Post-monorepo quality audit (c3825da): 14 findings under re-verification at current HEAD

[noahgift]

Tracking ticket for the post-monorepo quality audit taken at c3825da7e (2026-08-14 12:05Z). Source document is a static defect audit from a shallow clone with no toolchain — it says so itself in §0 and is careful to frame every finding as "the tree contains this", not "this fails".

Findings are being re-measured at current HEAD before any of them are acted on, because main has moved past the audit's HEAD and at least one finding (F-1) overlaps work that landed in #2471. Twelve agents: one verifier per cluster, one independent refuter each.

The audit's own thesis, which is the useful part

the gates measure declarations, not resolved state

.gitignore declares; the index contradicts. The sibling guard reads manifests; the lockfile contradicts. #[ignore] declares a test exists; the runner skips it. In each case the artifact that would falsify the claim is present in the tree and unread by any gate.

That is the same class this repo has been closing all week — a required check that scanned a nonexistent directory (#2476), a route guard whose candidate universe came from the side it was auditing (#2475), tests gated on paths consolidation deleted (#2478). It is worth taking seriously as a category, independent of whether each individual finding survives.

Findings under verification

#	Claim	Sev (as filed)
F-1	whisper-apr = "0.2" transitively pulls registry aprender 0.27.8 — the monorepo depending on a stale crates.io copy of itself, 36 minors behind — dragging in registry trueno/realizar/trueno-quant/renacer-core/batuta-common. The guard scans manifests and passes; Cargo.lock disagrees.	CRITICAL
F-2	.cargo/config.toml.dev-overrides tells developers to clone 8 siblings that were consolidated in-tree; its [patch.crates-io] is what hides F-1 locally	HIGH
F-3	461 tracked .pmat-work/ files = 313 MB, which .gitignore:62 declares ignored; 781 ignored-but-tracked files; 55% of tracked bytes	HIGH
F-4	4 committed ELF binaries incl. a 3.8 MB unstripped debug executable in the repo root	MEDIUM
F-5	691 #[ignore] tests, ~50 masking known defects (13× "APR dtype parsing bug", 10× "kernel bug", 5× "Uses buggy Lz4WarpCompressKernel — FN confirmed")	MED-HIGH
F-6	Lint suppression surface	MEDIUM
F-7	Mutation gate armed but parse-fragile	MEDIUM
F-8	Coverage floor 88 vs claim 96.35, PR-blind	MEDIUM
F-9	Publish path bypasses CI	MEDIUM
F-10	ROADMAP generated 41 days before HEAD	LOW-MED
F-11	Pre-consolidation naming persists in source	LOW
F-12	8 of 30 check_*.sh guards are not merge gates — 1,325 LOC of self-testing guard logic that never runs at merge, including check_publish_safety.sh (the one credited with keeping a 28 MB blob out of a published package) and check_contract_test_binding.sh (the largest guard in the tree)	HIGH
F-13	README says 1771 contracts in a table and 1767 in prose 212 lines later; the drift guard is unwired and pattern-narrow	MEDIUM
F-14	deny.toml exemptions name versions no longer in Cargo.lock (quick-xml rationale written against 0.37.5; lock resolves 0.39.4 and 0.41.0). No exemption carries an expiry	MEDIUM

What the audit gets right about the strengths

Worth recording, because it is not a hostile document: it credits the mutation gate as genuinely armed and diff-scoped with no continue-on-error, notes property testing is "not decorative" (1,166 proptest! blocks), and calls the 30-guard scripts/ directory "the strongest quality asset in the repo." F-12 is a criticism of the wiring, not of the guards.

Caveats being applied

• §0 is honest about its limits — no toolchain, no CI history, no churn. Anything requiring a build is unverified by construction, so several findings may be stale or already fixed.
• F-11 needs the by-design distinction. aprender-compute's [lib] name IS trueno; aprender-serve's IS realizar. A naive grep for pre-consolidation identifiers will overcount enormously. The verifier is explicitly briefed on this.
• F-3's fix is not obviously safe. If any gate reads those .pmat-work/contract.json files, git rm --cached breaks it. That is being checked before anything is deleted.

Findings that survive refutation get fixed with a mutation-verified falsifier each, per the usual standard. Findings that do not survive get recorded here as refuted, with the contradicting evidence, so the audit document does not get re-litigated later.

Refs #2474.

[noahgift]

Twelve agents re-measured the 14 findings at HEAD, each verifier followed by an independent refuter. Results below, with what shipped.

