release(0.70.0): sealed car — REPLACES #4372

.claude/skills/pr-review/SKILL.md

@@ -22,7 +22,7 @@ difference is a defect in this file.
 **Contract**: `contracts/pr-review-skill-v2.yaml` (§1 grounding, §7 blocking, §8 metrics)
 **Guard**: `scripts/check_pr_review_receipt.sh` — it validates what you emit here, it has
 its own positive controls, and its mutation set (`scripts/mutate-guard.sh`) reports
-233/233. **Run it on your own receipt before you post anything.**
+237/237. **Run it on your own receipt before you post anything.**
 
 ## Context
 
@@ -438,7 +438,7 @@ Bash guards are exercised with `bats-core` fixtures. For the receipt guard itsel
 mutation set already exists and is a derivation, not a list:
 
 ```bash
-bash scripts/mutate-guard.sh          # 233/233 on scripts/check_pr_review_receipt.sh
+bash scripts/mutate-guard.sh          # 237/237 on scripts/check_pr_review_receipt.sh
 ```
 
 **`attempted: 0` with `status: consulted` is rejected** (fixture row 2). A mutation set
@@ -1192,7 +1192,7 @@ the real merged commits, not from the spec's reasoning about them.
 ## §13 Autonomous merge on quorum (DESIGNED AND BUILT, **NOT ARMED**)
 
 Spec §13. Operator instruction, 2026-08-31: PRs auto-merge once the review quorum passes.
-The mechanism exists — `scripts/pr_review_quorum_arm.sh`, a table of 83 rows, a 134-mutant
+The mechanism exists — `scripts/pr_review_quorum_arm.sh`, a table of 90 rows, a 134-mutant
 set at 100% — and **it is reachable from no workflow that can merge anything.** §13.11 is
 the arming ladder; rung 0 is where this file is written.
 
@@ -1345,7 +1345,7 @@ That is the first falsifiable property of the section, and `q-44` plus the
 ### §13.9 Verifying the mechanism
 
 ```bash
-bats tests/pr-review-quorum.bats            # 83 rows: one per refusal path, four that PERMIT
+bats tests/pr-review-quorum.bats            # 90 rows: one per refusal path, four that PERMIT
 bash scripts/mutate_quorum_arm.sh           # 134/134 — §13.10 fixes this at one, no ratchet
 bash scripts/mutate_quorum_arm.sh --list    # the catalogue, no mutants run
 ```

.claude/skills/pre-release/SKILL.md

@@ -326,6 +326,11 @@ regression this repo has on record, and its power *falls* as data accumulates
 Richer fields (surface counts, findings, notable, verdict) are encouraged — the receipts
 already under `evidence/dogfood/` are the worked examples.
 
+**The tracked implementation of this step** is `scripts/release/host_receipt.sh`, which
+`scripts/release/autopilot.sh` ships to each host after publish (#3731). Never hand-roll
+the sweep; `scripts/check_dogfood_shim.sh` row 1b allows those two scripts only while
+this paragraph names them.
+
 **The sweep must `cargo install` the PUBLISHED crate**, not build the local tree.
 Building the tree tests what you have; installing tests what a user gets. On a box with a
 pre-existing `apr` the install correctly fails closed (rc=101) *before* compiling — use

.githooks/pre-push

@@ -19,4 +19,14 @@ cargo doc --no-deps -q 2>/dev/null || echo "WARN: cargo doc failed"
 echo "── ComputeBrick Compliance ──"
 pmat comply check --failures-only 2>/dev/null || true
 
+echo "── #4415/#4416: CI guard steps (scripts/ci_guards.sh, the script CI runs) ──"
+# The drift check is a YAML parse, so it always runs. The full guard run takes
+# many minutes; opt in with APR_PREPUSH_GUARDS=1 (or run `make guards-local`).
+rc=0; bash scripts/ci_guards.sh --check-coverage || rc=$?
+[ "$rc" -eq 1 ] && exit 1
+[ "$rc" -eq 0 ] || echo "WARN: guard drift check could not run (rc=$rc)"
+if [ "${APR_PREPUSH_GUARDS:-0}" = 1 ]; then
+    bash scripts/ci_guards.sh || exit 1
+fi
+
 echo "✅ Pre-push passed"

