Repository navigation
Epic: pv / provable-contracts hardening — the tool that decides release soundness #2556
Description
owner: aprender-df
Umbrella for the pv / provable-contracts hardening work. pv is the tool that decides
whether a release is contractually sound, so a defect in pv is a defect in every
release verdict it has ever issued.
The through-line across this work: pv reported the wrong number → pv silently dropped
what you wrote → pv accepts contracts that assert nothing. Each item below is one step
along that line.
Shipped
- fix(pv): pin pv to a HEAD build — the release receipt was citing pv 0.49.0 #2552 — pv was pinned to a HEAD build.
pvon PATH was 0.49.0 while the
in-tree crate was 0.63.0, and the two disagree on the gate that matters:
strict-test-binding reports 253 refs / 51 missing under the stale binary and
371 / 27 under HEAD.dogfood_surfaces.shprintedpv present (pv 0.49.0)into
the release receipt as evidence of correctness, andMakefile:352ran bare
pv lintas the hard release gate. Addsscripts/pv_bin.sh(cargo is the freshness
authority, not a version string — pv was rebuilt three times at the same version
with two distinct md5s giving different answers on an identical tree) and extends
check_apr_bin_pinned.shwithBARE-PV/PATHRES-PVclasses.
In flight
- fix/pv schema #2554 — three silent-drop defects in the contract schema: keys serde discards
without complaint, so contracts assert things nothing will ever evaluate. The guard's
own hermetic fixture turned out to be one of the 119 offenders — it stopped parsing
and every case in its table went silently unreported. - fix/pv facades #2553 (implements Publish provable-contracts{,-cli,-macros} as facade crates so existing users are carried forward, not stranded #2546) —
provable-contracts{,-macros,-cli}carried
forward as crates.io facades. The headline deliverable was found broken: the published
CLI facade cannot compile, because it callsaprender_contracts_cli::run()while
the pinned 0.63.0 is on crates.io bin-only. Invisible to the guard because every
check builds through the path dep, while a published consumer resolves from the
registry.
Open defects
- pv validate accepts competitor: THIS-DOES-NOT-EXIST, demand_score: 99999, intake_status: banana — 0 errors #2555 —
pv validateacceptscompetitor: THIS-COMPETITOR-DOES-NOT-EXIST,
demand_score: 99999,intake_status: bananawith 0 errors. 275/275 CRUX
contracts areregistry: true/proven: 0; 37falsification_crux_*.rsare dark
in CI. - check_contract_test_binding.sh resolves 371 test references and runs in no CI workflow #2512 —
check_contract_test_binding.shresolves 371 test references and runs
in no CI workflow. - 413 contracts assert something inert — classifier written and cross-validates
to zero symmetric difference; branchfix/pv-inertis held back because the prose it
emits contradicts its own numbers.
Structural work
- A contract kind that carries proof obligations and cannot be exempted by
registry: true. Todayprovability_violations()applies only to
ContractKind::Kerneland the registry exemption also keys on Kernel — so choosing
Kernel lets you self-exempt (481 contracts do), and choosing anything else escapes the
obligation entirely. Both roads end at a contract that proves nothing. This blocks the
competitive-parity mandate, which is otherwise unenforceable.
Housekeeping
-
.pv/contracts.idx,.pv/contracts.idx.mtime,.pv/lint-previous.jsonare
generated caches tracked in git. They have conflicted in three separate rebases
this week. Either untrack them or make the ratchet read from a non-conflicting form.
Standing rule
Every fix here must be mutation-verified in both directions, with proof the mutation
engaged. This week produced eleven controls that existed and enforced nothing; a
validator change nobody has watched go RED is simply the next one.
Activity
noahgift commentedon Aug 21, 2026
Operator ruling 2026-08-21: no exceptions. The
registry: trueprovability exemption is removed — tracked as #2557.Measured blast radius, and it argues for the decision: of the 500 currently-exempt contracts, 434 (87%) already carry falsification structure and are exempting themselves needlessly. The genuine debt is 66, not 500. Removing the exemption mostly starts counting work that already exists.
