Skip to content

PMAT-3627: rmsnorm scale invariance asserts the ε>0 property — the ε=0 theorem was false where the generator reaches - #3631

Merged
noahgift merged 4 commits into
mainfrom
PMAT-3627-rmsnorm-scale-invariance-eps
Sep 21, 2026
Merged

noahgift merged 4 commits into
mainfrom
PMAT-3627-rmsnorm-scale-invariance-eps

Conversation

@noahgift

@noahgift noahgift commented Sep 20, 2026 •

Copy link
Copy Markdown
Member

prop_scale_invariance asserted the ε=0 theorem against the ε=1e-6 implementation, and failed whenever α²·mean(x²) ≈ ε — the regime its own generator reaches. Killed #3621's shard 1/3 (the T-0 PR).

Two commits, RED in history:

git checkout <RED>  && cargo test -p aprender-core --test contract_tests regression_3627   # FAILED
git checkout <HEAD> && cargo test -p aprender-core --test contract_tests regression_3627   # ok

The property

With ε in the denominator, exactly:

RMSNorm(α·x) = sign(α) · RMSNorm(x) · √((m+ε)/(m+ε/α²)), m = mean(x²)

Re-derived in f64 on the killing input: relative error 2e-16. The ε=0 theorem (RMSNorm.rms_scale_zero_eps, "Proved for ε=0") is the k→1 limit and is false when α²·m is comparable to ε. The killing input has α²·m = 1.91e-6 against ε = 1e-6 and a 19% discrepancy: y[1] = -1.414158, y_scaled[1] = -1.146122 — the issue's numbers, reproduced independently to six digits.

The implementation is right. The assertion was wrong. Option 1 from the issue: the proptest and the regression case now assert the ε>0 form with relative tolerance 1e-4, in every regime the generator reaches, and the guessed tol = 0.05 if |α| < 0.1 branch is gone.

Evidence

regression_3627_scale_invariance_in_the_eps_dominated_regime ok — also pins y_scaled[1] = -1.146122, k = 0.810462
cargo nextest run -p aprender-core --test contract_tests prop_scale_invariance × 20, fresh seed each 20/20 (the criterion's own tool, not cargo test)
mutation: k := 1.0 (ε=0 restored) in the regression case RED, rel = 0.18953769
the whole rmsnorm suite 12 passed, 0 failed
pv validate contracts/rmsnorm-kernel-v1.yaml valid
cargo test -p aprender-contracts --lib (sigma armed) 1666 / 1666

RN-INV-005's formal now states the ε>0 property; its Lean notes say which regime the ε=0 theorem covers; FALSIFY-RN-002 names both tests and the mutation. The edit adds no file and no triple — census/graph/README unchanged, checked by regenerating with the pinned pv.

The done_when item that had to be withdrawn, and why

The issue asked for the test to be "regenerated with pv probar --binding, no hand edit" — the file's header says DO NOT EDIT — regenerate. That cannot be done. Measured with the pinned pv 0.68.2, both binding paths:

pv probar contracts/rmsnorm-kernel-v1.yaml --binding …  →  7 tests, all #[ignore = "no binding available"]
tracked rmsnorm_contract.rs                              →  5 real property tests

Obeying the header would have replaced five real tests with seven ignored stubs. The bodies came from the pre-monorepo generator (20dda945b, 2026-02-18); the in-tree pv probar has never been able to produce them. This is a declared hand edit, the header on this file now says so and why, and the item was withdrawn on the issue citing this measurement.

Then the class: every crates/aprender-core/tests/contracts/*_contract.rs with a matching contract — ~30 files — differs from its regeneration, and every regeneration is stubs. Not one DO NOT EDIT header in that directory is true. #3630. Not absorbed here; the guard is the deliverable there.

One line for the receipt row

nextest [profile.ci] retries = 2 replayed the case proptest persisted to proptest-regressions/ on TRY 1, so TRY 2 and 3 failed in 0.005 s each — three tries, one failure. A retry cannot un-persist a counterexample; retries are theater for property tests.

Closes #3627 — every remaining done_when item is met on the table above and item 2 was withdrawn on the issue itself (21:40Z) for the measurement this body records; the closing keyword is added against the issue's own text, not this body's summary of it.

keep-open: #3630 is the header class and its guard; #3621 is the T-0 PR this unblocks and merges on its own. Refs #3621, #3630.
ont-delta: none — an obligation's formal and a hand-maintained test, with no ontology type, shape or known-red list touched.