.github/actionlint.yaml

@@ -24,3 +24,5 @@ self-hosted-runner:
     - apple-silicon
     - m4
     - mini
+    # #4292 / infra#1042: the mini's dedicated repo-level release runner
+    - mini-builder

.github/workflows/book-contracts.yml

@@ -39,6 +39,15 @@ on:
   schedule:
     - cron: '45 22 * * *'
 
+
+# #3676: no concurrency group meant every superseded PR push ran the ~18 min
+# chapter suite to completion. Sampled 24 h to 2026-09-24 19:15Z: ~1650 of ~3700
+# wall-minutes of this workflow's pull_request runs came after a newer push
+# to the same PR had already started. Same shape as ci.yml: one group per PR, a
+# new push cancels the old run, and push/schedule runs are never cancelled.
+concurrency:
+  group: book-contracts-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 permissions:
   contents: read
 

.github/workflows/book.yml

@@ -60,9 +60,14 @@ permissions:
   pages: write
   id-token: write
 
+# #3676: one group per PR, and a newer push cancels the superseded run. The old
+# workflow-level group "pages" (cancel false) held EVERY run -- all PRs, main and
+# the nightly -- in one global queue, so each PR's mdBook check waited behind
+# every other PR's. Only the Pages deploy needs that serialisation, so the
+# "pages" group now sits on the deploy job alone. Non-PR events never cancel.
 concurrency:
-  group: "pages"
-  cancel-in-progress: false
+  group: book-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   build:
@@ -203,6 +208,10 @@ jobs:
     runs-on: [self-hosted, Linux, X64, clean-room]
     needs: build
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    # GitHub Pages deploys never overlap and are never cancelled (was workflow-level).
+    concurrency:
+      group: "pages"
+      cancel-in-progress: false
     permissions:
       pages: write
       id-token: write

