Skip to content

release(0.70.0): sealed car — REPLACES #4372 - #4429

Closed
noahgift wants to merge 258 commits into
mainfrom
car/0.70.0
Closed

noahgift wants to merge 258 commits into
mainfrom
car/0.70.0

Conversation

@noahgift

@noahgift noahgift commented Sep 25, 2026 •

Copy link
Copy Markdown
Member

REPLACES #4372. Operator ruling 16:14/16:15: the 0.70.0 sealed train car has fixed contents and no main-merges. It is cut fresh from main, and the scope is frozen.

Tickets: #312 #315 #317 #328 #356 #385 #390 #420 #597 #1042 #1059 #1087 #2307 #2582 #2586 #2696 #2699 #2706 #2870 #3090 #3093 #3140 #3204 #3269 #3298 #3425 #3488 #3522 #3544 #3563 #3567 #3569 #3571 #3594 #3596 #3602 #3610 #3611 #3622 #3624 #3633 #3636 #3658 #3668 #3669 #3676 #3679 #3690 #3707 #3711 #3714 #3715 #3718 #3730 #3731 #3732 #3739 #3740 #3741 #3745 #3748 #3749 #3750 #3756 #3761 #3765 #3772 #3773 #3774 #3777 #3782 #3790 #3795 #3799 #3804 #3805 #3807 #3809 #3810 #3821 #3839 #3841 #3844 #3850 #3953 #3956 #3964 #3972 #3975 #3981 #4020 #4023 #4024 #4028 #4033 #4045 #4046 #4047 #4048 #4056 #4057 #4059 #4060 #4062 #4076 #4083 #4085 #4096 #4097 #4101 #4107 #4110 #4113 #4114 #4127 #4129 #4130 #4138 #4144 #4149 #4152 #4162 #4168 #4173 #4175 #4179 #4183 #4192 #4200 #4207 #4219 #4223 #4224 #4228 #4233 #4244 #4252 #4256 #4267 #4275 #4282 #4285 #4286 #4287 #4290 #4292 #4312 #4314 #4315 #4326 #4327 #4328 #4329 #4336 #4339 #4340 #4342 #4344 #4345 #4351 #4352 #4368 #4369 #4373

🤖 Generated with Claude Code

keep-open: the Tickets: line is a traceability index of every issue cited by the car's 313 commits, not a closing list. Each stays with its own owner/PR (APR-EPIC-001: only the named closers close); this PR closes only #4047 and #3972 (aprender-ea verified ONT-4c5 on the car, 11/11).
ont-delta: resolves ONT-4c5 (#4047 #3972, verified on car 93aa211)

Closes #4047
Closes #3972

@github-actions

github-actions Bot commented Sep 25, 2026 •

Copy link
Copy Markdown

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=4429 head=0d7e7e49e4f469210c5f306d5a37ec5011c44409 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

noahgift and others added 4 commits September 25, 2026 18:49
…ratchet was cut

guard-cargo's include_fmt_ratchet REFUSEd 17 include!d files (+2 test submodules
rustfmt follows) that main gained since B2 and that are not in the baseline this PR
introduces. Formatted rather than baselined: the baseline may only shrink.
Refs #4427

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…th import, simulate needless borrow)

Same env_key rewrite as aprender-rag. Local `cargo clippy --all-targets
--keep-going -- -D warnings -A unused-variables` (ci / lint's command) now rc 0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…SIFY-BOOK-CLI-PARITY-001, 113/114)

The batch folded the aprender-ptx-debug binary into `apr ptx-debug` without a
chapter. Adds book/src/cli/ptx-debug.md + its SUMMARY entry; example-block and
linkcheck gates pass locally (115/115 chapters).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ed: same-family, agy 429)

