Contributor entry doc + audit round-3 record

README.md

@@ -80,6 +80,35 @@ Dependency directions, stated once:
 `runtime/` in this repo is the **frozen origin** of the Python crystal —
 kept for provenance; live code and releases are in secryst-py.
 
+## Contributing a language or a technique (the isxml framework)
+
+Training is config-driven: a language is **two YAML files plus a
+held-out eval set**, never a fork of the pipeline.
+
+- `corpora/<source>.yaml` — pinned, licensed dataset artifacts
+  (rows + sha256; see `corpora/PROVENANCE.md` for the evidence and the
+  license gate)
+- `recipes/<lang>-<task>.yaml` — the stage DAG (sft, oracle_relabel,
+  distill, decode policy), the gates (quality threshold **with its
+  metric convention**, runtime-mode parity, license), and the
+  negative-results registry so nobody re-treads a refuted technique
+
+The spine validates everything before any GPU time is spent:
+
+```sh
+isxml validate                                  # contracts (CI-enforced)
+isxml plan <recipe> --run <run-id>              # exact job argv, dry-run
+isxml gate <recipe> --metrics m.json --parity p.json
+isxml conformance --vectors conformance/… --zip model.zip
+```
+
+Standing laws are enforced by the validators, not by memory: no
+LLM-teacher stages for diacritization, corpus pins are dates or
+versions (never moving refs), held-out test splits mandatory,
+`UNVERIFIED`/`LicenseRef-*` licenses block publishing, and publication
+requires an explicit owner version, green gates, and frozen conformance
+fixtures (`conformance/CONFORMANCE.md`).
+
 ## Environment (as implemented by every crystal)
 
 `SECRYST_INDEX` (index URL or path; default: `models.yaml` on this

TODO.sota/52-unified-framework.md

@@ -149,3 +149,24 @@ doesn't merge).
   fixture-frozen conformance; our advantages kept: pinned/sha256
   corpora, numeric parity gates, models.yaml registry, negative-result
   registry. Gaps found in KLF filed as kotoshu/kotoshu#251.
+
+## Audit record
+
+- **Round 1 (2026-10-18)**: G1 CI-contracts gap, G2 metric-convention
+  gap, G3 publish-guard gap — fixed in #298 (contracts job green on
+  first live run; GateSpec.convention required; publish guard refuses
+  moving versions / blocked licenses / failing gates / missing
+  fixtures).
+- **Round 2**: stage-2 script staging verified; index-v6 verified
+  byte-identical across legacy + rebranded repos (sha 486d4bcd) —
+  runtime default URL re-point is hygiene backlog for the next runtime
+  release.
+- **Round 3**: (a) the shipped python runtime itself is being run
+  against the conformance fixture (the client-path test the reference
+  decoder can't prove by construction); (b) contributor entry doc added
+  to README (add-a-language = two YAMLs + eval gold; the isxml verbs;
+  the laws).
+- Backlog (non-blocking): housekeeper (checkpoint pruning / dead-repo
+  inventory); exporter attention-mask option for batched serving
+  (WO51 remedy (b)); conformance coverage grows with each shipped
+  artifact; src/gpu/modal_* deprecation flagged for owner.