name: Release
on:
workflow_dispatch:
inputs:
commit_sha:
description: Exact main-branch commit to publish
required: true
type: string
version:
description: Exact crate version to publish
required: true
type: string
cache_gate_run_id:
description: Successful exact-SHA Cache lifecycle workflow run ID
required: true
type: string
permissions:
actions: read
contents: write
concurrency:
group: release-${{ inputs.version }}
cancel-in-progress: false
jobs:
publish:
runs-on: macos-latest
timeout-minutes: 90
env:
EXPECTED_SHA: ${{ inputs.commit_sha }}
EXPECTED_VERSION: ${{ inputs.version }}
EXPECTED_CACHE_GATE_RUN_ID: ${{ inputs.cache_gate_run_id }}
EXPECTED_DEEPSEEK_MODEL_SHA256: ${{ vars.DEEPSEEK4_MODEL_SHA256 }}
EXPECTED_GEMMA_MODEL_SHA256: ${{ vars.GEMMA4_MODEL_SHA256 }}
EXPECTED_QWEN_MODEL_SHA256: ${{ vars.QWEN36_MODEL_SHA256 }}
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with:
ref: ${{ inputs.commit_sha }}
fetch-depth: 0
persist-credentials: false
- name: Verify immutable release identity
shell: bash
run: |
set -euo pipefail
actual_sha=$(git rev-parse HEAD)
test "$actual_sha" = "$EXPECTED_SHA"
git fetch origin main
test "$actual_sha" = "$(git rev-parse origin/main)"
actual_version=$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -1)
test "$actual_version" = "$EXPECTED_VERSION"
git diff --exit-code
- name: Require successful exact-SHA CI
shell: bash
env:
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
successes=$(gh run list \
--commit "$EXPECTED_SHA" \
--workflow CI \
--json conclusion,event \
--jq '[.[] | select(.event == "push" and .conclusion == "success")] | length')
test "$successes" -ge 1
- name: Require exact-artifact cross-family cache lifecycle proof
shell: bash
env:
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
run_json=$(gh run view "$EXPECTED_CACHE_GATE_RUN_ID" \
--json conclusion,event,headSha,workflowName,url)
test "$(jq -r .workflowName <<<"$run_json")" = "Cache lifecycle"
test "$(jq -r .event <<<"$run_json")" = "workflow_dispatch"
test "$(jq -r .headSha <<<"$run_json")" = "$EXPECTED_SHA"
test "$(jq -r .conclusion <<<"$run_json")" = "success"
gate_dir="$RUNNER_TEMP/cache-lifecycle-proof"
gh run download "$EXPECTED_CACHE_GATE_RUN_ID" \
--name "cache-lifecycle-$EXPECTED_SHA" \
--dir "$gate_dir"
manifest="$gate_dir/manifest.json"
test -s "$manifest"
# Recompute every powered sub-gate's baseline/final multiset delta
# from the downloaded raw snapshots. Summary counts alone are not
# release authority.
source scripts/qwen36_watchdog_validate.sh
power_snapshot_manifest="$gate_dir/power-event-snapshots.sha256"
expected_power_snapshot_sha=$(
jq -er '.power_event_snapshots_sha256' "$manifest"
)
actual_power_snapshot_sha=$(
shasum -a 256 "$power_snapshot_manifest" | awk '{print $1}'
)
test "$actual_power_snapshot_sha" = "$expected_power_snapshot_sha"
power_snapshot_prefixes=()
while IFS= read -r prefix; do
power_snapshot_prefixes+=("$prefix")
done < <(qwen36_release_power_snapshot_prefixes)
qwen36_verify_power_snapshot_manifest \
"$gate_dir" "$power_snapshot_manifest" \
"${power_snapshot_prefixes[@]}"
check_receipt() {
local path=$1
local selector=$2
local expected actual
expected=$(jq -er "$selector" "$manifest")
actual=$(shasum -a 256 "$gate_dir/$path" | awk '{print $1}')
test "$actual" = "$expected"
}
check_receipt deepseek/lifecycle/summary.json '.receipt_sha256.deepseek.lifecycle'
check_receipt deepseek/interactive/summary.json '.receipt_sha256.deepseek.interactive'
check_receipt deepseek/cached-suffix/summary.json '.receipt_sha256.deepseek.cached_suffix'
check_receipt deepseek/full-context-1/envelope.json '.receipt_sha256.deepseek.wave1'
check_receipt deepseek/full-context-2/envelope.json '.receipt_sha256.deepseek.wave2'
check_receipt deepseek/full-context-1/thermal/summary.json '.receipt_sha256.deepseek.wave1_thermal'