Round 1 on aec0b67: sonnet PASS, gemini PASS, haiku FAIL (deprecation warnings
removed from 4 main.rs files). Rebutted: those files are byte-identical to main and
to the quorumed batch; the warnings belong to out-of-scope #4058. Round 2 on dd6afad:
sonnet, haiku and a 2nd sonnet all PASS. The agy lane returned a 429 error and is not counted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
noahgift and others added 2 commits September 25, 2026 20:09
…asure it — extract worst_normalised

check_complexity_ratchet RED NEW: iq4_nl_device_ab_tests.rs::real_model_iq_ab
cyclomatic 17 cognitive 28 after 71d0b2a reformatted the file. The
normalised-error closure moves to a helper; pmat now reads 9/10 and 9/18.
Behaviour unchanged (same loop, same NaN->inf and zero-denominator rules).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…y ratchet to 445 (#4430)

contract_data_integrity reads falsifier ids in file order; 004 before 003
counted as a gap. tested: 4 now matches the four falsifiers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
noahgift and others added 8 commits September 25, 2026 20:40
…4056)

apr-cli's `wgpu` feature enabled only `inference`, but the finetune wgpu path
uses entrenar items gated behind entrenar's own `gpu` feature. `wgpu` now
enables `entrenar?/gpu` (weak: only when `training` brings entrenar in, which is
exactly when commands::finetune compiles).

Compiling that surface for the first time exposed 10 clippy findings in
aprender-train's gpu code, which no gate had ever linted:
- 3 unnecessary parens, 1 redundant field name, 1 unused var, 1 needless mut
- await_holding_refcell_ref in transformer/wgpu_block: the PipelineCache is
  now moved out of the RefCell for the await and put back before `?`
- dead code (keep-alive GPU buffers, an unread eps, an uncalled
  dispatch_lora_addmm): #[allow(dead_code)] with a reason, like vram_guard

Measured on lambda, base batch/0.70.0@5a70d9195:
  cargo clippy -p apr-cli --lib --features wgpu -- -D warnings   rc=0 (was 5 E0432/E0433/E0425, then 10 lints)
  cargo clippy -p apr-cli --lib -- -D warnings                   rc=0
  cargo test -p aprender-train --lib --features gpu --no-run     rc=0
  cargo fmt --all -- --check                                     rc=0
Not run: the wgpu_block GPU tests (gpu-q queue 6 deep, timed out waiting).

Follow-up for the fold: scripts/check_clippy_feature_matrix.sh (fold/4310-b4)
excludes `wgpu=#4056`; once both land, drop the exclusion and add a wgpu axis.

Refs #4056

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 5f7dd19)
(cherry picked from commit b155a6d)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…f; regenerated from the kernel headers

Fragment 490 wires sprint9_filtering_tests for the first time, and on the
gx10 aarch64 runner three of them failed: `echo` never showed brk. It did
call it. ld.so's first syscall, brk(NULL), printed as
`recvmsg(0x0, 0x0, 0x0) = <heap address>`, because socket..mremap sat two
numbers high (brk 216, not 214). 34 aarch64 rows were wrong, with
sched_yield and getrandom each listed twice. The x86_64 table had setgid..setsid
one high and pkey_mprotect at 302 (prlimit64).

Both tables are now regenerated from asm-generic/unistd.h and
x86_64 asm/unistd_64.h with the same name set, and they compile on every
host. The new abi_numbers tests pin every corrected row against the kernel
numbers. They require strictly ascending numbers and unique names, because
binary_search depends on both. Run against the old tables, all three fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ling gate (stable 1.98.1) is clean

chunks_exact(N) with a constant N becomes as_chunks::<N>(): fixed-size array
chunks, so byte decodes read *b instead of [b[0], b[1], …]. float16_dot takes
its remainders from as_chunks' second half. as_chunks is stable since 1.88;
the declared MSRV is 1.91.

make lint-current: RED (12) -> GREEN. aprender-serve quantize/float16/qwen35
unit tests: 2486/2486 before and after.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…46 + PMAT-4421)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…enerated by make roadmap-aggregate (union, check ok)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ase 0005847; merge delta quorum 3/3 PASS)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@noahgift
noahgift enabled auto-merge September 25, 2026 21:27
noahgift added a commit that referenced this pull request Sep 25, 2026
…car #4429 — 5/5 leak on rc.1, 5/5 clean on 0.70.0

