PRM-L: land PRM-001 v3 (PROMETHEUS) + rex/001 rows to main (Refs #4354)

Cargo.toml

@@ -79,6 +79,8 @@ members = [
     "crates/aprender-zram-adaptive",
     "crates/aprender-zram-cli",
     "crates/aprender-zram-generator",
+    # --- REX-001 (#4354): review-lane experiment harness + frozen analysis ---
+    "crates/aprender-review-experiment",
     # --- APR-MONO Phase 3b: presentar sub-crates (enabled) ---
     "crates/aprender-present-core",
     "crates/aprender-present-terminal",

Makefile

@@ -1417,3 +1417,18 @@ oracle:
 oracle-check: oracle
 	@git diff --exit-code tests/oracle/differential.json \
 	  || { echo "FAIL: tests/oracle/differential.json differs from a fresh run — commit it"; exit 1; }
+
+# PRA-001 §1 G14 (T0): read-only, one row per fleet host; UNREACHABLE fails the target.
+transcript-retention-audit:
+	@bash scripts/transcript_retention_audit.sh
+.PHONY: transcript-retention-audit
+
+# PRM-C13 (was PRA T13), lane-independence-v1: κ_err scoreboard of the shadow lane vs every
+# counted lane on matured gold SPLIT rows. With MANIFEST and CANDIDATE it gates (exit 12 = S-14).
+SPLIT ?= val
+MIN_N ?= 30
+lane-kappa:
+	@test -n "$(ROWS)" || { echo "usage: make lane-kappa ROWS=trace.jsonl [SPLIT=val] [MIN_N=30 | MANIFEST=m.json CANDIDATE=c.jsonl]"; exit 2; }
+	cargo run -q -p aprender-review-experiment --example rex -- lane-kappa "$(ROWS)" --split "$(SPLIT)" \
+	  $(if $(MANIFEST),--manifest "$(MANIFEST)" --candidate "$(CANDIDATE)",--min-n "$(MIN_N)")
+.PHONY: lane-kappa

README.md

@@ -40,8 +40,8 @@ publishing — all backed by YAML provable contracts that fail CI on drift.
 
