From c45d103fedc08f567e2892e8d71b1eda49cfe881 Mon Sep 17 00:00:00 2001 From: Jeremy Date: Wed, 21 Oct 2026 05:16:43 +0000 Subject: [PATCH] feat(embedded): expose bounded key reuse on residency owner --- .../src/serial_cpu_residency.rs | 99 +++++++++----- .../src/serial_cpu_residency_tests.rs | 49 +++++++ docs/cpu-scheduler-host-options.md | 30 +++++ docs/plans/cpu-scheduler/execution-ledger.md | 47 +++++++ docs/plans/cpu-scheduler/issues.md | 6 +- docs/plans/cpu-scheduler/plan.md | 23 ++-- .../2026-10-21-m5-m6-completion-checklist.md | 125 ++++++++++++++++++ 7 files changed, 334 insertions(+), 45 deletions(-) create mode 100644 docs/plans/cpu-scheduler/reports/2026-10-21-m5-m6-completion-checklist.md diff --git a/crates/pantograph-embedded-runtime/src/serial_cpu_residency.rs b/crates/pantograph-embedded-runtime/src/serial_cpu_residency.rs index 5192c30fb..678d36acc 100644 --- a/crates/pantograph-embedded-runtime/src/serial_cpu_residency.rs +++ b/crates/pantograph-embedded-runtime/src/serial_cpu_residency.rs @@ -133,10 +133,40 @@ struct ShutdownState { } impl EmbeddedSerialCpuResidency { + /// Construct the dedicated fair serial CPU residency owner with workload-key + /// reuse disabled. Existing resource and lifecycle requirements apply. pub async fn new( + config: EmbeddedSerialCpuResidencyConfig, + ) -> Result { + Self::build(config, false).await + } + + /// Opt into bounded pure workload-key reuse on the ordinary per-member path. + /// + /// Each member retains its own fair opportunity, preparation, resource and + /// Start checks, native execution/drain and matched cleanup. This enables no + /// native batching, new admission policy or complete-memory guarantee. + /// Construction does not load a model or qualify execution/performance. + pub async fn new_with_bounded_key_reuse( + config: EmbeddedSerialCpuResidencyConfig, + ) -> Result { + Self::build(config, true).await + } + + async fn build( mut config: EmbeddedSerialCpuResidencyConfig, + bounded_key_reuse: bool, ) -> Result { config.validate()?; + let mut serial = WorkflowSerialReadyConfig::default() + .with_fair_service_opportunities() + .with_serial_residency() + .map_err(initialization_error)?; + if bounded_key_reuse { + serial = serial + .with_bounded_grouping() + .map_err(initialization_error)?; + } config.runtime.max_loaded_sessions = Some(config.runtime.max_loaded_sessions.unwrap_or(8)); let calibration = inference::CandleCpuCalibrationConfig::new( config.cpu_threads, @@ -214,42 +244,36 @@ impl EmbeddedSerialCpuResidency { .map_err(initialization_error)?, ); std::fs::create_dir_all(&config.runtime.app_data_dir).map_err(initialization_error)?; - let service = WorkflowService::new_serial_ready_cpu( - port.clone(), - WorkflowSerialReadyConfig::default() - .with_fair_service_opportunities() - .with_serial_residency() - .map_err(initialization_error)?, - ) - .with_attribution_store( - pantograph_runtime_attribution::SqliteAttributionStore::open_in_memory() - .map_err(initialization_error)?, - ) - .with_diagnostics_ledger( - SqliteDiagnosticsLedger::open( - config - .runtime - .app_data_dir - .join("serial-cpu-diagnostics.db"), + let service = WorkflowService::new_serial_ready_cpu(port.clone(), serial) + .with_attribution_store( + pantograph_runtime_attribution::SqliteAttributionStore::open_in_memory() + .map_err(initialization_error)?, ) - .map_err(initialization_error)?, - ) - .with_artifact_store( - ArtifactStore::open( - config.runtime.app_data_dir.join("serial-cpu-artifacts"), - ArtifactPolicy { - policy_id: "serial-cpu-residency".into(), - policy_version: 1, - ttl_seconds: None, - max_disk_bytes: Some(1024 * 1024), - max_memory_bytes: Some(1024 * 1024), - max_single_artifact_bytes: Some(65536), - spill_threshold_bytes: None, - delete_on_consume: false, - }, + .with_diagnostics_ledger( + SqliteDiagnosticsLedger::open( + config + .runtime + .app_data_dir + .join("serial-cpu-diagnostics.db"), + ) + .map_err(initialization_error)?, ) - .map_err(initialization_error)?, - ); + .with_artifact_store( + ArtifactStore::open( + config.runtime.app_data_dir.join("serial-cpu-artifacts"), + ArtifactPolicy { + policy_id: "serial-cpu-residency".into(), + policy_version: 1, + ttl_seconds: None, + max_disk_bytes: Some(1024 * 1024), + max_memory_bytes: Some(1024 * 1024), + max_single_artifact_bytes: Some(65536), + spill_threshold_bytes: None, + delete_on_consume: false, + }, + ) + .map_err(initialization_error)?, + ); let input = EmbeddedHostedStartupCompositionInput::new(EmbeddedHostedStartupConfig { runtime_registry: registry.clone(), runtime_registry_controller: gateway.clone(), @@ -303,6 +327,13 @@ impl EmbeddedSerialCpuResidency { }) } + /// Read immutable constructor facts without querying native state or opening + /// execution admission. This value remains readable after shutdown and is + /// neither an execution capability nor proof of readiness or qualification. + pub fn scheduler_configuration(&self) -> WorkflowSchedulerConfiguration { + self.runtime.workflow_service.scheduler_configuration() + } + async fn admit(&self) -> Result, WorkflowServiceError> { let guard = self.operations.read().await; if self.closed.load(Ordering::Acquire) { diff --git a/crates/pantograph-embedded-runtime/src/serial_cpu_residency_tests.rs b/crates/pantograph-embedded-runtime/src/serial_cpu_residency_tests.rs index 9b9470df2..a1cd3eeb7 100644 --- a/crates/pantograph-embedded-runtime/src/serial_cpu_residency_tests.rs +++ b/crates/pantograph-embedded-runtime/src/serial_cpu_residency_tests.rs @@ -90,6 +90,55 @@ async fn invalid_facade_configuration_refuses_before_owner_or_filesystem_startup assert!(!root.exists()); } +#[tokio::test] +async fn key_reuse_configuration_refuses_before_owner_or_filesystem_startup() { + let directory = tempfile::tempdir().unwrap(); + let root = directory.path().join("not-created"); + let mut configuration = config(&root); + configuration.ram_capacity_bytes = 0; + assert!(matches!( + EmbeddedSerialCpuResidency::new_with_bounded_key_reuse(configuration).await, + Err(EmbeddedRuntimeError::Config { .. }) + )); + assert!(!root.exists()); +} + +#[tokio::test] +async fn owning_facade_explicit_key_reuse_preserves_default_and_shutdown_configuration() { + for enabled in [false, true] { + let directory = tempfile::tempdir().unwrap(); + seed(directory.path()); + let configuration = config(directory.path()); + let facade = if enabled { + EmbeddedSerialCpuResidency::new_with_bounded_key_reuse(configuration).await + } else { + EmbeddedSerialCpuResidency::new(configuration).await + } + .unwrap(); + let snapshot = facade.scheduler_configuration(); + assert_eq!( + snapshot.execution_owner(), + WorkflowSchedulerExecutionOwner::SerialReadyCpu + ); + assert!(snapshot.serial_fair_opportunities()); + assert!(snapshot.serial_residency()); + assert_eq!(snapshot.serial_key_reuse(), enabled); + assert!(!snapshot.serial_completion_advisory()); + assert_eq!(snapshot.serial_minimum_samples(), Some(3)); + assert_eq!( + snapshot.serial_maximum_sample_age(), + Some(Duration::from_secs(60)) + ); + assert!(facade.registry_snapshot().reservations.is_empty()); + assert_eq!(facade.residency_diagnostics().unwrap().loads, 0); + assert_eq!(facade.scheduler_configuration(), snapshot); + facade.shutdown().await.unwrap(); + facade.shutdown().await.unwrap(); + assert_eq!(facade.scheduler_configuration(), snapshot); + assert!(facade.registry_snapshot().reservations.is_empty()); + } +} + #[tokio::test] async fn projection_refresh_publishes_existing_raw_evidence_without_native_work() { use pantograph_diagnostics_ledger::{ diff --git a/docs/cpu-scheduler-host-options.md b/docs/cpu-scheduler-host-options.md index 9f44b4628..c67705b64 100644 --- a/docs/cpu-scheduler-host-options.md +++ b/docs/cpu-scheduler-host-options.md @@ -78,6 +78,36 @@ builders remain explicit and require fair service opportunities; observing their flags does not promote the unresolved M4/C2 acceptance gates. M6a adds no application selector, UI, IPC field, persisted preference or provider capability. +## Protected embedded residency owner + +With `pantograph-embedded-runtime`'s `backend-candle` feature, the owning +`EmbeddedSerialCpuResidency` facade provides two construction choices: + +- `new(config)` preserves fair serial residency with workload-key reuse disabled. +- `new_with_bounded_key_reuse(config)` explicitly enables the existing bounded + pure workload-key cache on that same per-member execution path. + +Both take the existing `EmbeddedSerialCpuResidencyConfig` unchanged. Invalid +resource/configuration declarations refuse before filesystem/native startup. +The caller still supplies valid local model identities and operator-declared +resource bounds; construction loads no model and downloads none. Physical run +and resume retain their `host-dependency-inventory` feature requirement. + +`facade.scheduler_configuration()` returns the same immutable value snapshot +described above, with fair opportunities/residency true, key reuse matching the +constructor, and completion advice false. It exposes no service, gateway, +registry, native owner or execution authority. It remains readable after +shutdown because configuration is not live runtime state. + +This is immediate ordinary member execution with planning reuse, not a grouped +native forward. Each member retains its own fair opportunity, preparation, +reservation, final Start checks, drain and matched cleanup. Change this choice +by acknowledged facade shutdown followed by construction at the next clean +startup; there is no live setter. Admission, resource accounting and defaults +are unchanged. Constructor/consumer tests do not qualify actual CPU