🤖 Generated with Claude Code

noahgift and others added 2 commits September 20, 2026 23:36
…egression case

RED FIRST. Only the regression test lands; the proptest, the contract and the header
are untouched. On THIS commit:

  test regression_3627_scale_invariance_in_the_eps_dominated_regime ... FAILED
  3627 regression: sign*y[1]=-1.414158 vs y_scaled[1]=-1.1461217, diff=0.26803625

Input: data = [0.0, -0.15964308], alpha = 0.012254778. alpha^2 * mean(x^2) = 1.91e-6,
eps = 1e-6 (RMSNorm::without_affine, group_norm.rs:275). Ratio 1.91: the eps term is
not negligible and RMSNorm(alpha*x) != sign(alpha)*RMSNorm(x), by design of eps. The
numbers were re-derived in f64 independently of the CI log and match to six digits;
the eps>0 identity y_scaled = sign(a)*y*sqrt((m+eps)/(m+eps/a^2)) predicts -1.146122
with relative error 2e-16. The implementation is right; the assertion was wrong.

Refs #3627, #3621

Pmat-Ticket: PMAT-3627
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
… not the eps=0 theorem

Same regression case as the RED commit, now green, plus the proptest, the contract and
the file's header.

THE PROPERTY. With eps in the denominator,
    RMSNorm(a*x) = sign(a) * RMSNorm(x) * sqrt((m+eps) / (m+eps/a^2)),  m = mean(x^2),
exactly (re-derived in f64: relative error 2e-16 on the killing input). The eps=0
theorem RMSNorm.rms_scale_zero_eps is the k -> 1 limit and is false whenever a^2*m is
comparable to eps. The proptest and the regression case now assert the eps>0 form with
a relative tolerance of 1e-4 -- testing what the implementation computes, in every
regime the generator reaches -- and the guessed `tol = 0.05 if |alpha| < 0.1` branch
is gone. Option 1 from the issue, chosen over the precondition: it is the stronger
property and excludes nothing.

  regression_3627_...                              ok
  prop_scale_invariance x 20 runs, fresh seed each  20/20 ok
  MUTATION (k := 1, the eps=0 form restored)       RED: rel=0.18953769 -- the 19%
  the whole rmsnorm suite                          12 passed, 0 failed

The regression case also pins y_scaled[1] = -1.146122 and k = 0.810462, so it is
anchored to the incident's numbers, not only to the identity.

THE CONTRACT. RN-INV-005's formal now states the eps>0 property (carries Sigma symbols:
forall, ne, sqrt, arrows), and its Lean notes say precisely which regime the eps=0
theorem covers. FALSIFY-RN-002 names both tests and the mutation. pv validate clean;
cargo test -p aprender-contracts --lib 1666/1666 (sigma armed). The edit adds no file
and no triple, so census/graph/README are unchanged -- checked by regenerating.

THE HEADER. This file said "DO NOT EDIT -- regenerate with `pv probar --binding`". That
is false: the in-tree pv probar emits seven `#[ignore = "no binding available"]` stubs
for this contract and cannot produce these bodies, which came from the pre-monorepo
generator (20dda94, 2026-02-18). Obeying the header would have replaced five real
property tests with seven ignored stubs. This is a declared HAND EDIT, and the header
now says so; the issue's "regenerated, no hand edit" item was withdrawn on that
measurement. The same false header stands on ~50 other tests/contracts/ files: #3630.

RETRIES ARE THEATER FOR PROPERTY TESTS. nextest [profile.ci] retries = 2 replayed the
case proptest persisted to proptest-regressions/ on TRY 1, so TRY 2 and 3 failed in
0.005 s each: three tries, one failure. A retry cannot un-persist a counterexample.

Refs #3627, #3621, #3630

Pmat-Ticket: PMAT-3627
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@noahgift
noahgift enabled auto-merge September 20, 2026 21:48
@github-actions

github-actions Bot commented Sep 20, 2026 •

Copy link
Copy Markdown

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3631 head=30493c1e2cc841ee2e3a1245984062319253a3a3 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

@noahgift
noahgift disabled auto-merge September 20, 2026 22:28
@noahgift
noahgift enabled auto-merge September 20, 2026 22:29
@noahgift

Copy link
Copy Markdown
Member Author

Quorum routing (AD-04, Phase 1 step 4), stated by the author.

Files: contracts/rmsnorm-kernel-v1.yaml, crates/aprender-core/tests/contracts/rmsnorm_contract.rs → |M| = 2 {contracts, crates/aprender-core}.

