name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
CARGO_TERM_COLOR: always
jobs:
peer-ref-ratchet:
name: peer reference ratchet
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- uses: actions/checkout@v4
- name: peer_ref_ratchet
run: sh scripts/peer_ref_ratchet.sh
build-and-test:
name: build + test (macos-latest)
runs-on: macos-latest
timeout-minutes: 60
steps:
- name: Checkout
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with:
persist-credentials: false
- name: Install Rust toolchain (1.88.0, as pinned in Cargo.toml)
uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 with:
toolchain: "1.88.0"
components: rustfmt, clippy
- name: Cache cargo registry + target
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 with:
path: |
~/.cargo/registry
~/.cargo/git
target
key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
restore-keys: cargo-${{ runner.os }}-
- name: cargo fmt --check (informational)
continue-on-error: true
run: cargo fmt --all -- --check
- name: cargo clippy (informational)
continue-on-error: true
run: cargo clippy --locked --all-targets --all-features
- name: Require canonical mlx-native build environment
shell: bash
run: |
if [[ ${MLX_NATIVE_SKIP_METALLIB+x} ]]; then
echo "MLX_NATIVE_SKIP_METALLIB is forbidden for release-capable builds" >&2
exit 1
fi
- name: Standalone distribution package contract
shell: bash
run: |
set -euo pipefail
package_list="$(cargo +1.88.0 package --locked --list)"
for required in \
src/distribution/mod.rs \
src/distribution/standalone.rs \
src/distribution/standalone/update.rs \
src/distribution/standalone_tests.rs \
src/cli/complete.rs \
src/cli/completion_install.rs \
src/cli/completion_install_tests.rs \
src/cli/completion_receipt.rs \
src/cli/completion_startup.rs \
src/cli/completion_startup_tests.rs \
src/operator_ui.rs \
src/chat/startup_ui.rs \
src/serve/startup_progress.rs \
assets/head.svg.base64 \
scripts/install.sh.in \
scripts/sign_notarize_standalone_release.sh \
scripts/test_standalone_installer.sh \
scripts/test_standalone_release_signing_contract.sh \
tests/frictionless_cli.rs \
scripts/test_frictionless_binary.sh \
scripts/test_frictionless_diagnostics_contract.sh \
docs/shell-completion.md \
docs/adr/ADR-045-frictionless-distribution-updates-and-onboarding.md
do
grep -Fqx -- "$required" <<<"$package_list"
done
- name: cargo check
run: cargo check --locked --all-targets --all-features
- name: cargo build --release
run: cargo build --release --locked
- name: Frictionless exact-binary preflight
shell: bash
env:
NO_COLOR: "1"
CLICOLOR: "0"
CLICOLOR_FORCE: "1"
FORCE_COLOR: "1"
run: |
bash scripts/test_frictionless_binary.sh \
"$GITHUB_WORKSPACE/target/release/hf2q" \
"$RUNNER_TEMP/hf2q-pr-frictionless"
- name: cargo audit
run: |
cargo install cargo-audit --locked --version 0.22.2 --no-default-features
cargo audit
- name: cargo test (hosted-safe contracts)
run: |
set -euo pipefail
cargo test --locked --lib --all-features
cargo test --locked --test build_script_contract --all-features
cargo test --locked --test completions --all-features
cargo test --locked --test convert_integration --all-features
cargo test --locked --test distribution_cli --all-features -- --test-threads=1
cargo test --locked --test frictionless_cli --all-features
cargo test --locked --test lcp_registry_unit --all-features
cargo test --locked --bin hf2q --all-features operator_ui::tests::
cargo test --locked --bin hf2q --all-features startup_progress
cargo test --locked --bin hf2q --all-features chat::startup_ui::tests::
cargo test --locked --bin hf2q --all-features chat::local::tests::startup_event_drain_is_bounded_per_poll_tick -- --exact
cargo test --locked --bin hf2q --all-features convert::orchestrator::tests::
cargo test --locked --bin hf2q --all-features distribution::standalone:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features distribution::purge_tests::cache_purge_removes_only_models_and_resets_manifest -- --exact
scripts/test_standalone_installer.sh
scripts/test_standalone_release_signing_contract.sh
cargo test --locked --bin hf2q --all-features setup:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features tests::convert_quant_suffix_flag_config_and_conflict_are_deterministic -- --exact
cargo test --locked --bin hf2q --all-features tests::invalid_operator_config_fails_before_convert_source_or_serve_bind -- --exact
cargo test --locked --bin hf2q --all-features tests::concurrent_remote_convert_waiter_reuses_winner_without_entering_conversion -- --exact
cargo test --locked --bin hf2q --all-features tests::conversion_noop_receipt_reads_are_bounded_nofollow_snapshots -- --exact
cargo test --locked --bin hf2q --all-features tests::automatic_pair_lock_plan_defers_extension_validation_until_multimodal_detection -- --exact
cargo test --locked --bin hf2q --all-features tests::extensionless_conditional_pair_conflict_checks_text_without_inventing_a_projector -- --exact