benefits; +the [finite completion checklist](plans/cpu-scheduler/reports/2026-10-21-m5-m6-completion-checklist.md) +keeps that native comparison and representative performance evidence separate. + ## Lifecycle and rollback The snapshot is stable across service clones and loaded-session capacity changes. diff --git a/docs/plans/cpu-scheduler/execution-ledger.md b/docs/plans/cpu-scheduler/execution-ledger.md index 9d5b7e259..267edbfdf 100644 --- a/docs/plans/cpu-scheduler/execution-ledger.md +++ b/docs/plans/cpu-scheduler/execution-ledger.md @@ -1,5 +1,52 @@ # CPU Scheduler Execution Ledger + +## 2026-10-21 — PR89 integration and finite M5/M6 consuming path + +- User authorized normal PR89 integration and required a complete remaining-plan + checklist before more allocation abstractions. Fresh actor MrScripty, remote + main/source tips, exact head48717570/tree2d59d369, 22 successful check runs/four + PR workflows and empty GitHub review/thread arrays were verified. Independent + source reviewer extended approval to merge; CodeRabbit supplies no source credit. +- Ready transition followed by guarded normal merge succeeded as dc64b895, parents + dc926783 and48717570, exact approved tree2d59d369. Source branches remain intact. + Actual-main post-merge CI is pending; do not infer its result from source CI. +- Independent audit found full allocator hooks are not an M5 prerequisite for + cost-free ordinary-member key reuse. The integrator explicitly selects that + previously open C2 option as the supported CPU envelope, retaining the actual + native comparison and broader qualifications. The [finite checklist](reports/2026-10-21-m5-m6-completion-checklist.md) + sets five deciding rows and stops further diagnostic slices from substituting + for usable consuming behavior or actual CPU evidence. +- Both independent pre-code reviewers admitted the additive owning constructor + and direct immutable query with unchanged config literals/defaults/owners/ + feature gates/lifecycle. Source write set is serial_cpu_residency.rs and its + existing tests; documentation is the host guide and CPU plan/ledger/issues/ + checklist. No allocator, dependency, manifest/lockfile, binding, IPC, CI or + admission change. Independent exact-source review approved the consumer change. +- Local verification passed: default facade module8, full embedded library607 + with2 existing ignored cost probes, inventory facade module6 including the + existing native lifecycle case; all-feature/all-target own-package warning-deny + Clippy, warning-deny own-package Rustdoc, formatting and33 local doc links. + Declared pre-push tests passed261/one existing ignored+168. +- Initial no-default/Candle test compilation selected a profile whose existing + tests require llama Gateway::new, and found one corrected new-test Option access; + no tests ran. The first default execution passed2/refused6 on the restricted + default Pumas registry home path. Both failures are retained. The pinned Pumas + supported PUMAS_REGISTRY_DB_PATH override points process-local test metadata to + writable scratch; corrected default/inventory runs passed without HOME, + authentication or security changes. No duplicate tests were launched during + the brief exec transport interruption; recovery was verified with pwd. +- Exact published head/tree and hosted CI belong to the draft PR. Constructor + facts and existing native regression execution do not close M5-CPU; that fixed + qualification producer/protocol and one retained comparison remain next after + this consumer's integration. +- New isolated branch/worktree feat/cpu-scheduler-owned-key-reuse at + /workspace/pantograph-owned-key-reuse starts from verified main dc64b895. + Root agent owns integration; target main. Retain it protected for parent review; + no worktree or prior branch is eligible for cleanup under this task. +- PR89 baseline strict Rustdoc/narrow-feature lint limitations and prior Forbidden + log evidence remain preserved, unsuppressed and unretried. + ## 2026-10-21 — PR88 integration and result-payload foundation - User explicitly authorized normal PR88 merge and the next reviewed backend diff --git a/docs/plans/cpu-scheduler/issues.md b/docs/plans/cpu-scheduler/issues.md index 5d345de78..a2212badb 100644 --- a/docs/plans/cpu-scheduler/issues.md +++ b/docs/plans/cpu-scheduler/issues.md @@ -45,6 +45,8 @@ copy/PUMAS/stop. Retained shutdown supervision survives caller wait drop. These are bounded implementation corrections, not default-policy or recovery expansion. | CPU-34 | The Ready boundary lacked a provenance-aware historical warm-service producer and inclusive measurements covering capture/cloning, bounds/equality and key work. Encoding counts alone establish no total-overhead result. | The bounded producer merged normally as PR88/dc926783 with exact