feat(parity): L0-1a — every supported model computes the same function on GPU as on CPU or the GPU refuses it (manifest, C14, REG-15 admission, effective-config parity)

[noahgift]

Ticket

#2971 (alfredodeza's report; P0; DAG row L0-1a, ticket PMAT-1065, epic #2873). #3017 was closed as its duplicate.

Claim

Claim 2 of 0.66, the bounded half: every model in evidence/models/supported.yaml (derived, never typed) is measured over ≥ 64 positions against a threshold that carries its basis, and a model that fails is refused by the GPU with its reason printed — never silently run on the CPU under a forced request. The op that diverges on Qwen2.5-1.5B and its fix are L0-1b.

RED test

• The RED-first record, before any kernel edit: c977cad58 — apr parity on lambda (RTX 4090, the 0.65.2 cuda install c642576eecb62daa), 78 positions: 1.5B min cosine 0.9508 at position 0 (token 785), 7B 0.9986; n=5 repeats are bit-for-bit identical (d2a566642).
• The sentinel gate: d56f65430 — sentinel_1p5b_on_lambda_is_red_under_the_horizon_rule / sentinel_7b_on_lambda_is_green_under_the_horizon_rule (lib tests, ride workspace-test).
• The must-RED twin: tests/fixtures/parity/defective/one-position-at-0.5.json (C14 case-table row 3).

Acceptance (.pr/L0-1/accept.sh, orchestrator's run, .pr/L0-1/accept.log)

derive_model_manifest.sh --self-test        rc=0   (6/6)
derive_model_manifest.sh --check            rc=0   (18 models)
check_model_parity.sh --self-test           rc=0   (6/6)
--judge 7B record                           rc=0   PASS min 0.9986
--judge 1.5B record                         rc=1   as required (RED)
--judge one-position-at-0.5 twin            rc=1   as required (RED)
cargo test -p apr-cli --test reg15_admission        rc=0 (7 passed)
cargo test -p apr-cli --lib sentinel_tests          rc=0 (3 passed)
cargo test -p aprender-serve --lib parity_report    rc=0
pv validate contracts/apr-gpu-cpu-parity-v1.yaml    rc=0 (valid)
--manifest: the fleet-verify leg on lambda/gx10 (not this host)

cargo check -p aprender-serve -p apr-cli --features cuda on lambda (CUDA 12.8): clean at 35c330c.

Mutation (I3)

round	commit	expected RED	run
1	a5db15200 — a hand-typed manifest entry + min_cosine: 0.90	guard-runner-labels: "The manifest equals its derivation" FAILS; workspace-test: sentinel_1p5b_on_lambda_is_red FAILS	run id after CI
2	(next) min_positions: 1	guard-runner-labels: C14 case-table row 4 FAILS	run id after CI
GREEN	the reverts	6/6 · 6/6 · 3 sentinels	run id after CI

Contract

contracts/apr-gpu-cpu-parity-v1.yaml — kind: pattern; PAR-OB-001..003 ↔ PAR-F-001..003. pv validate (via scripts/pv_bin.sh): 0 error(s), 0 warning(s) — Contract is valid.

Quorum

review-only row: one agy lane on this diff — verdict recorded in .pr/L0-1/quorum.md and the receipt before arming. The L0-1 root-cause quorum (three lanes, one family — a recorded gap) refuted the fused-FFN hypothesis on default config; L0-1b answers the rest by measurement.

Receipt

docs/audits/impl-PMAT-1065-receipt.md (v6 DONE-IF ledger: (i) admission level ✓, (ii) ✓, (iii) blocked on R-0a, (iv) one pair measured, (v) ✓, (vi) pending G-11b, (vii) ✓).

Writes

scripts/derive_model_manifest.sh, scripts/check_model_parity.sh, scripts/dogfood.sh (C14 rows), evidence/models/supported.yaml, evidence/parity/{thresholds.yaml,l0-1/**}, evidence/dogfood/0.65.2/{lambda,gx10}.json (validity relabel), tests/fixtures/parity/defective/**, crates/apr-cli/src/commands/{parity_admission.rs,chat_generate_session_02.rs,comparison.rs,mod.rs}, crates/apr-cli/src/error.rs, crates/apr-cli/tests/reg15_admission.rs, crates/aprender-serve/src/gguf/cuda/{mod.rs,mod_parity_gate.rs}, crates/aprender-serve/src/api/effective_config.rs, contracts/apr-gpu-cpu-parity-v1.yaml, .github/workflows/ci.yml (three guard-runner-labels steps), .pr/L0-1/accept.sh, the receipt. No DAG, roadmap, README or spec edit.

