feat(laya-train): LT-0 reads + rule checker for APR-LAYA-TRAIN-001 (Refs #4002)

[noahgift]

LT-0 of APR-LAYA-TRAIN-001: the reads and the rule checker for epic E8.

• scripts/check_laya_train_rules.sh: the hard rules as a diff checker (base..head), with --self-test planting 35 cases (each rule has a RED plant and a PASS control). H4 exempts exactly the LT-1 probe path. H15 matches plain substrings and skips only the checker's own path.
• ci/explicit-test-commands.d/795-laya-train-rules-self-test.cmd: runs the self-test in CI.
• evidence/laya-train/lt-0/{report.md,receipt.json}: the LT-0 reads and the receipt.

Checks run on this head: checker self-test PASS (35), --base origin/main RESULT PASS, cargo fmt --check, cargo test -p aprender-contracts --lib 2292/0, cargo deny check advisories ok.

Not armed: main is frozen to the 0.71.0 tag; a3 runs the checker and arms after UNFREEZE.

Refs #4002
keep-open: #4002 is the E8 epic; LT-0 is its first row of eleven.

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=5161 head=ca89c62ae7079a970a47d88c05ad3f2e3ffdad2c verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

Non-author review seats on head c7e1373aa0 (author: Claude Opus 5.5)

• Seat A (Sonnet), PASS. The rule checker was reviewed on 7a08cec: 35/35 self-test, and mutation plants on H15, H4 and H10 each turn the self-test red. The delta to c7e1373 touches only evidence/laya-train/lt-0/report.md, and the corrected counts re-derive.
• Seat B (Haiku): FAIL on 7a08cec, because the train counts said 16/5 where the table gives 14/4. FAIL on 9194cb4, because a quoted grep with an escaped pipe returned 0. Both are fixed, and it is PASS on c7e1373. Counts re-derived: core 9/1, train 14/4, G8 55/6 at e7730a3, G22 170 at main_sha e39f91a, self_test_cases 35.
• Checker on this head: --base origin/main RESULT PASS; --self-test SELF-TEST PASS.

Not armed. a3 arms on GO.

[noahgift]

Seats rebound on head 6715547. Delta from c7e1373: d2b6dc7, plus a merge of main that adds no files to the PR diff.

• Seat A (Sonnet): PASS. grep -Eq PAT <<<"$body" still matches line by line, so the ^ anchor works as before, and the H10 -n test is equivalent. The self-test passes. check_no_pipe_into_grep_q is at 60 of 60, check_guards_are_wired passes, and guard_tree --dry-run --no-cargo lists the checker. A planted H5 mutant turns the self-test FAIL. Note: plant-dirty goes RED from the --allow-dirty flag alone, so BUILD_WORD only affects how guard_tree classifies the checker.
• Seat B (Haiku): PASS. Only 4 files differ from main. The four rewrites keep their meaning, and no threshold or rule changed. The self-test and both guards pass, each with rc=0.

Neither seat is the author's model id (the author is Opus).

[noahgift]

seat 1, aprender-a7: HOLD @ 6715547

The checker is sound, and I would approve it as-is once the text below is fixed.

• --self-test passes 35/35 at this head. --base origin/main --head HEAD gives RESULT PASS.
• I read all eight rules. Each one has a RED plant and, where it matters, a PASS control. The H4 and H15 exemptions match exact paths, and the lookalike plants (laya_engine_probe2.rs, check_laya_train_rules2.sh) prove it.
• The self-test runs only in a mktemp repo, with its root checked and GIT_CEILING_DIRECTORIES set.

Holding for public-text hygiene only. Each line below is in a file this PR adds to the public tree:

• scripts/check_laya_train_rules.sh:31 and :36 cite internal coordination notes (a ruling id and two private note paths). Please keep the reason and drop the citation, e.g. "H15 skips exactly this file by path: it must name the forbidden needles to plant them."
• evidence/laya-train/lt-0/report.md:163 and :166 have the same two citations.
• evidence/laya-train/lt-0/report.md:3 and receipt.json:8 name the machine. A generic description (thread count and RAM) is enough.
• evidence/laya-train/lt-0/report.md:139 names runner labels.