 | Metric | Count | Source of truth |
 |-------:|------:|---|
-| Workspace crates | **79** workspace crates | `cargo metadata --no-deps` (NOT `ls crates/` — 4 are `exclude`d, 1 has no Cargo.toml) |
-| Provable contracts | **<!-- CONTRACT_COUNT_START -->1837<!-- CONTRACT_COUNT_END -->** provable contracts | `contracts/census.json` `.n_files` — the set `pv lint` walks (`pv census`, ONT-001 ONT-1; regenerated by `make contracts`, written by `make readme-sync`, guarded by `scripts/check_readme_claims.sh`) |
+| Workspace crates | **81** workspace crates | `cargo metadata --no-deps` (NOT `ls crates/` — 4 are `exclude`d, 1 has no Cargo.toml) |
+| Provable contracts | **<!-- CONTRACT_COUNT_START -->1858<!-- CONTRACT_COUNT_END -->** provable contracts | `contracts/census.json` `.n_files` — the set `pv lint` walks (`pv census`, ONT-001 ONT-1; regenerated by `make contracts`, written by `make readme-sync`, guarded by `scripts/check_readme_claims.sh`) |
 | CLI commands | **111** CLI commands | `contracts/apr-cli-commands-v1.yaml` §`commands` (parse the list; `apr --help` prints 112 because it lists `help` itself, and `grep -c '^  - name:'` gives 117 — other same-indent `name:` keys exist in the file) |
 | Book CLI chapters | **113** chapters | `ls book/src/cli/*.md` |
 | Book lib chapters | **72** chapters | `ls book/src/lib/*.md` (parity with `pub mod`) |
@@ -321,7 +321,7 @@ falsification_tests:
   prediction: apr validate bad-model.apr exits non-zero
 ```
 
-The tree carries <!-- CONTRACT_COUNT_START -->1837<!-- CONTRACT_COUNT_END --> contracts across inference, training, quantization, attention, FFN,
+The tree carries <!-- CONTRACT_COUNT_START -->1858<!-- CONTRACT_COUNT_END --> contracts across inference, training, quantization, attention, FFN,
 tokenization, model formats, CLI safety — and this README itself.
 
 ## Migration from old crates

contracts/agent-trace-terms-v1.yaml

@@ -0,0 +1,48 @@
+metadata:
+  version: 1.0.0
+  kind: schema
+  description: |
+    Provider-terms tagging for agent-trace-v1 rows (PRA-001 T12, spec §2.10, §9 P-TERMS;
+    agent-trace ruling 2026-09-25 items 1 and 7). Every row carries provider
+    {anthropic, google, local}, an exact model_id (never a family alias; a local model is
+    its weights sha256), access_channel {anthropic-api, claude-code-cli, antigravity,
+    gemini-api, vertex, apr-serve} consistent with the provider, and terms_ref {https url,
+    YYYY-MM-DD effective_date, RFC 3339 UTC fetched_at}. Any pool can be rebuilt without
+    a provider or channel through the first-class --exclude-provider / --exclude-channel
+    arguments. A row with a missing or inconsistent tag is REFUSED by every rebuild, since
+    an untagged row cannot be shown not to come from an excluded source. The public-release
+    default keeps local rows only (§2.11). This records the governing terms. It is not
+    legal advice; S-6 governs. Implementation: crates/aprender-review-experiment/src/terms.rs.
+  references:
+    - "docs/specifications/research-design-pr-agent-qwen-3.5.md"
+    - "contracts/training-pool-admission-v1.yaml"
+
+equations:
+  rebuild:
+    formula: "kept(R, X) = { r in R : gaps(r) = {} and provider(r) not in X.providers and channel(r) not in X.channels }"
+
+falsification_tests:
+  - id: FALSIFY-TERMS-001
+    name: pool_rebuild_excluding_a_provider
+    prediction: "P-TERMS: a rebuild of a six-channel batch with --exclude-provider google succeeds, keeps 0 google rows, and passes the rest through byte-identical"
+    test_harness: "cargo test -p aprender-review-experiment --lib falsify_terms_001"
+    expected_output: "exit 0"
+    if_fails: "A pool cannot be rebuilt without a provider, so provider terms cannot be honoured later."
+  - id: FALSIFY-TERMS-002
+    name: channel_exclusion_is_narrower_than_provider
+    prediction: "--exclude-channel antigravity drops only antigravity rows; gemini-api and vertex rows of the same provider stay"
+    test_harness: "cargo test -p aprender-review-experiment --lib falsify_terms_002"
+    expected_output: "exit 0"
+    if_fails: "Terms that differ by channel (App. A.7) cannot be applied separately."
+  - id: FALSIFY-TERMS-003
+    name: identity_case_table
+    prediction: "rows with a family alias, unknown or empty model_id, unknown provider or channel, a channel of another provider, a non-sha local model, or a missing/non-https/ill-dated terms_ref all have gaps; well-formed rows do not"
+    test_harness: "cargo test -p aprender-review-experiment --lib falsify_terms_003"
+    expected_output: "exit 0"
+    if_fails: "A row with unknown or aliased identity (G-ID) is accepted as tagged."
+  - id: FALSIFY-TERMS-004
+    name: untagged_row_is_refused_never_kept
+    prediction: "a row with gaps, or a non-JSON line, is refused by every rebuild, including one that excludes nothing, and is never in kept"
+    test_harness: "cargo test -p aprender-review-experiment --lib falsify_terms_004"
+    expected_output: "exit 0"