cargo test --locked --bin hf2q --all-features chat::endpoint::tests::retained_listener_rejects_ready_mismatch_and_prevents_exit_rebind -- --exact
cargo test --locked --bin hf2q --all-features serve::tests::chat_lifeline_transport_accepts_only_unix_sockets -- --exact
cargo test --locked --bin hf2q --all-features core::bounded_file::tests::bounded_authority_reads_reject_symlink_fifo_oversize_and_mutation -- --exact
cargo test --locked --bin hf2q --all-features core::bounded_file::tests::retained_sha256_rewinds_after_a_shared_descriptor_read -- --exact
cargo test --locked --bin hf2q --all-features core::bounded_file::tests::direct_operator_file_symlink_retains_target_and_detects_retargeting -- --exact
cargo test --locked --bin hf2q --all-features core::bounded_file::tests::descriptor_identity_path_cannot_be_redirected_to_a_hardlink_namespace_by_swap_restore -- --exact
cargo test --locked --bin hf2q --all-features serve::api::engine::tests::retained_no_general_name_uses_logical_id_for_tool_registration -- --exact
cargo test --locked --bin hf2q --all-features serve::multi_model::tests::retained_activation_path_loads_bytes_but_publishes_operator_path -- --exact
cargo test --locked --bin hf2q --all-features serve::multi_model::tests::retained_activation_size_drives_budget_when_public_symlink_is_swapped_and_restored -- --exact
cargo test --locked --bin hf2q --all-features serve::cache::tests::concurrent_cross_quant_touches_merge_stale_snapshots_under_manifest_lock -- --exact
cargo test --locked --bin hf2q --all-features input::hf_download::tests::complete_qwen_mtp_prefix_admits_the_same_one_layer_topology_as_runtime -- --exact
cargo test --locked --bin hf2q --all-features input::hf_download::tests::mtp_hosted_admission_rejects_shape_correct_non_executable_storage -- --exact
cargo test --locked --bin hf2q --all-features input::hf_download::tests::hosted_multimodal_pair_is_admitted_as_one_pretransfer_extent -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::actual_local_selection_prefers_successful_use_and_exact_quant_ignores_low_memory -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::production_manual_structural_admission_never_hashes_the_text_payload -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::production_structural_admission_rejects_same_quant_size_ambiguity_even_on_filename_match -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::malformed_projector_binding_is_a_warning_and_text_only_fallback -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::in_place_markerless_structural_match_prepares_exact_catalog_projector -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::fresh_hosted_projector_snapshot_is_retained_from_its_exact_blob -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::in_place_manual_structural_match_reuses_present_sibling_mmproj -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::direct_file_symlink_pair_is_discovered_and_retained_in_place -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::symlinked_conversion_receipt_wins_without_hosted_gguf_artifacts -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::receipt_history_sidecar_hub_filename_cannot_select_projector -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::symlinked_conversion_receipt_explicit_output_clears_source_identity -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::symlinked_managed_sidecar_is_not_local_authority -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::symlinked_conversion_receipt_for_another_repository_cannot_win -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::symlinked_receipt_target_retarget_is_rejected_before_activation -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::malformed_adjacent_conversion_receipt_does_not_abort_other_candidates -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::receipt_bridge_rejects_non_model_and_malformed_schema_v3_identities -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::mismatched_logical_sidecars_do_not_import_receipt_use_history -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::receipt_success_history_is_created_for_links_and_regular_outputs_and_selects_last_used -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::receipt_success_history_never_touches_a_different_manifest_artifact -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::receipt_success_history_rejects_retarget_to_another_valid_revision -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::regular_receipt_output_never_promotes_a_stale_sidecar_or_forged_projector -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::exact_receipt_history_clears_forged_sidecar_projector_and_prefers_receipt_pair -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::logical_projector_alias_satisfies_generation_marked_pair_guard -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::retained_target_pair_guard_uses_adjacent_receipt_projector_without_a_logical_alias -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::hosted_projector_beside_logical_text_keeps_the_logical_pair_namespace -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::structurally_valid_wrong_local_sibling_falls_through_to_exact_hosted_projector -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::disappearing_automatic_sibling_mmproj_degrades_to_text_only -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::same_size_projector_replacement_after_hash_admission_degrades_to_text_only -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::successfully_used_managed_pair_returns_before_hub_download_or_native_conversion -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::managed_candidate_same_quant_swap_after_verification_is_rejected -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::bound_projector_digest_is_authenticated_before_it_can_suppress_hosted_repair -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::retained_text_descriptor_drives_projector_metadata_through_public_swap_and_restore -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::hub_cache_loose_projector_selection_uses_retained_text_through_swap_restore -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::manual_loose_sibling_selection_uses_retained_text_through_swap_restore -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::manual_loose_hosted_fallback_keeps_retained_digest_after_public_swap -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::newer_same_quant_hub_cache_revision_is_not_shadowed_by_post_lock_old_binding -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::automatic_projector_preflight_failure_keeps_text_plan_and_suppresses_retry -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::explicit_local_output_projector_conflict_warns_and_materializes_text_only -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::prepared_existing_projector_rejects_same_inode_mutation_before_activation -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::retained_adoption_has_an_independent_inode_and_source_alias_mutation_isolated -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::retained_materialization_creates_independent_bytes_and_refuses_conflicts -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::concurrent_exact_destination_winner_is_rechecked_and_reused -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::inventory::inventory_output_tests::hub_cache_queued_directory_replacement_cannot_escape_snapshot -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::inventory::inventory_output_tests::direct_model_directory_symlink_is_a_bounded_scan_root -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::inventory::inventory_output_tests::direct_file_symlink_is_discovered_without_traversing_a_linked_tree -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::inventory::inventory_output_tests::inventory_classifies_projector_companions_as_non_models -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::inventory::inventory_output_tests::inventory_fields_escape_row_and_terminal_control_characters -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::inventory::inventory_output_tests::retained_direct_model_symlink_root_cannot_be_retargeted_into_another_tree -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::inventory::inventory_output_tests::hub_cache_snapshot_retarget_after_parse_is_not_listed -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::inventory::inventory_output_tests::hub_cache_model_ancestor_replacement_cannot_redirect_snapshot_authority -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::local_pair_source_and_destination_parent_replacement_refuses_before_first_write -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::older_local_multimodal_candidate_requests_its_exact_revision_not_head_projector -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::markerless_local_multimodal_uses_candidate_revision_config_and_companion -- --exact
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::retained_exact_destination_replacement_after_preflight_refuses_activation -- --exact
cargo test --locked --bin hf2q --all-features input::hf_download::tests::retained_cross_device_pair_preflight_aggregates_on_destination_authority -- --exact
cargo test --locked --bin hf2q --all-features input::hf_download::tests::authenticated_sparse_source_fetches_only_safetensors_headers -- --exact
cargo test --locked --bin hf2q --all-features core::paired_artifact::tests::conversion_operation_locks_serialize_a_shared_explicit_projector -- --exact
cargo test --locked --bin hf2q --all-features input::hf_download::tests::exact_transfer_preflight_fails_closed_on_unknown_or_zero_capacity -- --exact
cargo test --locked --bin hf2q --all-features convert::cli_driver::paired_transaction::tests::prejournal_recovery_handles_empty_root_before_or_after_private_mode -- --exact
cargo test --locked --bin hf2q --all-features serve::tests::serve_config_defaults_are_used_and_cli_overrides_them -- --exact
cargo test --locked --bin hf2q --all-features serve::tests::configured_lan_requires_runtime_auth -- --exact
