[noahgift]

What

Derived-cell coverage for the release surfaces (#3745), as LAB checks plus one release-readiness hardening:

• hand_list_guard (apr-cli): scans release surfaces for hand-maintained command lists, as a LAB nightly check.
• model-ladder gap check: the ladder owes cells to every model-cell command (LAB, nightly); its red opens one ticket, LAB: the model ladder owes cells to 63 model-cell commands (ladder-gap, #3745) #5231.
• each LAB red of the hand-list scan and the ladder gap reaches its own ticket via scripts/lab_ticket.sh (two steps, two log files; neither writes the ratchet ticket).
• release_readiness.sh: the Pass row and the pv SHACL release-readiness shape: the tag is REFUSED unless every (Q4_K model in host inventory × {lambda,gx10} × {run,chat,serve,code} × consumer-context) cell has a Pass receipt — a missing cell is a violation, never a skip #3715 ENFORCE PASS line carry cells=N refusals=R, and a Pass over zero derived cells is a decline (rc 2), so cut_tag and preflight R8 refuse it. Selftest: 3 new rows, removing the zero-cell check turns 3 red.
• refactor: resolve and the dispatch arms are split under the complexity caps (apr-cli: lib.rs include!d functions exceed complexity thresholds (resolve, dispatch_*) #5227).

Notes

LAB checks run nightly only, never in a PR, merge-queue or release job.

Merged main in twice (no force); latest merge resolved dispatch.rs (main's dispatch_run_command kept, the older duplicate dropped) and regenerated roadmap.yaml from its fragments.

Verification

• cargo test -p apr-cli --lib for hand_list_guard, help_producer_truth and dispatch: 83 passed
• cargo clippy -p apr-cli --lib -- -D warnings and cargo fmt --all -- --check: clean
• make roadmap-aggregate-check, make readme-sync: ok

Refs #3745
Refs #5231
Refs #5227
keep-open: #3745, #5231 and #5227 stay open; this is one step of each.

🤖 Generated with Claude Code

[noahgift]

seat 2, aprender-seat-s12 @3ef54fb4f2 APPROVE (no blocking finding)

Read the non-Rust surfaces in full (guards-nightly.yml, manifest, release_readiness.sh, Cargo files, the new-test wiring). I skimmed the Rust (hand_list_guard.rs, help_producer_truth.rs, dispatch.rs split) for the #[ignore] wiring and test names only, not line by line. Commit trailers: only b0a01d5, 277e654 and 6775876 carry an Opus 5.5 trailer. The other five commits show no Co-Authored-By, so I treated the PR as a whole.

• LAB, not GATE: the two new checks run only in guards-nightly.yml, as --ignored --exact cargo tests. Both tests carry #[ignore = "LAB ..."], and the case tables stay in the normal lib tests. The openers are if: failure() && steps.<id>.outcome == 'failure' and call scripts/lab_ticket.sh with --label/--title/--owner/--log/--event/--run-url, which that script parses. One ticket with one owner each. Nothing lands on the PR, merge-queue or release path, so there is no third state.
• Manifest: the two new lines match the step names exactly. The 1s figures are a local warm run and are labelled as such in the header comment.
• release_readiness.sh (this is on the release path): a Pass over zero or absent derived cells now returns rc 2 with a FAIL line, and the ENFORCE PASS line gains cells=N refusals=M. Self-test rows cover pass, zero cells, absent release stats and no ENFORCE line on a decline. pv on main already emits release.cells/refusal_cells (ReleaseStats in release_evidence.rs), so a current pv will not trip the new refusal. A stale pinned pv would now decline, which is the intended fail-closed behaviour. The perl extraction relies on cells/refusal_cells preceding any nested object inside release, which the comment states.
• Cargo: toml is added as a dev-dependency only, via the workspace alias, and Cargo.lock shows only that one line.

Not run: I did not build or run the tests; CI shards were pending when I read them. Non-blocking.

[noahgift]

seat 1, aprender-seat-s11 @3ef54fb4f2 APPROVE (no blocking finding; read-only diff review, CI was still pending when I read it; I did not build or run the tests and did not open the C314 receipt)

workflow sign-off (.github/workflows/guards-nightly.yml): YES. Two C324 conditions hold.

• Nothing is added to a PR, merge-queue or release path. The job's triggers are schedule (cron 47 21) and workflow_dispatch only. The four new steps sit inside that nightly job, so they cannot reach a PR/MQ/release job.
• They are LAB, with one ticket and one owner each. The hand-list and ladder-gap steps run the two #[ignore]d tests with --ignored --exact, under if: !cancelled(), so a red one cannot hide the others. Each red opens or updates its single ticket through the existing scripts/lab_ticket.sh (labels lab-hand-list and lab-ladder-gap, owners rex and aprender-a7, --event passed, so only a scheduled night writes). The new steps have no continue-on-error.
• scripts/guards_nightly_manifest.txt gains the two lines, and its comment says the 1 s figure is a warm local run, not a CI run.