This unblocks the structural item in this epic: there is currently no way to write a contract that must prove something.
noahgift commentedon Aug 21, 2026
Added #2558 — the
pvbinary-name collision, which is a distribution defect rather than a validator one and belongs in this epic.Three claimants on one name, resolved by last-install-wins:
aprender-contracts-clideclares[[bin]] name = "pv"(main)provable-contracts-cli(the facade on fix/pv facades #2553) declares it too — both install~/.cargo/bin/pv, second one silently overwritespv(1), the Unix pipe viewer, which cargo's own PATH guidance puts us ahead ofLive on this box right now:
~/.cargo/bin/pvis 0.49.0 from Jun 13, 69 days stale against an in-tree 0.63.0, and the two disagree on strict-test-binding (253/51 vs 371/27).Worth being precise about the limit of #2552: it pins what our scripts invoke, and it does nothing about what a user gets. Same defect class, different surface — which is the pattern this epic keeps rediscovering.
apr pvalready exists and works, so the in-apr route is settled; only the naked binary and the facade duplicate are open.noahgift commentedon Aug 21, 2026
#2558 substantially expanded. The finding that changes it:
pvis an existing crates.io crate — a Rust pipe-viewer reimplementation,bin_names: ["pv"], 7,065 downloads, first published 2019, still being released as of 2025-07-19.So we are the newcomer and the minority on this name: the pipe viewer's crate has 15x the downloads of
provable-contracts-cli(463). Four claimants, one path, last-install-wins.Also recorded there, because it is the reusable lesson: #2552 pinned what our scripts invoke and nothing about what a user gets. Two surfaces, one defect, and fixing the first reads as fixing both.
fix(pv): close the three minor defects the re-verification pass measured
fix(pv): fold paiml#2601/paiml#2602/paiml#2603 and close the eight de…
noahgift commentedon Sep 23, 2026
triage 2026-09-23 (aprender-dd, standing triage owner): milestoned to 0.70.0, theme Fast Train (CI, gates, pv, release tooling, hygiene); it moved out of
backlog(the 2026-09-17 overflow bucket, not a release).noahgift commentedon Sep 24, 2026
Folded into this epic by issue triage (evidence /mnt/nvme-raid0/cop-inbox/evidence/triage-1418.md). Each row was a separate issue, now closed as folded; reopen any if it needs its own thread:
supersededenumnoahgift commentedon Sep 24, 2026
Folded into this epic by issue triage (evidence /mnt/nvme-raid0/cop-inbox/evidence/triage-1623.md). Each row was a separate issue, now closed as folded; reopen any if it needs its own thread:
noahgift commentedon Sep 25, 2026
Triage (aprender-df, owner), 2026-09-25, measured on batch/0.70.0 @10f531a0d
check_contract_test_binding.shis invoked in ci.yml.pv/caches tracked in gitgit ls-treefinds nothing under.pv/;.gitignorehas**/.pv/(#2644)falsification:block, 0falsification_tests)fix/pv-inertno longer exists on the remoteregistry: trueself-exemptionCounts come from pv's own parser (
parse_contract,legacy_falsification_entries,metadata.kind == Kernel && metadata.registry) over all 1881 contract files, recursively; 1878 parse. An independent YAML count matches exactly.EV order:
validate_contracts.rs, which already runs in CI. Neither count can grow while the fix is designed. This is in progress now and goes into batch/0.70.0.registry: truecannot exempt. This is a schema design decision (what the 512 migrate to), so it goes to the cop for a ruling before any code.falsification_tests, in batches, lowering the ceiling each time.noahgift commentedon Sep 25, 2026
Ratchet landed on READY branch
wip/2556-pv-hardening@d099b86ca (off batch/0.70.0), for the fold owner: ceilings 512 self-exempt / 408 inert, parsed floor 1850. Mutation proof 3/3 RED (+1 self-exempt, +1 inert, empty walk), and the detector-off control stays green. It also fixes the batch's contract_data_integrity red (445 > 444, FALSIFY-VERSION id order). Parked (backlog) by cop reassignment to 0.71.0; the next items are the structural kind ruling, then migrating the 408 legacy blocks.fix(contracts): FALSIFY-VERSION-005 sat before -004 — contract_data_i…
noahgift commentedon Sep 27, 2026
Closed as absorbed into #2870 (the S2 standing epic, owner aprender-57). Every item this epic cites is closed or merged (#2512, #2546, #2552, #2553, #2554, #2555), plus #2978. Verified by aprender-df.