check_receipt deepseek/full-context-2/thermal/summary.json '.receipt_sha256.deepseek.wave2_thermal'
for wave in 1 2; do
wave_dir="$gate_dir/deepseek/full-context-$wave"
summary_sha=$(shasum -a 256 "$wave_dir/summary.json" | awk '{print $1}')
test "$summary_sha" = "$(jq -er .summary_sha256 "$wave_dir/envelope.json")"
jq -e -f scripts/deepseek4_full_context_receipt.jq \
"$wave_dir/summary.json" >/dev/null
thermal_summary="$wave_dir/thermal/summary.json"
thermal_log="$wave_dir/thermal/measurement.log"
thermal_settle_log="$wave_dir/thermal/settle.log"
bash scripts/verify_macos_thermal_receipt.sh "$wave" \
"$wave_dir/envelope.json" "$thermal_summary" \
"$thermal_log" "$thermal_settle_log" "$wave_dir/agents"
done
check_receipt gemma/lifecycle/summary.json '.receipt_sha256.gemma.lifecycle'
check_receipt gemma/overlap/summary.json '.receipt_sha256.gemma.overlap'
check_receipt gemma/wave1/summary.json '.receipt_sha256.gemma.wave1'
check_receipt gemma/wave2/summary.json '.receipt_sha256.gemma.wave2'
check_receipt gemma/wave1/thermal/summary.json '.receipt_sha256.gemma.wave1_thermal'
check_receipt gemma/wave2/thermal/summary.json '.receipt_sha256.gemma.wave2_thermal'
for wave in 1 2; do
wave_dir="$gate_dir/gemma/wave$wave"
bash scripts/verify_gemma4_wave_thermal_receipt.sh "$wave" \
"$wave_dir/summary.json" "$wave_dir/thermal/summary.json" \
"$wave_dir/thermal/measurement.log" \
"$wave_dir/thermal/settle.log" "$wave_dir/agents"
done
check_receipt gemma/eight-slots/summary.json '.receipt_sha256.gemma.eight_slots'
check_receipt gemma/eight-slots/thermal/summary.json '.receipt_sha256.gemma.eight_slots_thermal'
bash scripts/verify_gemma4_wave_thermal_receipt.sh eight-slots \
"$gate_dir/gemma/eight-slots/summary.json" \
"$gate_dir/gemma/eight-slots/thermal/summary.json" \
"$gate_dir/gemma/eight-slots/thermal/measurement.log" \
"$gate_dir/gemma/eight-slots/thermal/settle.log" \
"$gate_dir/gemma/eight-slots/agents"
jq -e -f scripts/gemma4_eight_slot_receipt.jq \
"$gate_dir/gemma/eight-slots/summary.json" >/dev/null
check_receipt gemma/transactions-four-slots.json '.receipt_sha256.gemma.transactions4'
check_receipt gemma/transactions-eight-slots.json '.receipt_sha256.gemma.transactions8'
check_receipt gemma/parity/summary.json '.receipt_sha256.gemma.parity'
bash scripts/verify_gemma4_parity_receipt.sh \
"$gate_dir/gemma/parity/summary.json" "$gate_dir/gemma/parity"
check_receipt gemma/heap-summary.json '.receipt_sha256.gemma.heap'
check_receipt qwen/lifecycle/summary.json '.receipt_sha256.qwen.lifecycle'
check_receipt qwen/cumulative/cumulative-release-summary.json '.receipt_sha256.qwen.cumulative'
check_receipt qwen/cancellation/cancellation-summary.json '.receipt_sha256.qwen.cancellation'
qwen36_validate_cancellation_transaction_counts \
"$gate_dir/qwen/cancellation/cancellation-summary.json"
for digest in \
"$EXPECTED_DEEPSEEK_MODEL_SHA256" \
"$EXPECTED_GEMMA_MODEL_SHA256" \
"$EXPECTED_QWEN_MODEL_SHA256"; do
[[ "$digest" =~ ^[0-9a-f]{64}$ ]]
done
jq -e \
--arg source_sha "$EXPECTED_SHA" \
--arg deepseek_sha "$EXPECTED_DEEPSEEK_MODEL_SHA256" \
--arg gemma_sha "$EXPECTED_GEMMA_MODEL_SHA256" \
--arg qwen_sha "$EXPECTED_QWEN_MODEL_SHA256" \
'. as $root
| .status == "pass"
and .source_sha == $source_sha
and .power_guarded_ac == true
and (.power_event_snapshots_sha256 | test("^[0-9a-f]{64}$"))
and (.binary_sha256 | test("^[0-9a-f]{64}$"))
and .models.deepseek.sha256 == $deepseek_sha
and .models.gemma.sha256 == $gemma_sha
and .models.qwen.sha256 == $qwen_sha
and (.families.deepseek as $d
| $d.status == "pass"
and $d.lifecycle.status == "pass"
and $d.lifecycle.active_stream_cancelled_without_done == true
and $d.lifecycle.queued_exact_retry_cached_tokens > 0
and $d.lifecycle.unrelated_conversation_content == "ISOLATION_OK"
and $d.interactive_overlap.status == "pass"
and $d.interactive_overlap.server.binary_sha256 == $root.binary_sha256