+    if_fails: "An untagged row slips past an exclusion filter it cannot be checked against."

contracts/census.json

@@ -1,8 +1,8 @@
 {
   "schema": "ont.paiml.dev/census/v1alpha1",
   "git_sha": null,
-  "n_files": 1837,
-  "n_parsed": 1837,
+  "n_files": 1858,
+  "n_parsed": 1858,
   "n_parse_errors": 0,
   "parse_errors": [],
   "quarantined_n": 0,
@@ -15,7 +15,7 @@
     "pattern": 95,
     "pretraining-corpus": 2,
     "registry": 521,
-    "schema": 768,
+    "schema": 789,
     "tokenizer": 1,
     "training-loop": 8,
     "training-precondition-gate": 1
@@ -26,12 +26,25 @@
     "pv-contract": 2,
     "release-evidence": 1
   },
+  "by_concept": {
+    "Code": 0,
+    "Contract": 1793,
+    "Dataset": 0,
+    "Doc": 0,
+    "Entity": 0,
+    "Kernel": 836,
+    "Model": 0,
+    "Proof": 0,
+    "Statement": 408,
+    "Symbol": 168,
+    "Test": 0
+  },
   "by_anchoring": {
-    "unanchored": 1829,
+    "unanchored": 1850,
     "class": 5,
     "instance": 3
   },
-  "id_set_sha256": "2055792eb2f6a0f696509d418e57868758e669988ea6e167867b02ec9983f1d7",
+  "id_set_sha256": "7298cd3a70dd7bbfa65a539da2e408c456a69bac8e87e41b4dfeede58bb57eb0",
   "declared_external": [
     {
       "name": "provable-contracts",

contracts/contracts.nt

@@ -8999,6 +8999,31 @@
 <https://ont.paiml.dev/v1alpha1/contract/retrieval-quality-v1> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://ont.paiml.dev/v1alpha1/Contract> .
 <https://ont.paiml.dev/v1alpha1/contract/retrieval-quality-v1> <https://ont.paiml.dev/v1alpha1/file> "contracts/trueno-rag/retrieval-quality-v1.yaml"^^<http://www.w3.org/2001/XMLSchema#string> .
 <https://ont.paiml.dev/v1alpha1/contract/retrieval-quality-v1> <https://ont.paiml.dev/v1alpha1/id> "retrieval-quality-v1"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/review-corpus-contamination-v1> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <http://www.w3.org/ns/prov#Entity> .
+<https://ont.paiml.dev/v1alpha1/contract/review-corpus-contamination-v1> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://ont.paiml.dev/v1alpha1/Contract> .
+<https://ont.paiml.dev/v1alpha1/contract/review-corpus-contamination-v1> <https://ont.paiml.dev/v1alpha1/file> "contracts/review-corpus-contamination-v1.yaml"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/review-corpus-contamination-v1> <https://ont.paiml.dev/v1alpha1/id> "review-corpus-contamination-v1"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/review-corpus-contamination-v1> <https://ont.paiml.dev/v1alpha1/kind> "schema"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/review-corpus-v1> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <http://www.w3.org/ns/prov#Entity> .
+<https://ont.paiml.dev/v1alpha1/contract/review-corpus-v1> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://ont.paiml.dev/v1alpha1/Contract> .
+<https://ont.paiml.dev/v1alpha1/contract/review-corpus-v1> <https://ont.paiml.dev/v1alpha1/file> "contracts/review-corpus-v1.yaml"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/review-corpus-v1> <https://ont.paiml.dev/v1alpha1/id> "review-corpus-v1"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/review-corpus-v1> <https://ont.paiml.dev/v1alpha1/kind> "schema"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/review-experiment-receipt-v1> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <http://www.w3.org/ns/prov#Entity> .
+<https://ont.paiml.dev/v1alpha1/contract/review-experiment-receipt-v1> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://ont.paiml.dev/v1alpha1/Contract> .
+<https://ont.paiml.dev/v1alpha1/contract/review-experiment-receipt-v1> <https://ont.paiml.dev/v1alpha1/file> "contracts/review-experiment-receipt-v1.yaml"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/review-experiment-receipt-v1> <https://ont.paiml.dev/v1alpha1/id> "review-experiment-receipt-v1"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/review-experiment-receipt-v1> <https://ont.paiml.dev/v1alpha1/kind> "schema"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/rex-cell-admission-v1> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <http://www.w3.org/ns/prov#Entity> .
+<https://ont.paiml.dev/v1alpha1/contract/rex-cell-admission-v1> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://ont.paiml.dev/v1alpha1/Contract> .
+<https://ont.paiml.dev/v1alpha1/contract/rex-cell-admission-v1> <https://ont.paiml.dev/v1alpha1/file> "contracts/rex-cell-admission-v1.yaml"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/rex-cell-admission-v1> <https://ont.paiml.dev/v1alpha1/id> "rex-cell-admission-v1"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/rex-cell-admission-v1> <https://ont.paiml.dev/v1alpha1/kind> "schema"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/rex-prereg-v1> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <http://www.w3.org/ns/prov#Entity> .
+<https://ont.paiml.dev/v1alpha1/contract/rex-prereg-v1> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://ont.paiml.dev/v1alpha1/Contract> .