approved tree88aaf720 after independent review, 22 successful check runs and four successful PR workflows. Local1,047-case evidence and the hosted84-case selection remain distinct. Admission and key-work counts stay unchanged. See [contract/evidence](reports/2026-10-21-provenance-producer.md). | -| CPU-35 | Pinned Candle has no inspected complete CPU allocation-lifetime observer: tensor IDs alias storage, while BERT temporaries, GEMM scratch and Rayon attribution escape returned-buffer snapshots. | This is missing software instrumentation, not a hardware-only blocker. The reviewed completed-result foundation covers only original immutable output Vec payload ownership after materialization, with explicit bookkeeping windows. No placeholder memory API or reservation/RSS arithmetic is added. Separately review dependency-level allocation/drop, shared-storage, scratch and worker attribution before any complete incremental-memory claim or admission use; representative model/hardware evidence qualifies the implemented producer later. | +| CPU-35 | Pinned Candle has no inspected complete CPU allocation-lifetime observer: tensor IDs alias storage, while BERT temporaries, GEMM scratch and Rayon attribution escape returned-buffer snapshots. | This is missing software instrumentation, not a hardware-only blocker. The reviewed completed-result foundation covers only original immutable output Vec payload ownership after materialization, with explicit bookkeeping windows. No placeholder memory API or reservation/RSS arithmetic is added. Dependency allocation/drop, shared-storage, scratch and worker attribution remains required for a future complete incremental-memory claim or admission use. It is not required for the cost-free C2a path selected by the finite completion checklist; no further allocator slice is next. Representative model/hardware evidence qualifies future claims later. | -| CPU-36 | Original completed embedding-result payload can remain allocated in an unpolled join or surviving Shared/Arc reader after worker exit/drain; wrapper completion is not final storage retirement. | Reviewed safe-Rust foundation attaches one lease inside the blocking worker to the immutable completed result and releases after actual payload drop. Four fixed job-owner counters measure only observed retained Vec capacity. Complete allocator/attempt memory remains unavailable; existing admission and cleanup authority stay unchanged. See [contract](reports/2026-10-21-result-payload-attribution.md). | +| CPU-36 | Original completed embedding-result payload can remain allocated in an unpolled join or surviving Shared/Arc reader after worker exit/drain; wrapper completion is not final storage retirement. | PR89 merged normally as dc64b895 after independent merge approval and 22 successful source check runs/four PR workflows; post-merge CI is pending. The reviewed safe-Rust foundation attaches one lease inside the blocking worker to the immutable completed result and releases after actual payload drop. Four fixed job-owner counters measure only observed retained Vec capacity. Complete allocator/attempt memory remains unavailable; existing admission and cleanup authority stay unchanged. See [contract](reports/2026-10-21-result-payload-attribution.md). | + +| CPU-37 | The protected `EmbeddedSerialCpuResidency` consumer hardcodes fair+residency with key reuse off and exposes no immutable configuration query, leaving the existing C2a opt-in inaccessible through that safe owner. | Add one explicit key-reuse constructor and delegate the existing value query, preserving defaults, config literals, private owners and shutdown. The [finite checklist](reports/2026-10-21-m5-m6-completion-checklist.md) owns remaining consumer and actual CPU gates; complete allocator diagnostics are not a substitute. | diff --git a/docs/plans/cpu-scheduler/plan.md b/docs/plans/cpu-scheduler/plan.md index 025e66ebc..9dd860f4d 100644 --- a/docs/plans/cpu-scheduler/plan.md +++ b/docs/plans/cpu-scheduler/plan.md @@ -2,9 +2,9 @@ **Plan status:** `Active` — M1/M2/M3, bounded M4, M5 C1/C2a, M6a and the bounded warm-service/grouping diagnostic producer are accepted and merged. Overall M5, broader M6 and real-model qualification remain unaccepted. -**Current phase:** PR88 merged normally as `dc9267831ee846229d365fa17e5bf9250b01868e`, exact independently reviewed tree `88aaf720384c5ff1537810a58dfd6fc055bc38b3`, preserving main4561 and head8306 as parents. All 22 PR check runs and four PR workflows passed. CodeRabbit skipped draft source review; independent source review owns approval. Local full-library evidence is 1,047 passes; hosted focused selection includes both new worker tests among 84 private-owner cases. Prior integration PR81 → PR83 → PR85 → PR86 → PR87 and all original branches/PR84 lineage remain protected. All20 