Repository navigation
Conversation
…3715) Quorum lanes 1 and 3 (sonnet, haiku) measured 4 of 39 rows RED: 997a343 made the T-1 readiness step re-prove $REPO_ROOT/target/release/apr against MC and take its surface, and the harness never put an apr there. ready() now plants a stub apr at the path autopilot pins; r_goes also requires the wrapper to receive --surface $AP/surface-t1.json from that binary. New row readiness-stale-apr-stops (an apr from another commit stops the step before the wrapper runs) and mutant readiness-any-apr (the check removed -> RED). 41/41 rows; floor 41. Lane 2's minor: the R8 fixture comment still called report the committed mode. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent: aprender-0d (cherry picked from commit 57a9497)
…e, and a WARN row stops T-1 and T-4 Operator R10 (2026-09-28): "report-only is not an option". L19: a silent report-only check = hard stop. - release_readiness.sh: resolve_mode prints enforce or fails; `report` as the env value OR as a committed DEFAULT_MODE is a caller error (3). Both WARN R8 REPORT-ONLY arms (the "not a stop until #3712" line) are gone. Selftest row mode_has_no_report_arm. - autopilot.sh T-1: a WARN R8 row from the wrapper is a die, even at rc 0. - check_publish_preflight.sh T-4 R8: rc 0 is not a pass without "#3715 ENFORCE PASS" for this version and HEAD; a WARN R8 row refuses. - Rows flipped: readiness-warn-continues -> readiness-warn-stops; r8_report_mode_warn_passes -> r8_report_mode_warn_refuses; new r8_rc0_without_enforce_pass_refuses. Each killed by its mutant. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent: aprender-0d
Agent: aprender-88 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… de-claimed with qwen3 Operator ruling 2026-09-28 16:15Z widens R1 (Qwen3 only) to every dense model on GB10: serial prefill is the sm_12x default for every non-hybrid arch (select_prefill_path). - cells.declaimed: + qwen2 @ gx10 (issue 4590, until 0.70.1); rung qwen2-1.5b-q4km hosts: [lambda] - README + CHANGELOG: "GB10 dense models: prompt processing unbatched (11.4 tok/s); fixed in 0.70.1 (#4590)" - enforce-gate proof (ont_release_readiness.rs): withdrawn on gx10 owes nothing; a planted gx10 claim of the dense model is RED; lambda dropping one dense row is RED (withdrawn != waived) Agent: aprender-e6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…gin/main resolves The workspace-lib docker run is root over a host-owned checkout; git refused it (dubious ownership), rev-parse origin/main failed, the refinement gate skipped and lint_passes_on_real_contracts asserted under CI (run 36449404284 job 109019972318). Reproduced on intel with sovereign-ci:stable: rc=128 without, rc=0 with the env. Agent: aprender-88 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ha off by default macros, aprender-common, aprender-contracts and aprender-contracts-cli pin 0.69.4 (v0.69.3 is taken; a version string is never reused). The cli's aprender-update and aprender-build-sha deps become optional features so the crates.io pv builds only from crates live there (B2a). Without build-sha, build.rs stamps APR_GIT_SHA from APR_GIT_SHA_OVERRIDE or v<ver>+no-git. pv_bin.sh and the Makefile pass --features update-check,build-sha, so in-tree pv keeps its update check and sha. binary-release.yml is a separate branch, pending operator OK. Agent: aprender-88 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 34ff1f7432a20f643161250d869cd8e0c9729828)
… at 0.69.4 cargo publish needs optional deps live on crates.io too (0d C1 dry-run). Both are new crate names there; publishing them waits on the operator ruling. Fallback without them: release/pv-0.69.4-fallback. Agent: aprender-88 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 1e5f8a84849003421e8e8640346a048bc87d595c)
…ld-sha The C2 bump makes both features off by default so crates.io pv builds from live crates. Release binaries keep the update check and build sha. Held: no merge until operator OK (workflow edit). Agent: aprender-88 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 372c980391143706bd811473bd43b3bc3385712b)
…et-pinned pv parses it pv 0.69.1 (the fleet pin, intel-clean-room) refuses the shape key allowEmpty (rc=3: shape release-readiness-v1.refusal uses unsupported allowEmpty), so check_fleet_pv_shapes_gate.sh reported pv-no-verdict (run 36449404284 job 109019972501). Deleting the key would make every green release decline under --shape release-readiness-v1 (the refusal shape is empty by design). The reason now lives in a contract-level allow_empty map keyed by shape id, which 0.69.1 ignores and HEAD applies with the same semantics; the in-shape key still parses. Agent: aprender-88 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…secret name) Agent: aprender-88 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… facade guard vs the scoped 0.69.4 pv set 1. `make contracts` called scripts/contracts_gate.sh, which PR-1 does not carry (it lands with PR-2). Restore main's step-list recipe; PR-2 brings the gate script and its recipe together. make_contracts_propagates.sh: 17/17 rows, mutants included. 