PMAT-3577: the logit-parity receipts under contract — parity-receipt-v2, extract:parity-receipt, and the 7 back-filled

.github/workflows/ci.yml

@@ -1211,6 +1211,14 @@ jobs:
         run: bash scripts/derive_model_manifest.sh --check
       - name: C14 model-parity case table (L0-1a, #2971)
         run: bash scripts/check_model_parity.sh --self-test
+      # #3577: the parity-receipt denominator is the SECOND, independent reader of the
+      # receipt corpus — the extractor is the first, and they share no code so a defect
+      # in either is caught by the other rather than by nobody. It shipped unwired, which
+      # `check_guards_are_wired.sh` caught: a refusal nothing runs is not a refusal, and
+      # `parity-receipt-v1.yaml`'s own equations name "both readers are wired into CI" as
+      # a precondition. Its 4-case self-test is cargo-free and model-free, so it runs here.
+      - name: Parity-receipt denominator case table (#3577)
+        run: bash scripts/parity_receipt_denominator.sh --self-test
       # F-1 (#3022, #3024): a model file the user NAMED is the model that answers, or
       # the command refuses — `apr chat` silently loaded its toy demo model for a
       # `model.safetensors.index.json` (exit 0, zero tokens, the real path in the banner)

ci/explicit-test-commands.d/420-aprender-contracts-cli-ont4c3-parity-receipts.cmd

@@ -0,0 +1 @@
+cargo test -p aprender-contracts-cli --test ont4c3_parity_receipts

contracts/census.json

@@ -1,8 +1,8 @@
 {
   "schema": "ont.paiml.dev/census/v1alpha1",
   "git_sha": null,
-  "n_files": 1801,
-  "n_parsed": 1801,
+  "n_files": 1803,
+  "n_parsed": 1803,
   "n_parse_errors": 0,
   "parse_errors": [],
   "quarantined_n": 0,
@@ -12,7 +12,7 @@
     "kernel": 363,
     "model-family": 28,
     "model-family-variant": 1,
-    "pattern": 87,
+    "pattern": 89,
     "pretraining-corpus": 2,
     "registry": 519,
     "schema": 766,
@@ -22,14 +22,15 @@
   },
   "by_entity_type": {
     "gguf": 2,
+    "json": 2,
     "pv-contract": 1
   },
   "by_anchoring": {
     "unanchored": 1798,
-    "class": 2,
+    "class": 4,
     "instance": 1
   },
-  "id_set_sha256": "e624814d2c82e8a53ab24faac0b5281c0dad15618d9f14e970c740c8391cb712",
+  "id_set_sha256": "717a1cd852f535664eb9d0d7c90ef6e8c2666362c992264f025fc86031e7de02",
   "declared_external": [
     {
       "name": "provable-contracts",

contracts/ontology.yaml

@@ -140,6 +140,10 @@ entity_types:
   - {name: apr-model, extractor: apr_model, implemented: true}
   - {name: gguf, extractor: gguf, implemented: true}
   - {name: csv, extractor: csv, implemented: false}
+  # ONT-4c3 (aprender#3577): the logit-parity receipts under evidence/parity/**. Subclasses `json` for now;
+  # it moves under a shared `Receipt` class once quorum and dispatch receipts join, so the three families
+  # inherit common shapes. NOT the throughput parity receipts — a different family with a different validator.
+  - {name: parity-receipt, extractor: parity_receipt, implemented: true}
 
 extractors:
   - {name: pv_contract, reader: ontology/extract/pv_contract.rs, implemented: true}
@@ -151,6 +155,7 @@ extractors:
   - {name: apr_model, reader: ontology/extract/apr_model.rs, implemented: true}
   - {name: gguf, reader: ontology/extract/gguf.rs, implemented: true}
   - {name: csv, reader: ontology/extract/csv.rs, implemented: false}
+  - {name: parity_receipt, reader: ontology/extract/parity_receipt.rs, implemented: true}
 
