split(#4502 PR-1): contracts layer — PVL rows PMAT-4199/4200/4347, GH-4122, ONT-4c4 (#4069)

.claude/skills/apr-dogfood/SKILL.md

@@ -1591,7 +1591,7 @@ The nine clusters at zero, largest first: `http-orchestrate-banco` (95),
 `test-harness` (49), `rag-eval` (44), `qa-cgp` (37), `simulation` (18),
 `orchestrate-pacha-secrets` (17).
 
-**Report both numbers or neither (T2).** "5 of 14 clusters gated (35.7%)" without "144 of 864 features gated (16.7%)" beside it is a proxy masquerading as coverage, and the gate refuses to emit it — *on this line too*.
+**Report both numbers or neither (T2).** "5 of 14 clusters gated (35.7%)" without "144 of 886 features gated (16.3%)" beside it is a proxy masquerading as coverage, and the gate refuses to emit it — *on this line too*.
 
 The rule is about the NUMBER, not about a phrasing, and it is enforced on every
 surface that can emit one: the gate's own report, the receipt, the output of

.github/workflows/binary-release.yml

@@ -160,7 +160,7 @@ jobs:
               esac
               ldd --version | head -1 > /workspace/target/BUILDER_GLIBC
               rustc --version > /workspace/target/BUILDER_RUSTC
-              cargo build --release --locked --bin pv -p aprender-contracts-cli --target "$T"
+              cargo build --release --locked --bin pv -p aprender-contracts-cli --features update-check,build-sha --target "$T"
               strip "/workspace/target/$T/release/pv"'
           mkdir -p "target/$T/release"
           cp "$CACHE/target/$T/release/pv" "target/$T/release/pv"

.github/workflows/ci.yml

@@ -407,6 +407,173 @@ jobs:
           python3 scripts/ci/sigma_executed.py explicit --kind "explicit (3 shards)" "${l[@]}" --step "Integration tests" --list "$d/sigma-shard-1/explicit.list.txt" || rc=1
           exit "$rc"
 