2. make_contracts_propagates.sh faked pv at the ROOT workspace version, but pv_bin.sh declares the CLI crate's own version first. The fixture now reads it the same way. 3. check_facade_compat.sh CURRENCY and PUBLISH ORDER compared against the root workspace version; R3 already used the fronted crate's own. All three now use the version this tree publishes for the fronted crate (identical when unscoped; an unreadable version is a FAIL). Facade pins -> 0.69.4, crates/facades/Cargo.lock regen. Agent: aprender-88 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…D — planted RED, qwen3moe@gx10 (#3715) STAGED, branch-only (cop 20:00Z/20:26Z; operator rules 07:30Z). Not for merge. cells.declaimed withdrew a (host, arch) from the owed cells, but nothing failed when a rung's host set (what released pv reads) or a long-rung representative still claimed it. declaim_still_claimed() in the judge (enforce: judge rc 1 -> check exits 1): - a rung whose hosts (or, absent, every required host) name a de-claimed (host, its arch) -> FAIL - a long_rungs_for representative for an arch de-claimed on every required host -> FAIL Case table: red-cells-declaimed-still-claimed (new), green-cells-declaimed narrowed to hosts: [lambda] (it claimed the de-claimed pair); cmutant declaim-claimed killed. Self-test 153/153. Data: cells.declaimed + (gx10, qwen3moe), issue 3715, until 0.70.1 (0d H4 19:54Z: arch-level DATA is clean for qwen3moe only). Real-contract proof in evidence/3715-declaim-planted-red/: real = 0, planted qwen3moe rung = 1, narrowed = 0, orphan representative = 1. Agent: aprender-e6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… N", not a 500 (D5) Operator ruling D5 (ruling-3715-2010): "a 500 is a crash-class lie". A 27155-token turn on a dense CUDA model reached BorrowedCudaForward::reserve, failed with "the device KV cache holds 4096", and came back as HTTP 500 (h4-depcheck-0d, lambda + gx10 serve/code cells). - serving_context(): the model's context capped by the device KV cache; the borrowed serve session reports it, so max_tokens clamps to what is left. - AppState caches it at construction (PMAT-073: no read lock in the handler). - serve_context_refusal(): the pre-flight 400 in the CUDA chat, CUDA /v1/completions and /generate/stream routes, before any path takes the model, so a streaming client gets a 400, not a mid-stream error. - The direct paths map ContextLimitExceeded through generation_error_status. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…or 0.70 Operator D1 (relayed by the cop, 2026-09-28 20:10Z): the qwen3moe-gx10 de-claim lands with the planted RED and a release-note warning. CHANGELOG Known issues + README known-issue note, same shape as the #4590 entries. Agent: aprender-e6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…t holds both files lambda holds Qwen3-30B-A3B-Instruct-2507 and Qwen3-Coder-30B-A3B (~/models, lambda H4 queue), so the entry now says what withdrawn-not-waived means there: lambda still owes every qwen3moe cell. Data text only; the judge keys on (host, arch) and is unchanged. Falsifier re-run on the real contract: entry -> withdrawn rc 0, drop -> owed again, bare -> rc 1. Refs #3715 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Agent: aprender-0d
…4604 set at 0.69.4 may leave the workspace version Quorum q-pr1-r81cd2 (gemini FAIL): comparing a crate against its own version let a coordinated off-workspace drift pass. pub_ver now admits the workspace version, or the EXACT version scoped_ver declares for that crate; anything else (unlisted crate, other version, unreadable) is RED. The only input the old workspace-only rows refused and these admit is the declared set itself. Agent: aprender-88 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…both files and still owes them Same false claim 0d fixed in the contract (e59329f); the release note carried it too. Agent: aprender-e6 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Four Makefile recipes in the split named scripts that live in PR-2 alone: census (check_census_derived.sh), guards-local (ci_guards.sh), oracle-owl (tests/oracle/owl) and coverage-serve (the .py -> .sh rename would have broken `make coverage`). Those hunks go back to main and travel with their scripts in PR-2. lint-ratchet stays: PR-1 carries EV-11, whose contract names scripts/lint_ratchet.sh as its writer, so the script comes with it (--self-test 12/12). Agent: aprender-88 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
#3715 is the pv SHACL release-readiness shape. D5 is its serve × consumer-context child: a turn longer than the device KV returned 500. The quorum judged this diff against #3715's acceptance and failed it 3/3 on the mismatch, so the serve fix now has its own ticket and acceptance. Refs #4616, #3715 Agent: aprender-2e-serve Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…R-1's 22 ledger rows run 36473794463 guard-tree step 11: the split moved the 22 surface_audit rows (11 apr, 11 pv) and the rows/ratio totals into PR-1, but not the per_binary / per_band / per_cluster entries. Re-derived with scripts/dogfood_baseline.py; --check PASSES. Agent: aprender-88 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…a CI caller for the two lean ones
Review B3 (PR-REVIEW-SKILL-002 v2 S3.D): check_facade_compat.sh (scoped
allowlist), check_leanchecker_scoped.sh and check_lean_modules_reachable.sh
had only self-authored self-tests, and the two lean guards had no CI caller.
