release: 0.67.0

[noahgift]

Release bump for 0.67.0 (06x release schedule §4.2): bump-version.sh 0.67.0 across every workspace, and the CHANGELOG section below.

When this merges, rel-067-autopilot/autopilot.sh runs the rest of the release-day protocol, fail-closed: pre-publish dogfood, tag, release, all sixteen assets checked with scripts/check_release_assets.sh, the crates.io cascade, host receipts on gx10 and yoga, and the epic and milestone close.

0.67.0 is the first train of the 06x schedule (docs/specifications/06x-release-schedule.md, epic #3078): a release every 2–3 days whose PR tier is one build graph and whose CI runs on all three self-hosted boxes. Correctness: every Q5_K tensor decoded wrong on the CPU path, in apr import and in the CUDA GEMV — all three readers had invented a layout; the oracle is now gguf-py on a real block (#3110, #3113). Qwen3.5/Qwen3.8 hybrid GGUFs are refused honestly on both backends instead of promising a CPU fallback (#3099; the CPU forward itself ships in 0.68 behind the parity gate, #3091). aarch64: NEON LZ4 read unwritten output at offsets 16..63 (#3103) and the ARM-only clippy errors that kept gx10 out of ci / lint are gone (#3112). Fleet: arch-neutral jobs run on any clean-room box — intel, yoga, gx10 (#3104); every self-hosted job checks the box's toolset before spending an hour (#3088); guard-cargo/guard-tree fit the 20-minute budget with seven nightly-class steps moved to guards-nightly.yml (#3094); advisory gpu-quick (gx10) and cuda-unit (yoga) PR jobs (#3095); the quick tier is one nextest invocation, 55 min → ~6 min, and the merge queue mirrors the PR (#3089); tree-reader modules cut quick-tier seconds 93 % → 58 %, the 2-h mutant arm sweep is input-gated, and DIRTY roadmap conflicts merge by id (#3115). Release integrity: four apr binaries on every tag ({cuda,cpu} × {x86_64,aarch64}) verified by check_release_assets.sh (#3092); every workspace example must build AND run before a tag, plus apr-cookbook and release-notes gates (#3122); a low-priority nightly coverage run on yoga toward the 95 % target (#3123). Dark targets: the quick tier runs every integration target of a touched crate, which surfaced 77 vacuous spec_checklist rows (#3131), 20 stale aprender-serve rows (GH-438 dtype bytes, PMAT-855 byte glyphs, GH-213 load-time truncation, CRUX-C-34 health codes, GGUF v2 support) and one wall-clock benchmark posing as a test — now behind bench-gates. Triage: every open issue and PR carries a milestone and a type + priority label (#3102, #3125).

The seventeen rows below marked via train #3127 landed as one squash (cb829fc, 2026-09-12T09:12Z, merge-queue run 34684644616); their row PRs are closed as ancestors of the train head, not merged, so a merged-PR listing alone would miss them.

Added

• feat(PMAT-1095): 0.67 CUDA Rust fleet readiness — fix the two wrong-host GPU tests, add scripts/cuda_rust_fleet_check.sh with per-host receipts (gx10 PASS, yoga PASS, lambda-vector blocked on a reboot) (feat(PMAT-1095): 0.67 CUDA Rust fleet readiness — fix the two wrong-host GPU tests, add scripts/cuda_rust_fleet_check.sh with per-host receipts (gx10 PASS, yoga PASS, lambda-vector blocked on a reboot) #3068)
• feat(gpu): O2 — arm the register_budget contract, vacuous since 2026-04-06 (feat(gpu): O2 — arm the register_budget contract, vacuous since 2026-04-06 #3064)
• feat(experiments): T3 — cutile-rs vs hand-PTX RMSNorm A/B on GB10 sm_121 (parity yes, faster no) (feat(experiments): T3 — cutile-rs vs hand-PTX RMSNorm A/B on GB10 sm_121 (parity yes, faster no) #3065)

Fixed

• fix(compute,aarch64): gx10 could not run ci / lint — ARM-only clippy errors, and Q4_K GEMV has no aarch64 SIMD and its "parallel" variant calls the scalar path #2567's parallel Q4_K path was never called (PMAT-1102) (fix(compute,aarch64): gx10 could not run ci / lint — ARM-only clippy errors, and #2567's parallel Q4_K path was never called (PMAT-1102) #3112, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• fix(guard): spec-conformance fixtures are bytes — the zero-width key rendered only under a UTF-8 locale (fix(guard): spec-conformance fixtures are bytes — the zero-width key rendered only under a UTF-8 locale #3109, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• fix(quantize): Q5_K readers decoded an invented layout — every Q5_K tensor on the CPU path and in apr import was wrong (PMAT-1101) (fix(quantize): Q5_K readers decoded an invented layout — every Q5_K tensor on the CPU path and in apr import was wrong (PMAT-1101) #3110, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• fix(cuda): the Q5_K GEMV read each value's fifth bit from a sequential bitmask — every Q5_K tensor decoded wrong on the GPU (CUDA Q5_K gemv/gemm read a non-ggml block layout (qh bit order; gemm also qh/qs offsets and scale unpacking) #3111) (fix(cuda): the Q5_K GEMV read each value's fifth bit from a sequential bitmask — every Q5_K tensor decoded wrong on the GPU (#3111) #3113, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• fix(gguf): Qwen3.5/Qwen3.8 hybrid GGUFs — the refusal names BOTH backends and the CLI stops promising a CPU fallback (CPU: Qwen3.5 / Qwen3.8 hybrid GGUFs are refused entirely — no fallback exists #3091 ask 2, GPU: implement Gated DeltaNet / SSM inference for Qwen3.5 / Qwen3.8 hybrid GGUFs #3090 related; PMAT-1098) (fix(gguf): Qwen3.5/Qwen3.8 hybrid GGUFs — the refusal names BOTH backends and the CLI stops promising a CPU fallback (#3091 ask 2, #3090 related; PMAT-1098) #3099, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• fix(tests): eight spec_checklist targets read repo paths from the crate dir — 77 vacuous rows now read the tree (Dark-in-FULL, light-in-QUICK: tree-reading integration tests read repo paths from the crate dir — 4 targets failed on first run today, 77 more sites are vacuous #3130) (fix(tests): eight spec_checklist targets read repo paths from the crate dir — 77 vacuous rows now read the tree (#3130) #3131, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• fix(compute): nine GPU tests panicked without an adapter — the nightly coverage run was RED six days on an environment fact (PMAT-1106) (fix(compute): nine GPU tests panicked without an adapter — the nightly coverage run was RED six days on an environment fact (PMAT-1106) #3116, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• fix(ptx): emitter was non-deterministic — the cubin cache has NEVER hit (42,880 stale cubins / 498 MB) (fix(ptx): emitter was non-deterministic — the cubin cache has NEVER hit (42,880 stale cubins / 498 MB) #3066)
• fix(zram-core,aarch64): NEON LZ4 match copy read unwritten output at offsets 16..63; orchestrate test hard-coded an x86_64 'native' target (gx10 CI P0, PMAT-1098) (fix(zram-core,aarch64): NEON LZ4 match copy read unwritten output at offsets 16..63; orchestrate test hard-coded an x86_64 'native' target (gx10 CI P0, PMAT-1098) #3103)
• fix(serve,x86): AVX2 Q4_K×Q8_K kernels paired each block with the wrong scale — no CI box ever ran them (fix(serve,x86): AVX2 Q4_K×Q8_K kernels paired each block with the wrong scale — no CI box ever ran them #3106)