The privacy scanner flags report.md:3, report.md:139 and receipt.json:8. The other citations are the same kind of text. The new commit voids seats in any case, so I will re-review the new head.

Non-blocking:

• H12 checks only added files. A modified file that grows past the cap is not caught.

[noahgift]

seat 2, aprender-df APPROVE @ 6715547

Read: the full diff against the merge base (4 files, +555): the rule checker, its CI self-test fragment, and the LT-0 report and receipt.

The four PR files are byte-identical between the signed commit bb57ca4 and this head (git diff over those paths is empty). The head only adds a merge of main, so the C314 sign-off (re-bound by a3 to bb57ca4) carries over.

Checker review:

• Each rule's arm prints what it looked at (path counts, receipt presence, largest added file), so a PASS over an empty diff is visible as such.
• H4: the exemption is an exact path match for the LT-1 probe; the lookalike plant (laya_engine_probe2.rs) and probe-plus-crate plant both go RED.
• H15: matches plain substrings anywhere on an added runner line (12 RED placements), and skips exactly the checker's own path; a lookalike path stays RED.
• H5 and H10 are n/a until LT-1's receipt and LT-9's declaration land on the base, and they have their own planted RED and PASS rows for when they do.
• The self-test runs only in a mktemp repo under a git ceiling, and its rm is guarded with ${ST:?}. The hooks-path override in st_commit applies only to that throwaway fixture repo.
• The CI fragment runs only the self-test: git-only, fixture-local, deterministic.

Measured at this head, on a clean checkout verified equal to 6715547:

• bash scripts/check_laya_train_rules.sh --self-test -> SELF-TEST PASS, 35 ok, 0 FAIL, rc 0
• bash scripts/check_laya_train_rules.sh --base --head HEAD -> RESULT PASS, rc 0 (H1 H2 H4 H11 H12 H15 PASS; H5 H10 n/a)

Advisory, non-blocking: H10 compares run_started_utc with the committer time of the commit that added the declaration. Under the squash queue that is the merge time, which is what the rule wants; a rebase that rewrites committer times would move it.

This seat is the review only; arming stays with a3.

[noahgift]

seat 1, aprender-a7: APPROVE @ 7fa07ed

Delta since my HOLD at 6715547: one commit, three files, 9 lines changed, and every one is a line I flagged. The internal citations and the machine and runner names are gone, and the reasons are kept.

Checked at this head:

• --self-test passes 35/35. --base origin/main --head HEAD gives RESULT PASS.
• The privacy scanner finds 0 hits in the script, report.md and receipt.json.
• The PR still touches only the checker, its CI command fragment and evidence/laya-train/.

The rule review from my previous comment still applies. On the two items the author raised:

• Two older commit messages carry internal ids. This does not block. Main already carries such ids in commit messages, so a re-cut on a new branch would cost more than it fixes.
• "the cop" (report, sec h) and the Q1-Q4 list in the receipt are generic role and question labels with no paths. They do not block either.

Non-blocking:

• The PR body still cites an internal sign-off note path. It can be edited without a new commit.
• H12 checks only added files, as noted before.

[noahgift]

seat 2, aprender-df APPROVE @ 7fa07ed

Re-seat on the new head; my review on 6715547 is void.

Delta 6715547..7fa07ed (one commit, 3 files, +9/-9, comments and prose only):

• receipt.json: the machine name is replaced by a hardware description.
• report.md: the machine name, the runner labels and the two internal citation paths are removed; the rule text is otherwise unchanged.
• check_laya_train_rules.sh: two comment lines lose their internal citation paths. No code line changed, so the self-test and real-run results from the previous head carry over: SELF-TEST PASS 35/35, and RESULT PASS rc 0 against the merge base.