cargo test --locked --bin hf2q --all-features serve::tests::direct_health_probe_uses_loopback_for_unspecified_bind_addresses -- --exact
cargo test --locked --bin hf2q --all-features serve::operator_settings::tests::cli_planning_values_override_setup_config -- --exact
cargo test --locked --bin hf2q --all-features serve::operator_settings::tests::max_slots_is_not_silently_ignored_by_fifo -- --exact
hf_source_tests="$(cargo test --locked --bin hf2q --all-features -- --list)"
for required_test in \
cli::tests::getting_started_qwen38_commands_parse_exactly \
distribution::standalone::tests::standalone_lifecycle_installs_updates_rolls_back_and_preserves_operator_state \
distribution::standalone::tests::standalone_installer_bootstrap_surface_is_hidden_bounded_and_parseable \
distribution::standalone::update::tests::stable_release_record_is_small_canonical_and_exact \
distribution::standalone::update::tests::standalone_candidate_architecture_is_exactly_thin_arm64 \
distribution::purge_tests::cache_purge_removes_only_models_and_resets_manifest \
setup::defaults_contract_tests::operator_config_v2_is_canonical_strict_and_uses_the_guide_defaults \
setup::defaults_contract_tests::operator_config_v2_rejects_incoherent_fifo_slots_and_invalid_quant \
setup::defaults_contract_tests::absent_operator_config_preserves_existing_command_behavior_without_claiming_root_authority \
setup::defaults_contract_tests::selected_state_root_loads_the_exact_operator_config \
setup::tests::cli_parses_the_closed_noninteractive_surface \
setup::tests::fresh_and_repeated_noninteractive_setup_are_idempotent \
setup::tests::interactive_setup_uses_current_values_and_records_explicit_operator_choices \
setup::tests::cancelled_or_interrupted_interactive_setup_creates_nothing \
setup::tests::noninteractive_setup_requires_complete_choices_or_accept_defaults \
setup::tests::named_performance_levels_accept_one_or_more_levels_and_reject_incoherent_facts \
tests::convert_quant_suffix_flag_config_and_conflict_are_deterministic \
tests::invalid_operator_config_fails_before_convert_source_or_serve_bind \
tests::concurrent_remote_convert_waiter_reuses_winner_without_entering_conversion \
tests::conversion_noop_receipt_reads_are_bounded_nofollow_snapshots \
tests::automatic_pair_lock_plan_defers_extension_validation_until_multimodal_detection \
tests::extensionless_conditional_pair_conflict_checks_text_without_inventing_a_projector \
tests::remote_pair_paths_and_explicit_no_clobber_conflicts_fail_before_source_planning \
chat::endpoint::tests::retained_listener_rejects_ready_mismatch_and_prevents_exit_rebind \
serve::tests::chat_lifeline_transport_accepts_only_unix_sockets \
core::bounded_file::tests::bounded_authority_reads_reject_symlink_fifo_oversize_and_mutation \
core::bounded_file::tests::retained_sha256_rewinds_after_a_shared_descriptor_read \
core::bounded_file::tests::direct_operator_file_symlink_retains_target_and_detects_retargeting \
core::bounded_file::tests::descriptor_identity_path_cannot_be_redirected_to_a_hardlink_namespace_by_swap_restore \
serve::api::engine::tests::retained_no_general_name_uses_logical_id_for_tool_registration \
serve::multi_model::tests::retained_activation_path_loads_bytes_but_publishes_operator_path \
serve::multi_model::tests::retained_activation_size_drives_budget_when_public_symlink_is_swapped_and_restored \
serve::cache::tests::concurrent_cross_quant_touches_merge_stale_snapshots_under_manifest_lock \
serve::tests::serve_config_defaults_are_used_and_cli_overrides_them \
serve::tests::configured_lan_requires_runtime_auth \
serve::tests::direct_health_probe_uses_loopback_for_unspecified_bind_addresses \
serve::operator_settings::tests::cli_planning_values_override_setup_config \
serve::operator_settings::tests::max_slots_is_not_silently_ignored_by_fifo \
setup::tests::lock_contention_is_busy_and_mints_no_config \
setup::tests::exact_read_rejects_leaf_replacement_after_reading_the_open_inode \
setup::tests::partial_leaf_replacement_before_rename_is_rejected_without_publication \
setup::tests::config_lock_and_partial_leaf_replacements_never_return_success \
setup::tests::stale_prompt_snapshot_and_partial_prefix_replacement_fail_closed \
setup::tests::sigabrt_at_every_publication_barrier_recovers_in_a_fresh_process \
input::hf_reference_tests::equivalent_model_references_share_one_canonical_identity \
input::hf_download_plan_tests::file_specific_resolution_fails_before_any_hub_lookup \
input::hf_download_plan_tests::repository_info_seals_a_mutable_request_to_the_returned_exact_commit \
input::hf_download_plan_tests::immutable_file_metadata_is_checked_before_transfer \
input::hf_download_plan_tests::metadata_transfer_caps_are_explicit_and_exact \
model_spec::tests::repository_quant_suffix_is_case_insensitive_and_exact \
cli::tests::frictionless_convert_accepts_repo_quant_without_output \
cli::tests::frictionless_serve_operand_accepts_repo_quant_and_list \
cli::tests::frictionless_chat_operand_accepts_repo_quant_and_list \
