feat(rex): land the review-experiment epic work on main (PMAT-4524)

.gitattributes

@@ -23,8 +23,16 @@
 #
 # scripts/check_append_only_ledgers.sh holds that distinction as a case table.
 docs/audits/*.jsonl merge=union
-# Append-only ledgers one level down. `docs/audits/*.jsonl` does not cross a `/`,
-# so these two resolved no merge driver (check_append_only_ledgers, after the
-# main merge into #4431). Named file by file: the scope rule above still holds.
-docs/audits/review-corpus/corpus-v1.jsonl merge=union
-docs/audits/rex-001/rex-04-admission.jsonl merge=union
+# rex/001 (#4354): the admission files are appended one row per cell, so they are
+# ledgers. `docs/audits/*.jsonl` does not cross a `/`, so they need their own line
+# (main named rex-04-admission.jsonl alone, after the main merge into #4431; this
+# glob covers it).
+docs/audits/rex-001/*.jsonl merge=union
+# The corpus (written whole by `rex corpus`) and the #4026 oracle captures (written
+# whole by c4026_live.sh) are single-writer goldens, not ledgers: a union merge of
+# two regenerations would interleave both versions' rows. Declared `audit-golden`,
+# so a two-sided change conflicts and check_append_only_ledgers.sh accepts them.
+docs/audits/review-corpus/*.jsonl audit-golden
+# PRM-S1 v2 (#4447): the frozen set and each build's replay rows are written whole
+# by `replay build` / `replay run`, so they are single-writer goldens, not ledgers.
+docs/audits/prm-001/s1-v2/**/*.jsonl audit-golden

Makefile

@@ -1565,6 +1565,21 @@ oracle-check: oracle
 	@git diff --exit-code tests/oracle/differential.json \
 	  || { echo "FAIL: tests/oracle/differential.json differs from a fresh run — commit it"; exit 1; }
 
+# PRA-001 §1 G14 (T0): read-only, one row per fleet host; UNREACHABLE fails the target.
+transcript-retention-audit:
+	@bash scripts/transcript_retention_audit.sh
+.PHONY: transcript-retention-audit
+
+# PRM-C13 (was PRA T13), lane-independence-v1: κ_err scoreboard of the shadow lane vs every
+# counted lane on matured gold SPLIT rows. With MANIFEST and CANDIDATE it gates (exit 12 = S-14).
+SPLIT ?= val
+MIN_N ?= 30
+lane-kappa:
+	@test -n "$(ROWS)" || { echo "usage: make lane-kappa ROWS=trace.jsonl [SPLIT=val] [MIN_N=30 | MANIFEST=m.json CANDIDATE=c.jsonl]"; exit 2; }
+	cargo run -q -p aprender-review-experiment --example rex -- lane-kappa "$(ROWS)" --split "$(SPLIT)" \
+	  $(if $(MANIFEST),--manifest "$(MANIFEST)" --candidate "$(CANDIDATE)",--min-n "$(MIN_N)")
+.PHONY: lane-kappa
+
 # ONT-001 §3.8 / ONT-2c — the OWL oracle (release gate only, R-13; never per PR). Three arms:
 # horned-owl re-parses the fixture's written .ofn and must equal the HAND-WRITTEN axiom list; every live
 # axiom must be a told-closure-admitted kind; ELK 0.4.3 (pinned by sha256, needs a JVM) must agree with

