…itstream-io) (#1878)

`cargo deny check advisories` started failing on every PR (and on main)
2026-05-22 with:

    error[unmaintained]: core2 is unmaintained, all versions yanked
    ├ ID: RUSTSEC-2026-0105
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0105

The dep is pulled in transitively via `bitstream-io` (image/media decoding
stack — `cargo tree` shows `bitstream-io v4.9.0 → core2 v0.4.0`). No
first-party use; no drop-in replacement until upstream `bitstream-io`
migrates off core2.

This commit unblocks the in-flight PR cascade (#1867 #1868 #1870 #1873
#1875 #1876) which all failed CI's `ci / lint` step on this advisory.
The deny entry is structured per the existing pattern in this file (id +
human reason mentioning the transitive path) so revisiting the ignore in
6-12 months is straightforward.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

…ly cron (#1875)

Adds an end-to-end "Qwen story" that exercises every core apr command
group against the Qwen scale ladder (0.5B → 1.5B → 7B → 30B-MoE). The
story is the single canonical demo in README.md AND a regression gate
via runnable script + falsification contract + nightly cron.

## Beats

1. **Discover** (Registry) — pull, list
2. **Trust** (QA) — qa, validate, lint
3. **Explore** (Inspection) — inspect, tensors, tree
4. **Adapt** (Model ops) — export, diff, convert/quantize
5. **Use** (Inference) — run, chat, code
6. **Serve** (REST) — serve run + curl /v1/chat/completions OpenAI-compat
7. **Operate** (Profiling) — profile, gpu, serve plan (7B Q4K GGUF)
8. **Scale** (MoE) — inspect, tensors on 30B-MoE qwen3moe

## Pmat bug-hunt layer

When run with `PMAT_HUNT=1` (default), each beat emits a structured
manifest of high-risk untested code in the command-handler modules it
just exercised:

    -- pmat bug-hunt manifest (run chat code) --
        gap   crates/apr-cli/src/commands/run.rs:resolve_model_alias (impact=42.3)
        churn crates/apr-cli/src/commands/code.rs:dispatch_agent (commits=11)
        fault crates/aprender-serve/src/api/cuda_chat_backend.rs:try_qwen3_moe (unwrap)

The nightly cron uploads this manifest as an artifact, compares against
the previous successful run, and opens (or comments on) a tracking issue
when growth exceeds 5 lines — so untested branches in command handlers
can't accumulate quietly.

## Files

- `scripts/qwen-story.sh` (336 LOC) — runnable story with proper exit-code
  capture (`OUT=$(cmd); EC=$?` everywhere; no pipe-then-`$?` per memory rule)
- `contracts/qwen-story-v1.yaml` — 3 equations + 8 falsifiers, all PASS
  locally (script exists+executable, 8 beats, run_cmd helper, pmat_hunt
  per beat, README link, daily cron file, bashrs clean, Beat 7 skips
  `apr qa` on 7B Q4K due to #1864)
- `README.md` — new `## A Qwen story` section replacing the flat
  `## CLI examples` block. Fixes two README bugs surfaced during dogfood:
  `apr profile --roofline` (no such flag; just `apr profile <file>`)
  and `apr bench --assert-tps` (flag is on `apr qa`, not `bench`).
- `.github/workflows/qwen-story-daily.yml` — self-hosted GPU runner,
  04:17 UTC cron + workflow_dispatch, uploads pmat manifest + story log
  artifacts, files tracking issue when story regresses or manifest grows.

## Verification

    $ bash scripts/qwen-story.sh   # local smoke
    -- Beat 1: Discover (Registry) --
    ✓ PASS  B1 list
    -- Beat 2: Trust (QA gates) --
    ✓ PASS  B2 apr qa
    ✗ FAIL  B2 apr validate --quality  -  exit=5 (after #1866 fix this should be 0)
    -- Beat 3: Explore (Inspection) --
    ✓ PASS  B3 apr inspect --json (arch=qwen2)
    ✓ PASS  B3 apr tensors --json (339 tensors)
    ✓ PASS  B3 apr tree
    -- Beat 4: Adapt (Model ops) --
    ✗ FAIL  B4 apr export  -  PANIC (exit=101)  -  #1865 regression
    -- Beat 5: Use (Inference) --
    ✓ PASS  B5 apr run (Rust code completion)
    ✓ PASS  B5 apr code -p
    -- Beat 6: Serve (REST API) --
    ✓ PASS  B6 apr serve run (port=22915)
    ✓ PASS  B6 /v1/chat/completions (got OK...)
    -- Beat 7: Operate (Profiling) --
    ✓ PASS  B7 apr profile
    ✓ PASS  B7 apr gpu --json
    ✓ PASS  B7 apr serve plan -- 7B VRAM budget
    -- Beat 8: Scale (MoE introspection) --
    ✓ PASS  B8 apr inspect --json (arch=qwen3moe)
    ✓ PASS  B8 apr tensors --json (579 tensors)
    14 PASS / 2 FAIL / 0 SKIP

The 2 FAILs are EXPECTED until the in-flight fixes land:
- B2 validate --quality: closed by #1870
- B4 export panic: closed by #1868

Once those PRs merge, this story will be 16 PASS / 0 FAIL / 0 SKIP on a
host with all 4 Qwen models cached.

## Follow-up

A separate PR will add `/dogfood` Gate 18 that invokes this script (kept
separate to avoid conflict with PR #1872 which is already adding Gates
13-17 to the dogfood skill).

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>