Refs #4344

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit e3bcd6b)
noahgift added a commit that referenced this pull request Sep 25, 2026
…are on no PR (#4083)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@noahgift
noahgift disabled auto-merge September 25, 2026 22:02
noahgift and others added 3 commits September 26, 2026 00:02
…ms; rc_fleet_stage label no longer reads as a bare apr

The car's kernels_generate_gemm_cuda.rs gained three indirect GDN arms (+13
lines above the fused arms), so contracts/kernel-fusion-v1.yaml still cited
371/374/377 and fusion_call_site_guard_3985 failed on workspace-test shard 3.
They are 384/387/390, each a live call of its kernel.

check_apr_bin_pinned.sh read the self-test label 'mutant (apr verify deleted)'
at rc_fleet_stage.sh:302 as an unpinned apr invocation (guard-cargo RED). The
label now says 'asset verify'; rc_fleet_stage --self-test PASS, pin guard OK
(386 files).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@noahgift
noahgift enabled auto-merge September 25, 2026 22:08
… — setsid as PID 1 reaps an orphan and exits 1

#4427 wraps guard steps in `setsid --wait`. In the 4 steps that run it inside
`docker run`, setsid is the container's PID 1: orphaned grandchildren (the
nextest probe's cargo/rustc) reparent to it, its wait() returns one of THEIR
pids instead of bash's, and util-linux errs "setsid: wait: Success", rc 1,
before the guard prints a verdict. guard-cargo failed this way on gx10-build
and yoga-build3 (runs 36182568927 a1/a2); main has no setsid, so it never did.

Measured on gx10, image sha256:0569673d, same script + config as main:
  without --init  3/3 rc=1 'setsid: wait: Success'
  with    --init  3/3 rc=0 'PASS: every key is understood.'
  without setsid  rc=0 PASS
--init makes tini PID 1, so orphans are reaped there, not by setsid.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
noahgift and others added 4 commits September 27, 2026 16:04
…ee m53)

token_usage_report.py derives repo roots from SRC; provable-ladder ELAN_HOME
defaults to $HOME/.elan via GITHUB_ENV; dogfood 0.68.2 evidence uses ~/models.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…achine path

Path-only (operator go via cop 77): vars.APR_QWEN35_MODEL still wins; the
fallback is $HOME/models/… and is exported for the cargo test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- include-fmt: rustfmt the 3 include!d files
- bashrs: suppress 4 findings in ci_guard_steps.sh, each with a reason
- census: restore main's train snapshot (#3569); README frontmatter contract_count = census n_files
- baselines: classify bin_names_pending_fold.txt and bin_renames.txt (#4430)
- pipe-grep-q: 6 new sites become here-strings (66 -> 60)
- tracked-ignored: un-ignore kernel A/B evidence logs (321 -> 320)
- guard-steps self-test: run the no-manifest fixture outside CI mode (it died rc 2 under GITHUB_ACTIONS)
- mutants: car/* of this repo defers to mutants-nightly (operator 2026-09-27, verbatim "exempt the car"); rule 0 in mutants_diff_gate.sh with 7 case rows and 5 mutants

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…in (619 -> 617)

scripts/ci/fat_driver.py::cmd_self_test (C, 252 lines, #4507) is now seven _st_* section
functions; its 56 rows are unchanged (56/56 before and after). scripts/nightly_manifest.py::main
(B-) is now _parser() plus one _cmd_<name> per subcommand behind a COMMANDS table; its
--self-test and check_guards_nightly_manifest.sh --self-test pass. Both arrived through main
merges after the 617 re-baseline (13b0e89). The baseline stays 617 (#4101).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@noahgift
noahgift disabled auto-merge September 27, 2026 14:21
@noahgift
noahgift enabled auto-merge September 27, 2026 14:28
@noahgift noahgift added the owner:aprender-36 owning session (cop inbox claims) label Sep 27, 2026
… on the car (the_tracked_repo_graph_is_fresh)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@noahgift
noahgift disabled auto-merge September 27, 2026 15:24
@noahgift
noahgift enabled auto-merge September 27, 2026 15:26
…us, not the walked tree (guard-cargo#m29)