Privacy rescan of all four public files at this head: no internal paths, machine names, runner labels, citation ids, session names or e-mail addresses remain. The only pattern matches left are the ordinary English verb in report.md table cells and the H4 PASS message, which are not private.

Advisory, non-blocking: "the cop" still appears as a role name (checker header line 7, report.md lines 152, 170, 175). It names no person, machine or path; a neutral wording such as "the reviewer" would read better for outside readers.

CI at post time: shards 2 and 3 and mg-reuse-self-test green; shard 1 and x86-main still running. This seat is the review only; arming stays with a3.

[noahgift]

seat 1, aprender-a7: APPROVE @ ca89c62

Delta since my approval at 7fa07ed is one commit, scripts/check_laya_train_rules.sh only (+58/-8).

• The range is computed once (RANGE). Every diff call uses it in place of a hard-coded base...head.
• With no merge base (a shallow pull-request merge clone), it uses base..head only when base is the first parent of head, read from the raw commit object. Anything else exits 2. That is the right shape: on a merge commit, the first-parent tree diff is exactly the pull request's merged change.
• st_shallow adds two cases. In both, main adds a .py the pull request does not own. plant-py-shallow is RED (x.py) and clean-shallow is PASS, which proves the main-side file is not counted. Both also require "diff first-parent" in the output, so the shallow path is shown to engage.

Checked at this head:

• --self-test passes 37/37.
• --base origin/main --head HEAD gives "diff merge-base" and RESULT PASS.
• bashrs lint: 0 errors, no SC1066.
• The privacy scanner finds 0 hits.
• Fail-closed probe (my own throwaway repo): a depth-1 merge clone with its SECOND parent passed as --base exits 2 with "no merge base ... is not the first parent of a merge head".

Non-blocking:

• No self-test row plants the exit-2 path. I covered it by hand above.
• On a shallow clone, H10's git log --diff-filter=A <base> sees the graft commit as adding every file, so the declaration time reads as the base commit's time. That can only make H10 stricter, never looser, and H10 is n/a until LT-9 lands.

[noahgift]

seat 2, aprender-df APPROVE @ ca89c62

Re-seat on the new head; my review on 7fa07ed is void.

Delta 7fa07ed..ca89c62 (one commit, scripts/check_laya_train_rules.sh, +58/-8):

• Every diff now goes through one RANGE. It is base...head when a merge base exists, which is unchanged behaviour.
• With no merge base, as in a shallow pull-request clone, it falls back to base..head only when the head is a merge commit whose first parent, read from the raw commit object, is the base. That tree diff is exactly the pull request's side. Any other case prints why and exits 2, so it fails closed and never guesses a range. The header line names which diff was used.
• st_shallow builds that CI shape: main gains a .py the PR does not own, a no-ff merge, a depth-1 clone, and the first parent fetched alone. plant-py-shallow must be RED and clean-shallow must PASS, which proves main's file is not attributed to the PR. It also requires the header to say first-parent, so a silent three-dot fallback cannot pass. The clones live under the fixture dir and are excluded from its git add.
• The SC1066 fix is the H4 arm string: "exempt=N (path)" instead of "path=N".

Measured at this head, on a clean checkout verified equal to ca89c62:

• --self-test -> SELF-TEST PASS, 37 ok, 0 FAIL, rc 0 (35 earlier rows + plant-py-shallow RED + clean-shallow PASS)
• --base --head HEAD -> "diff merge-base", RESULT PASS, rc 0
• --base --head HEAD -> rc 0
• Privacy scan of the added lines: clean.

Advisory, non-blocking: the exit-2 branch (no merge base and the base is not the first parent) has no self-test row. One more st_ row with an unrelated base would pin it.

This seat is the review only; arming stays with a3.