  • Q1 |M|≥3: no
  • Q2 spec/plan artifact: arguable — an obligation's formal changed, which is a specification change; flagged rather than waved through
  • Q3 five-whys diverge: no
  • Q4 --quorum always: no

No trigger under the ≥3-modules rule in force tonight. No quorum receipt exists for this PR; if Q2 is read as firing, this is disarmed until a lane judges it. This PR was not built through paiml-implement, so this is a post-hoc routing statement, not a Phase-1 plan line.

@noahgift
noahgift disabled auto-merge September 20, 2026 22:33
…orum can run

docs/roadmaps/entries/PMAT-3627.yaml hand-entered from issue #3627 (title, done_when as
notes), roadmap.yaml regenerated by make roadmap-aggregate. quorum-review.sh refuses
unless `pmat work status PMAT-3627` resolves, and the item existed only as a GitHub
issue. Four roadmap guards rc=0. No renumbering, no separate PR.

Pmat-Ticket: PMAT-3627
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@noahgift

Copy link
Copy Markdown
Member Author

quorum-review (AD-04): three PASS — agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3627",
 "head": "fd068099fd8ad3a31c802c18ee1655944dfad49e",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 3
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 5
  }
 ]
}

docs/audits/quorum-PMAT-3627.json from quorum-review.sh --base origin/main --pr 3631, executor
agy, width 3, models gemini-3.1-pro-high / gemini-3.8-flash-high / gemini-3.7-flash-high,
none in the author's family. Independence inspected: every lane file has zero
references to a sibling lane, $WORK or the .lanes/ dir. Dissent: none.

Pmat-Ticket: PMAT-3627
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@noahgift

Copy link
Copy Markdown
Member Author

AD-04 quorum: 3/3 PASS, three independent lanes

docs/audits/quorum-PMAT-3627.json, executor agy, width 3, judged at head fd068099f, author model claude-opus-5:

lane model verdict
1 gemini-3.1-pro-high PASS (3 findings)
2 gemini-3.8-flash-high PASS (0 findings)
3 gemini-3.7-flash-high PASS (5 findings)

dissent: []. Independence inspected: zero references to a sibling lane, $WORK, or the .lanes/ dir in any lane file. None of the three models is in the author's family. The ticket was registered on this branch (fragment + aggregate) so pmat work status could resolve it; the registration commit precedes the receipt.

@noahgift

noahgift commented Sep 20, 2026 •

Copy link
Copy Markdown
Member Author

Cross-inspection of docs/audits/quorum-PMAT-3627.json lanes (non-author: aprender-04, 23:09Z)

lane conversation status verdict findings refs to sibling lanes/receipts turns
lane 1 8967174e SUCCESS PASS 3 (3 cited) 0 1 turns / 377.661577467 s
lane 2 73a37273 SUCCESS PASS 0 (0 cited) 0 1 turns / 226.892534496 s
lane 3 9ceecf3d SUCCESS PASS (structured_output) 0 (0 cited) 0 1 turns / 163.873795262 s

Distinct agy conversation ids: 3/3. No lane's response references another lane's file or any quorum-PMAT-*.json. Each verdict is grounded in its own findings (file:line). Read from /mnt/nvme-raid0/agent-wt/rmsnorm-3627/docs/audits/quorum-PMAT-3627.json.lanes on this box; the receipt on the branch records agreed: true, three PASS, models gemini-3.1-pro-high / 3.8-flash-high / 3.7-flash-high, author claude-opus-5 (flag).

Verdict line: 3/3 PASS, independent. Arming.

Table corrected 23:12Z: two cells first read "None" because my parser took response instead of structured_output; the receipt's verdict_source is structured_output for all three lanes and all three are PASS there. #3617 lane 2 opens with an interim sentence ("running in the background…") but its structured summary records the guard run (check_tag_step_gated.sh rc=0, --self-test rc=0, 3 mutants killed) — a completed review, not a premature PASS.

@noahgift
noahgift enabled auto-merge September 20, 2026 23:09
@noahgift
noahgift added this pull request to the merge queue Sep 21, 2026
Merged via the queue into main with commit d0b4802 Sep 21, 2026
25 of 26 checks passed
@noahgift
noahgift deleted the PMAT-3627-rmsnorm-scale-invariance-eps branch September 21, 2026 03:43
noahgift added a commit that referenced this pull request Sep 21, 2026
…rom fragments

The merge-queue group build conflicted on the committed aggregate against
#3631's PMAT-3627 entry (#3650). Resolution: take main's roadmap.yaml, run
make roadmap-aggregate, which re-adds PMAT-3604 and PMAT-3637 from their
fragments. The PR's own diff vs main is unchanged (two fragments + the
aggregate lines they produce); the quorum receipt judged that diff.

