[noahgift]

Split PR-1 of 2 of #4502. Per the operator plan, the split is a MOVE of #4502: PR-1 ∪ PR-2 = #4502's diff.

What: the contracts layer from #4502 r7 A 0be7c00372. That is:

• crates/aprender-contracts{,-cli,-macros,-staging} and contracts/
• the additive aprender-common cli_roles module
• the Migrate the 12 hand-rolled producer build.rs key builders onto build_helper::env_key (#2699 remainder) #4369 build_helper::env_key build.rs in every binding crate, plus its build-dep

c1's #4069 ONT-4c4 commits stay in (HARD KEEP).

Rows (operator rulings, relayed by the cop): all four PVL rows stay: #4199, #4200 and #4122 (the ONT-10 → ONT-5 → EV-9 dependency; gate-named rows never move), plus #4347. #4347 now carries 098fae4, which deletes the dead cooperative-matrix chain and clears the live f16 axiom. 29 contracts whose tests or [[bin]] live in PR-2 moved to PR-2; they are byte-identical there, and no kept row references them. PR-1 also takes 01's shapes fix: README, CLAUDE.md and the Makefile from the batch, plus the binary snapshot for PR-1's 30 bins.

Tripwire leaves fixed in this push (3c2a40a): 456 (ev11 baseline 129), 461 (EV-6a), lean-reach, 290, 343, 430 (fb), kernel-fusion call_site, binding 233/233, verification-ladder, the Axioms.lean regen, the dogfood ledger (144/886, G2.6 T2 PASS), and strict_test_binding. The generated set is regenerated once via batch_fold.sh --regen.

keep-open: PR-1 is half of the #4502 MOVE. Its rows (#4069, #4122, #4199, #4200, #4347, #4369) are closed by #4502 / PR-2, not by this half.
ont-delta: none — contract sources only. The generated ontology set is regenerated once in this push, and PR-2's single-writer regen owns the ontology delta.

Still red on intel at 3c2a40a (pre-push local receipt): 338 (ont4b tracked graph / corpus shapes), 472 (ont4d subsumption: pv exit 2), 480 (ONT-4c5 Unknown(NoFocus)). Owners are being routed; they are not fixed by this push.

Folded in (operator P4, 17:15Z, one push; cop 18:05Z):

• C2: publish pv (aprender-contracts-cli) 0.69.4 + deps for B1 gate tool (L20) #4604 C2: pv set at 0.69.4 — aprender-build-sha, aprender-update, aprender-contracts-macros, aprender-common, aprender-contracts, aprender-contracts-cli. update-check + build-sha are OFF by default; binary-release.yml builds pv with them (operator B2). pv publishes from this PR's merge commit after clean-room (B3). keep-open: C2: publish pv (aprender-contracts-cli) 0.69.4 + deps for B1 gate tool (L20) #4604 closes on the crates.io publish, not on merge.

• Shard 3 fix: the root lib-test container sets safe.directory=/workspace so the pinned origin/main resolves (run 36449404284 job 109019972318).

• N-1: the pv: a shapes gate reports Pass AND armed over ZERO focus nodes — aggregate swallows decline: NoFocus #3610 exemption is a contract-level allow_empty: map, so the fleet-pinned pv 0.69.1 parses release-readiness-v1 (job 109019972501).

• x86-main reds from run 36462668621 (81cd662): make contracts called scripts/contracts_gate.sh, which only PR-2 carries, so main's step-list recipe is restored here (make_contracts_propagates.sh 17/17, mutants included). That test's fixture now reads the pv version the way pv_bin.sh does (the crate first). In check_facade_compat.sh, CURRENCY and PUBLISH ORDER compare against the version this tree publishes for the fronted crate, as R3 already did (identical when unscoped; unreadable = FAIL). Facade pins are 0.69.4 and the facade lock is regenerated. On intel: PASS 32 ok, and a 0.69.3-pin mutant is RED.