and $d.interactive_overlap.server.model_sha256 == $deepseek_sha
and $d.interactive_overlap.server.max_slots == 4
and $d.interactive_overlap.fixture_sha256 == "6671a0c89b8d4935caa4b87bee08361c5b8727ec557e9edb05947ad90c94c13d"
and $d.interactive_overlap.long_prompt_tokens > 80000
and $d.interactive_overlap.first_mixed_prefill_chunk_tokens > 0
and $d.interactive_overlap.first_mixed_prefill_chunk_tokens <= 256
and $d.interactive_overlap.first_mixed_prefill_window_cap == 2
and $d.interactive_overlap.short_generated_tokens_at_first_window >= 8
and $d.interactive_overlap.terminal_parking.park_observed == true
and $d.interactive_overlap.terminal_parking.terminal_absent_while_parked == true
and $d.interactive_overlap.terminal_parking.active_cold_prefills_at_park >= 1
and $d.interactive_overlap.terminal_parking.park_log_line < $d.interactive_overlap.terminal_parking.long_prefill_complete_log_line
and $d.interactive_overlap.terminal_parking.long_prefill_complete_log_line < $d.interactive_overlap.terminal_parking.release_log_line
and $d.interactive_overlap.terminal_parking.release_log_line <= $d.interactive_overlap.terminal_parking.request_complete_log_line
and $d.interactive_overlap.ready_http == 200
and $d.interactive_overlap.power_event_delta == 0
and $d.cached_suffix.status == "pass"
and $d.cached_suffix.server.binary_sha256 == $root.binary_sha256
and $d.cached_suffix.overlap.cached_prefill_transactions >= 3
and $d.cached_suffix.overlap.peer_decode_progress_events_between_transactions >= 1
and $d.cached_suffix.overlap.peer_terminal_done_exactly_once == true
and $d.cached_suffix.cancellation.counter_after == ($d.cached_suffix.cancellation.counter_before + 1)
and $d.cached_suffix.cancellation.chunks_after_stability == $d.cached_suffix.cancellation.chunks_after_settle
and $d.cached_suffix.cancellation.emitted_done == false
and (($d.cached_suffix.cancellation.expected_anchor_tokens | type) == "number")
and $d.cached_suffix.cancellation.expected_anchor_tokens > 0
and $d.cached_suffix.cancellation.post_cancel_cached_tokens == $d.cached_suffix.cancellation.expected_anchor_tokens
and $d.cached_suffix.cancellation_after_candidate_anchor.counter_after == ($d.cached_suffix.cancellation_after_candidate_anchor.counter_before + 1)
and $d.cached_suffix.cancellation_after_candidate_anchor.chunks_after_stability == $d.cached_suffix.cancellation_after_candidate_anchor.chunks_after_settle
and (($d.cached_suffix.cancellation_after_candidate_anchor.expected_anchor_tokens | type) == "number")
and $d.cached_suffix.cancellation_after_candidate_anchor.expected_anchor_tokens > 0
and $d.cached_suffix.cancellation_after_candidate_anchor.post_cancel_cached_tokens == $d.cached_suffix.cancellation_after_candidate_anchor.expected_anchor_tokens
and $d.cached_suffix.cancellation_during_decode.counter_after == ($d.cached_suffix.cancellation_during_decode.counter_before + 1)
and $d.cached_suffix.cancellation_during_decode.progress_events_after_stability == $d.cached_suffix.cancellation_during_decode.progress_events_after_settle
and (($d.cached_suffix.cancellation_during_decode.seed_request_id | type) == "number")
and $d.cached_suffix.cancellation_during_decode.seed_request_id > 0
and (($d.cached_suffix.cancellation_during_decode.expected_anchor_tokens | type) == "number")
and $d.cached_suffix.cancellation_during_decode.expected_anchor_tokens > 0
and $d.cached_suffix.cancellation_during_decode.post_cancel_cached_tokens == $d.cached_suffix.cancellation_during_decode.expected_anchor_tokens
and $d.cached_suffix.ready_before == true and $d.cached_suffix.ready_after == true
and $d.cached_suffix.fatal_log_signatures == 0
and ($d.full_context_waves | length) == 2
and ([$d.full_context_waves[].wave] | sort) == [1, 2]
and all($d.full_context_waves[];
.status == "pass" and .binary_sha256 == $root.binary_sha256