.github/workflows/ci.yml

@@ -73,8 +73,8 @@ jobs:
   # with the same rule the old job of that name applied.
   # ==========================================================================
   x86-main:
-    # Any free X64 runner in the pool takes it: intel, framework16 or yoga.
-    runs-on: [self-hosted, Linux, X64, clean-room]
+    # Car #4429 keeps its pre-merge runner pin (cop 2026-09-26: no runner-host change mid-release).
+    runs-on: [self-hosted, Linux, X64, clean-room, intel]
     timeout-minutes: 240
     # The sections carry their own permissions blocks (the sov provenance section
     # needs id-token + attestations); one job token must cover all of them.
@@ -85,13 +85,32 @@ jobs:
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       FAT_VARS_JSON: ${{ toJSON(vars) }}
-      FAT_SECRET_PR_REVIEW_SIGNING_KEY_B: ${{ secrets.PR_REVIEW_SIGNING_KEY_B }}
+      FAT_SECRET_PR_REVIEW_SIGNING_KEY_B64: ${{ secrets.PR_REVIEW_SIGNING_KEY_B64 }}
     steps:
       # Full history: a section whose own checkout asked for depth 1 (the default)
       # is cut back to exactly that by the driver; one asking for 0 needs it all.
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+      # Fail fast: the reds car#4429 took four fat runs to see, in ~2 min, before
+      # any section starts. rustfmt runs in the image sov.lint uses (same digest,
+      # so the same verdict); the ID-order rule is contract_data_integrity's,
+      # without cargo; the case tables are guard-tree's cheapest.
+      - name: Cheap checks (fmt, falsification-ID order, guard case tables)
+        run: |
+          set -euo pipefail
+          python3 scripts/ci/fail_fast.py self-test
+          python3 scripts/ci/fail_fast.py ids --base origin/main
+          docker run --rm -v "$GITHUB_WORKSPACE:/w:ro" -w /w \
+            localhost:5000/sovereign-ci:stable@sha256:70f2cdc9e537fe4447306d33c317fea33017f78f1ffa3b7af99095391419ef36 \
+            cargo fmt --all -- --check
+          bash scripts/tests/guard_tree_test.sh
+          bash scripts/bump-version.sh --self-test
+          setsid --wait bash scripts/check_no_claim_literals.sh --selftest
+          setsid --wait bash scripts/check_hardcoded_paths.sh --self-test
+          setsid --wait bash scripts/check_pr_review_wiring.sh --self-test
+          setsid --wait bash scripts/check_ci_gate_mutants_rule.sh --self-test
+          setsid --wait bash scripts/check_ci_gate_docs_only_rule.sh --self-test
       # The driver decides what every section's if:/matrix/needs means and whether
       # the vendored workflow is the upstream one; its case table must go RED on
       # each planted defect before it is trusted to report a section green.
@@ -100,7 +119,7 @@ jobs:
       - name: Sections (the determinism raster returns first; the rest keep running)
         run: >-
           python3 scripts/ci/fat_driver.py run
-          --sections 'sov.*,guard-tree,guard-cargo,vendored-schemas,pr-review-shadow,pr-review-sign,mutants,determinism[X64]'
+          --sections 'sov.*,changes,guard-tree,guard-cargo,vendored-schemas,pr-review-shadow,pr-review-sign,mutants,determinism[X64],provable-ladder'
           --external-job workspace-test
           --results "$RUNNER_TEMP/fat/results.json"
           --background-until 'determinism[X64]'
@@ -436,14 +455,38 @@ jobs:
           # cuda-unit were never in the gate; they still are not.
           # workspace-test is its own job now (three shard jobs + the Σ fan-in).
           [ "$WT" = success ] || { echo "workspace-test failed: $WT"; exit 1; }
-          for pair in X86:guard-tree X86:guard-cargo X86:sov.gate DET:determinism-compare; do
+          # guard-cargo and determinism-compare are read below under the docs-only rule (#3668).
+          for pair in X86:guard-tree X86:sov.gate; do
             job="${pair%%:*}" sec="${pair#*:}"
             r=$(res "${!job}" "$sec")
             if [ "$r" != success ]; then
               echo "$sec failed: $r"
               exit 1
             fi
           done
+          # guard-cargo is the cargo half of the same guard universe (BSE-01), and
+          # determinism-compare is APEX-001 EV-2a's two-architecture comparison. A
+          # required check that `gate` does not read is not a required check, so both
+          # are read here -- and each may be `skipped` ONLY on a docs-only PR (#3668).
+          DOCS=$(printf '%s' "${X86:-null}" | jq -r '(. // {}).changes.outputs.docs_only // ""')
+          CHG=$(res "$X86" changes)
+          GC=$(res "$X86" guard-cargo)
+          DC=$(res "$DET" determinism-compare)
+          # --- GATE-DOCS-ONLY-RULE-BEGIN (#3668; scripts/check_ci_gate_docs_only_rule.sh runs this block) ---
+          # A skip is the docs-only skip only when the `changes` section SUCCEEDED and
+          # said docs_only=true. Any other skip -- changes skipped, failed, missing or
+          # said false -- means a section that should have run did not: a failure.
+          skip_ok=0
+          if [ "$CHG" = success ] && [ "$DOCS" = true ]; then skip_ok=1; fi
+          for pair in "guard-cargo=$GC" "determinism-compare=$DC"; do
+            job=${pair%%=*}; res=${pair#*=}
+            case "$res:$skip_ok" in
+              success:*) echo "$job: success" ;;
+              skipped:1) echo "$job: skipped -- docs-only PR (changes: docs_only=true, #3668)" ;;
+              *) echo "$job failed: $res (changes=$CHG docs_only='$DOCS'; a skip passes only on a docs-only PR)"; exit 1 ;;
+            esac
+          done
+          # --- GATE-DOCS-ONLY-RULE-END ---
           MUT=$(res "$X86" mutants)
           # --- GATE-MUTANTS-RULE-BEGIN (#3676; scripts/check_ci_gate_mutants_rule.sh runs this block) ---
           # `skipped` is a pass ONLY when the skip is the job's own filter:

.github/workflows/cuda-nightly.yml

@@ -327,6 +327,43 @@ jobs:
           nice -n 19 cargo test -p aprender-serve --lib --release cb008_checker_controls
           APR_FALSIFY_MODEL="$model" nice -n 19 cargo test -p aprender-serve --features cuda \
             --release --test falsify_cb008_no_frozen_slots_2753 -- --nocapture
+
+      # aprender#4251: #4250's serve batched-prefill test. ci.yml's cuda-only step selects it, but
+      # there a missing Qwen3.5 file is a legitimate skip, and the runners do not carry one. So it
+      # passed without running. Here the model is resolved first, and a `SKIP:` line or a
+      # run that is not exactly `1 passed` is RED. `!cancelled()` so an earlier red falsifier
+      # cannot hide this one.
+      - name: aprender#4251 - every serve route prefills through the batched prefill (Qwen3.5)
+        if: ${{ !cancelled() && steps.decide.outputs.proceed == 'true' }}
+        env:
+          APR_QWEN35_MODEL_VAR: ${{ vars.APR_QWEN35_MODEL }}
+        run: |
+          set -euo pipefail
+          export APR_QWEN35_MODEL="${APR_QWEN35_MODEL_VAR:-$HOME/models/Qwen3.5-0.8B-Q4_K_M.gguf}"
+          if [ ! -f "$APR_QWEN35_MODEL" ]; then
+            echo "::error::#4251 UNMEASURABLE on ${{ matrix.name }} (provisioning, not a code defect): $APR_QWEN35_MODEL is absent"
+            exit 1
+          fi
+          echo "#4251 model: $APR_QWEN35_MODEL"
+          log="$RUNNER_TEMP/serve-batched-prefill.log"
+          rc=0
+          nice -n 19 cargo test -p aprender-serve --features cuda --lib --release \
+            api::openai_handlers::qwen35_serve_tests::gpu_every_serve_route_prefills_through_the_batched_prefill \
+            -- --exact --nocapture \
+            >"$log" 2>&1 || rc=$?
+          cat "$log"
+          if [ "$rc" -ne 0 ]; then
+            echo "::error::#4251 serve batched-prefill test FAILED (exit $rc)"
+            exit "$rc"
+          fi
+          if grep -q '^SKIP:' "$log"; then
+            echo "::error::#4251 the test SKIPPED on a CUDA runner with the model named: $(grep -m1 '^SKIP:' "$log")"
+            exit 1
+          fi
+          if ! grep -q 'test result: ok\. 1 passed' "$log"; then
+            echo "::error::#4251 the filter did not run exactly one test"
+            exit 1
+          fi
       # PP-26 / L0 CORRECTNESS: the batch-invariance witness (FALSIFY-CB-006,
       # #2753, §9 #1a on Blackwell). PP-LLAMA-001 §7.0 puts correctness at layer
       # L0 and says perf041 runs "nightly + release, missing marker = RED"; the

.github/workflows/install-script.yml

@@ -37,6 +37,12 @@ on:
   schedule:
     - cron: '0 23 * * *'
 
+
+# #3676: a newer push to the same PR cancels the superseded run
+# (scripts/check_pr_workflows_cancel_superseded.sh).
+concurrency:
+  group: install-script-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 permissions:
   contents: read
 

.github/workflows/nightly.yml

@@ -29,9 +29,9 @@
 # job runs on the fleet. x86_64 builds on yoga and aarch64 natively on gx10, both
 # inside rust:1.93.0-bullseye (binary-release.yml's CPU-lane pattern), so the
 # nightly's glibc floor is 2.31; the ubuntu-latest build needed GLIBC_2.39 and did
-# not run on lambda's 22.04. The macOS and Windows targets are gone: no self-hosted
-# macOS or Windows runner is registered in the org, and there is no hosted
-# fallback. They come back when a box for them does.
+# not run on lambda's 22.04. Windows is gone: no self-hosted Windows runner is
+# registered and there is no hosted fallback. macOS came back with a box for it
+# (#3204): aarch64-apple-darwin builds host-native on mini-m4 (build-darwin).
 
 name: Nightly
 
@@ -162,7 +162,7 @@ jobs:
           # The driver is dlopen'd at run time (aprender-gpu: dep:libloading), so
           # the bullseye image needs no toolkit -- binary-release.yml's cuda lane.
           # Record proves the feature took (libcuda.so in the executable).
-          APR_SHA=$(git rev-parse --short HEAD)
+          APR_SHA=$(git rev-parse --short=9 HEAD)
           mkdir -p "$CACHE/target-cuda"
           $DOCKER run --rm \
             -v "$GITHUB_WORKSPACE:/workspace" \
@@ -214,6 +214,60 @@ jobs:
           path: dist/*
           if-no-files-found: warn
 