• Facade guard: exact scoped allowlist (ff5c834). Quorum q-pr1-r81cd2 on 81cd662 (gemini FAIL, sonnet PASS, haiku PASS) found that comparing a crate against its own version let a coordinated off-workspace drift pass. pub_ver now admits the workspace version, or the EXACT version scoped_ver declares for that crate (C2: publish pv (aprender-contracts-cli) 0.69.4 + deps for B1 gate tool (L20) #4604: six crates at 0.69.4). Case table, intel clone at ff5c834:

  Input	Result
  this tree (scoped set at 0.69.4)	PASS rc=0, 0 FAIL
  unscoped tree (crate == workspace version)	same as before the edit
  mutant A: aprender-contracts removed from the allowlist (off-workspace, unlisted)	RED rc=1
  mutant B: allowlist version 0.69.5 (wrong version)	RED rc=1 (CURRENCY + both PUBLISH ORDER rows)
  mutant C: contracts, cli and macros drift together to 0.69.5, pins follow (the gemini case)	RED rc=1
  unreadable version	FAIL (<unread>), never a pass

• Main merged in once (f766fc7, brings fix(ci): plumb secrets.PR_REVIEW_SIGNING_KEY_B64 under its real name; guard section secrets vs plumbing (#4510) #4512's signing-key secret name).

PR-2 (the rest of #4502): #4588.

A′ survivor table (operator ruling 2026-09-29 06:36Z)

CI builds the survivor table itself. A table typed up by hand does not count.

• mutants-table-scope decides whether the head ref is in ci/mutants-table-refs.txt (PR-1 and PR-2 for 0.70). On every PR it also re-proves the gate rule and the checker.
• mutants-shard (matrix 1..16, clean-room) checks out the PR head sha and computes git diff <merge-base>...HEAD. Each job writes meta.json (head sha, diff sha256, run id), list.txt (the full universe) and outcomes.json for --shard K-1/16.
• mutants-table verifies before it trusts. RED on any of:
  • a dead, skipped or cancelled shard;
  • a missing, extra or twice-tested mutant;
  • a mutant with no verdict;
  • a sha that is not the head sha, or a diff hash that is not the PR diff hash;
  • survivors over MUTANTS_MAX_MISSED (default 0).
• An equivalent needs three things: a one-line proof in evidence/mutants-equiv/<PR>.tsv, a pr-review receipt that names the mutant with reviewer ≠ author, and a .minisig that verifies against the base branch's .github/pr-review.pub.
• gate requires mutants-table == success for a listed ref (GATE-MUTANTS-TABLE-RULE). The one-job mutants section hands a listed ref over to the table (has_rs=false). For any other ref it is unchanged.

Proof (G3): the case tables, re-run at this head

missing mutant → RED · wrong sha → RED · wrong diff → RED · complete table → GREEN (checker, 24 rows). Gate rule: 14 rows, and 3 planted weak rules are all RED.

output

ok    complete table, all killed -> GREEN
ok    a table missing 1 mutant -> RED
ok    a mutant tested twice -> RED
ok    a shard run on the wrong head sha -> RED
ok    a shard bound to another diff -> RED
ok    a shard that delivered nothing -> RED
ok    shards that listed different universes -> RED
ok    a tested mutant that was never listed -> RED
ok    an empty universe -> RED
ok    one survivor over limit 0 -> RED
ok    one timeout over limit 0 -> RED
ok    an unviable mutant counts as killed -> GREEN
ok    an unknown outcome -> RED
ok    survivor within --max-missed 1 -> GREEN
ok    equivalent with proof + receipt naming it -> GREEN
ok    equivalent whose receipt does not name it -> RED
ok    equivalent citing a stray file that names it -> RED
ok    equivalent citing a receipt path that is not an in-toto statement -> RED
ok    equivalent whose receipt is a self-review -> RED
ok    equivalent whose receipt is unsigned -> RED
ok    equivalent signed by a key that is not --pubkey -> RED
ok    equivalent row checked with no --pubkey -> RED
ok    equivalent with no proof column -> RED
ok    equivalent row for an id outside the universe -> RED
PASS
=== gate requires the survivor table for a listed head ref (check_ci_gate_mutants_table_rule.sh) ===
ok    row 1  pull_request scope=success   in=true  table=success   -> pass
ok    row 2  pull_request scope=success   in=true  table=failure   -> FAIL
ok    row 3  pull_request scope=success   in=true  table=skipped   -> FAIL
ok    row 4  pull_request scope=success   in=true  table=cancelled -> FAIL
ok    row 5  pull_request scope=success   in=false table=skipped   -> pass
ok    row 6  pull_request scope=success   in=false table=success   -> FAIL
ok    row 7  pull_request scope=success   in=-     table=skipped   -> FAIL
ok    row 8  pull_request scope=failure   in=-     table=skipped   -> FAIL
ok    row 9  pull_request scope=skipped   in=-     table=skipped   -> FAIL
ok    row 10 pull_request scope=cancelled in=-     table=skipped   -> FAIL
ok    row 11 merge_group  scope=skipped   in=-     table=skipped   -> pass
ok    row 12 push         scope=skipped   in=-     table=skipped   -> pass
ok    row 13 merge_group  scope=success   in=true  table=success   -> FAIL
ok    row 14 merge_group  scope=skipped   in=-     table=failure   -> FAIL
=== the survivor-table checker's case table (scripts/ci/mutants_survivor_table.py --self-test) ===
ok    complete table, all killed -> GREEN
ok    a table missing 1 mutant -> RED
ok    a mutant tested twice -> RED
ok    a shard run on the wrong head sha -> RED
ok    a shard bound to another diff -> RED
ok    a shard that delivered nothing -> RED
ok    shards that listed different universes -> RED
ok    a tested mutant that was never listed -> RED
ok    an empty universe -> RED
ok    one survivor over limit 0 -> RED
ok    one timeout over limit 0 -> RED
ok    an unviable mutant counts as killed -> GREEN
ok    an unknown outcome -> RED
ok    survivor within --max-missed 1 -> GREEN
ok    equivalent with proof + receipt naming it -> GREEN
ok    equivalent whose receipt does not name it -> RED
ok    equivalent citing a stray file that names it -> RED
ok    equivalent citing a receipt path that is not an in-toto statement -> RED
ok    equivalent whose receipt is a self-review -> RED
ok    equivalent whose receipt is unsigned -> RED
ok    equivalent signed by a key that is not --pubkey -> RED
ok    equivalent row checked with no --pubkey -> RED
ok    equivalent with no proof column -> RED
ok    equivalent row for an id outside the universe -> RED
PASS
PASS
=== gate survivor-table rule: planted weak rules must turn the table RED ===
ok    planted "table-failure-only" is RED: 8 row(s)
ok    planted "ignore-scope" is RED: 7 row(s)
ok    planted "trust-in-scope-only" is RED: 7 row(s)
ok    a workflow with no rule block is ENV rc=2, never a pass
SELF-TEST PASSED

Mutation proof: I disabled 16 separate checks with sed, one at a time. Each one turns the checker's self-test RED. Review: three Sonnet lanes, receipt evidence/pr-review/4587/b132bf3c34….

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=4587 head=af891a92c77d90367d1c25699961fcb6eb8602ed verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=true disarmed=true)

{
 "ticket": "PMAT-4502,PMAT-4199,PMAT-4200,PMAT-4347,PMAT-4166,PMAT-4139,PMAT-4604,PMAT-4369",
 "head": "5296a9fef738be14d037a3e7c6c2476a73b28102",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": true,
  "disarmed": true,
  "note": "auto-merge was armed from an earlier round; disarmed before lanes launched"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "FAIL",
   "findings": 2
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-4502,PMAT-4199,PMAT-4200,PMAT-4347,PMAT-4166,PMAT-4139,PMAT-4604,PMAT-4369",
 "head": "ee9d92bab5c0ff2527c06895a82aedc6e25708b9",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "FAIL",
   "findings": 2
  },
  {
   "lane": 3,
   "verdict": "FAIL",
   "findings": 2
  }
 ]
}

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-4502,PMAT-4199,PMAT-4200,PMAT-4347,PMAT-4166,PMAT-4139,PMAT-4604,PMAT-4369",
 "head": "ee9d92bab5c0ff2527c06895a82aedc6e25708b9",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 2,
   "verdict": "FAIL",
   "findings": 1
  },
  {
   "lane": 3,
   "verdict": "FAIL",
   "findings": 2
  }
 ]
}

[noahgift]

Closed with a pointer (0.70.2 backlog, aprender-78): this PR's content landed on main in #4655 (989cb01, "fold(0.70): #4587+#4588 …"). Measured: of the 786 files it touches, the only ones whose PR-side change is absent from main are contracts/census.json, one witness json (generated, regenerated on main) and two version = "0.69.4" pins that main supersedes with version.workspace = true. Branch split/pvl-rows-0.70 is kept.