PMAT-3715: release-readiness-v1 — the tag is refused unless every release cell has a fresh Pass receipt

[noahgift]

PMAT-3715: release-readiness-v1. The tag is refused unless every release cell has a fresh Pass receipt

Operator, 2026-09-21, verbatim: "you need to improve our dogfood process and pv SHACL so leaks don't exist pre-release. this is clown town." Every 0.69.0 leak was absence read as conformance. Here every obligation of a release is a graph node derived from what was measured, so a missing receipt is a missing edge that minCount 1 rejects.

What it does

• receipts.rs reads v1 and v2 (P0 release-process: the train can publish with "most models working" — the model gate is a hand-picked ladder with OPTIONAL rungs, a skip reads as pass, and the dogfood can be inherited. Every Q4_K model × {lambda, gx10} × CUDA must be green or NOTHING ships #3712's apr-model-ladder-receipt/v2). Until now, the first committed v2 receipt would have turned pv lint --gate shapes into exit 3 on every PR. A foreign schema such as v3 is still refused by name.
• extract:release-evidence is a new Σ entity type and extractor. It builds the release graph only when a release subject is given; an ordinary PR has none, so it contributes 0 focus nodes there.
  • Nodes: Release, Host, Model, Verb, ContextRung, Cell/CellReceipt, RefusalCell, RungCoverage, TokenizerCell, KernelCell.
  • The universe is derived, never listed: host inventory ∪ cuda ladder rungs × {run, chat, serve, code} × thinking_modes × context rungs {4k, 8k, 20k, 60k, consumer-max (computed from the consumer records), declared (the GGUF's own length)}.
  • Long rungs are owed per long_rungs_for. Rungs above a model's length are not owed, and cells that don't fit the host's memory are owed as honest pre-load refusals.
  • Kernels come from every host's dispatch path, keyed (kernel, quant) per GPU arch. There is one tokenizer-parity cell per model (apr's byte-level BPE tokenizer is non-canonical: every non-ASCII byte → id 0, ASCII segmented unlike llama.cpp (2 of 10 ids agree on a path) — corrupts copy tasks and every non-ASCII user; apr parity is blind (shared tokenizer) #3726).
• A nine-shape family in contracts/release-readiness-v1.yaml. --shape arms it whatever armed_shapes says. Findings are reported release → host → context → model → coverage → tokenizer → kernel → refusal → cell.
• CLI. The exit codes are agreed with aprender-f0 on P0 release-process: the train can publish with "most models working" — the model gate is a hand-picked ladder with OPTIONAL rungs, a skip reads as pass, and the dogfood can be inherited. Every Q4_K model × {lambda, gx10} × CUDA must be green or NOTHING ships #3712; f0's call sites STOP on any non-zero exit.

  pv lint contracts --gate shapes --shape release-readiness-v1 --release-version V --release-commit MC \
     [--receipts-commit S] [--receipts D] [--kernel-receipts D] [--tokenizer-receipts D] --dogfood-receipt F
  

  → 0 Pass · 1 Fail, naming the cells · 2 decline (no subject; zero cells is never a pass) · 3 caller error (partial subject, short sha, a flag outside --gate shapes).
  pv extract --release-* --out F writes the release graph to F and never into the tracked contracts.nt.