 # What this ontology does NOT express, said out loud so nobody encodes it by accident. Each names the reader that
 # would have to change first.

contracts/parity-receipt-v1.yaml

@@ -0,0 +1,120 @@
+# ──────────────────────────────────────────────
+# parity-receipt-v1 — the RETIRED logit-parity layout (ONT-001 §5 ONT-4c3; issue #3577, PMAT-3577)
+#
+# WHAT THIS IS. The layout the seven logit-parity records carried from 2026-09-06 until #3577 migrated them:
+# the bare `apr parity --json` document, with the readings and the judgment mixed at one level.
+#
+#   {"model": "./m.gguf", "tokens": 78, "passed": 78, "failed": 0, "parity": true, "metrics": [ … ]}
+#
+# It is recorded rather than deleted because a version nobody wrote down is a version somebody re-invents. The
+# fork was real and cost real time: an extractor keyed to one layout silently skips the other, and skipping is
+# indistinguishable from passing — which is how a record can sit in the tree for months with no comparator and
+# no shape able to say so.
+#
+# STATUS: superseded by parity-receipt-v2, WITH NO INSTANCES IN THE TREE. All seven records were migrated to v2
+# in the same commit as the comparator back-fill (#3577), so this contract declares no shape: a shape whose
+# target class nothing instantiates passes vacuously, and a vacuous pass is worth less than no shape at all.
+# The enforcement that replaces it is stronger and lives where it can fire — `extract:parity-receipt` REFUSES
+# an unmigrated record BY NAME (a file with no v2 `schema` but a top-level `metrics[]` or `parity`), and
+# `scripts/parity_receipt_denominator.sh` refuses it independently. A returning v1 record is an error naming the
+# file, not a silent skip.
+#
+# WHAT V2 CHANGED, and why each:
+#   · `schema` — v1 had none, so nothing could tell a parity record from any other JSON in the directory.
+#   · raw readings separated from the judgment (`raw` vs `result`) — the #3574 layout. `raw` is the original
+#     document byte for byte, so the migration is a relabel and the measurement is never restated.
+#   · `comparator {kind, comparator_sha, reason}` — the field whose absence this row exists to make impossible.
+#     All seven were self-comparisons (apr-CPU vs apr-CUDA) that implied an oracle they never had.
+#   · `partially_receipted`, `unmeasured[]` — an empty completeness claim now has to be written deliberately.
+#   · `host`, `backend`, `apr_version`, `generated_at`, `threshold_source` — recovered from committed evidence
+#     (each record's `provenance.record` names the RECORD.md it was quoted from), never invented.
+#   · `cell.model_sha256` — carried ONLY by the one record that recorded it at measurement time. The other six
+#     say so in `unmeasured` instead of being back-filled from a hash taken today.
+#
+# KIND: pattern (historical). No shape, by construction — see STATUS.
+# ──────────────────────────────────────────────
+name: parity-receipt-v1
+version: "1.0.0"
+scope: >
+  The retired logit-parity record layout, recorded so the fork it caused is documented and a returning instance
+  is recognisable. Out of scope: everything live — the shapes, the extractor and the denominator are
+  parity-receipt-v2's.
+status: superseded
+
+metadata:
+  version: "1.0.0"
+  kind: pattern
+  created: '2026-09-20'
+  last_modified: '2026-09-20'
+  author: PAIML Engineering
+  description: >
+    The pre-#3577 logit-parity layout: no schema, readings and judgment at one level, no comparator. Superseded
+    by parity-receipt-v2, with no instances in the tree; an unmigrated instance is refused by name by the
+    extractor and by the committed denominator predicate rather than by a shape that would pass vacuously.
+  references:
+    - 'aprender#3577 (the migration and the back-fill), #3576, #3269 (ONT-4c3)'