Changed

• ci(fleet): workspace-test runs on any clean-room box — gx10 measured 3–4× faster than intel; four aarch64-only reds fixed; tree-reader step builds 20 packages, not 686 binaries (PMAT-3138) (ci(fleet): workspace-test runs on any clean-room box — gx10 measured 3–4× faster than intel; four aarch64-only reds fixed; tree-reader step builds 20 packages, not 686 binaries (PMAT-3138) #3139; receipt evidence/ci/arm64-workspace-test-2026-09-12/gx10-summary.txt)
• perf(ci): pr-review-receipt is dispatch-only — 96 h of fleet runner-time for a job that gates nothing (PMAT-1078) (perf(ci): pr-review-receipt is dispatch-only — 96 h of fleet runner-time for a job that gates nothing (PMAT-1078) #3046)
• dogfood(examples): G3.EX found a dead example, an undeclared feature gate and a panicking benchmark — coop_gemm_bench deleted with its feature, prose_detection gets required-features, bench_bpe prints usage (dogfood(examples): G3.EX found a dead example, an undeclared feature gate and a panicking benchmark — coop_gemm_bench deleted with its feature, prose_detection gets required-features, bench_bpe prints usage #3136)
• ci(cuda-nightly): 67-F1 — PP-26 byte-compare via REST with the job token; gx10 host receipt (ci(cuda-nightly): 67-F1 — PP-26 byte-compare via REST with the job token; gx10 has no gh (#3096 filed for the witness itself) #3097)
• ci: arch-neutral jobs run on any clean-room box (intel, yoga, gx10); workspace-test keeps X64; perf benchmarks pin intel (P0-4: aprender builds on ANY of intel/gx10/yoga — a shared build pool label, host-layout parametrized, yoga joins the x86 pool first, gx10 after an arm64 sovereign-ci image (operator 2026-09-10) #3100) (ci: arch-neutral jobs run on any clean-room box (intel, yoga, gx10); workspace-test keeps X64; perf benchmarks pin intel (#3100) #3104, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• ci(67-C2): every self-hosted job asks the box what it has before it spends an hour — ci_self_hosted_preflight.sh + fleet-toolset.yml (P0-2 P0-2: self-hosted boxes carry no gh and nothing checks the toolset a workflow assumes — the CUDA backfill built green on gx10 and failed at upload (67-C2) #3083, PMAT-1098) (ci(67-C2): every self-hosted job asks the box what it has before it spends an hour — ci_self_hosted_preflight.sh + fleet-toolset.yml (P0-2 #3083, PMAT-1098) #3088, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• perf(ci): 67-E3 — guard-cargo and guard-tree under the 20-minute budget: 7 nightly-class steps move to guards-nightly.yml, guard_tree.sh dispatches in parallel (289 s → 96 s) ( (perf(ci): 67-E3 — guard-cargo and guard-tree under the 20-minute budget: 7 nightly-class steps move to guards-nightly.yml, guard_tree.sh dispatches in parallel (289 s → 96 s) (PMAT-1098) #3094, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• ci(gpu): 67-C1/D1 — advisory gpu-quick (gx10) and cuda-unit (yoga) PR jobs that skip the hosts a change does not touch (ci(gpu): 67-C1/D1 — advisory gpu-quick (gx10) and cuda-unit (yoga) PR jobs that skip the hosts a change does not touch #3095, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• ci(release): P0-1 — four apr binaries on every tag ({cuda,cpu} × {x86_64,aarch64}), verify-apr-assets requires all four, check_release_assets.sh + C13 + a post-publish dogfood r (ci(release): P0-1 — four apr binaries on every tag ({cuda,cpu} × {x86_64,aarch64}), verify-apr-assets requires all four, check_release_assets.sh + C13 + a post-publish dogfood row (67-A1, #3082, PMAT-1098) #3092, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• spec(release): 06x release schedule — 0.67.0→0.70.0 every 2–3 days, one epic per train, priorities A–G with acceptance commands; contract + drift gate (PMAT-1097) (spec(release): 06x release schedule — 0.67.0→0.70.0 every 2–3 days, one epic per train, priorities A–G with acceptance commands; contract + drift gate (PMAT-1097) #3087, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• docs(audits): PMAT-1100 triage receipt — every open issue/PR without a milestone filed into a release train (263 rows, 33/33 verified; Alfredo's first) (docs(audits): PMAT-1100 triage receipt — every open issue/PR without a milestone filed into a release train (263 rows, 33/33 verified; Alfredo's first) #3102, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• dogfood(release): every example builds AND runs, apr-cookbook and release-notes gates, nightly examples on yoga (PMAT-3121, pre-release dogfood: every workspace example builds AND runs, apr-cookbook updated, release notes written — three rows on every tagged release (operator 2026-09-11) #3121) (dogfood(release): every example builds AND runs, apr-cookbook and release-notes gates, nightly examples on yoga (PMAT-3121, #3121) #3122, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• ci(coverage-nightly): low-priority coverage run on the yoga pool, timeout 150 min (operator 2026-09-11: nightly low-priority coverage toward 95%) (ci(coverage-nightly): low-priority coverage run on the yoga pool, timeout 150 min (operator 2026-09-11: nightly low-priority coverage toward 95%) #3123, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• audit(triage): PMAT-3124 — the 72 unlabeled open issues now carry a type + priority label; 0 remain (Triage pass: label the 72 open issues that carry no label (constant triage, operator 2026-09-11) #3124) (audit(triage): PMAT-3124 — the 72 unlabeled open issues now carry a type + priority label; 0 remain (#3124) #3125, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• docs(spec): NVIDIA CUDA Rust integration for GPU quality stabilization (0.67) (docs(spec): NVIDIA CUDA Rust integration for GPU quality stabilization (0.67) #3061, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• ci(release): the workspace target/ mountpoint is pre-created before the bullseye CUDA build — the root-owned mountpoint killed rebuilds (ci(release): pre-create the workspace target/ mountpoint before the bullseye CUDA build — the root-owned mountpoint killed rebuild 34488955316 at mkdir #3098, via train release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)
• perf(ci): P0-3 — the quick tier is ONE build graph (55 min → ~6 min) and the merge queue mirrors the PR instead of paying an hour for a moved main (67-E1 + 67-E2, P0-3: a one-file YAML change costs two full workspace-test trips — 55-min serial quick tier + a FULL merge-queue rerun whenever main moved (67-E1/E2) #3084, PMAT-1098) (perf(ci): P0-3 — the quick tier is ONE build graph (55 min → ~6 min) and the merge queue mirrors the PR instead of paying an hour for a moved main (67-E1 + 67-E2, #3084, PMAT-1098) #3089)
• ci(fleet): sweeper+steward+ledgers, roadmap 3-way merge driver, 80/20 tier filterset, tree-reader MODULES (93%→58% quick-tier seconds), 2-h arm sweep input-gated (PMAT-1105/3118/3119/3120) (ci(fleet): sweeper+steward+ledgers, roadmap 3-way merge driver, 80/20 tier filterset, tree-reader MODULES (93%→58% quick-tier seconds), 2-h arm sweep input-gated (PMAT-1105/3118/3119/3120) #3115)
• release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) (release(0.67): train A — 17 row PRs of the 0.67.0 train in one build graph (PMAT-1098) #3127)

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3145 head=aa61219ef8b32232ec1ab8a9ff81f36fac187e0a verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.