared role inexpressible — any `unknown` argument outside a foreign subtree is RED, naming `<path> <arg>`. Mutants planted in the real tree every run: inspect's model arg reverted to PathBuf, a new verb with a raw --model PathBuf, run --prompt as a raw String, a nested raw arg, a raw global. Live source mutant observed: inspect `file: PathBuf` → RED "1 free-form argument(s) with no declared role: inspect file"; restored → GREEN. Foreign mounts are matched by child-name SET (clap's mut_subcommand reorders). Pmat-Ticket: PMAT-3749 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
0.70 batch-1: nine seated rows in one CI run and one queue slot
Built under APR-RELEASE-001 §13, "batching is the default merge path" (#3674 is row 1 of this batch). It was assembled by aprender-b3 with
scripts/batch_fold.sh. After the operator closed b3 (2026-09-21 ~14:05Z) it was handed to aprender-62 by the cop (aprender-04). Every row carries a non-author measured seat: the agy quorum could not seat valid lanes today (Gemini quota, gpt-oss 503, stale-clone VOID lanes, paiml-implement#317), so the operator's fallback ladder applied. The generated set (roadmap.yaml,census.json,contracts.nt,shapes.ttl, README counts) was regenerated with thepvbuilt from this tree as the rows folded (batch_fold.sh --regen, fixed points asserted). After main (225b2a9ab, the v0.69.0 bump) was merged in, a final--regenfound it already consistent (fixed points asserted).Measured locally at the pushed head
32dd7b666:bash scripts/guard_tree.sh --no-cargogives 87 checks, 0 failed;cargo fmt --all -- --checkrc 0;cargo test -p aprender-contracts --libgives 1684 passed;cargo check --workspace --all-targetsrc 0 (viacommand cargoand the worktree's own target dir, infra#885). The body passesscripts/check_pr_closes_issue.sh --body(rc 0). The push waited on the v0.69.0 clean-room:clean-room (aprender)passed in run 35610850375 on intel-clean-room-14.scripts/batch_fold.sh, APR-RELEASE-001 §1362ae1b628: #3674 (comment)64a153c00reason=pv-no-verdict); only pv's own exit 2 is fleet state62ae8ea3ccheck_pr_review_counts.shfixed and wired into guard-tree; its unwired-ledger line deleted3e7a88cd09cc89e3a9: #3678 (comment)6fd2416457acdb8f0b(receipt on97093d2a5)7#3688 (PMAT-3676)coverage_onfix, see below0517e75a7aprbinary run): #3661 (comment)c995801d5publish-order.txtis refused by line number, not as an empty crateb6282d187apr runtemplates the prompt ONCE (21 tokens, greedy text byte-identical to llama.cpp)Row 7 is left out: it rides batch-2 with the
coverage_onfix. Itsskip_coverage: trueon the pinnedsovereign-ci.yml@70e51ecmadeci / gatefail on every PR ("coverage did not succeed (result: skipped)"): that gate counts a skipped coverage job as a mandatory failure. #3688's own PR CI was red on the same gate. The operator-authorized fix ("YES, coverage on tags release only", 08:38Z) bumps the pin topaiml/.github@69482db7821c, whosecoverage_on: tagthe gate honours, and adds av*tag trigger. It will go on #3688 and be proven there by its own green CI before it is folded. Here the fold is reverted withgit revert -m 1 9a0c3cbad, one commit, no force, and the generated set was regenerated without PMAT-3676.Row 1 (#3674): §13 supersedes APR-RELEASE-001 hard rule 9. The basis, verbatim: operator 2026-09-21, "work smarter and use different ideas...batching PRs, etc" and "lets update our docs/memory and sister aprender agents this is new process". The operator may veto this; reverting it is one commit.
New content beyond the rows: only merge commits whose resolutions are the generated set above, plus one
merge origin/mainbringing in the 0.69.0 bump (225b2a9ab). The only file both sides changed there wasCargo.toml, and it merged with no conflict hunk.After this merges, the constituent PRs #3674, #3678 and #3659 close as "landed in #". #3688 stays open for batch-2.
Closes #3673
Closes #3671
Closes #3609
Closes #3657
Closes #3661
Closes #3696
Closes #3672
Refs #3646, #3076
keep-open: #3646 item 2 is open by design (check_pr_review_receipt.sh is reached only through check_pr_review_arm4.sh; whether that counts as wired is the guard_tree owner's decision). #3076 has no done_when and its author made no closing claim, so it closes at reconcile. #3676 is left out of this batch (row 7 above). The constituent PRs #3674 #3678 #3659 are closed by hand; #3688 rides batch-2 as landed here, not by a keyword. The context references #3669, #3650, #3685, #3689 and paiml-implement#317 cite history only.
ont-delta: none the one prose sink this batch touches is APR-RELEASE-001 §13 (row 1, #3674), which records a merge-path PROCESS rule (batching is the default); it adds no ontology type, shape or reason and resolves no ontology id, and its executable form is scripts/batch_fold.sh plus its case table scripts/check_batch_fold.sh
🤖 Generated with Claude Code