Contract tooling: unique shape IRIs in pv and the YAML parser swap #5340

Scope: pv's SHACL shapes (nested node blocks share one IRI) and replacing the unmaintained YAML parser with serde-saphyr.

Why it matters: Shared IRIs make two different shapes indistinguishable to the checker, and the parser swap removes an advisory exception.

Done when: pv gives each nested shape its own IRI with a test, and the workspace builds and passes contracts tests on serde-saphyr.

Epic: #3994. Folded under triage rule 7b (2026-10-14): each row below was its own issue, closed as not planned and kept here as a sub-ticket. Reopen an issue when its work starts or its PR opens.

Sub-tickets

• pv shapes: two nested node: blocks under one shape share one IRI (release-readiness-v1.host/node) #4994 pv shapes: two nested node: blocks under one shape share one IRI (release-readiness-v1.host/node) (milestone 0.71.1)
  • accept: the outcome in the title, with a receipt
• serde-saphyr swap S3: decide, simulate, orchestrate (#5205) #5207 serde-saphyr swap S3: decide, simulate, orchestrate (cargo-deny: unsafe-libyaml unmaintained (RUSTSEC-2024-0449) — interim ignore, then serde_yaml swap #5205) (milestone 0.71.0)
  • accept: Done when:

Merged in (TRIAGE-100, 2026-10-14)

From #5326 — Dependencies: serde_yaml to serde-saphyr swap, cargo-deny advisories, stale sibling paths (reopened: 0.72.0 floor row)

• Dependencies: serde_yaml to serde-saphyr swap, cargo-deny advisories, stale sibling paths #5326 — Dependencies: serde_yaml to serde-saphyr swap, cargo-deny advisories, stale sibling paths — reopened 2026-10-14 as a 0.72.0 floor row; tracked on its own ticket, not here
• build scripts still read the gone provable-contracts sibling path: serve codegen (arch-requirements, tensor-names), graph, verify, verify-ml (#4369 class) #4380 — build scripts still read the gone provable-contracts sibling path: serve codegen (arch-requirements, tensor-names), graph, verify, verify-ml (Migrate the 12 hand-rolled producer build.rs key builders onto build_helper::env_key (#2699 remainder) #4369 class) (branch: e6/4380-build-contracts-paths)
• cargo-deny: unsafe-libyaml unmaintained (RUSTSEC-2024-0449) — interim ignore, then serde_yaml swap #5205 — cargo-deny: unsafe-libyaml unmaintained (RUSTSEC-2024-0449) — interim ignore, then serde_yaml swap (branch: fix/5205-drop-bashrs)
• serde_yaml swap S2: present, present-yaml, test-lib, serve, qa-runner, core → serde-saphyr #5208 — serde_yaml swap S2: present, present-yaml, test-lib, serve, qa-runner, core → serde-saphyr (branch: w71-e3a/5208-saphyr-s2)
• serde_yaml → serde-saphyr swap, stage S4: apr-cli, contracts-cli, train #5209 — serde_yaml → serde-saphyr swap, stage S4: apr-cli, contracts-cli, train
• RUSTSEC-2026-0344: ruzstd 0.8.3 in Cargo.lock fails cargo-deny advisories on every PR #5249 — RUSTSEC-2026-0344: ruzstd 0.8.3 in Cargo.lock fails cargo-deny advisories on every PR