Refs #3604, #3634, #3650
noahgift added a commit that referenced this pull request Sep 21, 2026
…ap.yaml re-aggregated from entries/

The committed roadmap.yaml aggregate conflicted with #3631's PMAT-3627 entry now on
main (the cascade #3650 predicts). Resolution: main's roadmap.yaml, then
`make roadmap-aggregate` re-adds this branch's PMAT-3587 fragment; aggregate --check
idempotent over 50 fragments; the four roadmap guards PASS. The PR's diff vs main
is unchanged: .config/nextest.toml, the guard, the fragment, the receipt. The AD-04
receipt (docs/audits/quorum-PMAT-3587.json) judged that diff at 3df1c64; this merge
is past the judged head and changes nothing it judged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Sep 21, 2026
…ap.yaml re-aggregated from entries/

The committed roadmap.yaml aggregate conflicted with #3631's PMAT-3627 entry now on
main (the cascade #3650 predicts). Resolution: main's roadmap.yaml, then
`make roadmap-aggregate` re-adds this branch's PMAT-3644 fragment; aggregate --check
idempotent; the four roadmap guards PASS. The PR's diff vs main is unchanged; the
AD-04 receipt (docs/audits/quorum-PMAT-3644.json) judged that diff, and this merge is
past the judged head and changes nothing it judged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Sep 21, 2026
…ml re-aggregated from entries/

The committed roadmap.yaml aggregate conflicted with #3631's PMAT-3627 entry now on
main (the cascade #3650 predicts). Resolution: main's roadmap.yaml, then
`make roadmap-aggregate` re-adds this branch's PMAT-3629 fragment; aggregate --check
idempotent; the four roadmap guards PASS. The PR's diff vs main is unchanged; the
AD-04 receipt (docs/audits/quorum-PMAT-3629.json) judged that diff, and this merge is
past the judged head and changes nothing it judged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Sep 21, 2026
… set, not resolved to a side

#3650: #3631's PMAT-3627 entry rewrote the committed aggregate, so every branch
minting a fragment conflicts on that one file.

`docs/roadmaps/roadmap.yaml` is GENERATED. The conflict is in the artifact, never
in the inputs: `docs/roadmaps/entries/` merged with ZERO conflicts because the
fragments are separate files, and main's `PMAT-3627.yaml` arrived intact. So the
resolution is `make roadmap-aggregate` over the merged set — taking either side
whole would drop the other's entry, which is the failure mode this file class has.

Verified rather than assumed: both `PMAT-3602` and `PMAT-3627` appear exactly once
in the regenerated file, and `make roadmap-aggregate-check` reports
`roadmap.yaml == aggregate(50 fragment(s)), idempotent`.

THE JUDGED DIFF IS UNCHANGED. This is a merge commit past the judged head that
touches one generated file; no reviewed code, test or contract is altered, so the
AD-04 receipt on this branch stays valid.

Refs #3650
Pmat-Ticket: PMAT-3602
noahgift added a commit that referenced this pull request Sep 21, 2026
… set, not resolved to a side

#3650: #3631's PMAT-3627 entry rewrote the committed aggregate, so every branch
minting a fragment conflicts on that one file.

`docs/roadmaps/roadmap.yaml` is GENERATED. The conflict is in the artifact and
never in the inputs — `docs/roadmaps/entries/` merged with ZERO conflicts because
the fragments are separate files, and main's `PMAT-3627.yaml` arrived intact. So
the resolution is `make roadmap-aggregate` over the merged set; taking either
side whole would silently drop the other's entry, which is this file class's
failure mode.

Verified rather than assumed: PMAT-3597 and PMAT-3627 each appear exactly once in the
regenerated file, and `make roadmap-aggregate-check` reports it idempotent.

THE JUDGED DIFF IS UNCHANGED. A merge commit past the judged head touching one
generated file; no reviewed code, test or contract is altered, so this branch's
AD-04 receipt stays valid.

Refs #3650
Pmat-Ticket: PMAT-3597
noahgift added a commit that referenced this pull request Sep 21, 2026
… set, not resolved to a side

#3650: #3631's PMAT-3627 entry rewrote the committed aggregate, so every branch
minting a fragment conflicts on that one file.