extract:readme grades README frontmatter contract_count as 'resolves: census'
(== contracts/census.json n_files). readme_sync wrote the walked count there.
census.json is the release train's snapshot (#3569) and lags on any branch that
adds a contract, so the two gates demanded different numbers (1844 vs 1837) and
one of them was always RED. Body CONTRACT_COUNT blocks stay walked
(FALSIFY-README-002); the frontmatter now reads census.json, failing closed if
it is unreadable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@noahgift
noahgift disabled auto-merge September 27, 2026 17:20
@noahgift
noahgift enabled auto-merge September 27, 2026 17:31
@noahgift
noahgift disabled auto-merge September 27, 2026 17:50
noahgift and others added 2 commits September 27, 2026 20:02
…3/3 non-Claude); CI signer stamps patch-id

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
noahgift and others added 3 commits September 27, 2026 20:37
…gner push fires no pull_request_target)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ard schema (unsigned; CI signer re-stamps)

A4 rejected crux_coverage=partial. Local run of main's check_pr_review_receipt.sh then
found two more old-schema fields; all three are now fixed, and it passes (throwaway key):
- crux_coverage partial -> none: the ptx-debug surface has no crux contract; finding
  PRREV-4429-CRUX-PTX-DEBUG-COVERAGE-GAP records that
- duplication_coverage not_run -> none (verdict is BLOCK, not PASS)
- the ptx-debug cited finding gains its excerpt + excerpt_sha256 from
  contracts/apr-dogfood-coverage-v1.yaml:109 at fbf106b (total 4, not 3)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@noahgift

Copy link
Copy Markdown
Member Author

Closed as superseded by #4502, which now carries this release car's full content (merge 5c54a8e of car/0.70.0 into batch/ont-10). The only commits not carried are 55f86db and 0d7e7e4, which are this PR's own receipt evidence and irrelevant once it is closed. Operator ruling (single release PR): one CI, one review, one merge, no duplicate changes across two open PRs. The branch is kept.

@noahgift noahgift closed this Sep 27, 2026
noahgift added a commit that referenced this pull request Sep 27, 2026
OPERATOR ruling via 77: head vs base, not a stored number. Main aca6f2d
has 76 theorem-bearing unrefined modules; this head had 131 (+55, all
entered at cf038d3). infra-83: none of the 55 is named by an ONT-10 row.

Of the 55, 27 hold a contract-bound root (a lean_theorem names one of their
theorems): taking them out of the cone makes `pv discharge check` RED with
ORPHANED-ROOT (measured: 85 roots). They stay, pending the cop. The other 28
bind nothing; their root imports move here to the 0.70.1 branch (a move, not
a copy; the .lean files are on main already). Each had two import lines
(the #4429 merge union), so 56 lines go.

Measured: cone 163 -> 135, theorem-bearing 131 -> 103;
`pv discharge check --no-lake`: ROOTS 249 pinned, 0 ORPHANED-ROOT, ok.

Modules:
  ProvableContracts/Theorems/AdamW/Analytic.lean
  ProvableContracts/Theorems/AprCode/HarnessIrRoundtrip.lean
  ProvableContracts/Theorems/BLAS/Trmm.lean
  ProvableContracts/Theorems/BLAS/Trsm.lean
  ProvableContracts/Theorems/DPO.lean
  ProvableContracts/Theorems/FFT/Bluestein.lean
  ProvableContracts/Theorems/FFT/Fft2d.lean
  ProvableContracts/Theorems/FFT/Fft3d.lean
  ProvableContracts/Theorems/FFT/FftBatched.lean
  ProvableContracts/Theorems/GPU/DimensionIndependence.lean
  ProvableContracts/Theorems/Image/Canny.lean
  ProvableContracts/Theorems/Image/ConnectedComponents.lean
  ProvableContracts/Theorems/Image/Conv2d.lean
  ProvableContracts/Theorems/Image/Histogram.lean
  ProvableContracts/Theorems/Image/HsvRoundtrip.lean
  ProvableContracts/Theorems/Image/Morphology.lean
  ProvableContracts/Theorems/Image/Resize.lean
  ProvableContracts/Theorems/Image/RgbToGray.lean
  ProvableContracts/Theorems/Image/Sobel.lean
  ProvableContracts/Theorems/MatMul/MatVecLinearity.lean
  ProvableContracts/Theorems/Rand/Philox.lean
  ProvableContracts/Theorems/Rand/Threefry.lean
  ProvableContracts/Theorems/Sparse/BsrSpmv.lean
  ProvableContracts/Theorems/Sparse/SellSpmv.lean
  ProvableContracts/Theorems/Sparse/Spgemm.lean
  ProvableContracts/Theorems/Sparse/Spmm.lean
  ProvableContracts/Theorems/Tensor/Einsum.lean
  ProvableContracts/Theorems/Tokenizer.lean

