[noahgift]

Refs #3715 (B1, the release-readiness gate). Stacked on #4588 (#4502 PR-2), which carries the cells producer. The base retargets to main when #4588 lands.

BLOCKED on the gate pv. Released pv 0.69.2 has neither --surface nor --crux-receipts. Both arrive with #4587 (#4502 PR-1) and are not released yet. The 0.69.2 release-readiness-v1 shape also requires a surface (minCount 1). Measured on intel with pv 0.69.2 (mac-server): green fixture rc 1, drop-one-cell rc 1, restored rc 1, so 0.69.2 is RED on every input. The operator decides which pv the gate uses. The PR stays draft until then.

What it does

• release_readiness.sh runs pv lint --gate shapes --shape release-readiness-v1 in enforce mode. DEFAULT_MODE=enforce is at line 45, and it is the only mode.
• R10: the report-only arm is deleted, including the old "not a stop until P0 release-process: the train can publish with "most models working" — the model gate is a hand-picked ladder with OPTIONAL rungs, a skip reads as pass, and the dogfood can be inherited. Every Q4_K model × {lambda, gx10} × CUDA must be green or NOTHING ships #3712" line. report is refused both as an env value and as a committed default (caller error 3). Selftest row: mode_has_no_report_arm.
• T-1: autopilot cut_tag() refuses the tag unless the log carries ok R8 #3715 ENFORCE PASS version=V commit=MC pv=.... A WARN R8 row stops T-1 even when rc is 0.
• T-4: preflight R8 refuses a WARN R8 row, and refuses rc 0 without the ENFORCE PASS line for this version and HEAD.
• Data de-claim of Qwen3 on gx10 (0.70.1 P0: Qwen3 on GB10 (sm_121) is correct but ~30x slow — ship sm_121 SASS, re-test batched prefill #4590). The cells producer passes --surface, filters the crux dir and uses the release apr for models_t1.

R9 proof

(a) Planted failing check leads to RED, and (b) a clean pass leads to GREEN. falsify.sh runs the real wrapper and the real cut_tag over pv's green fixture:

green     readiness_rc=0 cut_tag_rc=0 tag=CUT      log_sha256=8c73e91e13beaa51
red       readiness_rc=1 cut_tag_rc=1 tag=REFUSED  log_sha256=7cd8a93441f7f097   (one lambda cell dropped)
restored  readiness_rc=0 cut_tag_rc=0 tag=CUT      log_sha256=2acdf4a92d0766d8

This run used pv built at dev 8d021f6. With released pv 0.69.2 the gate cannot pass (see BLOCKED above). The receipt will be re-run on whichever pv the operator picks.

Selftests on this head: release_readiness.sh --selftest 30/30, check_publish_preflight.sh --selftest 57/57, and check_release_models_t1.sh --selftest green. Each new refusal row is killed by its mutant:

• dropping the preflight WARN check or the ENFORCE check breaks r8_report_mode_warn_refuses and r8_rc0_without_enforce_pass_refuses;
• dropping the autopilot WARN die breaks readiness-warn-stops.

(c) The gate runs only on the release path (L21).

• No workflow runs the gate itself. CI only runs fixture selftests: ci/sections.yml:2256 runs check_publish_preflight.sh --selftest, and the pv unit test ont_release_readiness runs too.
• The real gate is called only from scripts/release/autopilot.sh (T-1) and scripts/check_publish_preflight.sh R8 (T-4).
• A normal PR's check list (fix(guard): silicon coverage — a short API listing is NO-GO, never STALE (PMAT-4594) #4598) has no readiness check: determinism, gpu-touched, gx10, mac-check, present, workspace-test-shard (1/2/3), x86-main, yoga.

Final proof is still owed: the rc.1 and FINAL release-decision run IDs showing the #3715 step ran in ENFORCE and passed.

🤖 Generated with Claude Code

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3715",
 "head": "616fd1461e3383ffd9ad94f4998d38fcf555cf18",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "FAIL",
   "findings": 8
  },
  {
   "lane": 2,
   "verdict": "FAIL",
   "findings": 2
  },
  {
   "lane": 3,
   "verdict": "NO-VERDICT",
   "findings": 0
  }
 ]
}

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3715",
 "head": "9efceaa0248ab90213ccc1cb1868653eba33aa03",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "FAIL",
   "findings": 4
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "NO-VERDICT",
   "findings": 0
  }
 ]
}

[noahgift]

quorum-review (AD-04): three PASS — agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-3715",
 "head": "33b032506af6cb0300815e499ba9109dbda76a2c",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 2
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}