and .model_sha256 == $deepseek_sha and .ready_http == 200
and .fatal_log_signatures == 0 and .receipt.status == "pass"
and .thermal.status == "pass"
and .thermal.required_state == "nominal"
and .thermal.runtime_preflight == "pass"
and .thermal.measurement_scope == "cold-cohort"
and (.thermal.cold_receipts | type) == "array"
and (.thermal.cold_receipts | length) == 4
and ([.thermal.cold_receipts[].name] | unique | length) == 4
and all(.thermal.cold_receipts[];
(.name | test("^agent-[1-4]\\.cold\\.json$"))
and (.sha256 | test("^[0-9a-f]{64}$")))
and (.thermal.settle_seconds | type) == "number"
and .thermal.settle_seconds >= 60
and (.thermal.settle_duration_seconds | type) == "number"
and .thermal.settle_duration_seconds >= .thermal.settle_seconds
and (.thermal.settle_samples | type) == "number"
and .thermal.settle_samples > 0
and (.thermal.measurement_samples | type) == "number"
and .thermal.measurement_samples >= 2
and (.thermal.measurement_duration_seconds | type) == "number"
and .thermal.measurement_duration_seconds > 0
and (.thermal.sample_interval_seconds | type) == "number"
and .thermal.sample_interval_seconds == 2
and (.thermal.maximum_sample_gap_seconds | type) == "number"
and .thermal.maximum_sample_gap_seconds > 0
and .thermal.maximum_sample_gap_seconds <= 5
and (.thermal.settle_sample_interval_seconds | type) == "number"
and .thermal.settle_sample_interval_seconds == 5
and (.thermal.maximum_settle_sample_gap_seconds | type) == "number"
and .thermal.maximum_settle_sample_gap_seconds > 0
and .thermal.maximum_settle_sample_gap_seconds <= 8
and (.thermal.non_nominal_measurement_samples | type) == "number"
and .thermal.non_nominal_measurement_samples == 0
and (.thermal.settle_telemetry_gaps | type) == "number"
and .thermal.settle_telemetry_gaps == 0
and (.thermal.telemetry_gaps | type) == "number"
and .thermal.telemetry_gaps == 0
and (.thermal.settle_log_sha256 | test("^[0-9a-f]{64}$"))
and (.thermal.measurement_log_sha256 | test("^[0-9a-f]{64}$"))
and (.cold_prefill_tokens_per_second | type) == "array"
and (.cold_prefill_tokens_per_second | length) == 4
and all(.cold_prefill_tokens_per_second[]; type == "number" and . > 0)
and .receipt.family == "deepseek4" and .receipt.concurrent_agents == 4
and .receipt.require_cold_first == 1 and (.receipt.agents | length) == 4
and .receipt.agentic_context_fixture_sha256 == "2c894c9ed9cf02d5454e9756e6836ffbeed4f256c9e35c544cc451636476b4ef"
and .receipt.agentic_context_fixture_bytes == 21204
and .receipt.repository_context_chars == 20584
and .receipt.prompt_tokens == 6685
and all(.receipt.agents[];
.status == "pass" and .cold_cached_tokens == 0
and .agentic_context_fixture_sha256 == "2c894c9ed9cf02d5454e9756e6836ffbeed4f256c9e35c544cc451636476b4ef"
and .agentic_context_fixture_bytes == 21204
and .repository_context_chars == 20584
and .expected_path == "/opt/hf2q-worktrees/full-context-slots/Cargo.toml"
and .prompt_tokens == 6685
and .cold_ttft_ms <= 60000
and .cold_semantic_response_ms <= 60000
and .cached_tokens >= (.prompt_tokens - 32)
and .auto_cached_tokens >= (.prompt_tokens - 32)
and .continuation_cached_tokens >= (.prompt_tokens - 32)
and .cached_ttft_ms <= 5000
and .cached_semantic_response_ms <= 15000
and .auto_semantic_response_ms <= 15000
and .cached_sse_tool_call_ms <= 15000
and .tool_result_response_ms <= 35000)))
and (.families.gemma as $g
| $g.status == "pass" and $g.lifecycle.status == "pass"
and $g.lifecycle.active_stream_cancelled_without_done == true
and $g.lifecycle.queued_exact_retry_cached_tokens > 0
and $g.lifecycle.unrelated_conversation_content == "ISOLATION_OK"
and $g.overlap_and_cancellation.status == "pass"
and $g.overlap_and_cancellation.binary_sha256 == $root.binary_sha256
and $g.overlap_and_cancellation.model_sha256 == $gemma_sha
and $g.overlap_and_cancellation.max_slots == 4