+  # #4587 A' (operator 2026-09-29 06:36Z, via the cop): "CI generates the survivor table itself: the
+  # split runs become CI matrix jobs (run IDs), each bound to PR-1's head sha and diff hash ... The gate
+  # verifies before trusting it ... Any gap -> RED." Scope: the head refs in ci/mutants-table-refs.txt
+  # (PR-1 and PR-2 of 0.70) and nothing else; every other PR keeps the one-job `mutants` section and its
+  # 60-mutant cap. For a listed ref that section hands over, and `gate` requires mutants-table.
+  mutants-table-scope:
+    runs-on: [self-hosted, Linux, clean-room]
+    timeout-minutes: 10
+    if: github.event_name == 'pull_request'
+    outputs:
+      in_scope: ${{ steps.decide.outputs.in_scope }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      # minisign for the equivalents-signature rows (pinned + digest-checked, per-run private bin dir).
+      - name: Install minisign (the checker refuses an unverifiable equivalent)
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          bash scripts/install_pr_review_tools.sh "$RUNNER_TEMP/pr-review-tools/bin"
+          echo "$RUNNER_TEMP/pr-review-tools/bin" >> "$GITHUB_PATH"
+      # Every PR re-proves the gate's survivor-table rule and the checker's case table (planted defects RED).
+      # The checker's case table needs the minisign installed above, so this guard is wired HERE with its input
+      # named (guard_tree.sh rule 1 then leaves it to this step); the sovereign-ci image has no minisign.
+      - name: The survivor-table gate rule and checker still turn RED
+        env:
+          GATE_RULE_WORKFLOW: .github/workflows/ci.yml
+        run: |
+          set -euo pipefail
+          setsid --wait bash scripts/check_ci_gate_mutants_table_rule.sh --self-test
+          setsid --wait bash scripts/check_ci_gate_mutants_table_rule.sh
+      - name: The mutants feature groups cover every feature-gated module
+        run: setsid --wait bash scripts/check_mutants_feature_groups.sh
+      - name: Is this head ref judged by the survivor table?
+        id: decide
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          set -euo pipefail
+          if grep -v '^#' ci/mutants-table-refs.txt | grep -qxF -- "$HEAD_REF"; then v=true; else v=false; fi
+          echo "head ref $HEAD_REF -> in_scope=$v"
+          echo "in_scope=$v" >> "$GITHUB_OUTPUT"
+
+  # One shard of the diff's mutants per job, on the PR HEAD sha (not the merge commit), cap 0.
+  mutants-shard:
+    runs-on: [self-hosted, Linux, clean-room]
+    timeout-minutes: 720
+    needs: [mutants-table-scope]
+    if: needs.mutants-table-scope.outputs.in_scope == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]
+    env:
+      IMAGE: localhost:5000/sovereign-ci:stable
+      SHARDS: '16'
+      MUTANTS_TABLE_JOBS: ${{ vars.MUTANTS_TABLE_JOBS || '2' }}
+    steps:
+      - name: Pre-checkout ownership restore (EACCES self-heal)
+        run: |
+          if docker image inspect "$IMAGE" > /dev/null 2>&1; then
+            docker run --rm -v "${GITHUB_WORKSPACE}:/workspace" "$IMAGE" \
+              bash -c 'chown -R 1000:1000 /workspace 2>/dev/null || true'
+          fi
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - name: The PR diff this shard is bound to
+        run: bash scripts/mutants_table_diff.sh "${{ github.event.pull_request.base.ref }}" pr.diff
+      - name: Pull sovereign-ci image (with retry + local-cache fallback)
+        run: |
+          if docker image inspect "$IMAGE" > /dev/null 2>&1; then exit 0; fi
+          for i in $(seq 1 15); do
+            docker pull "$IMAGE" && exit 0
+            sleep $((4 + 6 * i))
+          done
+          echo "::error::Registry localhost:5000 unreachable after 15 attempts AND image not in local cache"
+          exit 1
+      - name: Shard ${{ matrix.shard }} of the survivor table
+        run: |
+          set -euo pipefail
+          docker run --rm \
+            -e CI -e GITHUB_ACTIONS -e GITHUB_RUN_ID -e GITHUB_RUN_ATTEMPT -e SHARDS -e MUTANTS_TABLE_JOBS \
+            -e SHARD=${{ matrix.shard }} \
+            -v "${GITHUB_WORKSPACE}:/workspace" -w /workspace "$IMAGE" \
+            bash -c '
+              set -uo pipefail
+              export CARGO_INSTALL_ROOT=/usr/local/cargo-mutants-root
+              export PATH="$CARGO_INSTALL_ROOT/bin:$PATH"
+              if ! cargo mutants --version > /dev/null 2>&1; then
+                cargo install cargo-mutants --locked --version 27.1.0 > /tmp/mi.log 2>&1 || {
+                  echo "::error::cargo-mutants install failed; the shard cannot run"; tail -20 /tmp/mi.log; exit 1; }
+              fi
+              cargo mutants --version || { echo "::error::cargo-mutants not runnable after install"; exit 1; }
+              # The same exclusions as the mutants section: derived from the workspace-test nextest line.
+              EXCL=$(grep -m1 -E "^[[:space:]]+cargo nextest run --profile ci --workspace --lib" ci/sections.yml \
+                | grep -oE -- "--exclude [a-z0-9_-]+" | sed "s/^--exclude /--exclude-crate /" | tr "\n" " ")
+              [ -n "$EXCL" ] || { echo "::error::no --exclude list found on the workspace-test nextest line"; exit 1; }
+              # shellcheck disable=SC2086
+              bash scripts/mutants_table_shard.sh pr.diff "$SHARD" "$SHARDS" "$MUTANTS_TABLE_JOBS" \