+    - 'contracts/parity-receipt-v2.yaml — the live contract'
+    - 'crates/aprender-contracts/src/ontology/extract/parity_receipt.rs — refuses an unmigrated record by name'
+    - 'scripts/parity_receipt_denominator.sh — refuses one independently'
+    - 'evidence/parity/l0-1/{lambda,gx10}/RECORD.md, evidence/parity/l0-1b/gx10/n5/DETERMINISM.md — the provenance the back-fill quotes'
+
+entity:
+  # The entity type this contract's shapes govern (Σ: contracts/ontology.yaml entity_types). It is NOT
+  # `json`: an `entity: {type: json}` contract must name a document with `entity.ref`, and these two carry
+  # shapes over an extractor rather than reading one tool's --json output.
+  type: parity-receipt
+
+relations:
+  depends_on: [ont-sigma-v1]
+
+equations:
+  # A `kind: pattern` contract declares no SHAPE — see STATUS, a shape over a class nothing
+  # instantiates passes vacuously — but it still ASSERTS things, and those are statable. These two
+  # are the invariants below written as the equations the corpus integrity check reads, not new
+  # claims invented to satisfy a counter: PRC1-INV-001 and PRC1-INV-002 said exactly this already.
+  no_instances:
+    formula: "legacy(f) ⇔ f ∈ evidence/parity/**/*.json ∧ ¬f.schema ∧ (f.metrics[] ∨ f.parity)"
+    domain: every *.json under evidence/parity/, walked in byte order
+    codomain: the empty set — all seven records were migrated to v2 in the #3577 commit
+    invariants:
+      - "the retired layout is recognised by ABSENCE of `schema` plus PRESENCE of a top-level
+        reading: either half alone is some other document and is not claimed here"
+      - a count of zero is asserted, not assumed — the denominator predicate measures it independently
+    preconditions:
+      - the seven records named in evidence/parity/*/RECORD.md have been migrated
+    postconditions:
+      - a v1 record reappearing under evidence/parity/ makes this equation false and is visible
+    lean_theorem: "none — L4 not declared"
+  refused_by_name:
+    formula: "legacy(f) ⇒ f ∈ errors(extract:parity-receipt) ∧ exit(parity_receipt_denominator.sh) ≠ 0"
+    domain: a planted v1-layout record
+    codomain: two independent refusals, each naming the file
+    invariants:
+      - "refused BY NAME, never skipped: a skip is indistinguishable from a pass, which is how a
+        record sat in the tree for months with no comparator and nothing able to say so"
+      - "two readers, not one: the extractor and the shell predicate share no code, so a defect in
+        either is caught by the other rather than by nobody"
+    preconditions:
+      - both readers are wired into CI — a refusal nothing runs is not a refusal
+    postconditions:
+      - removing the planted record makes both pass again, so the pair can return to green
+    lean_theorem: "none — L4 not declared"
+
+invariants:
+  - id: PRC1-INV-001
+    property: the retired layout has no instances in the committed tree
+    formal: '∀ f ∈ evidence/parity/**/*.json: schema(f) = "apr-parity-receipt/v2" ∨ ¬legacy(f)'
+    prose: false
+  - id: PRC1-INV-002
+    property: a returning instance is refused by name, by two independent readers
+    formal: 'legacy(f) ∧ ¬schema(f) ⇒ f ∈ errors(extract:parity-receipt) ∧ exit(denominator.sh) ≠ 0'
+    prose: false
+
+falsification_tests:
+  - id: FALSIFY-PRC1-001
+    rule: no instance survives
+    prediction: >
+      planting a v1-layout record under evidence/parity/ makes both the extractor and the denominator predicate
+      refuse it by name, and removing it makes both pass again — both directions
+    test: cargo test -p aprender-contracts --lib ontology::extract::parity_receipt && bash scripts/parity_receipt_denominator.sh --self-test
+    if_fails: the retired layout returns and nothing says so