and $g.overlap_and_cancellation.primary_context_sha256 == "07b147e9c6ac26a0c9c4a719391c0772b2d27b9d77499479014b9ace88b6b11e"
and $g.overlap_and_cancellation.cancellation_context_sha256 == "f0b264eedae315618941d8fa6fb16454c4eac03b5793e213b613d66ccb7b6e4a"
and $g.overlap_and_cancellation.long_prompt_tokens > 80000
and $g.overlap_and_cancellation.short_semantic_during_long_prefill == true
and $g.overlap_and_cancellation.committed_tokens_when_short_progressed < $g.overlap_and_cancellation.long_prompt_tokens
and $g.overlap_and_cancellation.cancellation_delta == 1
and $g.overlap_and_cancellation.chunks_after_cancel == $g.overlap_and_cancellation.chunks_after_stability
and $g.overlap_and_cancellation.rollback_restores >= 1
and $g.overlap_and_cancellation.transaction_cap_tokens == 4096
and $g.overlap_and_cancellation.ready_http == 200
and $g.overlap_and_cancellation.power_event_delta == 0
and ($g.agent_waves | length) == 3
and ($g.agent_waves | map(.concurrent_agents) | sort) == [4,4,8]
and ([$g.agent_waves[] | select(.concurrent_agents == 4) | .wave_id] | sort) == ["wave1","wave2"]
and all($g.agent_waves[];
.status == "pass" and .family == "gemma4" and .require_cold_first == 1
and all(.agents[]; .status == "pass" and .cold_cached_tokens == 0
and .cached_tokens >= (.prompt_tokens - 32)
and .auto_cached_tokens >= (.prompt_tokens - 32)
and .continuation_cached_tokens >= (.prompt_tokens - 32)))
and all($g.agent_waves[] | select(.concurrent_agents == 4);
(.wave_id == "wave1" or .wave_id == "wave2")
and .thermal.status == "pass"
and .thermal.concurrent_agents == 4
and .thermal.required_state == "nominal"
and .thermal.measurement_scope == "full-agent-wave"
and .thermal.settle_seconds == 60
and .thermal.settle_duration_seconds >= 60
and .thermal.settle_samples > 0
and .thermal.measurement_samples >= 2
and .thermal.measurement_duration_seconds > 0
and .thermal.sample_interval_seconds == 2
and .thermal.maximum_sample_gap_seconds == 5
and .thermal.settle_sample_interval_seconds == 5
and .thermal.maximum_settle_sample_gap_seconds == 8
and .thermal.non_nominal_measurement_samples == 0
and .thermal.settle_telemetry_gaps == 0
and .thermal.telemetry_gaps == 0
and (.thermal.cold_receipts | length) == 4)
and all($g.agent_waves[] | select(.concurrent_agents == 8);
.wave_id == "eight-slots"
and (.agents | type) == "array" and (.agents | length) == 8
and .thermal.status == "pass"
and .thermal.phase == "gemma-eight-slots"
and .thermal.concurrent_agents == 8
and .thermal.required_state == "nominal"
and .thermal.measurement_scope == "full-agent-wave"
and .thermal.settle_seconds == 60
and .thermal.settle_duration_seconds >= 60
and .thermal.settle_samples > 0
and .thermal.measurement_samples >= 2
and .thermal.measurement_duration_seconds > 0
and .thermal.sample_interval_seconds == 2
and .thermal.maximum_sample_gap_seconds == 5
and .thermal.settle_sample_interval_seconds == 5
and .thermal.maximum_settle_sample_gap_seconds == 8
and .thermal.non_nominal_measurement_samples == 0
and .thermal.settle_telemetry_gaps == 0
and .thermal.telemetry_gaps == 0
and (.thermal.cold_receipts | length) == 8
and (.maximum_cold_ttft_ms | type) == "number"
and .maximum_cold_ttft_ms >= 0 and .maximum_cold_ttft_ms <= 40000
and (.maximum_cold_semantic_response_ms | type) == "number"
and .maximum_cold_semantic_response_ms >= 0
and .maximum_cold_semantic_response_ms <= 60000
and (.maximum_tool_result_ms | type) == "number"
and .maximum_tool_result_ms >= 0 and .maximum_tool_result_ms <= 30000
and all(.agents[];
(.cold_ttft_ms | type) == "number"
and .cold_ttft_ms >= 0 and .cold_ttft_ms <= 40000
and (.cold_semantic_response_ms | type) == "number"
and .cold_semantic_response_ms >= 0
and .cold_semantic_response_ms <= 60000
and (.tool_result_response_ms | type) == "number"
and .tool_result_response_ms >= 0
and .tool_result_response_ms <= 30000)
