Epic: apr-dogfood v3.0 — coverage is the organizing gate (17.1% of 830 features, 27 of 28 binaries at zero) #2582

owner: aprender-w5404 (re-owned 2026-10-19 by aprender-triage-worker at the cop's word: previous owner session absent; picks up children only as batch constituents after its current timed task)

Tracking epic for the apr-dogfood v3.0 rewrite. The four artifacts exist and are
verified; this issue exists so the reasoning survives them.

The finding that drove the rewrite

A four-part surface audit gave the gate suite a denominator it never had:

Read the bands correctly. 644 features scored 6 because no ledger finding exists
and no gate covers them. That is not "fine" — it is unlooked-at. Where gates
actually look, they find defects at 72.5%. The 4.3%/72.5% split is not evidence that
the uncovered surface is healthy; it is evidence that nobody has looked.

That inverts the organizing principle. v2.0 was 19 gates in search of things to check.
v3.0's organizing gate is coverage itself (Phase 2): the CSV is the denominator, the
runtime enumeration must reconcile against it in both directions, and coverage may
never decrease.

Artifacts

Integrity verified on receipt: zero U+FFFD replacement characters, line counts match
stated values exactly.

Constraints that must not be violated

1. Do not re-derive Tier 1 P1–P12 or Tier 2 T2.1–T2.9. v3.0 carries them by
   reference only — its author read the headings and falsifier IDs of v2.0's Gates
   2–18, not their bodies. Copy those bodies verbatim. A re-derived body silently
   loses the specific mutation each was hardened against, which is the entire reason
   they are worded as they are. Splice points are marked in-file at lines 164, 346–347,
   and the caveat at 607–609 (delete the caveat once satisfied, or a completed merge
   looks permanently outstanding).
2. Every line reference is UNVERIFIED until checked at HEAD. Two were already stale
   on arrival (below). If one has moved, fix the reference, do not delete the claim.
3. Every number is a snapshot. Recompute from the CSV and from HEAD. If the reading
   disagrees, the reading wins, and the discrepancy is recorded rather than passed
   through.
4. The G2.3 threshold table is deliberately blank. Measure today's values, commit
   them as the baseline, ratchet from there. Do not pick a round number.
5. Ticket first (pmat work add) → branch → PR → green ci / gate. pv contract in the
   same PR as the implementation.
6. pmat query, not grep.
7. The skill is read-only in operation. apr-dogfood audits; it never modifies files.
   Defects become issues and tickets.

Verification ledger — claims checked at HEAD (4bbfeb0)

Flagging staleness is a success, not a failure. Two of four G1.3 references had moved
and the substantive claim survived both — which is the ledger working.

Work

• G1.3 — apr serve run --backend accepts any string. apr run and apr chat
  pin BACKEND_VALUES; serve does not, and the value is consumed. The constant's own
  doc-comment says it exists to prevent "a run whose throughput number was taken
  through a backend the caller did not ask for" — reproduced on the serve path. The
  doc also claims it covers "apr run / apr chat": there are three declaration
  sites, not two. Separately: apr bench has no --backend at all, despite
  being the throughput command.
• G1.4 — 8 reachable, undocumented --task arms.
• G0.5 — the two apr bin targets are the same program by hand-duplication, not
  by sharing, and have already diverged.
• CUDA doc falsehood — dispatch.rs:180-182 tells the user only the root crate's
  feature chain can enable the CUDA path. False: apr-cli/Cargo.toml:89 defines
  cuda directly and qwen-story-daily.yml:63 builds the nightly CUDA binary via
  -p apr-cli.
• G2.2 — reconcile the denominator, both directions, and silently reconcile
  neither. In-binary-not-in-CSV means the ledger is stale; in-CSV-not-in-binary means
  the surface shrank unnoticed.
• G2.3 — measure and commit contracts/apr-dogfood-coverage-v1.yaml (author it).
  Every value cites the command that produced it. This is the item that turns v3.0
  from a document into a ratchet.
• Coverage gate — blocking. Fails when coverage drops below baseline, or when a
  quality-≤-4 feature has no gate and no waiver.
• Enumerate the 44 — each needs an open issue or an explicit written waiver
  before the next release.