`docs/roadmaps/roadmap.yaml` is GENERATED. The conflict is in the artifact and
never in the inputs — `docs/roadmaps/entries/` merged with ZERO conflicts because
the fragments are separate files, and main's `PMAT-3627.yaml` arrived intact. So
the resolution is `make roadmap-aggregate` over the merged set; taking either
side whole would silently drop the other's entry, which is this file class's
failure mode.

Verified rather than assumed: PMAT-3610 and PMAT-3627 each appear exactly once in the
regenerated file, and `make roadmap-aggregate-check` reports it idempotent.

THE JUDGED DIFF IS UNCHANGED. A merge commit past the judged head touching one
generated file; no reviewed code, test or contract is altered, so this branch's
AD-04 receipt stays valid.

Refs #3650
Pmat-Ticket: PMAT-3610
noahgift added a commit that referenced this pull request Sep 21, 2026
… set, not resolved to a side

#3650: #3631's PMAT-3627 entry rewrote the committed aggregate, so every branch
minting a fragment conflicts on that one file.

`docs/roadmaps/roadmap.yaml` is GENERATED. The conflict is in the artifact and
never in the inputs — `docs/roadmaps/entries/` merged with ZERO conflicts because
the fragments are separate files, and main's `PMAT-3627.yaml` arrived intact. So
the resolution is `make roadmap-aggregate` over the merged set; taking either
side whole would silently drop the other's entry, which is this file class's
failure mode.

Verified rather than assumed: PMAT-3598 and PMAT-3627 each appear exactly once in the
regenerated file, and `make roadmap-aggregate-check` reports it idempotent.

THE JUDGED DIFF IS UNCHANGED. A merge commit past the judged head touching one
generated file; no reviewed code, test or contract is altered, so this branch's
AD-04 receipt stays valid.

Refs #3650
Pmat-Ticket: PMAT-3598
noahgift added a commit that referenced this pull request Sep 21, 2026
… not resolved to a side

#3650: #3631's PMAT-3627 entry rewrote the committed roadmap aggregate. On this
branch a second generated artifact conflicts too.

  docs/roadmaps/roadmap.yaml   ->  make roadmap-aggregate
  contracts/census.json        ->  pv census contracts --format json

Neither conflict is in an INPUT. `docs/roadmaps/entries/` merged with zero
conflicts (fragments are separate files) and main's `PMAT-3627.yaml` arrived
intact; the census is a count over `contracts/`, which also merged cleanly. So
both are regenerated from the merged tree. Picking a side on a generated file
drops whatever the other side contributed and leaves an artifact that no longer
equals its own derivation — which the checks then catch, or worse, do not.

Verified rather than assumed: PMAT-3605 and PMAT-3627 each appear exactly once in the
regenerated roadmap; `make roadmap-aggregate-check` reports it idempotent; the
census re-derives to n_files=1802 with zero conflict markers and zero unresolved
paths.

THE JUDGED DIFF IS UNCHANGED. A merge commit past the judged head touching two
generated files; no reviewed code, test or contract is altered, so this branch's
AD-04 receipt stays valid.

Refs #3650
Pmat-Ticket: PMAT-3605
noahgift added a commit that referenced this pull request Sep 21, 2026
… not resolved to a side

#3650: #3631's PMAT-3627 entry rewrote the committed roadmap aggregate. On this
branch a second generated artifact conflicts too.

  docs/roadmaps/roadmap.yaml   ->  make roadmap-aggregate
  contracts/census.json        ->  pv census contracts --format json

Neither conflict is in an INPUT. `docs/roadmaps/entries/` merged with zero
conflicts (fragments are separate files) and main's `PMAT-3627.yaml` arrived
intact; the census is a count over `contracts/`, which also merged cleanly. So
both are regenerated from the merged tree. Picking a side on a generated file
drops whatever the other side contributed and leaves an artifact that no longer
equals its own derivation — which the checks then catch, or worse, do not.

Verified rather than assumed: PMAT-3577 and PMAT-3627 each appear exactly once in the
regenerated roadmap; `make roadmap-aggregate-check` reports it idempotent; the
census re-derives to n_files=1803 with zero conflict markers and zero unresolved
paths.

THE JUDGED DIFF IS UNCHANGED. A merge commit past the judged head touching two
generated files; no reviewed code, test or contract is altered, so this branch's
AD-04 receipt stays valid.

Refs #3650
Pmat-Ticket: PMAT-3577
@noahgift noahgift mentioned this pull request Sep 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant