Add canonical pcs-bench ingest producer for labtrust admission.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: fraware

.github/workflows/pcs-ci.yml

@@ -25,6 +25,8 @@ on:
       - 'scripts/run-pcs-v01-clean-chain.sh'
       - 'scripts/pcs-benchmark-admission.sh'
       - 'scripts/pcs-bench-producer.sh'
+      - 'scripts/pcs-bench-validate-ingest.sh'
+      - 'scripts/pcs-bench-producer-contract-check.py'
       - 'scripts/validate-pf-pcs-bench-ingest.py'
       - 'scripts/materialize-admission-benchmark-cases.py'
       - 'benchmarks/admission/**'
@@ -56,6 +58,8 @@ on:
       - 'scripts/run-pcs-v01-clean-chain.sh'
       - 'scripts/pcs-benchmark-admission.sh'
       - 'scripts/pcs-bench-producer.sh'
+      - 'scripts/pcs-bench-validate-ingest.sh'
+      - 'scripts/pcs-bench-producer-contract-check.py'
       - 'scripts/validate-pf-pcs-bench-ingest.py'
       - 'scripts/materialize-admission-benchmark-cases.py'
       - 'benchmarks/admission/**'
@@ -500,38 +504,55 @@ jobs:
           OUT="$GITHUB_WORKSPACE/benchmark_runs"
           cd "$GITHUB_WORKSPACE/core/cli/pf"
           for SUITE in labtrust_qc_release tool_use_safety computation_reproducibility formal_trust_kernel; do
+            if [[ "${SUITE}" == "labtrust_qc_release" ]]; then
+              SUITE_OUT="labtrust_admission"
+            else
+              SUITE_OUT="${SUITE}_admission"
+            fi
             go run . benchmark admission \
               --cases "$GITHUB_WORKSPACE/benchmarks/admission/${SUITE}" \
               --registry "$REG" \
-              --out "${OUT}/${SUITE}_admission" \
+              --out "${OUT}/${SUITE_OUT}" \
               --validate \
               --validate-pcs-core-output "$PCS_CORE_PATH"
           done
-          test -f "${OUT}/labtrust_qc_release_admission/benchmark_report.v0.json"
-          test -f "${OUT}/labtrust_qc_release_admission/benchmark_run.v0.json"
-          test -f "${OUT}/labtrust_qc_release_admission/coverage_report.v0.json"
+          LABTRUST="${OUT}/labtrust_admission"
+          test -f "${LABTRUST}/benchmark_report.v0.json"
+          test -f "${LABTRUST}/benchmark_run.v0.json"
+          test -f "${LABTRUST}/coverage_report.v0.json"
           test -f "${OUT}/formal_trust_kernel_admission/explain_quality_report.v0.json"
-          test -f "${OUT}/labtrust_qc_release_admission/pcs_bench_ingest.v0.json"
-          test -f "${OUT}/labtrust_qc_release_admission/coverage/registry_coverage_report.v0.json"
-          test -f "${OUT}/labtrust_qc_release_admission/coverage/formal_check_coverage_report.v0.json"
-          test -f "${OUT}/labtrust_qc_release_admission/coverage/admission_profile_coverage_report.v0.json"
-          test -f "${OUT}/labtrust_qc_release_admission/coverage/release_reproducibility_coverage_report.v0.json"
-          test -f "${OUT}/labtrust_qc_release_admission/coverage/admission_profile.profile_coverage_report.v0.json"
-          test -d "${OUT}/labtrust_qc_release_admission/explain_quality"
-          test -d "${OUT}/labtrust_qc_release_admission/failure_localization"
-          test -f "${OUT}/labtrust_qc_release_admission/failure_localization/bundle_hash_mismatch.failure_localization_result.v0.json"
-          python3 -c "import json; m=json.load(open('${OUT}/labtrust_qc_release_admission/admission_benchmark_suite.v0.json'))['metrics']; assert m['valid_release_admission_rate']==1.0; assert m['invalid_release_rejection_rate']>=0.85; assert m['failure_localization_accuracy']>=0.85"
+          test -f "${LABTRUST}/pcs_bench_ingest.v0.json"
+          test -f "${LABTRUST}/coverage/registry_coverage_report.v0.json"
+          test -f "${LABTRUST}/coverage/formal_check_coverage_report.v0.json"
+          test -f "${LABTRUST}/coverage/admission_profile_coverage_report.v0.json"
+          test -f "${LABTRUST}/coverage/release_reproducibility_coverage_report.v0.json"
+          test -f "${LABTRUST}/coverage/admission_profile.profile_coverage_report.v0.json"
+          test -d "${LABTRUST}/explain_quality"
+          test -d "${LABTRUST}/failure_localization"
+          test -f "${LABTRUST}/failure_localization/bundle_hash_mismatch.failure_localization_result.v0.json"
+          python3 -c "import json; m=json.load(open('${LABTRUST}/admission_benchmark_suite.v0.json'))['metrics']; assert m['valid_release_admission_rate']==1.0; assert m['invalid_release_rejection_rate']>=0.85; assert m['failure_localization_accuracy']>=0.85"
           test -f "$GITHUB_WORKSPACE/benchmarks/admission/examples/labtrust_qc_release.pcs_bench_ingest.reference.json"
           cd "$GITHUB_WORKSPACE"
           go run ./tools/pcs-validate \
-            "${OUT}/labtrust_qc_release_admission/benchmark_report.v0.json" \
-            "${OUT}/labtrust_qc_release_admission/coverage_report.v0.json" \
-            "${OUT}/labtrust_qc_release_admission/explain_quality_report.v0.json" \
-            "${OUT}/labtrust_qc_release_admission/pcs_bench_ingest.v0.json"
-          go run ./tools/pcs-validate --benchmark-bundle "${OUT}/labtrust_qc_release_admission" --pcs-core "$PCS_CORE_PATH"
+            "${LABTRUST}/benchmark_report.v0.json" \
+            "${LABTRUST}/coverage_report.v0.json" \
+            "${LABTRUST}/explain_quality_report.v0.json" \
+            "${LABTRUST}/pcs_bench_ingest.v0.json"
+          go run ./tools/pcs-validate --benchmark-bundle "${LABTRUST}" --pcs-core "$PCS_CORE_PATH"
           pip install -q -e "${PCS_CORE_PATH}/python"
-          pcs validate "${OUT}/labtrust_qc_release_admission/pcs_bench_ingest.v0.json"
+          pcs validate "${LABTRUST}/pcs_bench_ingest.v0.json"
           pcs validate "$GITHUB_WORKSPACE/benchmarks/admission/examples/labtrust_qc_release.pcs_bench_ingest.reference.json"
+          python3 "$GITHUB_WORKSPACE/scripts/pcs-bench-producer-contract-check.py" \
+            --ingest "${LABTRUST}/pcs_bench_ingest.v0.json" \
+            --bundle-dir "${LABTRUST}"
+          python3 "$GITHUB_WORKSPACE/scripts/pcs-bench-producer-contract-check.py" \
+            --ingest "$GITHUB_WORKSPACE/benchmarks/admission/examples/labtrust_qc_release.pcs_bench_ingest.reference.json" \
+            --bundle-dir "${LABTRUST}"
+          bash "$GITHUB_WORKSPACE/scripts/pcs-bench-validate-ingest.sh" \
+            --input "$GITHUB_WORKSPACE/benchmarks/admission/examples/labtrust_qc_release.pcs_bench_ingest.reference.json" \
+            --bundle-dir "${LABTRUST}" \
+            --pcs-core "$PCS_CORE_PATH" \
+            --release-grade
           cd "$GITHUB_WORKSPACE/core/cli/pf"
           go run . benchmark admission \
             --cases "$GITHUB_WORKSPACE/benchmarks/admission/labtrust_qc_release" \
@@ -543,10 +564,10 @@ jobs:
           grep -q '"suite_id": "pf-labtrust-admission-v0"' "$RUNNER_TEMP/admission_summary.json"
           grep -q '"workflow_id": "hospital_lab.qc_release"' "$RUNNER_TEMP/admission_summary.json"
           grep -q '"pcs_bench_ingest_path"' "$RUNNER_TEMP/admission_summary.json"
-          python3 -c "import json; i=json.load(open('${OUT}/labtrust_qc_release_admission/pcs_bench_ingest.v0.json')); assert i['suite_id']=='pf-labtrust-admission-v0'; assert i['workflow_id']=='hospital_lab.qc_release'; assert all('/' in r['path'] or '\\\\' not in r['path'] for r in i.get('artifact_refs',[]))"
-          python3 "$GITHUB_WORKSPACE/scripts/validate-pf-pcs-bench-ingest.py" \
-            --ingest "${OUT}/labtrust_qc_release_admission/pcs_bench_ingest.v0.json" \
-            --bundle-dir "${OUT}/labtrust_qc_release_admission" \
+          python3 -c "import json; i=json.load(open('${LABTRUST}/pcs_bench_ingest.v0.json')); assert i['suite_id']=='pf-labtrust-admission-v0'; assert i['workflow_id']=='hospital_lab.qc_release'; assert all('/' in r['path'] or '\\\\' not in r['path'] for r in i.get('artifact_refs',[])); assert 'benchmarks/admission/labtrust_qc_release' in i['commands'][0]['command']"
+          bash "$GITHUB_WORKSPACE/scripts/pcs-bench-validate-ingest.sh" \
+            --input "${LABTRUST}/pcs_bench_ingest.v0.json" \
+            --bundle-dir "${LABTRUST}" \
             --pcs-core "$PCS_CORE_PATH" \
             --release-grade
 

.gitignore

@@ -238,6 +238,9 @@ workspaces_verify_preflight_smoke/
 # PCS admission benchmark run outputs (regenerated by make test-pcs-benchmark)
 /benchmark_runs/
 
+# WSL path-duplication artifacts (accidental nested mounts)
+/mnt/
+
 # Repo-root prediction artifacts from local bench runs
 /predictions*.jsonl
 /*.pfmeta.jsonl

Makefile

@@ -99,6 +99,12 @@ export-pcs-benchmark-ingest-reference:
 	@$(ECHOOK) "Materialize labtrust PcsBenchIngest reference artifact..."
 	bash scripts/export-pcs-benchmark-ingest-reference.sh
 
+validate-pcs-reference-ingest:
+	@$(ECHOOK) "Validate committed labtrust reference ingest (producer contract)..."
+	python3 scripts/pcs-bench-producer-contract-check.py \
+	  --ingest benchmarks/admission/examples/labtrust_qc_release.pcs_bench_ingest.reference.json \
+	  --bundle-dir benchmark_runs/labtrust_admission
+
 ifeq ($(OS),Windows_NT)
 pcs-bench-producer:
 	@$(ECHOOK) "PCS-bench producer gate (labtrust admission ingest)..."
@@ -109,7 +115,7 @@ pcs-bench-producer:
 	@bash scripts/pcs-bench-producer.sh
 endif
 
-test-pcs-full: test-pcs test-pcs-rc-gate test-pcs-phase2 validate-pcs-fixtures test-pcs-benchmark validate-pcs-benchmark-bundle pcs-bench-producer
+test-pcs-full: test-pcs test-pcs-rc-gate test-pcs-phase2 validate-pcs-fixtures test-pcs-benchmark validate-pcs-benchmark-bundle pcs-bench-producer validate-pcs-reference-ingest
 	@$(ECHOOK) "OK: PCS full gate passed (unit, RC lock, Phase 2, fixtures, admission benchmarks)"
 
 validate-pcs-fixtures:

adapters/pcs/README.md

@@ -88,6 +88,18 @@ pcs-bench producer gate (labtrust ingest at `benchmark_runs/labtrust_admission/p
 make pcs-bench-producer
 ```
 
+Validate an existing ingest (release-grade):
+
+```bash
+bash scripts/pcs-bench-validate-ingest.sh \
+  --input benchmark_runs/labtrust_admission/pcs_bench_ingest.v0.json \
+  --bundle-dir benchmark_runs/labtrust_admission \
+  --pcs-core ../pcs-core \
+  --release-grade
+```
+
+Labtrust failure-family case IDs: `pcs.LabtrustRequiredFailureFamilyCaseIDs` (see `admission_benchmark_labtrust_test.go`).
+
 See [docs/guides/pcs-admission-benchmark.md](../../docs/guides/pcs-admission-benchmark.md).
 
 ## Tests

adapters/pcs/admission_benchmark.go

@@ -227,6 +227,11 @@ func RunAdmissionBenchmark(opts AdmissionBenchmarkOptions) (AdmissionBenchmarkSu
 	if opts.SourceCommit == "" {
 		opts.SourceCommit = ResolveSourceCommit()
 	}
+	if strings.TrimSpace(opts.RepoRoot) == "" {
+		if root, err := FindRepoRoot(opts.CasesDir); err == nil {
+			opts.RepoRoot = root
+		}
+	}
 
 	var results []AdmissionBenchmarkCaseResult
 	var locCases []FailureLocalizationCaseResult
@@ -379,15 +384,60 @@ func admissionCasePassed(c AdmissionBenchmarkCase, cr AdmissionBenchmarkCaseResu
 }
 
 func buildBenchmarkCommandLine(c AdmissionBenchmarkCase, workflow AdmissionBenchmarkWorkflow, opts AdmissionBenchmarkOptions) string {
-	parts := []string{"pf", "benchmark", "admission", "--cases", opts.CasesDir}
-	if opts.RegistryPath != "" {
-		parts = append(parts, "--registry", opts.RegistryPath)
+	repoRoot := strings.TrimSpace(opts.RepoRoot)
+	if repoRoot == "" {
+		repoRoot, _ = FindRepoRoot(opts.CasesDir)
+	}
+	casesDir := portableBenchmarkPath(repoRoot, opts.CasesDir)
+	registry := portableBenchmarkPath(repoRoot, opts.RegistryPath)
+	parts := []string{"pf", "benchmark", "admission", "--cases", casesDir}
+	if registry != "" {
+		parts = append(parts, "--registry", registry)
 	}
 	parts = append(parts, fmt.Sprintf("# case=%s mode=%s profile=%s", c.CaseID, c.VerifyMode, c.ProfileID))
 	_ = workflow
 	return strings.Join(parts, " ")
 }
 
+func benchmarkPathKey(p string) string {
+	abs := p
+	if resolved, err := filepath.Abs(p); err == nil {
+		abs = resolved
+	}
+	return strings.ToLower(filepath.ToSlash(filepath.Clean(abs)))
+}
+
+// portableBenchmarkPath rewrites absolute filesystem paths to repo-relative forward-slash paths for reproducible command logs.
+func portableBenchmarkPath(repoRoot, path string) string {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return ""
+	}
+	clean := filepath.Clean(path)
+	absClean := clean
+	if resolved, err := filepath.Abs(clean); err == nil {
+		absClean = resolved
+	}
+	if repoRoot != "" {
+		absRepo, _ := filepath.Abs(repoRoot)
+		if rel, err := filepath.Rel(absRepo, absClean); err == nil && rel != "" && !strings.HasPrefix(rel, "..") {
+			return filepath.ToSlash(rel)
+		}
+		siblingCore, _ := filepath.Abs(filepath.Join(absRepo, "..", "pcs-core"))
+		keyClean := benchmarkPathKey(absClean)
+		keySibling := benchmarkPathKey(siblingCore)
+		if keySibling != "" && (keyClean == keySibling || strings.HasPrefix(keyClean, keySibling+"/")) {
+			tail := strings.TrimPrefix(keyClean, keySibling)
+			tail = strings.TrimPrefix(tail, "/")
+			if tail == "" {
+				return "../pcs-core"
+			}
+			return filepath.ToSlash(filepath.Join("..", "pcs-core", filepath.FromSlash(tail)))
+		}
+	}
+	return filepath.ToSlash(clean)
+}
+
 func explainFromPCSReport(r *PCSExplainQualityReport) *ExplainQualityCaseScore {
 	if r == nil {
 		return nil

adapters/pcs/admission_benchmark_bundle.go

@@ -32,6 +32,27 @@ var RequiredAdmissionInvalidCaseIDs = []string{
 	"scientific_memory_import_failure",
 }
 
+// LabtrustRequiredFailureFamilyCaseIDs are negative admission cases the labtrust QC release suite must reject.
+// Unioned with the valid release case, this set is the PF producer contract for pcs-bench ingestion.
+var LabtrustRequiredFailureFamilyCaseIDs = []string{
+	"missing_handoff",
+	"legacy_handoff_in_release_mode",
+	"missing_registry",
+	"wrong_admission_profile",
+	"rejected_certificate",
+	"certificate_status_rejected",
+	"trace_hash_mismatch",
+	"bundle_hash_mismatch",
+	"registry_wrong_producer",
+	"registry_disallowed_status",
+	"missing_proof_obligation",
+	"missing_lean_check_result",
+	"failed_lean_check",
+	"failed_lean_theorem",
+	"unauthorized_lean_theorem",
+	"scientific_memory_import_failure",
+}
+
 // writeAdmissionBenchmarkBundle emits a pcs-core benchmark bundle for pcs-bench ingestion.
 // When pcsCoreRoot is non-empty, per-artifact validation uses pcs-core/schemas.
 func writeAdmissionBenchmarkBundle(repoRoot, pcsCoreRoot, dir string, bundle PCSBenchmarkBundle, executions []benchmarkCaseExecution) error {
@@ -280,6 +301,21 @@ func mustJSONDoc(v any) any {
 	return doc
 }
 
+func benchmarkIngestPathForSummary(repoRoot, outDir string) string {
+	ingestPath := filepath.Join(outDir, "pcs_bench_ingest.v0.json")
+	if strings.TrimSpace(repoRoot) == "" {
+		if root, err := FindRepoRoot(outDir); err == nil {
+			repoRoot = root
+		}
+	}
+	if repoRoot != "" {
+		if rel, err := filepath.Rel(repoRoot, ingestPath); err == nil && rel != "" && !strings.HasPrefix(rel, "..") {
+			ingestPath = rel
+		}
+	}
+	return filepath.ToSlash(ingestPath)
+}
+
 // FormatBenchmarkAdmissionSummaryJSON returns a compact JSON summary for --json-summary.
 func FormatBenchmarkAdmissionSummaryJSON(run AdmissionBenchmarkSuiteV0, outDir string) (string, error) {
 	passed := 0
@@ -288,7 +324,7 @@ func FormatBenchmarkAdmissionSummaryJSON(run AdmissionBenchmarkSuiteV0, outDir s
 			passed++
 		}
 	}
-	ingestPath := filepath.Join(outDir, "pcs_bench_ingest.v0.json")
+	ingestPath := benchmarkIngestPathForSummary("", outDir)
 	summary := map[string]any{
 		"producer_id":                     "provability-fabric",
 		"suite_id":                        pcsBenchmarkSuiteID(run.Workflow),

adapters/pcs/admission_benchmark_flr_test.go

@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	pcs "github.com/SentinelOps-CI/provability-fabric/adapters/pcs"
@@ -82,9 +83,13 @@ func TestExportPCSBenchIngestReferenceArtifact(t *testing.T) {
 	if _, err := os.Stat(path); err != nil {
 		t.Skip("reference ingest not materialized; run scripts/export-pcs-benchmark-ingest-reference.sh")
 	}
+	pcsCore := pcsCoreRoot(t)
 	if err := pcs.ValidateBenchmarkArtifactFile(root, path); err != nil {
 		t.Fatal(err)
 	}
+	if err := pcs.ValidateBenchmarkArtifactFileWithPCSCore(pcsCore, path); err != nil {
+		t.Fatal(err)
+	}
 	data, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatal(err)
@@ -96,4 +101,23 @@ func TestExportPCSBenchIngestReferenceArtifact(t *testing.T) {
 	if err := pcs.ValidatePCSBenchIngestSemantics(ingest); err != nil {
 		t.Fatal(err)
 	}
+	if ingest.SuiteID != "pf-labtrust-admission-v0" || ingest.WorkflowID != "hospital_lab.qc_release" {
+		t.Fatalf("reference ingest ids: suite=%q workflow=%q", ingest.SuiteID, ingest.WorkflowID)
+	}
+	if len(ingest.FailureLocalizationReports) == 0 || len(ingest.ExplainQualityReports) == 0 {
+		t.Fatal("reference ingest missing FLR or explain quality reports")
+	}
+	if len(ingest.ArtifactRefs) == 0 {
+		t.Fatal("reference ingest missing artifact_refs")
+	}
+	for _, cmd := range ingest.Commands {
+		if strings.Contains(cmd.Command, `\`) {
+			t.Fatalf("reference command must use portable paths: %q", cmd.Command)
+		}
+	}
+	for _, ref := range ingest.ArtifactRefs {
+		if strings.Contains(ref.Path, `\`) {
+			t.Fatalf("reference artifact ref path must use forward slashes: %q", ref.Path)
+		}
+	}
 }