- mutate_{facade_compat,leanchecker_scoped,lean_modules_reachable}_guard.sh:
17/17, 31/31, 18/18 killed. Each patch fails closed (INVALID, never a
survivor), the M0 baseline must pass, and mutants run against copies.
- First runs killed 0/17, 27/31 and 16/18. The self-test rows that kill the
survivors were added. No check was removed or loosened. scoped_ver/pub_ver
were moved, unchanged, above the self-test so it can reach them.
- ci/sections.yml guard-cargo runs the mutation sets, plus both lean guards
(self-test and the real check).
Full facade guard on intel: PASS.
Agent: aprender-88
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ot the workspace beside it
guard-tree step 17 (bump-version.sh --check) failed on run 36485785730. The
check compared each facade pin with the ROOT workspace version (0.69.3). But
PR-1's scoped pv set moves aprender-contracts{,-macros} to 0.69.4, so the pins
on those two crates (0.69.4) were the correct values, and the check called them
wrong.
--check now compares each pin with the version its `upstream` path crate
actually carries. A crate on version.workspace = true carries the workspace
version. Case table rows 7-10: one pass and one RED for a literal-versioned
upstream, and one pass and one RED for a workspace-versioned upstream. Each RED
row must stay RED. The self-test passes 10/10, and --check passes on this tree.
Agent: aprender-88
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…, DEGRADED, advisory finding) Non-author reviewer (Sonnet 5), per COP 22:16Z applying the 21:10Z committed- .minisig route. diff_patch_id cf52ad666e. Verdict DEGRADED: cuda (docs MCP OAuth-gated) and mutation (no cargo test on lambda) unreachable; pmat and agy gemini-3.1-pro-high consulted; crux not triggered. Guard rejects only B1 (unsigned) until the CI signer's .minisig is committed. Advisory finding (measured): /generate and /batch/generate still map every CUDA error to 500 (batch_processing.rs:492, batch.rs:515). Follow-up, not folded here: changing the diff would void this receipt. Agent: aprender-2e-serve Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…receipt Per COP 22:16Z (21:10Z committed-.minisig route). The .minisig is verbatim from pr-review-signature check-run 109170961010 (CI signer, repository key). minisign -V under .github/pr-review.pub: verified, trusted comment pr=4614 pid=cf52ad666e. check_pr_review_receipt.sh: ACCEPT (positive controls fired). Agent: aprender-2e-serve Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…und to patch-id 1817f9d2 The reviewer is claude-sonnet-5; the author is claude-opus-5-5. The verdict is BLOCK, and its only reason is the PR1-MUTANTS HARD-STOP (3555 mutants in the diff, cap 60, operator ruling at 07:30Z). B3 (guard mutation sets) is resolved by c1e4d19. The receipt is unsigned; the ci pr-review-sign job signs it. Agent: aprender-88 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
check_guard_steps_isolated.sh was RED on the local guard-tree run: the six invocations the step added in c1e4d19 shared the runner's process group (#4133). Now green: every direct guard invocation in 25 workflows is isolated. Agent: aprender-88 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…g the serial prefill (#3715) The #3715 lambda cells timed out or failed at the 20k rung on two causes, both measured on the RTX 4090 with apr 0.70.0 (8d021f6): - Qwen3-1.7B (QK-norm): `[PREFILL-PATH] serial cc=89 (qk-norm model)`. One forward_gpu_resident per prompt token: 7955 tokens took 109 s, 26131 did not finish in 300 s at GPU util 99-100 %. Not #4609: the backend was the GPU throughout. - Qwen2.5-0.5B IQ3_M (batched): CUDA_ERROR_OUT_OF_MEMORY in prefill_all_layers_gpu at 26148 tokens. One pass allocates a num_heads x S x S f32 score matrix (38 GB), and its u32 row offsets wrap past 