README.md

@@ -114,7 +114,7 @@ publishing — all backed by YAML provable contracts that fail CI on drift.
 | Metric | Count | Source of truth |
 |-------:|------:|---|
 | Workspace crates | **81** workspace crates | `cargo metadata --no-deps` (NOT `ls crates/` — 4 are `exclude`d, 1 has no Cargo.toml) |
-| Provable contracts | **<!-- CONTRACT_COUNT_START -->1903<!-- CONTRACT_COUNT_END -->** provable contracts | `contracts/census.json` `.n_files` — the set `pv lint` walks (`pv census`, ONT-001 ONT-1; regenerated by `make contracts`, written by `make readme-sync`, guarded by `scripts/check_readme_claims.sh`) |
+| Provable contracts | **<!-- CONTRACT_COUNT_START -->1922<!-- CONTRACT_COUNT_END -->** provable contracts | `contracts/census.json` `.n_files` — the set `pv lint` walks (`pv census`, ONT-001 ONT-1; regenerated by `make contracts`, written by `make readme-sync`, guarded by `scripts/check_readme_claims.sh`) |
 | CLI commands | **113** CLI commands | `contracts/apr-cli-commands-v1.yaml` §`commands` (parse the list; `apr --help` also lists `help` itself, and `grep -c '^  - name:'` gives 119 — other same-indent `name:` keys exist in the file) |
 | Book CLI chapters | **114** chapters | `ls book/src/cli/*.md` |
 | Book lib chapters | **73** chapters | `ls book/src/lib/*.md` (parity with `pub mod`) |
@@ -403,7 +403,7 @@ falsification_tests:
   prediction: apr validate bad-model.apr exits non-zero
 ```
 
-The tree carries <!-- CONTRACT_COUNT_START -->1903<!-- CONTRACT_COUNT_END --> contracts across inference, training, quantization, attention, FFN,
+The tree carries <!-- CONTRACT_COUNT_START -->1922<!-- CONTRACT_COUNT_END --> contracts across inference, training, quantization, attention, FFN,
 tokenization, model formats, CLI safety — and this README itself.
 
 ## Migration from old crates

contracts/agent-trace-terms-v1.yaml

@@ -0,0 +1,48 @@
+metadata:
+  version: 1.0.0
+  kind: schema
+  description: |
+    Provider-terms tagging for agent-trace-v1 rows (PRA-001 T12, spec §2.10, §9 P-TERMS;
+    agent-trace ruling 2026-09-25 items 1 and 7). Every row carries provider
+    {anthropic, google, local}, an exact model_id (never a family alias; a local model is
+    its weights sha256), access_channel {anthropic-api, claude-code-cli, antigravity,
+    gemini-api, vertex, apr-serve} consistent with the provider, and terms_ref {https url,
+    YYYY-MM-DD effective_date, RFC 3339 UTC fetched_at}. Any pool can be rebuilt without
+    a provider or channel through the first-class --exclude-provider / --exclude-channel
+    arguments. A row with a missing or inconsistent tag is REFUSED by every rebuild, since
+    an untagged row cannot be shown not to come from an excluded source. The public-release
+    default keeps local rows only (§2.11). This records the governing terms. It is not
+    legal advice; S-6 governs. Implementation: crates/aprender-review-experiment/src/terms.rs.
+  references:
+    - "docs/specifications/research-design-pr-agent-qwen-3.5.md"
+    - "contracts/training-pool-admission-v1.yaml"
+
+equations:
+  rebuild:
+    formula: "kept(R, X) = { r in R : gaps(r) = {} and provider(r) not in X.providers and channel(r) not in X.channels }"
+
+falsification_tests:
+  - id: FALSIFY-TERMS-001
+    name: pool_rebuild_excluding_a_provider
+    prediction: "P-TERMS: a rebuild of a six-channel batch with --exclude-provider google succeeds, keeps 0 google rows, and passes the rest through byte-identical"
+    test_harness: "cargo test -p aprender-review-experiment --lib falsify_terms_001"
+    expected_output: "exit 0"
+    if_fails: "A pool cannot be rebuilt without a provider, so provider terms cannot be honoured later."
+  - id: FALSIFY-TERMS-002
+    name: channel_exclusion_is_narrower_than_provider
+    prediction: "--exclude-channel antigravity drops only antigravity rows; gemini-api and vertex rows of the same provider stay"
+    test_harness: "cargo test -p aprender-review-experiment --lib falsify_terms_002"
+    expected_output: "exit 0"
+    if_fails: "Terms that differ by channel (App. A.7) cannot be applied separately."
+  - id: FALSIFY-TERMS-003
+    name: identity_case_table
+    prediction: "rows with a family alias, unknown or empty model_id, unknown provider or channel, a channel of another provider, a non-sha local model, or a missing/non-https/ill-dated terms_ref all have gaps; well-formed rows do not"
+    test_harness: "cargo test -p aprender-review-experiment --lib falsify_terms_003"
+    expected_output: "exit 0"
+    if_fails: "A row with unknown or aliased identity (G-ID) is accepted as tagged."
+  - id: FALSIFY-TERMS-004
+    name: untagged_row_is_refused_never_kept
+    prediction: "a row with gaps, or a non-JSON line, is refused by every rebuild, including one that excludes nothing, and is never in kept"
+    test_harness: "cargo test -p aprender-review-experiment --lib falsify_terms_004"
+    expected_output: "exit 0"
+    if_fails: "An untagged row slips past an exclusion filter it cannot be checked against."