bench+config: ship readiness — pin temp=0 in production, reject IPv4 in citation linter

Two pre-ship fixes that closed the last gap between the temp=0 probe
result (8/10) and the production-config confirmation (which initially
reported 7/10).

configs/single_64gb.yaml — promote temperature: 0.2 → 0.0.

The 2026-05-01 PM variance probe established that the variance in
the v1 baseline (4-7/10 across three identical runs at temp=0.2) was
sampling-driven; pinning temp=0 collapsed pass/fail vectors to
deterministic across two back-to-back full sweeps. Greedy decoding
also lifted the implement category to 4/4 baseline ceiling out of
the box (the lift Phase 1 attributed to structural prompts was
plausibly a baseline-variance artifact). The variant override in
variants_v1_temp0_probe.yaml stays in place for future variance probes.

src/luxe/citations.py — reject IPv4-shaped paths in extract_citations.

The citation regex `[\w./_-]+\.[\w]+:\d+` was matching IPv4 host:port
references like `127.0.0.1:27001` as `path:line` citations. Without
this guard, isomer-quickstart's synthesizer report (which legitimately
mentions `http://127.0.0.1:27001/` for the dashboard) reported 2
unresolved citations and lost the build-breaking citation gate. The
guard rejects paths matching `(?:^|/)\d+\.\d+\.\d+\.\d+$` — handles
both bare `127.0.0.1` and URL-form `//127.0.0.1` (the citation regex
greedily eats leading `/` from `http://...`). Two new tests in
test_citations_diff_aware.py: one asserts host:port references are
dropped while a real `app.py:42` citation in the same text is kept;
one asserts dotted filenames with digits (e.g. `v1.2.3.py:10`) survive.

Sidecar regrade against the existing isomer-quickstart commit can't
test this fix (citations are computed at run time and persisted by
the agent loop, not by the grader). Confirmed via fresh re-run:
isomer-quickstart now PASSes (cite=0/0). Cumulative confirmation
result is 8/10 — v1 ship gate cleared.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: michaeldtimpe

configs/single_64gb.yaml

@@ -25,7 +25,13 @@ roles:
     num_ctx: 32768
     max_steps: 30
     max_tokens_per_turn: 8192
-    temperature: 0.2
+    temperature: 0.0    # 2026-05-01 promotion: variance probe showed
+                        # temp=0.2 produced ±2 fixture swings between
+                        # identical bench runs (4-7/10 across 3 baseline
+                        # samples); temp=0 collapses pass/fail vectors to
+                        # deterministic across two back-to-back runs.
+                        # Greedy decoding also lifts implement to 4/4
+                        # ceiling out of the box. See variants_v1_temp0_probe.yaml.
     tools:
       - read_file
       - list_dir

src/luxe/citations.py

@@ -61,6 +61,15 @@ def is_cleared(self) -> bool:
 _CITATION_RE = re.compile(
     r"`?(?P<path>[\w./_-]+\.[\w]+):(?P<line>\d+)(?:-(?P<line_end>\d+))?`?"
 )
+# Reject IPv4-shaped paths — `127.0.0.1:8000` matches the citation regex
+# (path=127.0.0.1 because `.1` looks like a `.ext` suffix, line=8000) but is
+# almost always a host:port reference in deployment docs, not a file:line
+# citation. Without this guard, isomer-quickstart's synthesizer report
+# (which mentions `127.0.0.1:27001` for the dashboard URL) reports 2
+# unresolved citations and fails the build-breaking gate. Anchor handles
+# both bare `127.0.0.1` and URL-form `//127.0.0.1` (the citation regex's
+# path group greedily eats leading `/` characters from `http://...`).
+_IPV4_PATH_RE = re.compile(r"(?:^|/)\d+\.\d+\.\d+\.\d+$")
 _FUZZY_WINDOW = 20
 
 
@@ -118,6 +127,9 @@ def extract_citations(text: str) -> list[Citation]:
         # 1.2.3:4 would never match because they lack a letter in the extension).
         if "." not in path:
             continue
+        # Skip IPv4-shaped paths (`127.0.0.1:8000` is a host:port, not file:line).
+        if _IPV4_PATH_RE.search(path):
+            continue
         key = (path, line, line_end)
         if key in seen:
             continue

tests/test_citations_diff_aware.py

@@ -190,3 +190,39 @@ def test_dedupe_citations():
     text = "`src/foo.py:1` and `src/foo.py:1` again"
     cs = extract_citations(text)
     assert len(cs) == 1
+
+
+def test_extract_citations_rejects_ipv4_host_port():
+    """`127.0.0.1:8000` is a host:port reference (deployment doc), not a
+    file:line citation. The extractor must skip IPv4-shaped paths so the
+    citation linter doesn't flag dashboard URLs as unresolved.
+
+    Regression: isomer-quickstart synthesizer reports referenced
+    `127.0.0.1:27001` for the dashboard and the build-breaking citation
+    gate then docked the fixture's score (Phase 1 ship-confirmation
+    2026-05-02). Surgical fix at extractor: reject paths matching
+    `^\\d+\\.\\d+\\.\\d+\\.\\d+$`.
+    """
+    text = (
+        "Run with `docker compose up`; the dashboard is at "
+        "`http://127.0.0.1:27001/`. The mapping `127.0.0.1:27001:27001` "
+        "is in `docker-compose.yml`. A real citation: `app.py:42`."
+    )
+    cs = extract_citations(text)
+    paths = {c.path for c in cs}
+    assert "127.0.0.1" not in paths
+    # The legitimate file:line reference should still be extracted.
+    assert "app.py" in paths
+    # Both IP-shaped strings rejected; only the real one survives.
+    assert len(cs) == 1
+
+
+def test_extract_citations_keeps_dotted_filenames_with_digits():
+    """`v1.2.3.py:10` is a real (if unusual) filename; the IPv4 guard
+    must NOT reject it. Only paths that fully match `\\d+\\.\\d+\\.\\d+\\.\\d+`
+    (no extension) are dropped — `v1.2.3.py` has a `.py` extension and
+    a non-digit prefix in the leading segment."""
+    text = "See `v1.2.3.py:10` for the override."
+    cs = extract_citations(text)
+    assert len(cs) == 1
+    assert cs[0].path == "v1.2.3.py"