and .maximum_cold_ttft_ms == ([.agents[].cold_ttft_ms] | max)
and .maximum_cold_semantic_response_ms == ([.agents[].cold_semantic_response_ms] | max)
and .maximum_tool_result_ms == ([.agents[].tool_result_response_ms] | max))
and ($g.transactions | length) == 2
and all($g.transactions[]; .status == "pass" and .transaction_cap_rows == 4096
and .max_transaction_rows <= 4096 and .multi_slot_transactions > 0
and .nonaligned_transactions > 0)
and $g.parity.status == "pass"
and $g.parity.profile == "release"
and $g.parity.n4_exact_output_parity == true
and $g.parity.n8_exact_output_parity == true
and $g.parity.n8_cross_slot_admit == true
and $g.parity.n8_max_tokens == 24
and $g.parity.n8_rounds == 25
and $g.parity.n8_seed_budget_exact_output_parity == true
and $g.parity.n8_seed_budget_max_tokens == 1
and $g.parity.n8_seed_budget_rounds == 25
and $g.parity.n8_tiny_hybrid_exact_output_parity == true
and $g.parity.n8_tiny_full_tq_exact_output_parity == true
and $g.parity.n8_tiny_prefill_rounds == 64
and $g.parity.n8_tiny_resume_rounds == 16
and $g.parity.fresh_and_reused_4096_8193_bounded_output_parity == true
and $g.parity.long_resume_exact_output_parity == true
and $g.heap.status == "pass"
and $g.heap.snapshot_order == ["baseline","post_wave1","post_wave2","post_overlap","post_lifecycle"]
and all($g.heap.snapshots[]; .command_buffer_objects == 0 and .command_buffer_impls == 0)
and all($g.heap.snapshots[];
(.cfstring_count | type) == "number" and .cfstring_count >= 0
and (.autoreleasepool_content_count | type) == "number"
and .autoreleasepool_content_count >= 0)
and ($g.heap.snapshots.post_wave1.cfstring_count - $g.heap.snapshots.baseline.cfstring_count) <= 256
and ($g.heap.snapshots.post_wave2.cfstring_count - $g.heap.snapshots.post_wave1.cfstring_count) <= 256
and ($g.heap.snapshots.post_wave2.cfstring_count - $g.heap.snapshots.baseline.cfstring_count) <= 512
and ($g.heap.snapshots.post_overlap.cfstring_count - $g.heap.snapshots.post_wave2.cfstring_count) <= 512
and ($g.heap.snapshots.post_lifecycle.cfstring_count - $g.heap.snapshots.post_overlap.cfstring_count) <= 512
and ($g.heap.snapshots.post_lifecycle.cfstring_count - $g.heap.snapshots.post_wave2.cfstring_count) <= 1024
and ($g.heap.snapshots.post_wave1.autoreleasepool_content_count - $g.heap.snapshots.baseline.autoreleasepool_content_count) <= 8
and ($g.heap.snapshots.post_wave2.autoreleasepool_content_count - $g.heap.snapshots.post_wave1.autoreleasepool_content_count) <= 8
and ($g.heap.snapshots.post_wave2.autoreleasepool_content_count - $g.heap.snapshots.baseline.autoreleasepool_content_count) <= 16
and ($g.heap.snapshots.post_overlap.autoreleasepool_content_count - $g.heap.snapshots.post_wave2.autoreleasepool_content_count) <= 8
and ($g.heap.snapshots.post_lifecycle.autoreleasepool_content_count - $g.heap.snapshots.post_overlap.autoreleasepool_content_count) <= 8
and ($g.heap.snapshots.post_lifecycle.autoreleasepool_content_count - $g.heap.snapshots.post_wave2.autoreleasepool_content_count) <= 16)
and (.families.qwen as $q
| $q.status == "pass" and $q.lifecycle.status == "pass"
and $q.lifecycle.active_stream_cancelled_without_done == true
and $q.lifecycle.queued_exact_retry_cached_tokens > 0
and $q.lifecycle.unrelated_conversation_content == "ISOLATION_OK"
and $q.cumulative.status == "pass"
and $q.cumulative.binary_sha256 == $root.binary_sha256
and $q.cumulative.model_sha256 == $qwen_sha
and $q.cumulative.max_slots == 4 and $q.cumulative.ready_http == 200
and $q.cumulative.power_event_delta == 0 and $q.cumulative.heap_bounds_valid == true
and $q.cumulative.overlap.prompt_tokens == 87972
and $q.cumulative.overlap.short_prompt_tokens == 552
and $q.cumulative.overlap.tools == 347
and $q.cumulative.overlap.chunks == 44
and $q.cumulative.overlap.full_chunks == 42
and $q.cumulative.overlap.short_semantic_before_long_chunk == true