serve::managed_artifacts::tests::actual_local_selection_prefers_successful_use_and_exact_quant_ignores_low_memory \
serve::managed_artifacts::tests::production_manual_structural_admission_never_hashes_the_text_payload \
serve::managed_artifacts::tests::production_structural_admission_rejects_same_quant_size_ambiguity_even_on_filename_match \
serve::managed_artifacts::tests::malformed_projector_binding_is_a_warning_and_text_only_fallback \
serve::managed_artifacts::tests::in_place_markerless_structural_match_prepares_exact_catalog_projector \
serve::managed_artifacts::tests::fresh_hosted_projector_snapshot_is_retained_from_its_exact_blob \
serve::managed_artifacts::tests::in_place_manual_structural_match_reuses_present_sibling_mmproj \
serve::managed_artifacts::tests::direct_file_symlink_pair_is_discovered_and_retained_in_place \
serve::managed_artifacts::tests::symlinked_conversion_receipt_wins_without_hosted_gguf_artifacts \
serve::managed_artifacts::tests::receipt_history_sidecar_hub_filename_cannot_select_projector \
serve::managed_artifacts::tests::symlinked_conversion_receipt_explicit_output_clears_source_identity \
serve::managed_artifacts::tests::symlinked_managed_sidecar_is_not_local_authority \
serve::managed_artifacts::tests::symlinked_conversion_receipt_for_another_repository_cannot_win \
serve::managed_artifacts::tests::symlinked_receipt_target_retarget_is_rejected_before_activation \
serve::managed_artifacts::tests::malformed_adjacent_conversion_receipt_does_not_abort_other_candidates \
serve::managed_artifacts::tests::receipt_bridge_rejects_non_model_and_malformed_schema_v3_identities \
serve::managed_artifacts::tests::mismatched_logical_sidecars_do_not_import_receipt_use_history \
serve::managed_artifacts::tests::receipt_success_history_is_created_for_links_and_regular_outputs_and_selects_last_used \
serve::managed_artifacts::tests::receipt_success_history_never_touches_a_different_manifest_artifact \
serve::managed_artifacts::tests::receipt_success_history_rejects_retarget_to_another_valid_revision \
serve::managed_artifacts::tests::regular_receipt_output_never_promotes_a_stale_sidecar_or_forged_projector \
serve::managed_artifacts::tests::exact_receipt_history_clears_forged_sidecar_projector_and_prefers_receipt_pair \
serve::managed_artifacts::tests::logical_projector_alias_satisfies_generation_marked_pair_guard \
serve::managed_artifacts::tests::retained_target_pair_guard_uses_adjacent_receipt_projector_without_a_logical_alias \
serve::managed_artifacts::tests::hosted_projector_beside_logical_text_keeps_the_logical_pair_namespace \
serve::managed_artifacts::tests::structurally_valid_wrong_local_sibling_falls_through_to_exact_hosted_projector \
serve::managed_artifacts::tests::disappearing_automatic_sibling_mmproj_degrades_to_text_only \
serve::managed_artifacts::tests::same_size_projector_replacement_after_hash_admission_degrades_to_text_only \
serve::managed_artifacts::tests::successfully_used_managed_pair_returns_before_hub_download_or_native_conversion \
serve::managed_artifacts::tests::managed_candidate_same_quant_swap_after_verification_is_rejected \
serve::managed_artifacts::tests::bound_projector_digest_is_authenticated_before_it_can_suppress_hosted_repair \
serve::managed_artifacts::tests::retained_text_descriptor_drives_projector_metadata_through_public_swap_and_restore \
serve::managed_artifacts::tests::hub_cache_loose_projector_selection_uses_retained_text_through_swap_restore \
serve::managed_artifacts::tests::manual_loose_sibling_selection_uses_retained_text_through_swap_restore \
serve::managed_artifacts::tests::manual_loose_hosted_fallback_keeps_retained_digest_after_public_swap \
serve::managed_artifacts::tests::cache_selection_tracks_the_exact_quant_used_not_the_repository_lru \
serve::managed_artifacts::tests::cached_hub_q8_is_selected_locally_before_a_q4_fallback_tier \
serve::managed_artifacts::tests::exact_loose_digest_adopts_misnamed_bytes_and_hashes_once \
serve::managed_artifacts::tests::newer_same_quant_hub_cache_revision_is_not_shadowed_by_post_lock_old_binding \
serve::managed_artifacts::tests::text_only_local_projector_resolution_stops_before_any_hub_lookup \
serve::managed_artifacts::tests::authenticated_gguf_vision_marker_overrides_absent_repository_config_marker \
serve::managed_artifacts::tests::automatic_projector_preflight_failure_keeps_text_plan_and_suppresses_retry \
serve::managed_artifacts::tests::explicit_local_output_projector_conflict_warns_and_materializes_text_only \
serve::managed_artifacts::tests::local_pair_extent_refusal_suppresses_projector_retry_after_text_materialization \
serve::managed_artifacts::tests::incompatible_newest_loose_digest_continues_to_older_compatible_local_bytes \
serve::managed_artifacts::tests::local_candidate_mutated_during_catalog_latency_is_discarded_for_fallback \
serve::managed_artifacts::tests::non_runtime_setup_quant_fails_only_when_remote_fallback_is_needed \
serve::managed_artifacts::tests::destination_preflight_reuses_exact_bytes_and_rejects_conflict_before_transfer \