Proof

• 34 red-turning CLI cases, crates/aprender-contracts-cli/tests/ont_release_readiness.rs, wired as ci/explicit-test-commands.d/450. The green base passes 48/48 cells, each named, and then one thing changes per case:
  • a cell that is missing, skipped, falls back, doesn't say whether it fell back, is stale by sha, stale by version, or duplicated;
  • a think-ON cell that is missing, or has an unclosed block and an empty answer;
  • a declared-length rung that is absent, or unmeasured; two hosts that disagree on a file's length; a prompt short of its rung;
  • a kernel green on sm_121 and red on sm_89 (reported first); a kernel measured on one arch only;
  • one mismatched tokenizer id; zero tokens compared; a broken round trip;
  • a host with no receipt; a v1 receipt standing in for a host; an inherited or absent dogfood;
  • a consumer with no number; a thinking_modes/markers contradiction;
  • the memory rule: a 27B-shaped refusal on lambda plus a pass on gx10 is GREEN; an OOM instead of a refusal, a co-tenant refusal, a refusal with no shortfall, and a rung that fits nowhere are RED;
  • T-4's --receipts-commit; no subject → 2; caller errors → 3; pv extract writes only to --out.
• Mutants: skip-as-pass (a shape mutant) turns 1 case red; always-fresh (a code mutant) turns 3 red.
• cargo test -p aprender-contracts --lib: 1695 passed. cargo test -p aprender-contracts-cli: every target green. The ont4b shape ratchet was raised 9 → 18, naming the new shapes. pv lint contracts: PASS, 0 errors, and no new warnings from this contract. make ont-ratchet was restamped. Clippy -D warnings is clean on both crates, lib and tests.
• evidence/release/proof-0.69.0/ (done_when 5, first half): 0.69.0's own evidence, translated without inventing a measurement (the rules are in translate.py and the README), is RED with 795 findings. They name:
  • qwen3-8b on lambda: verdict=fail;
  • qwen2.5-coder on lambda and qwen3moe on both hosts: never identified by the release (unmeasuredModel), with their failing sweep rows unkeyedRow;
  • 752 of 768 cells absent: every chat, serve and code cell;
  • the dogfood receipt the train "inherited" a GO from, which says NO-GO, for the parent commit, at 0.68.2.

Known remainder (cop ruling, verbatim)

release_evidence.rs VERBS is a hand-coded list; #3745 S2 replaces it with the derived cell set via Inputs.cells. 0.69.1 does not tag while it exists.

Quorum

Round 3 at 84289cb7ba38adf96c0a1c5f836eb84ccb8d0646 is AGREED: gemini-3.1-pro-high PASS, gemini-3.1-pro-low PASS, gpt-oss-120b-medium PASS (author claude-opus-5; receipt-lint: complete). Artifact: docs/audits/quorum-PMAT-3715.json, diff_sha256 9df958d287befbf36a6b50be55984468291262bf8a3cf2cf9507b584e2f5676b. Round 1 judged against the ticket title alone and was superseded by the implementation receipt; round 2 was 2 PASS + 1 NO-VERDICT. After the round-3 head, the only commit adds this artifact and the roadmap-fragment note below, and changes no code.

Merged origin/main

#3706 (PMAT-3704) ties pc_extract to Σ, so release-evidence gets its own control, release_evidence::positive_control(), drawn every gate run. Mutant measured: emitting only cells that have rows gives pv lint --gate shapes exit 2, "positive control pc_extract.release-evidence did not fire".

Not in this PR, so it carries Refs

• done_when 4's call sites: autopilot T-1 and check_publish_preflight.sh T-4 (aprender-f0, #3712 done_when 3 (child): the model-matrix gate runs at T-1 on BOTH hosts before any tag, receipts committed in the bump, re-read at T-4 by the same judge #3717 / autopilot's INHERITED dogfood GO writes no receipt that check_publish_preflight.sh R5 accepts — v0.69.0 stopped at the publish preflight 43 min after tagging #3708). This PR supplies the invocation they call.
• done_when 5's second half, "on 0.69.1 it passes with N/N cells named". That needs the producer (P0 release-process: the train can publish with "most models working" — the model gate is a hand-picked ladder with OPTIONAL rungs, a skip reads as pass, and the dogfood can be inherited. Every Q4_K model × {lambda, gx10} × CUDA must be green or NOTHING ships #3712 cells[], the memory arithmetic, kernel and tokenizer receipts) and the model fixes to land. release.cell_names is what it will print.
• Waivers: none, by cop ruling (c). Every agent session posts as noahgift, so a comment-based waiver is forgeable. The operator-only surface is release-readiness waivers need a surface only the operator holds — a gh comment by noahgift is forgeable by every agent session #3722.

Receipt formats were agreed on #3712 with aprender-62, -f0, -37 and -eb; tokenizer parity on #3726.

Refs #3715, #3712, #3710, #3726

🤖 Generated with Claude Code

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3715",
 "head": "0e99993dc13eae20f6f49644f29041d2e23b4796",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "NO-VERDICT",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "NO-VERDICT",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3715",
 "head": "ba9afe3d1cd8c6a900ade681ce17cc4d3b1cf4ba",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "NO-VERDICT",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3736 head=c7dfd6427ee9963ba37b4e42a9b81b1f45a7f486 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

quorum-review (AD-04): three PASS — agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3715",
 "head": "84289cb7ba38adf96c0a1c5f836eb84ccb8d0646",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}