+                "mutants-shard-$SHARD" $EXCL
+            '
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: mutants-shard-${{ matrix.shard }}
+          path: |
+            mutants-shard-${{ matrix.shard }}/meta.json
+            mutants-shard-${{ matrix.shard }}/list.txt
+            mutants-shard-${{ matrix.shard }}/outcomes.json
+          if-no-files-found: error
+
+  # The verifier: trusts no shard until scripts/ci/mutants_survivor_table.py has checked the union.
+  mutants-table:
+    runs-on: [self-hosted, Linux, clean-room]
+    timeout-minutes: 20
+    needs: [mutants-table-scope, mutants-shard]
+    if: always() && needs.mutants-table-scope.outputs.in_scope == 'true'
+    steps:
+      - name: Every shard ran to the end
+        env:
+          SHARD_RESULT: ${{ needs.mutants-shard.result }}
+        run: |
+          echo "mutants-shard matrix result: $SHARD_RESULT"
+          [ "$SHARD_RESULT" = success ] || { echo "::error::mutants-table: shard matrix result is '$SHARD_RESULT' (a dead, cancelled or skipped shard is not a pass)"; exit 1; }
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: mutants-shard-*
+          path: ${{ runner.temp }}/mt
+      # minisign for the equivalents-signature rows (pinned + digest-checked, per-run private bin dir).
+      - name: Install minisign (the checker refuses an unverifiable equivalent)
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          bash scripts/install_pr_review_tools.sh "$RUNNER_TEMP/pr-review-tools/bin"
+          echo "$RUNNER_TEMP/pr-review-tools/bin" >> "$GITHUB_PATH"
+      - name: The checker's case table must still turn RED
+        run: python3 scripts/ci/mutants_survivor_table.py --self-test
+      - name: "Survivor table: every listed mutant judged once, on the PR head + diff (#4587 A')"
+        env:
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR: ${{ github.event.pull_request.number }}
+          MUTANTS_MAX_MISSED: ${{ vars.MUTANTS_MAX_MISSED || '0' }}
+        run: |
+          set -euo pipefail
+          bash scripts/mutants_table_diff.sh "${{ github.event.pull_request.base.ref }}" pr.diff
+          # The key an equivalent's receipt must verify against comes from the BASE branch: the PR's own copy
+          # of .github/pr-review.pub is editable by the PR, so trusting it would let a PR sign its own proof.
+          git show "origin/${{ github.event.pull_request.base.ref }}:.github/pr-review.pub" > "$RUNNER_TEMP/base-pr-review.pub"
+          python3 scripts/ci/mutants_survivor_table.py check --dir "$RUNNER_TEMP/mt" --shards 16 \
+            --head-sha "$HEAD_SHA" --diff pr.diff --equiv "evidence/mutants-equiv/$PR.tsv" \
+            --max-missed "$MUTANTS_MAX_MISSED" --repo . --pubkey "$RUNNER_TEMP/base-pr-review.pub" --table "$RUNNER_TEMP/mt/survivor-table.tsv"
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: mutants-survivor-table
+          path: ${{ runner.temp }}/mt/survivor-table.tsv
+          if-no-files-found: ignore
+
   ci-gate:
     name: ci / gate
     runs-on: [self-hosted, Linux, clean-room]
@@ -426,7 +593,7 @@ jobs:
   gate:
     runs-on: [self-hosted, Linux, clean-room]   # arch-neutral: intel, yoga or gx10 (#3100)
     timeout-minutes: 22
-    needs: [x86-main, workspace-test, determinism]   # as on main: the GPU jobs are advisory (68-C3 / 68-D2)
+    needs: [x86-main, workspace-test, determinism, mutants-table-scope, mutants-table]   # as on main: the GPU jobs are advisory (68-C3 / 68-D2)
     if: always()
     steps:
       - name: Check required sections
@@ -435,6 +602,9 @@ jobs:
           DET: ${{ needs.determinism.outputs.results }}
           WT: ${{ needs.workspace-test.result }}
           EVT: ${{ github.event_name }}
+          SCOPE: ${{ needs.mutants-table-scope.result }}
+          IN_SCOPE: ${{ needs.mutants-table-scope.outputs.in_scope }}
+          TABLE: ${{ needs.mutants-table.result }}
         run: |
           set -euo pipefail
           res() { printf '%s' "${1:-null}" | SEC="$2" jq -r '(. // {})[env.SEC].result // "missing"'; }
@@ -480,4 +650,16 @@ jobs:
             *) echo "mutants (diff-scoped mutation) on $EVT: $MUT"; exit 1 ;;
           esac
           # --- GATE-MUTANTS-RULE-END ---
+          # --- GATE-MUTANTS-TABLE-RULE-BEGIN (#4587 A'; scripts/check_ci_gate_mutants_table_rule.sh runs this block) ---
+          # For a head ref in ci/mutants-table-refs.txt the mutants section hands over, so here the survivor
+          # table must have RUN and succeeded. The scope decision itself must have run on every pull_request:
+          # a missing decision would let a listed ref pass on the section's hand-over alone.
+          case "$EVT:$SCOPE:$IN_SCOPE:$TABLE" in
+            pull_request:success:true:success) echo "mutants-table: survivor table GREEN" ;;
+            pull_request:success:false:skipped) echo "mutants-table: not in scope (the mutants section judged this PR)" ;;
+            pull_request:*) echo "mutants-table on a pull_request: scope=$SCOPE in_scope=$IN_SCOPE table=$TABLE"; exit 1 ;;
+            *:skipped::skipped) echo "mutants-table: skipped on $EVT (pull_request only)" ;;
+            *) echo "mutants-table on $EVT: scope=$SCOPE in_scope=$IN_SCOPE table=$TABLE"; exit 1 ;;
+          esac
+          # --- GATE-MUTANTS-TABLE-RULE-END ---
           echo "All required sections passed"