serve::managed_artifacts::tests::verified_conversion_pair_is_reused_and_published_as_managed_authority \
serve::managed_artifacts::tests::automatic_native_selection_steps_down_using_exact_product_sizes \
serve::managed_artifacts::tests::prepared_existing_projector_rejects_same_inode_mutation_before_activation \
serve::managed_artifacts::tests::cached_projector_snapshot_symlink_is_retained_from_its_repo_blob \
serve::managed_artifacts::tests::retained_adoption_has_an_independent_inode_and_source_alias_mutation_isolated \
serve::managed_artifacts::tests::retained_materialization_creates_independent_bytes_and_refuses_conflicts \
serve::managed_artifacts::tests::concurrent_exact_destination_winner_is_rechecked_and_reused \
serve::managed_artifacts::tests::local_pair_source_and_destination_parent_replacement_refuses_before_first_write \
serve::managed_artifacts::tests::older_local_multimodal_candidate_requests_its_exact_revision_not_head_projector \
serve::managed_artifacts::tests::markerless_local_multimodal_uses_candidate_revision_config_and_companion \
serve::managed_artifacts::tests::retained_exact_destination_replacement_after_preflight_refuses_activation \
serve::managed_artifacts::inventory::inventory_output_tests::hub_cache_queued_directory_replacement_cannot_escape_snapshot \
serve::managed_artifacts::inventory::inventory_output_tests::direct_model_directory_symlink_is_a_bounded_scan_root \
serve::managed_artifacts::inventory::inventory_output_tests::direct_file_symlink_is_discovered_without_traversing_a_linked_tree \
serve::managed_artifacts::inventory::inventory_output_tests::inventory_classifies_projector_companions_as_non_models \
serve::managed_artifacts::inventory::inventory_output_tests::inventory_fields_escape_row_and_terminal_control_characters \
serve::managed_artifacts::inventory::inventory_output_tests::retained_direct_model_symlink_root_cannot_be_retargeted_into_another_tree \
serve::managed_artifacts::inventory::inventory_output_tests::hub_cache_snapshot_retarget_after_parse_is_not_listed \
serve::managed_artifacts::inventory::inventory_output_tests::hub_cache_model_ancestor_replacement_cannot_redirect_snapshot_authority \
chat::local::tests::owned_private_ready_handoff_binds_authorized_endpoint \
chat::local::tests::targeted_chat_propagates_the_selected_state_root_to_owned_serve \
convert::cli_driver::tests::temporary_conversion_creates_a_fresh_managed_revision_parent \
convert::cli_driver::paired_transaction::tests::retry_removes_a_crashed_prejournal_workspace_under_exclusive_intent \
convert::cli_driver::paired_transaction::tests::prejournal_recovery_handles_empty_root_before_or_after_private_mode \
convert::cli_driver::paired_transaction::tests::single_output_retry_recovers_after_receipt_publication_crash \
convert::orchestrator::tests::planned_output_bytes_matches_multiple_unaligned_tensor_payloads \
convert::orchestrator::tests::pretransfer_native_bound_covers_actual_f32_kept_storage_plans \
input::hf_download::gguf_probe::tests::malicious_counts_and_lengths_fail_before_allocation \
input::hf_download::tests::complete_qwen_prefix_admits_runtime_metadata_tokenizer_and_tensor_topology \
input::hf_download::tests::complete_qwen_mtp_prefix_admits_the_same_one_layer_topology_as_runtime \
input::hf_download::tests::qwen_admission_rejects_embedding_tables_smaller_than_selected_heads \
input::hf_download::tests::mtp_hosted_admission_rejects_shape_correct_non_executable_storage \
input::hf_download::tests::exact_revision_hub_cache_lookup_reuses_an_existing_quant_without_transfer \
input::hf_download::tests::hosted_multimodal_pair_is_admitted_as_one_pretransfer_extent \
input::hf_download::tests::native_projector_planning_fails_closed_when_exact_config_inspection_fails \
input::hf_download::tests::native_output_bound_covers_kept_f32_fp16_fp8_and_mxfp4_sources \
input::hf_download::tests::exact_local_text_projector_destinations_require_zero_new_extent \
input::hf_download::tests::exact_transfer_preflight_fails_closed_on_unknown_or_zero_capacity \
input::hf_download::tests::retained_cross_device_pair_preflight_aggregates_on_destination_authority \
input::hf_download::gguf_probe::tests::gguf_vision_profile_is_authoritative_for_projector_planning \
input::hf_download::tests::exact_owned_hub_bytes_use_local_compatibility_admission_without_a_range_request \
input::hf_download::tests::incomplete_qwen_prefix_is_rejected_before_payload_transfer \
input::hf_download::tests::qwen_dense_hosted_admission_is_isomorphic_to_runtime_storage \
input::hf_download::tests::qwen_operational_scalars_reject_non_executable_runtime_configs \
input::hf_download::tests::native_conversion_preflight_uses_exact_plan_plus_safety_headroom \
input::hf_download::tests::native_source_and_output_are_admitted_as_one_shared_filesystem_extent \
input::hf_download::tests::native_metadata_stage_preflights_before_first_cache_write \
input::hf_download::tests::authenticated_sparse_source_fetches_only_safetensors_headers \