and $q.cumulative.overlap.continuation_cached_tokens > 80000
and $q.cumulative.overlap.continuation_first_chunk_start == $q.cumulative.overlap.continuation_cached_tokens
and all($q.cumulative.agent_waves[];
.status == "pass" and .family == "qwen36" and .concurrent_agents == 4
and .require_cold_first == 1
and .agentic_system_prompt_sha256 == "dbedef4c2efa20e51603355def14af7f11658a03fd0dcda6de9d900588f7cb3c"
and .tool_result_success_prefix_sha256 == "2d73b080a69f15d8cac736b264d82fdb4e8fe40e6cff6ed6bf099565f499ef5a"
and all(.agents[];
.cold_cached_tokens == 0
and .expected_path == "/opt/hf2q/Cargo.toml"
and .agentic_system_prompt_sha256 == "dbedef4c2efa20e51603355def14af7f11658a03fd0dcda6de9d900588f7cb3c"
and .tool_result_success_prefix_sha256 == "2d73b080a69f15d8cac736b264d82fdb4e8fe40e6cff6ed6bf099565f499ef5a"))
and $q.cumulative.agent_waves.warmup.maximum_tool_result_ms <= 15000
and $q.cumulative.agent_waves.wave1.maximum_tool_result_ms <= 10000
and $q.cumulative.agent_waves.wave2.maximum_tool_result_ms <= 10000
and all($q.cumulative.heap[]; .command_buffer_objects == 0 and .command_buffer_impls == 0)
and $q.cumulative.heap_deltas.cfstring_baseline_to_warmup <= 1024
and $q.cumulative.heap_deltas.cfstring_warmup_to_wave2 <= 512
and $q.cumulative.heap_deltas.pool_baseline_to_warmup <= 16
and $q.cumulative.heap_deltas.pool_warmup_to_wave2 <= 16
and $q.cancellation.status == "pass"
and $q.cancellation.binary_sha256 == $root.binary_sha256
and $q.cancellation.model_sha256 == $qwen_sha
and $q.cancellation.max_slots == 1
and ($q.cancellation.chunks_at_disconnect | type) == "number"
and ($q.cancellation.chunks_after_cancel | type) == "number"
and ($q.cancellation.chunks_after_stability | type) == "number"
and $q.cancellation.chunks_at_disconnect == ($q.cancellation.chunks_at_disconnect | floor)
and $q.cancellation.chunks_after_cancel == ($q.cancellation.chunks_after_cancel | floor)
and $q.cancellation.chunks_after_stability == ($q.cancellation.chunks_after_stability | floor)
and $q.cancellation.chunks_at_disconnect == 3
and $q.cancellation.chunks_after_cancel >= $q.cancellation.chunks_at_disconnect
and $q.cancellation.chunks_after_cancel <= ($q.cancellation.chunks_at_disconnect + 1)
and $q.cancellation.cancellation_delta == 1
and $q.cancellation.cancelled_success_terminal == false
and $q.cancellation.same_slot_reuse == true
and $q.cancellation.chunks_after_cancel == $q.cancellation.chunks_after_stability
and $q.cancellation.pre_tiny_ready_http == 200
and $q.cancellation.ready_http == 200
and $q.cancellation.power_event_delta == 0)' \
"$manifest" >/dev/null
expected_crate_sha=$(jq -er '.crate_sha256' "$manifest")
[[ "$expected_crate_sha" =~ ^[0-9a-f]{64}$ ]]
echo "EXPECTED_CRATE_SHA256=$expected_crate_sha" >> "$GITHUB_ENV"
- name: Toolchain
uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 with:
toolchain: "1.88.0"
- name: cargo audit
shell: bash
run: |
cargo install cargo-audit --locked --version 0.22.2 --no-default-features
cargo audit
- name: Package exact source
shell: bash
run: |
set -euo pipefail
cargo package --locked
crate="target/package/hf2q-${EXPECTED_VERSION}.crate"
test -s "$crate"
actual_crate_sha=$(shasum -a 256 "$crate" | awk '{print $1}')
test "$actual_crate_sha" = "$EXPECTED_CRATE_SHA256"
printf '%s %s\n' "$actual_crate_sha" "$crate" \
| tee "$RUNNER_TEMP/release-crate.sha256"
- name: Install and smoke-test packed artifact
shell: bash
run: |
set -euo pipefail
package_root="target/package/hf2q-${EXPECTED_VERSION}"
(
cd "$package_root"
cargo check --locked --all-targets --all-features
cargo test --locked --lib --all-features
cargo test --locked --test convert_integration --all-features
cargo test --locked --test lcp_registry_unit --all-features
cargo test --locked --bin hf2q --all-features convert::orchestrator::tests::