post-merge check runs and all four workflows passed at dc926783; their identities are recorded separately. +**Current phase:** PR89 merged normally as `dc64b895180260ceef8619bedd1ac6d8b756a3ec`, tree `2d59d369f11b89e119c54afce9f0a6df86ada4bd`, preserving main `dc926783` and source `48717570` as parents. Independent exact-source review approved merging; all 22 source check runs and four PR workflows passed. Post-merge CI is pending. CodeRabbit status supplies no independent source-review credit. PR88 and prior integrations remain accepted within their reported limits; all earlier branches, PR84 lineage and unrelated work remain protected. -**Next slice:** The user authorized a proportionate allocation/lifetime foundation after PR88 integration. Independent pre-code review admitted [completed-result ownership attribution](reports/2026-10-21-result-payload-attribution.md) at the existing Candle embedding job boundary. Track immutable original completed-result payload capacity through actual Shared/Arc custody, gated solely by the existing calibration owner. This is post-materialization ownership evidence, with explicit untracked construction, tensor/alias, scratch/worker, residency and caller-copy allocations. Keep admission/default policy unchanged. Complete allocator attribution still requires separately reviewed backend/dependency hooks; reservation/RSS proxies remain inadmissible. Preserve all earlier branches and unrelated work. The reviewed CI follow-up explicitly discovers and executes all twelve new feature-gated cases, retaining exact revision/result evidence; existing checks and controls remain intact. +**Next slice:** Verify and publish the implemented ordinary-member key-reuse consuming path through the protected residency facade, following the [finite M5/M6 checklist](reports/2026-10-21-m5-m6-completion-checklist.md). The additive constructor choice reuses the immutable configuration snapshot; preserve the existing constructor, admission and lifecycle. The integrator selects C2's safe ordinary-member planning-reuse option as this supported envelope. Actual CPU comparison and final consumer qualification remain required before accepting that envelope. Complete allocator instrumentation is separate future work for a complete-memory claim, not a prerequisite for cost-free key reuse. Do not add another partial instrumentation domain instead of closing the five finite checklist rows. **Acceptance status:** M1 merged as PR73 in main `07b23d47`; the original negative cohort and the separately accepted C3 supplement remain unchanged. @@ -218,8 +218,12 @@ and write sets receive an independent review before their first code change. | M2 / Accepted; merged PR76 | Bounded completion lookahead for a disclosed CPU cohort, initially advisory on actual work. Extend existing scheduler kernels, workflow capture and native evidence producer only. | M1; complete comparable evidence for every admitted alternative/transition, including unfinished obligations. Hand-computed independent oracles, work-budget refusal, missing/stale evidence, owner invalidation and actual CPU trace correspondence. No forecasts authorize execution. Promote only a separately qualified action subset; do not fill missing cold/transfer costs with zero. | | M3 / Accepted; PR81 merged as71cfd845 | Explicit per-app/bucket service opportunities at an authoritative ready-work boundary, alongside priorities. Writes confined to scheduler/workflow queue/attribution integration and tests after its design review. | M1 and a bounded eligible population; use authenticated existing attribution, not arbitrary caller identities. Fixed modeled traces prove opportunity/order, then actual CPU sessions from two authenticated units prove progress under repeated foreground arrival and cancellation. No wall-clock guarantee for unbounded nonpreemptible jobs. Missing entitlement identity has an explicit owned disposition. | | M4 / Bounded C4/C5 accepted; merged as fa3a9b88 | CPU residency actions improve a specified repeated-model workflow without violating cleanup; serial preparation/eviction only. | Independently reviewed synthetic-fixture two-model, pressure and source-assisted cancellation evidence; six enforced inventory/native cases and all exact candidate CI passed. No overlapping loads, speculative release, automatic recovery, trained-model, speedup or allocator-memory qualification. Historical failures remain failures. | -| M5 / C1 and C2a implemented; integration owned by PR85/PR86 | C1 supplies the bounded advisory library policy. C2a reuses pure workload keys on the actual sequential worker path; it does not combine native executions. | Source/tests/evidence independently reviewed. C1 scheduler has 222 fresh passes; C2a candidate CI passed. Required current integration checks remain owned