input::hf_download::tests::mixed_local_text_hosted_projector_extents_are_aggregated_by_filesystem \
core::paired_artifact::tests::conversion_operation_locks_serialize_a_shared_explicit_projector \
models::vit::gguf_emit::tests::planned_mmproj_bytes_match_real_nonempty_aligned_output \
serve::managed_artifacts::tests::native_multimodal_disk_plan_includes_the_f16_projector_before_transfer \
serve::managed_artifacts::tests::source_only_native_fallback_refuses_an_upper_bound_that_does_not_fit \
serve::auto_pipeline::tests::self_spawned_convert_arguments_parse_on_the_current_cli \
inference::models::qwen35::source_precision::operator::tests::embedded_qwen38_source_manifest_projects_exact_offline_inventory \
convert::cli_driver::tests::deepseek_tiny_official_layout_converts_to_q2_k_s_end_to_end \
input::integrity::tests::safetensors_index_entry_cap_is_exact \
convert::receipt::tests::prepared_success_receipt_binds_output_and_replaces_stale_atomically \
convert::receipt::tests::explicit_receipt_destination_cannot_replace_the_artifact \
tests::convert_source_classifier_reconciles_revision_and_rejects_ambiguity
do
grep -Fq -- "$required_test: test" <<<"$hf_source_tests"
done
cargo test --locked --bin hf2q --all-features input::hf_reference_tests::
cargo test --locked --bin hf2q --all-features input::hf_download_plan_tests::
cargo test --locked --bin hf2q --all-features model_spec::tests::
cargo test --locked --bin hf2q --all-features cli::tests::frictionless_
cargo test --locked --bin hf2q --all-features serve::managed_artifacts::tests::
cargo test --locked --bin hf2q --all-features chat::local::tests::
cargo test --locked --bin hf2q --all-features input::hf_download::tests::
cargo test --locked --bin hf2q --all-features input::hf_download::gguf_probe::tests::
cargo test --locked --bin hf2q --all-features serve::auto_pipeline::tests::
cargo test --locked --bin hf2q --all-features convert::cli_driver::paired_transaction::tests::
cargo test --locked --bin hf2q --all-features convert::cli_driver::tests::temporary_conversion_creates_a_fresh_managed_revision_parent -- --exact
cargo test --locked --bin hf2q --all-features models::vit::gguf_emit::tests::planned_mmproj_bytes_match_real_nonempty_aligned_output -- --exact
cargo test --locked --bin hf2q --all-features inference::models::qwen35::source_precision::operator::tests::embedded_qwen38_source_manifest_projects_exact_offline_inventory -- --exact
cargo test --locked --bin hf2q --all-features input::integrity::tests:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features convert::cli_driver::tests::deepseek_tiny_official_layout_converts_to_q2_k_s_end_to_end -- --exact
cargo test --locked --bin hf2q --all-features convert::receipt::tests::
cargo test --locked --bin hf2q --all-features tests::convert_source_classifier
cargo test --locked --bin hf2q --all-features qwen38 -- --test-threads=1
cargo test --locked --bin hf2q --all-features qwen_thinking_budget -- --test-threads=1
cargo test --locked --bin hf2q --all-features gqa_q2_policy::tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features iter230_a2_lock_discipline -- --test-threads=1
cargo test --locked --bin hf2q --all-features loaded_registration_overrides -- --test-threads=1
cargo test --locked --bin hf2q --all-features serve::operator_ui::tests:: -- --test-threads=1
cargo test --locked --bin hf2q --all-features qwen35_serving_tokenizer_is_sidecar_free_and_detects_vision_markers -- --test-threads=1
cargo test --locked --bin hf2q --all-features vision_projector_binding -- --test-threads=1
cargo test --locked --bin hf2q --all-features model_advertisement_contract_ -- --test-threads=1
cargo test --locked --bin hf2q --all-features qwen35_startup_warmup_primes_gpu_for_serial_and_slot_aware -- --test-threads=1
cargo test --locked --bin hf2q --all-features qwen35_bounded_prefill_watchdog_tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features prompt_cache_ -- --test-threads=1
cargo test --locked --bin hf2q --all-features agentic_grammar_contract_ -- --test-threads=1
cargo test --locked --bin hf2q --all-features gemma4_bounded_prefill_tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features slotaware_fail_stop_tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features engine_supervisor::tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features public_watchdog_fixture_bytes_are_stable_without_a_model -- --test-threads=1
cargo test --locked --bin hf2q --all-features public_watchdog_fixture_consumers_share_the_canonical_digests -- --test-threads=1
cargo test --locked --bin hf2q --all-features readiness_guard_tests -- --test-threads=1
bash -n scripts/qwen36_watchdog_validate.sh \
scripts/test_getting_started_guide.sh \
scripts/test_shipping_contract.sh \
scripts/serve_qwen38_opencode.sh \
scripts/test_qwen36_prefill_watchdog.sh \
scripts/test_qwen36_prefill_cancellation.sh \
scripts/test_qwen36_cumulative_release.sh \
scripts/test_deepseek4_agentic.sh \