Registered mutations

Each must be observed RED, with the pre-fix GREEN captured as before-evidence in the
PR body, plus a discrimination check (RED for the mutation, GREEN for a no-op rebuild
of the same commit — a gate that fires on both is not measuring what it claims).

Prove each mutation ENGAGED before trusting its verdict. A sed that silently fails
to match reads exactly like "the gate is fine". This has bitten twice today — once where
a replacement hit a comment quoting the literal rather than the code.

Anti-vacuity — a lesson paid for today, applies directly here

The multi-platform dogfood gate (#2573) held its host list and its anti-vacuity floor
as literals in the same file. One commit editing both to a smaller matrix exited 0 —
measured. The original mutation proved the floor fires; it never proved the floor could
not be lowered.

Root cause, from five rounds on the competitive-parity ledger:

Any state the author writes and the gate reads can be moved in the same commit.

The resolution is that the comparand lives on protected main — git show origin/main:<file> — which a PR cannot rewrite in its own commit. The coverage
baseline must be read from origin/main, not from the working tree.

The #2332 name-collision hazard — preserve the frontmatter comment

Without an explicit name:, the skill takes its name from its directory, collides with a
user-scope ~/.claude/skills/dogfood/, and never appears in the session's skill
listing — it cannot be invoked and nothing warns. Edits look effective and change
nothing that runs. That is exactly what happened when #2357 hardened Gates 1 and 13.

Open design question — escalate, do not default

The four-host benchmark gate (lambda-labs, gx10, mini, intel) has no obvious CI
home: lambda-labs was retired as a runner 2026-05-10 and marked do-not-revive; mini
is cowork-first with selective CI; intel is the clean-room runner the benchmark would
contend with. Four options in APR-BENCH-RFC-001 §7.3 (paiml/infra#259). Pick one,
record the rationale in the ticket, and if the ledger-based option is chosen, ship the
staleness arm — otherwise the gate measures declared state rather than resolved
state.

Definition of done, per item

1. Merged to main via green ci / gate
2. A gate exists that would have caught the original gap
3. The named mutation applied and observed RED, pre-fix GREEN captured in the PR body
4. pv contract in the same PR
5. Discrimination confirmed — GREEN on a no-op change
6. Any doc claim the change invalidates updated in the same PR

Related

• paiml/infra#259 — APR-BENCH-RFC-001, the four-host benchmark gate
• feat(release): dogfood every supported platform before a cut, and prove it happened #2573 — multi-platform dogfood gate (Gate 12) and its anti-vacuity fix
• Cross-platform dogfood: aarch64 Linux and arm64 macOS verified — Q4_K GEMV is scalar on ARM, OOM guard fails open on macOS #2566 — cross-platform dogfood findings (aarch64, macOS)

Folded sub-tickets (TRIAGE-100, 2026-10-14)

These open sub-tickets were folded here as checklist rows and closed as not planned so the open count stays at or under 100. Reopen one when its work resumes; an open PR for it reopens it.

• The dogfood release gate is unrunnable for every sibling repo whenever aprender is not on main #2701 — The dogfood release gate is unrunnable for every sibling repo whenever aprender is not on main (branch: fix/2701-dogfood-canon-ref, fix/2701-dogfood-canon-ref-port)
• SafeTensors serve route drops ignore_eos and seed: apr-cli's ChatCompletionRequest has no such fields #2853 — SafeTensors serve route drops ignore_eos and seed: apr-cli's ChatCompletionRequest has no such fields (branch: fix/2853-safetensors-ignore-eos, fix/2853-safetensors-ignore-eos-seed)