First, a correction to this ticket's own premise

I opened it saying main had moved past the audit's HEAD. Wrong. origin/main was c3825da7e — the audit commit. My local checkout was 9 commits behind, not ahead. The audit was taken at the tip and nothing was stale for that reason.

F-1 — real, but the prescribed fix catches 0 of 8

#2471 closed 24 of 32 registry collisions (lock 1493 → 1402 packages). Seven names survive, transitively:

aprender 0.27.8   <- whisper-apr 0.2.8 <- {apr-cli, aprender-orchestrate, aprender-rag}
trueno 0.17.5, realizar 0.8.6, trueno-quant, renacer-core, provable-contracts-macros
batuta-common     <- bashrs <- aprender-compute-xtask  (NOT optional)

aprender 0.27.8 is the monorepo depending on a published copy of itself, 36 minors behind — the self-referential cycle APR-MONO existed to remove.

But cargo tree --duplicates — the fix the audit recommends, and the instrument the existing guard's own header names — is structurally blind to 6 of them, permanently. --duplicates reports one package at two versions. trueno/realizar/batuta-common are [lib] names; the packages are aprender-compute/aprender-serve/aprender-common. The lockfile holds exactly one trueno package — the registry one. Not a duplicate, never will be. Measured: 0 of 8 caught under default features, 2 of 8 under --all-features, which no workflow passes.

Severity: MEDIUM, not CRITICAL. Six of seven are lockfile-only. cargo tree -i aprender@0.27.8 exits 101 under default features — the tree does not compile two incompatible truenos today. Only batuta-common is actually built. The live harms are the published-crate cycle and supply-chain pollution, not a broken build.

Shipped: #2484. Lockfile-layer guard reusing the manifest guard's own name extractor (independently reproduces the same 272 names). Ratcheted at 7. Three mutations verified RED.

F-12 / F-13 — confirmed, and the refuter found more than the audit did

17 of 31 guards (1,976 LOC) cannot block a merge — the audit said 8/1,325.

Two were not merely unwired but incapable of failing:

• check_package_includes.sh — Gate 1 of the pre-release skill — was checking an empty directory. It scanned src/ and packaged -p aprender: the pre-monorepo layout. Root src/ now holds 2 files with zero include!(), while 1,798 live under crates/. It printed OK: All 0 include!() files are included for every release since consolidation. This is the CB-510 guard. Shipped: fix(guard): Gate 1 of the pre-release skill has been checking an empty directory #2483 — 10 crates, 1,539 targets, vacuity floor. Tree is clean.
• check_book_examples_executable.sh printed total=244 pass=0 skip=244 fail=0 ... PASS. Zero executed, verdict green. And when apr is available it ran examples through bash -c, resolving apr via PATH — measured 0.60.0 on this box against a 0.63.0 tree, despite the script correctly sourcing apr_bin.sh first. Pinned and then not used. Shipped: fix(book): the CLI-example gate pinned apr and then ran a different one #2486.

F-13 confirmed and extended: README carried three contract counts — 1771 (table, correct), 1158 (line 225, off by 613, the audit missed this one), 1767 (line 256). The guard matched only the bold form, then head -1, so it checked the one that happened to be right. Shipped: #2485 — all claims checked, README can no longer contradict itself, guard wired.

F-5 — confirmed in shape, several counts overstated

Refuted: "kernel bug ×10" is 2 (10 is the raw grep; 8 are prose). "Lz4 ×5" is 4, and the string is F082 confirmed, not FN confirmed. "flaky 81" was the refuter's error — the audit's 68 is right.

Confirmed and worse than filed: 5 of the 13 APR-dtype ignores sit in files that never compile. Of the 8 live, 7 still fail and 1 passes and is still muted. Plus a latent defect: an unknown dtype byte falls through to eprintln! + silent F32 coercion, locked in by a passing test asserting byte 255 → "F32".

40 #[ignore]s carry no reason at all, and clippy::ignore_without_reason is disabled in two places.

F-3 / F-4, F-14, F-2 — confirmed, medium

F-3/F-4 reproduce to the byte. Before deleting: check whether any gate reads .pmat-work/contract.json. F-14 confirmed — quick-xml rationale written against 0.37.5, lock resolves 0.39.4 and 0.41.0. No exemption carries an expiry.

Not yet done

1. Cut the transitive source: vendor whisper-apr per APR-MONO or drop its published-aprender dep (clears 6); batuta-common needs its own resolution.
2. Wire the remaining unwired guards — several fail today, which is the EV ranking.
3. F-3 tracked-scratch removal, after the gate-dependency check.
4. Fix the 5 book-example failures, then add a build step and wire that gate.

Refs #2483, #2484, #2485, #2486.