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Sep 28, 2026
…us (1837), per readme_sync #4429

The fold wrote the walked count (1889) into the frontmatter too. extract:readme grades it against
contracts/census.json (the train snapshot, #3569), so lint_passes_on_real_contracts failed once
census.json was restored. Body blocks stay 1889 (FALSIFY-README-002). check_readme_claims: 0 FAIL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
guyernest pushed a commit to guyernest/aprender that referenced this pull request Sep 29, 2026
…aiml#4468)

* ci: yoga's CUDA jobs run test binaries under the one host GPU lock

yoga's GPU is shared by CI and by agents, and nothing serialised them: an
agent test holding the GPU with no lock hung paiml#4429's cuda-unit. Operator
ruling 2026-09-26: the GPU is exclusive for CI jobs, via one host lock that
every GPU user takes.

- cuda-unit (ci/sections.yml, the ephemeral docker runner) and cuda-nightly
  ada-yoga (the host runner) set CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER
  to `flock -E 175 -w 600 /run/lock/fleet-gpu/gpu.lock`. cargo runs each TEST
  BINARY under it, so compiling holds no lock; 175 = not free after 10 min.
- Each job first asserts the lock is the HOST's. flock creates a missing
  file, so without the bind mount it would take a private lock that
  serialises nothing: cuda-unit asks for the mountpoint, ada-yoga for a
  root-owned file.

The host side (tmpfiles lock, read-only bind mount into the job container,
the agents' cargo wrapper and a watcher that ANDONs on an unlocked GPU pid)
is paiml/infra#1178, applied through forjar.

Refs paiml/infra#1178

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* PMAT-4469: ticket for the yoga CUDA GPU-lock change

Refs paiml#4469. Host side: paiml/infra#1182.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* PMAT-4469: quorum receipt — 3/3 PASS on 69c8bad

Tool round (quorum-review.sh, lint ok, agreed): gemini-3.1-pro-high PASS +
claude-haiku-4-5 PASS. Third lane: a separate claude-sonnet-5 conversation, PASS.

Refs paiml#4469
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
noahgift added a commit that referenced this pull request Sep 29, 2026
…p move to PR-2b

Cop ruling 19:35Z (split). Gate-graph walk from rc.1 (rc-cut.yml: ci/gate +
workspace-test; gate.needs closure) and FINAL (paiml-ontology @60179ae2:714,
ONT-10 depends_on): neither row is needed, directly or transitively.

- x86-main: runs-on back to main's [self-hosted, Linux, X64, clean-room].
  The gate needs the job, not the runner label.
- #3668: the `changes` job, guard-cargo's needs/if, the gate's
  GATE-DOCS-ONLY-RULE, ci_docs_only.sh, check_ci_gate_docs_only_rule.sh,
  fat_driver's outputs pass-through and the PMAT-3668 roadmap entry are
  removed. The three guard steps return to guard-cargo. The gate again reads
  guard-cargo and determinism-compare strictly, as main does, so no gate is
  loosened versus main.

Receipts: fat_driver self-test 59/59; check_ci_gate_mutants_rule,
check_guards_are_wired, check_ci_fat_secrets_plumbed,
check_ci_gate_mutants_table_rule rc 0; actionlint 2 findings = HEAD's 2;
make roadmap-aggregate-check ok.

Pmat-Ticket: PMAT-4502
Agent: aprender-07

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

owner:aprender-36 owning session (cop inbox claims)

Projects

None yet

2 participants