2^32. The batched prefill now runs in chunks whose score matrix fits the 1 GiB budget the Qwen3.5 prefill already uses; each chunk appends to the KV cache through the existing cache_len > 0 attention path. A prompt that fits one chunk runs exactly as before. QK-norm models keep FP8 off and now take the FP16 batched prefill, which #3413 measured passing CPU parity; serial was chosen only because the unchunked prefill OOMed 8B. Refs: #3715 Agent: aprender-ec Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…3715) apr chat built its CUDA model with a flat 2048-position KV. The dense session refuses a longer turn on the device, so a 26k-token chat turn on Qwen3-1.7B ran on the CPU and hit the 600 s cell timeout (GPU util 0%, measured on lambda). apr run already sizes its KV to the turn (#4268); chat loads before it has read a turn, so it now takes the model context, capped by free VRAM after the weights, the FP16/FP8 prefill cache, the GH-178 reserve and the chunked-prefill score budget. When nothing is left (Qwen3-8B on 24 GB), it keeps the 2048 floor. Refs: #3715 Agent: aprender-ec Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…3715) The Qwen3.5 batched prefill dequantizes each weight to F32 for one SGEMM, and had kernels for Q4_K/Q5_K/Q6_K/Q8_0 only. Qwen3.5-4B-UD-Q4_K_XL (F16 ssm_alpha/beta, IQ4_XS FFN blocks) and Qwen3.5-0.8B-IQ4_XS therefore refused the CUDA prefill, the F2 guard rejected the GPU, and every lambda cell ran on the CPU (GPU 0%) into the 600 s timeout. Adds F16DequantKernel and Iq4XsDequantKernel. The values match the per-token GEMV weights bit for bit (device tests against the ggml reader). Refs #3715 Agent: aprender-ec Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ched prefill does not fit (#3715) 3c2a354 moved QK-norm models from the serial prefill to the chunked FP16 batched one. The FP16 weight cache is warmed on either path, but only batched also needs the prefill workspace. Qwen3-8B on the 24 GB 4090 has 4.7 GB of weights and a 15.1 GB FP16 cache, which leaves 0.1 GB, so init_prefill_workspace failed and a 2k chat turn fell back to the CPU (382 s, rg5 C-q38b-chat-2k). The path is now decided against the device before the cache is warmed: weights + cache + KV + prefill reserve over free VRAM keeps serial, as on the base. Qwen3-1.7B (about 9 GB of 23) stays batched. BATCHED_PREFILL still overrides. The resident-bytes estimate is shared with session_kv_len. Refs: #3715 Agent: aprender-ec Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 12, 2026
apr serve: /v1/chat/completions stream leaks <|im_end|> into delta content (1/14 CRUX prompts)
#4340
Closed
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fold for 0.70.0 (operator C218/C219/C220). One branch, merge commits only (no squash, no rebase, no force-push). Ticket: PMAT-4502.
build_corpusrow)Base: origin/main 430be65 (#4647). gdn_prefill_ops.rs = rc-rehearsal/0.70 e95e419 copy.
What is new versus the reviewed heads (the only part needing review):
make roadmap-aggregate). Local hook skipped under C205(3) for 3 files byte-identical to 8a8e721 (explain.rs, pretrain.rs, rosetta.rs), logged in the controls ledger.scripts/bump-version.sh --checkis all ok.Not armed. The cop arms.
^slowest:wall-clock lines. Review receipt db86acf.🤖 Generated with Claude Code
keep-open: #4621 closes with the last PR of the D3 split (C, the chat session KV), per #4620; #3715 is the parent operator ruling / SHACL release-readiness gate, cited by #4620 and #4614 and never closed by a child; #4616 (D5) is closed by hand after 0.70.0 is verified on crates.io, not on merge.
ont-delta: none — a fold of 5 already-reviewed PRs; the generated ontology set was regenerated once (f51e38e), and contracts/census.json stays with the release train (#3569), so this fold adds no ontology delta of its own.