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3026 head=d4e1f416ceba81f020004ff345315806c173fc06 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

Card ledger, 2026-09-08 — the row is complete except one item that is another row's command

item	state
(i) forced --gpu + parity FAIL ⇒ refusal code from error.rs, never selected: cpu	✓ forced_backend_over_a_failed_parity_gate_refuses_with_the_code_from_error_rs (7/7 in reg15_admission)
(ii) /v1/effective-config carries parity: {status, cosine, positions, threshold, basis}	✓ parity_report_carries_the_five_keys_when_no_gate_ran
(iii) apr devices --model <gguf> serviceable column	blocked on R-0a (apr devices, #3004, inst:B) — A does not implement B's command. The DATA that column renders is this row's and has landed: the manifest, the per-host records, and check_model_parity.sh --judge
(iv) threshold basis from n ≥ 5 per known-good pair	✓ CLOSED, [U] lifted — see below
(v) diff-benchmark decomposition recorded	✓
(vi) make fleet-verify ROW=L0-1 on lambda and gx10	the target does not exist (BSE's G-11b) and was not waited on: both hosts measured, records attached
(vii) PR-time gate = two sentinels	✓ now two per host — 1.5B RED / 7B GREEN on lambda AND gx10, plus cross-host agreement and threshold-margin rows (8 tests)
(viii) every 0.65.2 (1.5B, cuda) receipt relabelled INVALID-CORRECTNESS	✓

The second host, and what it settles

gx10-a5b5, aarch64, NVIDIA GB10 (sm_121), driver 590.48.01; apr 0.65.2 (c04eda87) built from the tip of main, sha256 21d182d69505159c. Mechanism proved, not intended: every run's stderr carries [GH-480] Patched N backward branch(es) for sm_121 JIT workaround, a path lambda's sm_89 build does not have.

model	lambda / RTX 4090 / sm_89 / x86_64	gx10 / GB10 / sm_121 / aarch64	Δ
1.5B min cosine	0.950827	0.950611	2.2e-4
7B min cosine	0.998607	0.998465	1.4e-4

n=5 per cell, stdev 0.0 in all four. The divergence is selected by the MODEL, not by the device — which refutes every "an sm_89 kernel is wrong" / "the sm_121 JIT corrupts a branch" hypothesis before L0-1b dispatches a lane, and is asserted by the_two_hosts_agree_on_each_model_to_within_a_thousandth rather than merely written down. (L0-1b has since named the op — a crushed Q8_K activation block, with the CPU reference the inaccurate side — and the gx10 twin of the fix reads 1.5B 0.999583 / 7B 0.999782, first_divergence none on both.)

Item (iv) is closed by the same measurement: 0.98 now separates two known-good pairs from two known-bad pairs with 0.0185 of margin under the lower good floor, asserted at ≥ 0.01 on each side because a gate that passes with no headroom is a finding.

Two guards, answered rather than routed around

check_hardcoded_paths.sh refused +25 shipped machine paths (24 of them "model": "/home/noah/models/…" inside the apr parity --json output). That guard has no allowlist by design, and its own header says redacting a host path "would delete the evidence and fabricate a cleaner history" — so neither a redaction nor an exemption was taken. The records were re-taken with the model named relatively (cd ~/models && apr parity ./<model>.gguf …) on the same pinned binaries: the metrics array and every other key are byte-identical, only model differs, compared field by field. And n5/ collapsed from ten JSONs per host to DETERMINISM.md, because all five runs were byte-identical to each other and to the canonical record. --full → delta +0, every number unchanged, sentinels 8/8.

make readme-sync: the generated CONTRACT_COUNT block stated 1815 against a merge tree carrying 1816 — a generated number is an equality, not a ratchet.

Receipt: docs/audits/impl-PMAT-1065-receipt.md.