by the PRs. Overall C2 execution/performance acceptance and actual CPU grouped-versus-singleton evidence remain separate; native/continuous execution remains Deferred. | -| M6 / M6a source accepted; broader rollout planned | Read-only constructor configuration and a fixed hosted scalar diagnostic document existing explicit host choices. No mode activation, UI, IPC or persistence is added. | M6a source/tests/guide independently reviewed; 19 fresh constructor/consumer cases and all source-candidate CI pass. Documentation successor and final integration checks are recorded in PR87. Broader rollout requires reviewed consumer contracts and real consuming-path evidence. Default activation and deployment remain separate decisions. | +| M5 / C1 and C2a merged; supported-envelope qualification pending | C1 supplies the bounded advisory library policy. C2a reuses pure workload keys on the actual sequential worker path; it does not combine native executions. | Source/tests/evidence independently reviewed. C1 scheduler has 222 fresh passes; C2a candidate CI passed. PR85/86 integration is complete. The finite checklist selects ordinary-member key reuse; its actual CPU comparison remains required. Native/continuous execution remains Deferred; no complete-memory or speedup acceptance is inferred. | +| M6 / M6a merged; owning-consumer key-reuse choice next | Accepted M6a supplies read-only constructor configuration and a fixed hosted scalar diagnostic, with no mode activation. The next additive owning constructor explicitly selects existing key reuse; no UI, IPC or persistence is added. | M6a source/tests/guide independently reviewed; 19 fresh constructor/consumer cases and all source-candidate CI pass. PR87 integration is complete. The finite checklist requires the protected owning consumer and actual CPU evidence before scoped closure. Default activation and deployment remain separate decisions. | + +Dated admissions below preserve binding invariants and original evidence. Their +then-pending integration/status narration is historical; the current milestone +table and finite completion checklist own live acceptance and remaining work. ### M5 C1 bounded grouping kernel admission @@ -953,10 +957,11 @@ push and use normal CI for completed source changes; no forced updates or securi suppression. Where CI triggers only on PR/main, report that limitation and use a review PR only when authorized, never an unauthorized main push to obtain CI. -Current M1 design admission is approved by independent feasibility and standards -reviewers; findings and disposition are in the execution ledger. Publication through the -authorized GitHub connector is available; Git CLI GraphQL reads return HTTP 403 in this saved environment; the GitHub connector -read of PR73 succeeds. Publication must verify the supported connector/write path. +Historical M1 design admission and publication restrictions are retained in the +execution ledger. Current connected actor and remote state were verified for +PR89; permitted Git CLI metadata reads and the authorized GitHub connector merge +completed. No historical log-storage denial is reopened by that capability. +Current remaining gates and stop conditions are the finite completion checklist. No evidence is accepted merely because source compiles or a historical report is green. Full simulator differential acceptance remains unavailable without the verified archive and is not claimed for the independently qualified CPU subset. @@ -969,7 +974,7 @@ or measured regression that invalidates the promised useful outcome. Fix routine implementation defects inside the admitted boundary without repeating design ceremonies. GPU/remote remain Deferred until the stated environment and authority. -## Final Acceptance +## Historical M1 acceptance checkpoint M0 is accepted. M1 implementation and CPU/ranking/measurement evidence are independently reviewed. The original release cohort remains negative for diff --git a/docs/plans/cpu-scheduler/reports/2026-10-21-m5-m6-completion-checklist.md b/docs/plans/cpu-scheduler/reports/2026-10-21-m5-m6-completion-checklist.md new file mode 100644 index 000000000..ddd00cd0c --- /dev/null +++ b/docs/plans/cpu-scheduler/reports/2026-10-21-m5-m6-completion-checklist.md @@ -0,0 +1,125 @@ +# Bounded M5/M6 completion checklist + +Operation `continue` under [the CPU plan](../plan.md). The user authorized PR89 +integration and required a finite production/qualification boundary before more +instrumentation. This reconciliation supersedes an open-ended sequence of +allocation-observer slices; it does not accept overall M5/M6 from diagnostics. + +## Supported production outcome and integrator decision + +The supported CPU envelope is **ordinary per-member execution with bounded pure +workload-key reuse**, explicitly selected by an owning