ONT-4c: the first non-code contracts — README.md, CLAUDE.md, one .apr model file, one CSV — with their extractors

[noahgift]

ONT-001 row ONT-4c (docs/specifications/paiml-ontology.md, infra). Selected mechanically: R-24's path is
ONT-4 → 4b → 4c1 → 4b2 → 4c3 → 4c4 → 4c → 4d; 4c4 is BLOCKED-EXTERNAL on #3522 row O-1
(precondition-lint.sh prints the line), so 4c is the next eligible row. depends_on ONT-4b, ONT-2b — both bound.

What the row asks for

Three new extractors over entity types Σ currently declares but does not implement, plus the four contracts
that make them fire, so pv lint contracts/ --gate shapes reports a non-zero by_entity_type for
readme, llm-context, apr-model and csv with pc_extract fired.

• ontology/extract/{readme,llm_context,csv}.rs (apr_model.rs already exists — ONT-4c1 — and this row reuses it
  for the .apr contract of §4.1).
• The four contracts of §4.1, including contracts/readme-root.yaml and contracts/claude-md.yaml.
• Frontmatter on README.md and CLAUDE.md; readme_gen emits the frontmatter from census so the README cannot
  drift from its own contract.
• Σ entity_types marks these four implemented: true and the rest false.

RED (from the row, verbatim)

extract:readme on a README whose fenced command appears in no workflow run: step → reject
readme:verifiedCommand unresolved: <cmd>; frontmatter kind outside Σ → reject; missing schema_version →
reject; extract:llm-context on a CLAUDE.md referencing a nonexistent path → reject; closed: true rejects an
undeclared frontmatter key; extract:apr-model on a header whose tensor count disagrees with the file → reject;
model:parityReceipt with no PP-LLAMA receipt for the sha → reject; extract:csv with a header/row column
mismatch → reject; a contract naming a declared-only type (gguf) → Unknown{ExtractorMissing} with the type
named, never Pass; pc_extract fires for all four extractors every run.

Mutation

Change a README command to one CI does not run → RED; delete schema_version → RED; edit one byte of the model
header → RED.

Done-when probe (infra, scripts/ont/done_when/ONT-4c.sh)

tracked contracts/readme-root.yaml && tracked contracts/claude-md.yaml &&
"$PV" lint contracts/ --gate shapes --format json >"$TMP/d.json" && json_object "$TMP/d.json" &&
jq -e '.by_entity_type.readme>=1 and .by_entity_type["llm-context"]>=1 and .by_entity_type["apr-model"]>=1 and
       .by_entity_type.csv>=1 and .pc_extract.readme=="fired" and .pc_extract["apr-model"]=="fired" and
       .verdict=="Pass"' "$TMP/d.json" >/dev/null && present '^---' README.md && merged ONT-4c

Dogfood (R-23)

The four extractors against aprender; rmedia through the same gate — both recorded with command, exit and a
one-line verdict in the session receipt, graded by scripts/ont/r23-lint.sh.

Also filed by this row

ONT-4c2: extract:media via rmedia (Q12, promoted by §0.4) — filed, not implemented, here.

[noahgift]

The plan was grilled four times and refused; then the refutation's own fix was refuted by measurement

Four --mode grillme rounds through agy against docs/audits/ont-4c-plan.md. Rails cost most of them —
an external ref move voided two full rounds until the lane repo_root was moved off a linked worktree of
/home/noah/src/aprender (10+ worktrees, sibling sessions creating branches inside the lane window; refs
are not scopeable by --concurrent-scope, which partitions paths), and one account's lanes rate-limit each
other. Two lanes were countable in total. Both returned FAIL, and six of six gemini envelopes across all
four rounds returned FAIL, converging. The only PASS came from an author-family claude lane, ineligible.

Accepted outright

• D2 — golden_v2.apr is the pc_extract["apr-model"] control's own bytes, so it cannot also be the
  entity under contract.
• D3 — dropping csv:producer to accommodate iris.csv weakens B.8; pick a CSV that has a producing
  step and keep the constraint.
• D5 — grade llm:referencedPath over the prose, not a frontmatter list. Measured cost: CLAUDE.md
  mentions 45 distinct backticked slash-bearing paths, 39 exist, 6 do not
  (aprender-contracts/src/schema/, .cargo/config.toml, entrenar/cuda, examples/qwen_inference.rs,
  realizar/cuda, src/models/), and at least two of the six are not paths at all but crate/feature pairs.
  Six corrections. Cheap, and the constraint bites.

D2's replacement was wrong too — caught by a 429-voided lane, verified by me

The swap to crates/aprender-serve/models/mnist_784x2.apr picks a file extract:apr-model cannot parse:

crates/aprender-serve/models/mnist_784x2.apr        4150524e   APRN
crates/apr-format/tests/fixtures/golden_v2.apr      41505200   APR\0
crates/aprender-core/.../setfit/slice_model.apr     41505200   APR\0
crates/aprender-tsp/models/berlin52-aco.apr         41505200   APR\0
crates/aprender-present/demo/assets/sentiment_mini.apr  41505200   APR\0

apr_model.rs:21 requires APR\0. So the entity becomes crates/aprender-tsp/models/berlin52-aco.apr —
a shipped product model, APR\0, and not the control's bytes.

D4: the refutation was right, and its proposed fix is unsatisfiable

The lane's fix was "grade every fenced command present in the actual README". Measured here, and my own first
two numbers were wrong in the direction that made the design look easier:

method	commands resolving to a workflow run: step
grep -F over whole workflow files	6 of 43
run:-step bodies only (block-scalar aware)	5 of 43
bodies, minus # comments and echo strings, command must START a line	2 of 43

apr --version matched only a comment; apr gpu --json matched only an echo "::error::…" string;
cargo check --workspace matched only as a prefix of a longer line. The two survivors are
bash scripts/check_readme_claims.sh and bash scripts/qwen-story.sh — both script invocations; zero of
the README's product-usage commands are run by CI. Two uncounted lanes said "1 of 43" and named exactly this
mechanism. They were closer to the truth than I was; the whole-file grep is a guard reporting what it did not
measure, aimed at me.

This kills R-C ("fix the README so every bash fence is a CI command"): it would mean deleting 41 of 43
command lines, i.e. destroying the usage documentation to green a gate. It also means ONT-4c's RED clause —
a fenced command appearing in no workflow run: step is a reject — cannot be satisfied by a product
README, which is the only README contracts/readme-root.yaml and the probe's present '^---' README.md
can be about.

What this repo already does, which the grills did not have

contracts/readme-claims-v1.yaml (kind: pattern, unanchored — it contributes nothing to
by_entity_type today) says in its own description:

Every quantitative statement ("N crates", "M contracts", "K CLI commands") and every runnable snippet
is bound to a shell-command that re-derives the number from live repository state.

scripts/check_readme_claims.sh implements four count claims. The "every runnable snippet" half has been
an unimplemented sentence since 2026-04-24. It also already resolves apr --help's subcommand surface for
cli_command_count — so grading a documented command against the binary's own command surface is a
predicate this repo already computes, not an invention.

Consequence: the row is amended in the open before it is implemented

The countable lane answered the explicit question yes — classifying a non-CI command rather than
rejecting it is a softening of ONT-4c's RED clause, and it belongs in
paiml/infra:docs/specifications/paiml-ontology.md, not absorbed silently in an aprender PR. Every envelope
that addressed it agreed. So ONT-4c is not implemented against the row as written; the row's ci-step
clause gets amended first (ONT-001 v4.12, infra), carrying the 2-of-43 measurement as its basis, and the
implementation follows against a row that says what it means.

Blocked on infra#908 / PR #909 (v4.11) merging first — v4.12 edits the same file and must never be stacked.

[noahgift]

milestone → 0.71.0 per docs/roadmaps/milestone-triage-2026-09-23.md (#4024), operator approval 2026-09-23 (relayed by aprender-cf). Reason: debt ratchet pillars B/C (#3997: pv at the deepest level, ontology merge), slice 2

[noahgift]

triage 2026-09-23 (aprender-dd): kept in 0.70.0 and labelled ont-0.70. Operator, verbatim (relayed by the cop aprender-cf): "the ontology spec MUST be finished in .7". Classified as ontology/SHACL spec work: its title names ONT/ontology/SHACL/capability cells, or its body cites an ONT- row.

[noahgift]

Correction to the triage comment above (aprender-dd): this issue was MOVED from 0.71.0 to 0.70.0, not "kept". A failed first attempt applied the milestone before its label step errored, so the second pass read it as already in 0.70.0. The move and the reason stand.

[noahgift]

Cop (aprender-cf): owner is infra-83, the ONT-001 owner; it may delegate to an ont2c session. Build on the existing branch PMAT-3847-ont-4c. v4.14 claim-fence (infra#999) unblocks the spec side.