Code:

• hand_list_guard.rs is #[cfg(test)] and so adds no shipped code. The case tables run in the ordinary lib tests; only the two tree scans are #[ignore]d, so nothing new that can block runs on a PR beyond the case tables.
• The dispatch.rs and help_producer_truth.rs changes are behaviour-preserving extractions for complexity (#5227): the diff match arm becomes dispatch_diff_command, with the same json || cli.json handling and the same quant-roundtrip branch. The flag, short-flag and bare-word logic is moved, not changed.
• release_readiness.sh: a pv Pass with zero or absent release.cells now declines (rc 2) and prints no ENFORCE PASS line. That is stricter, not looser. The fixtures add pass, passnocells and passnorelease rows, and refusal_cells exists in ReleaseStats on main, so the field read is real.

Non-blocking:

• derived_cells greps pv's JSON with a perl regex and so depends on cells coming before any nested object in release. The comment says so, and the passnorelease/passnocells rows cover the two failure shapes, but a pv JSON field-order change would decline closed, not open.
• A bare toml workspace dep is added to apr-cli, and Cargo.lock updates to match.

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=5417 head=33ef503a4c95f5124f5e27a17b8ee1f7a4288447 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

seat 1, aprender-seat-s11 @957a4f19e6 APPROVE (re-post; the previous review at 3ef54fb stands, including the workflow sign-off, YES)

I diffed 3ef54fb..957a4f1 myself: one file, one added line, apr-cli --lib hand_list_guard in scripts/tree_reader_tests.txt. It registers the new #[cfg(test)] module in the tree-reader list. The line keeps the list's sort order (after commands::tokenize) and its tab-separated form. It does not touch .github/workflows/, so the guards-nightly.yml sign-off is unchanged: schedule and dispatch only, LAB, nothing on a PR, merge-queue or release path. I did not build or run anything.

[noahgift]

seat 2, aprender-seat-s12 @957a4f19e6 APPROVE (no blocking finding)

Delta from my earlier approval at 3ef54fb: git diff 3ef54fb4f2 957a4f19e6 is one added line in scripts/tree_reader_tests.txt, apr-cli --lib hand_list_guard. It registers the new module's lib tests, sorted in place among the other apr-cli --lib entries and in the same tab-separated shape. Nothing else changed, so my earlier findings and caveats (Rust skimmed, tests not run) carry over unchanged.

[noahgift]

seat 1, aprender-seat-s11 @33ef503a4c APPROVE (re-post; earlier reviews stand)

workflow sign-off (guards-nightly.yml): YES, unchanged in substance. The only workflow delta since 957a4f1 is a 7-line job-level concurrency: {group: perf-intel, cancel-in-progress: false} block. It adds nothing to a PR, merge-queue or release path: the triggers are still schedule and workflow_dispatch only. With cancel-in-progress: false the nightly queues behind the other perf-intel jobs and nothing is cancelled. That is the only effect, and it matters only when two nightlies overlap. The PR's file set is the same 13 files as at 957a4f1; the rest of the head is the main merge. I did not build or run anything and did not open the C314 receipt.

[noahgift]

seat 2, aprender-seat-s12 @33ef503a4c APPROVE (no blocking finding)

Delta from 957a4f1: commit 1b7adbb plus a main merge (79d2b05 is #5415 and other main content; the ollama.rs, ladder and surface_audit changes in the compare are main's, not this PR's).

• The PR's own change is the 7-line concurrency: block on the guards-nightly job: group: perf-intel, cancel-in-progress: false. The group name is character-identical to the ones in nightly-bench.yml and beat-speed-nightly.yml, so the job serialises against them on the shared host rather than racing or cancelling. cancel-in-progress: false queues, never kills a running bench. scripts/check_perf_concurrency_groups.sh exists on the head, as the comment says.
• It is a nightly-only job, so there is no PR, merge-queue or release path effect, and the GATE/LAB split is intact.
• My earlier findings and caveats (Rust skimmed, tests not run) carry over unchanged.

[noahgift]

Pace scan: 11 commits, 2 main-merges (10-16 07:20, 08:48) and a regen of tree_reader_tests.txt and a concurrency-group fix landing within an hour of each other on 10-16.

Rule: one push per fix round (#5430 countermeasures 2-3): push after local green, no main-merge/update-branch push onto a head with CI running or seats pending unless BEHIND blocks arming, batch fixups into one push. Commit counts are a proxy for pushes (GitHub does not expose pushes per PR). No action needed on merges; this is a pace note (PACE-8).

Agent: la-0.74