Rust host. Every actual +member still takes its own authenticated M3 opportunity, preparation, reservation, +final Start fence, native execution/drain and matched cleanup. There is no batching +wait, grouped native forward, shared grant, forecast-based admission or new memory +policy. Ordinary construction keeps its current behavior. + +As serial integrator, select the ordinary-member option left open by the +[C2 boundary decision](2026-10-20-m5-bounded-grouping-contract-proposal.md#required-decision-before-runtime-integration). +This is the supported-envelope M5 target, not acceptance of native/continuous +batching or every possible C1 consumer. The existing C2a contract already defines +its cost-free compatibility projection and exact immutable-key cache. Accept this +target only after the actual CPU gate below passes; do not silently count an +advisory grouping proposal as executing a group. + +## Finite required checklist + +| ID | Required outcome and deciding evidence | Current disposition / stop condition | +| --- | --- | --- | +| INT-89 | PR89 exact head `48717570004be87735c4b693212fdadf154d8738`, tree `2d59d369f11b89e119c54afce9f0a6df86ada4bd`, independently approved for merge; normal merge preserves both parents; actual merge CI terminal. | Source had 22 successful checks/four PR workflows. Merged as `dc64b895180260ceef8619bedd1ac6d8b756a3ec`, parents `dc926783` and `48717570`, identical tree. Post-merge CI is pending; the integration receipt owns final run identities. Stop integration on an actual failed required check and diagnose permitted fresh evidence. | +| M5-SW | Bounded C1 library API and C2a ordinary-worker key reuse preserve fresh per-member authority, fallback, bounds and cleanup. | Implemented/merged PR85/86; independently reviewed focused and controlled-worker evidence exists. Do not add another scheduler, forecast store or allocator observer to close this row. | +| M6-SW | One supported owning host can explicitly choose that existing key-reuse mode and read its immutable configuration without exposing private authority. Existing constructor remains unchanged; shutdown/reconstruction is rollback. | Concrete missing production capability after PR89: `EmbeddedSerialCpuResidency::new` fixes fair+residency with reuse off and offers no choice/query. The reviewed implementation adds the explicit constructor and delegates the existing query. Default/inventory consumer tests pass; publication and required exact-head CI remain to decide this row. | +| M5-CPU | One prospectively fixed actual CPU baseline-versus-key-reuse comparison through public sessions verifies exact outputs, member/attempt identities, separate grants/Starts and matched cleanup, with fresh owner/proof checks. Capture actual cache behavior and all five existing phase spans; report elapsed observations descriptively. | Pending software qualification producer/protocol admission, then one retained execution using committed untrained BERT fixtures. Existing controlled 30-versus-16 encoding counts and isolated local times are not native acceptance. Missing instrumentation in this producer is software work, not an external-input blocker. Stop on the fixed protocol's terminal outcome, any missing criterion or infrastructure failure; preserve all outcomes and do not tune/retry for a winner. | +| M6-CLOSE | Independent exact source/consumer/evidence review, required exact-head CI and post-merge checks support the bounded host choice and operator instructions. | Pending M6-SW and M5-CPU. Close only the named ordinary-member envelope; retain other qualifications below. No UI, IPC, persistence, deployment or default activation is implied. | + +These five rows are the completion boundary. After they pass, stop implementation +of this envelope and mark only these scoped claims accepted. If a row fails, +repair the evidenced defect within its contract or record a concrete blocked +disposition. Do not create another diagnostic domain instead of deciding the row. + +## Validation that needs representative workloads or hardware + +The committed BERT fixtures can qualify native ownership, numerical output and +the supported mechanism on accessible CPU hardware; they require no downloaded +model or invented measurements. They do not establish trained-model quality, +production throughput, tail latency, forecast accuracy, power use or practical +memory savings. Those claims require frozen representative model/tokenizer +revisions, inputs/shapes, settings, baseline and target CPU/hardware/environment, +with an independently reviewed measurement protocol. No such claim is an input +to current admission. GPU/remote qualification needs the separately authorized +suitable devices/hosts already excluded by the plan. + +## Separate optional or deferred work + +- Complete incremental