+  # ── Build apr: macOS aarch64 natively on mini-m4 (#3204) ──
+  # Host-native: there is no docker on macOS and no glibc floor to pin, so the
+  # toolchain is rust-toolchain.toml via the runner's rustup, as in ci.yml's
+  # mac-check. A LITERAL runs-on list, not fromJSON, so check_runner_labels.sh
+  # sees the apple-silicon label. Gated on the same `gate` decision as the Linux
+  # matrix (car's `check-activity` job does not exist on this branch -- folded
+  # into `gate`'s reused/build/red-ci/ci-pending verdict, #4189). One box with
+  # 16 GB: this leg must not hold the Linux nightly hostage -- `publish-darwin`
+  # below only uploads when this job is green, and the darwin tarball is
+  # simply absent that night otherwise; it never blocks or is blocked by
+  # `publish` (that job's per-arch manifest tracks Linux targets only).
+  build-darwin:
+    needs: gate
+    if: needs.gate.outputs.decision == 'build'
+    name: apr aarch64-apple-darwin on mini
+    runs-on: [self-hosted, macOS, ARM64, apple-silicon, m4, mini]
+    timeout-minutes: 90
+    env:
+      CARGO_INCREMENTAL: 0
+      CARGO_TERM_COLOR: never
+      T: aarch64-apple-darwin
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Build apr (host-native, pinned toolchain)
+        run: |
+          set -euo pipefail
+          rustup show active-toolchain
+          cargo build --release --locked -p apr-cli --target "$T"
+          "target/$T/release/apr" --version
+
+      - name: Package
+        run: |
+          set -euo pipefail
+          ARCHIVE="apr-$T"
+          rm -rf "$ARCHIVE" "$ARCHIVE.tar.gz" "$ARCHIVE.tar.gz.sha256"
+          mkdir -p "$ARCHIVE"
+          cp "target/$T/release/apr" "$ARCHIVE/"
+          for f in README.md LICENSE LICENSE-MIT COPYING UNLICENSE; do
+            if [ -f "$f" ]; then cp "$f" "$ARCHIVE/"; fi
+          done
+          tar czf "${ARCHIVE}.tar.gz" "$ARCHIVE"
+          shasum -a 256 "${ARCHIVE}.tar.gz" > "${ARCHIVE}.tar.gz.sha256"
+          echo "Packaged: ${ARCHIVE}.tar.gz ($(du -h "${ARCHIVE}.tar.gz" | cut -f1))"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: apr-aarch64-apple-darwin
+          path: |
+            apr-aarch64-apple-darwin.tar.gz
+            apr-aarch64-apple-darwin.tar.gz.sha256
+
   # ── Publish per arch, then the manifest ──────────────────
   publish:
     needs: [gate, build]
@@ -262,3 +316,31 @@ jobs:
             ci-pending) echo "::warning::required checks not finished on ${GITHUB_SHA:0:9}; last green kept"; exit 0 ;;
             *) echo "::error::nightly $DECISION at ${GITHUB_SHA:0:9}; see nightly-manifest.json"; exit 1 ;;
           esac
+
+  # ── Attach the darwin asset to the nightly release ────────
+  # `publish`'s manifest system (scripts/nightly_manifest.py) tracks the Linux
+  # targets only; it neither knows about nor deletes unlisted assets, so this
+  # upload is additive and independent -- a red/skipped darwin leg leaves the
+  # Linux assets alone, and a red Linux leg (this job needs `publish` only so
+  # the "nightly" release already exists) does not block the mac asset.
+  publish-darwin:
+    needs: [gate, build-darwin, publish]
+    if: always() && needs.gate.outputs.decision == 'build' && needs.build-darwin.result == 'success'
+    runs-on: [self-hosted, Linux, X64, clean-room]
+    steps:
+      - name: Download darwin artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: apr-aarch64-apple-darwin
+          path: dist-darwin
+
+      - name: Upload to the nightly release
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: nightly
+          name: Nightly Build
+          prerelease: true
+          make_latest: false
+          files: |
+            dist-darwin/apr-aarch64-apple-darwin.tar.gz
+            dist-darwin/apr-aarch64-apple-darwin.tar.gz.sha256