+<https://ont.paiml.dev/v1alpha1/contract/rex-prereg-v1> <https://ont.paiml.dev/v1alpha1/file> "contracts/rex-prereg-v1.yaml"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/rex-prereg-v1> <https://ont.paiml.dev/v1alpha1/id> "rex-prereg-v1"^^<http://www.w3.org/2001/XMLSchema#string> .
+<https://ont.paiml.dev/v1alpha1/contract/rex-prereg-v1> <https://ont.paiml.dev/v1alpha1/kind> "schema"^^<http://www.w3.org/2001/XMLSchema#string> .
 <https://ont.paiml.dev/v1alpha1/contract/rmsnorm-kernel-v1> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <http://www.w3.org/ns/prov#Entity> .
 <https://ont.paiml.dev/v1alpha1/contract/rmsnorm-kernel-v1> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://ont.paiml.dev/v1alpha1/Contract> .
 <https://ont.paiml.dev/v1alpha1/contract/rmsnorm-kernel-v1> <https://ont.paiml.dev/v1alpha1/file> "contracts/rmsnorm-kernel-v1.yaml"^^<http://www.w3.org/2001/XMLSchema#string> .

contracts/lane-independence-v1.yaml

@@ -0,0 +1,53 @@
+metadata:
+  version: 2.0.0
+  kind: schema
+  description: |
+    PRM-C13 (was PRA-001 T13) (PRM-001 v3 "PROMETHEUS" H7 §3, S-14; row 2 of §7, was research-design-pr-agent-qwen-3.5 §5 M4).
+    `make lane-kappa SPLIT=val ROWS=F [MANIFEST=M CANDIDATE=F2]` = `rex lane-kappa ROWS --split val (--min-n N | --manifest M --candidate ROWS2)` (crates/aprender-review-experiment: kappa_probe.rs, examples/rex.rs)
+    measures κ_err, Cohen's κ on binary per-item error indicators against GOLD, for every
+    (qwen, counted-lane) pair on matured gold val rows, reusing stats::error_kappa (PRM-001 §3 error
+    overlap). An error is a parsed verdict that disagrees with the gold outcome; unparsed items and
+    silver, pending or quarantined rows are excluded, never counted as errors. A pair with fewer than
+    `min_n` shared items, or with κ undefined, reports `insufficient` (S-14), never a number.
+    2.0.0: the gate is v3's δ-free H7, decided by the prereg-locked stats::h7_holds. On I, the
+    items the shadow lane and EVERY counted lane (voter) scored, κ_err(qwen, V) must be ≤ the
+    largest voter–voter κ_err for each voter V. v2's baseline + δ rule is gone, and a manifest that
+    still carries `delta` is refused, since nothing would read it. The voters and min_n come only from
+    the run manifest, registered before training. Refusal is an andon (non-zero exit), not a warning.
+  references:
+    - "docs/specifications/PRM-001-prometheus.md"
+    - "docs/specifications/review-experiment-protocol.md"
+
+equations:
+  error_indicator:
+    formula: "err(lane, i) = parsed(lane, i) ∧ verdict(lane, i) ≠ gold(i)"
+  kappa_err:
+    formula: "κ_err(a, b) = (p_o − p_e) / (1 − p_e) over items i with gold(i) ∧ matured(i) ∧ split(i) = val ∧ parsed(a, i) ∧ parsed(b, i)"
+  gate:
+    formula: "pass ⇔ |I| ≥ min_n ∧ h7_holds([κ_err_I(qwen, V) : V ∈ voters], [κ_err_I(V_i, V_j) : i < j]) = Some(true), i.e. ∀ V: κ_err_I(qwen, V) ≤ max_{i<j} κ_err_I(V_i, V_j); I = items scored by qwen and every voter, gold agreeing"
+
+falsification_tests:
+  - id: FALSIFY-LIND-001
+    name: only_matured_gold_val_rows_are_scored
+    prediction: "silver, pending, quarantined, train/test-split and immature rows in the planted fixture leave κ_err unchanged"
+    test_harness: "cargo test -p aprender-review-experiment --lib falsify_lind_001"
+    expected_output: "exit 0"
+    if_fails: "The baseline would mix silver labels into gold and measure agreement with the voters, not error overlap."
+  - id: FALSIFY-LIND-002
+    name: the_gate_refuses_what_it_cannot_decide
+    prediction: "a thin or undefined pair reports insufficient; the gate refuses (S-14) below min_n common items, with one voter (no voter–voter κ), with an undefined κ, and with a voter the rows lack; every κ, the ceiling included, is taken on I, not on each pair's own overlap"
+    test_harness: "cargo test -p aprender-review-experiment --lib falsify_lind_002"
+    expected_output: "exit 0"
+    if_fails: "A gate could pass on too few rows or on an undecided h7_holds, which is exactly the §10 risk that matured gold is scarce."
+  - id: FALSIFY-LIND-003
+    name: h7_is_qwen_kappa_at_most_max_voter_kappa
+    prediction: "a qwen copying one voter's errors (κ = 1 > voter–voter max) is refused naming that voter; with identical voters (ceiling 1) the same copy passes, since the bound is inclusive"
+    test_harness: "cargo test -p aprender-review-experiment --lib falsify_lind_003"
+    expected_output: "exit 0"
+    if_fails: "A silver-trained Qwen that copies the voters' blind spots could occupy the dissent lane (R13, PRA-H1)."
+  - id: FALSIFY-LIND-004
+    name: voters_and_min_n_are_pre_registered_and_delta_is_gone
+    prediction: "a manifest with no block, min_n 0, no voters, a registration at or after training start, a non-Z timestamp, or a v2 `delta` is refused"
+    test_harness: "cargo test -p aprender-review-experiment --lib falsify_lind_004"
+    expected_output: "exit 0"
+    if_fails: "The runner could pick the voters after seeing κ, or believe a δ that the δ-free gate never reads."