allocation: PR89 completely follows its *registered + original completed-result payload* domain after materialization, including + Shared/Arc retention; it does not observe original allocation starts or an + instantaneous physical peak. Construction, allocator metadata, inputs/tokenizer, + model residency, Candle intermediate/shared aliases, GEMM scratch, Rayon/workers + and caller copies remain outside that domain. Dependency allocation/drop hooks, + alias identity and scratch/worker context are necessary for a **future complete + memory claim**, not for the cost-free C2a path. Do not substitute RSS or + reservation estimates. No new allocator slice is selected by this checklist. +- A full C1 memory-aware dispatch consumer, native/continuous batching, general + preemption/load overlap, automatic recovery, UI/persisted selection and default + activation/deployment require their own concrete consumer, design admission and + qualification. None is silently reclassified as completed. +- Broader real-model, multimodal, GPU and remote acceptance remains with its + existing authority. Optional telemetry expansion must name a decision it changes + before it delays this finite checklist. + +## Next software slice and review boundary + +Write set: `serial_cpu_residency.rs`, its existing tests, the host-options guide, +this checklist and canonical CPU plan/ledger/issues. Add +`EmbeddedSerialCpuResidency::new_with_bounded_key_reuse(config)` and +`scheduler_configuration()` returning the existing value snapshot. Reuse one +private constructor implementation and existing builders; preserve config struct +literal compatibility and all existing lifecycle/feature gates. No new options +framework, stored snapshot, policy, dependency, manifest/lockfile, IPC, native +allocator or binding mechanism is needed. This is one usable consuming-path change. + +Composed-design admission is not applicable to a replacement composition: the +same protected facade/service/port/registry/native owners and shutdown protocol +remain, with one existing constructor-owned boolean selected explicitly. This +adds no ownership/lifecycle boundary, state owner or operational obligation. If implementation needs to +change ownership, grants, Start fences, resource claims or shutdown, stop and +re-admit that design instead of inheriting this bounded decision. + +Baseline strict Rustdoc and narrow-feature lint limitations recorded in the +[PR89 report](2026-10-21-result-payload-attribution.md) remain unsuppressed. +Historical denied log reads remain denied evidence, including PR88 main jobs +`119033798758`/`119033798732`; no retries or alternate routes are authorized. + +## Consumer implementation checkpoint + +The implemented public factory is `new_with_bounded_key_reuse(config)`; existing +`new(config)` still selects false through the same private constructor. The +immutable query delegates directly and remains readable after acknowledged, +idempotent shutdown. Config struct literals, public run/resume inventory gates, +private owners, resource policy and native cleanup code are unchanged. + +Local verification: default facade module8/8; full embedded library607passed, +2existing ignored controlled cost probes; inventory-feature facade module6/6; +all-feature/all-target own-package warning-deny Clippy; warning-deny own-package +Rustdoc; formatting;33 resolved local documentation links; declared pre-push +261passed/one existing ignored+168passed. These checks establish this consumer's +configuration and regression behavior. The existing native lifecycle case uses +its original constructor; no new key-reuse CPU comparison is claimed. + +Preserved failures: the first no-default/Candle compilation selected a profile +incompatible with existing llama-specific test helpers and caught one corrected +new-test Option access; no cases ran. The first default test execution passed2 +and failed6 because Pumas could not create its default metadata directory under +the restricted home path. Pinned Pumas supports `PUMAS_REGISTRY_DB_PATH`; using +that process-local override for fresh scratch metadata made both corrected +module runs pass. No dependency code, HOME, authentication, permissions or +security settings changed. An exec transport interruption was followed by a +successful workspace recovery check before one retry of the failed read-only process creation; +local edits and active test processes remained intact. + +Both independent pre-code reviews admitted this boundary, and independent +source/test review approved the implementation. The published draft owns exact +head/tree and hosted evidence. This checkpoint does not accept M5-CPU or overall +M5/M6, authorize the native protocol, or supply independent review credit for a +CodeRabbit status. Stop adding instrumentation; close the finite rows instead.