scripts/test_deepseek4_structured_tools.sh \
scripts/test_deepseek4_agentic_fixture_contract.sh \
scripts/test_deepseek4_cooperative_prefill_receipt_contract.sh \
scripts/test_deepseek4_decode_cohort_receipt_contract.sh \
scripts/test_deepseek4_peer_cold_wave.sh \
scripts/test_deepseek4_peer_cold_wave_contract.sh \
scripts/run_deepseek4_matched_peer.sh \
scripts/macos_thermal_guard.sh \
scripts/verify_macos_thermal_receipt.sh \
scripts/verify_deepseek4_cooperative_prefill_receipt.sh \
scripts/verify_deepseek4_decode_cohort_receipt.sh \
scripts/run_deepseek4_decode_cohort_gate.sh \
scripts/verify_gemma4_wave_thermal_receipt.sh \
scripts/verify_gemma4_parity_receipt.sh \
scripts/qwen38_long_decode_ab.sh \
scripts/qwen38_speculation_ab.sh \
scripts/qwen38_matched_reference_contract.sh \
scripts/qwen38_matched_reference_abba.sh \
scripts/verify_qwen38_long_decode_receipt.sh \
scripts/test_qwen38_long_decode_receipt_contract.sh \
scripts/test_qwen38_artifact_binding_contract.sh \
scripts/test_qwen38_matched_reference_contract.sh \
scripts/test_macos_thermal_guard_contract.sh \
scripts/test_gemma4_wave_thermal_contract.sh \
scripts/test_gemma4_eight_slot_receipt_contract.sh \
scripts/seal_release_binary.sh \
scripts/test_release_binary_seal_contract.sh \
scripts/sign_notarize_standalone_release.sh \
scripts/verify_standalone_candidate.sh \
scripts/test_standalone_release_signing_contract.sh \
scripts/verify_release_dependency_provenance.sh \
scripts/test_release_dependency_provenance_contract.sh \
scripts/run_release_gate_process_group.sh \
scripts/test_release_gate_process_group_contract.sh \
scripts/ensure_github_release_tag.sh \
scripts/test_release_tag_recovery_contract.sh \
scripts/test_deepseek4_cached_suffix.sh \
scripts/test_deepseek4_cached_suffix_contract.sh \
scripts/test_deepseek4_interactive_overlap.sh \
scripts/test_agentic_cache_lifecycle.sh \
scripts/test_gemma4_long_short_overlap.sh \
scripts/test_gemma4_long_short_overlap_contract.sh \
scripts/run_agentic_cache_release_gate.sh
bash scripts/test_qwen36_watchdog_harness_contract.sh
bash scripts/test_getting_started_guide.sh
bash scripts/test_shipping_contract.sh
bash scripts/test_deepseek4_cached_suffix_contract.sh
bash scripts/test_deepseek4_agentic_fixture_contract.sh
bash scripts/test_deepseek4_cooperative_prefill_receipt_contract.sh
bash scripts/test_deepseek4_decode_cohort_receipt_contract.sh
bash scripts/test_deepseek4_peer_cold_wave_contract.sh
bash scripts/test_macos_thermal_guard_contract.sh
bash scripts/test_gemma4_wave_thermal_contract.sh
bash scripts/test_gemma4_eight_slot_receipt_contract.sh
bash scripts/test_qwen38_long_decode_receipt_contract.sh
bash scripts/test_qwen38_artifact_binding_contract.sh
bash scripts/test_qwen38_matched_reference_contract.sh
bash scripts/test_release_binary_seal_contract.sh
bash scripts/test_standalone_release_signing_contract.sh
bash scripts/test_release_dependency_provenance_contract.sh
bash scripts/test_release_gate_process_group_contract.sh
bash scripts/test_release_tag_recovery_contract.sh
bash scripts/test_frictionless_diagnostics_contract.sh
bash scripts/test_gemma4_long_short_overlap_contract.sh
cargo test --locked --bin hf2q --all-features deepseek4 -- \
--skip attention_forward_tests \
--skip allocator_materializes_the_plan_as_zeroed_bf16_buffers \
--skip cache_steps_publish_only_complete_groups_and_commit_transactionally \
--skip partial_token_poison_requires_reset_before_replay \
--skip start_zero_prefill_span_counts_complete_groups_and_publishes_once \
--skip ffn_forward_tests \
--skip raw_matmul_accepts_quality_sensitive_f32_weights \
--skip embedding_forward_rejects_empty_input \
--skip q2_k_embeddings_expand_to_four_identical_hc_streams \
--skip native_model_load_keeps_weights_and_cache_on_one_device \
--skip native_output_head_produces_finite_vocab_logits_and_rejects_shape_drift \
--skip loader_preserves_raw_blocks_and_expands_only_elementwise_state \
--skip loader_rejects_catalog_and_i32_storage_before_residency
- name: activate() matrix smoke (clean / REFUSED / UNSAFE)
shell: bash
run: |
set -euo pipefail
echo "--- clean env should produce no investigation output ---"
./target/release/hf2q --help > /dev/null 2>/tmp/stderr_clean.log
if [[ -s /tmp/stderr_clean.log ]]; then
echo "FAIL: clean-env run produced stderr:" >&2
cat /tmp/stderr_clean.log >&2
exit 1
fi
echo " OK"
echo "--- HF2Q_F16_KV=1 without ack must REFUSE ---"
HF2Q_F16_KV=1 ./target/release/hf2q --help \
> /dev/null 2>/tmp/stderr_refused.log
grep -q "REFUSED" /tmp/stderr_refused.log
grep -q "HF2Q_F16_KV=1" /tmp/stderr_refused.log
echo " OK"
echo "--- HF2Q_F16_KV=1 + HF2Q_UNSAFE_EXPERIMENTS=1 must ACTIVATE ---"
HF2Q_F16_KV=1 HF2Q_UNSAFE_EXPERIMENTS=1 \
./target/release/hf2q --help \
> /dev/null 2>/tmp/stderr_unsafe.log
grep -q "UNSAFE (ack-required, activated)" /tmp/stderr_unsafe.log
if grep -q "REFUSED" /tmp/stderr_unsafe.log; then
echo "FAIL: explicitly acknowledged unsafe activation was refused" >&2
exit 1
fi
echo " OK"