cargo test --locked --bin hf2q --all-features qwen35_bounded_prefill_watchdog_tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features prompt_cache_ -- --test-threads=1
cargo test --locked --bin hf2q --all-features gemma4_bounded_prefill_tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features slotaware_fail_stop_tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features engine_supervisor::tests -- --test-threads=1
cargo test --locked --bin hf2q --all-features public_watchdog_fixture_bytes_are_stable_without_a_model -- --test-threads=1
cargo test --locked --bin hf2q --all-features readiness_guard_tests -- --test-threads=1
bash -n scripts/qwen36_watchdog_validate.sh \
scripts/test_qwen36_prefill_watchdog.sh \
scripts/test_qwen36_prefill_cancellation.sh \
scripts/test_qwen36_cumulative_release.sh \
scripts/test_deepseek4_agentic.sh \
scripts/test_deepseek4_agentic_fixture_contract.sh \
scripts/test_deepseek4_peer_cold_wave.sh \
scripts/test_deepseek4_peer_cold_wave_contract.sh \
scripts/run_deepseek4_matched_peer.sh \
scripts/macos_thermal_guard.sh \
scripts/verify_macos_thermal_receipt.sh \
scripts/verify_gemma4_wave_thermal_receipt.sh \
scripts/verify_gemma4_parity_receipt.sh \
scripts/test_macos_thermal_guard_contract.sh \
scripts/test_gemma4_wave_thermal_contract.sh \
scripts/test_gemma4_eight_slot_receipt_contract.sh \
scripts/seal_release_binary.sh \
scripts/test_release_binary_seal_contract.sh \
scripts/test_deepseek4_cached_suffix.sh \
scripts/test_deepseek4_cached_suffix_contract.sh \
scripts/test_deepseek4_interactive_overlap.sh \
scripts/test_agentic_cache_lifecycle.sh \
scripts/test_gemma4_long_short_overlap.sh \
scripts/test_gemma4_long_short_overlap_contract.sh \
scripts/run_agentic_cache_release_gate.sh
bash scripts/test_qwen36_watchdog_harness_contract.sh
bash scripts/test_deepseek4_cached_suffix_contract.sh
bash scripts/test_deepseek4_agentic_fixture_contract.sh
bash scripts/test_deepseek4_peer_cold_wave_contract.sh
bash scripts/test_macos_thermal_guard_contract.sh
bash scripts/test_gemma4_wave_thermal_contract.sh
bash scripts/test_gemma4_eight_slot_receipt_contract.sh
bash scripts/test_release_binary_seal_contract.sh
bash scripts/test_gemma4_long_short_overlap_contract.sh
cargo test --locked --bin hf2q --all-features deepseek4 -- \
--skip attention_forward_tests \
--skip allocator_materializes_the_plan_as_zeroed_bf16_buffers \
--skip cache_steps_publish_only_complete_groups_and_commit_transactionally \
--skip partial_token_poison_requires_reset_before_replay \
--skip start_zero_prefill_span_counts_complete_groups_and_publishes_once \
--skip ffn_forward_tests \
--skip raw_matmul_accepts_quality_sensitive_f32_weights \
--skip embedding_forward_rejects_empty_input \
--skip q2_k_embeddings_expand_to_four_identical_hc_streams \
--skip native_model_load_keeps_weights_and_cache_on_one_device \
--skip native_output_head_produces_finite_vocab_logits_and_rejects_shape_drift \
--skip loader_preserves_raw_blocks_and_expands_only_elementwise_state \
--skip loader_rejects_catalog_and_i32_storage_before_residency
)
install_root="$RUNNER_TEMP/hf2q-install"
cargo install \
--path "$package_root" \
--locked \
--root "$install_root"
"$install_root/bin/hf2q" --help >/dev/null
- name: Publish exact package
shell: bash
env:
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
run: |
set -euo pipefail
test -n "$CARGO_REGISTRY_TOKEN"
published="$RUNNER_TEMP/hf2q-${EXPECTED_VERSION}-published.crate"
if curl --fail --location --silent --show-error \
"https://static.crates.io/crates/hf2q/hf2q-${EXPECTED_VERSION}.crate" \
--output "$published"; then
echo "hf2q ${EXPECTED_VERSION} is already published; verifying exact bytes"
else
# The exact package was already compiled and tested above. Avoid
# re-running dependency build scripts while the registry token is
# present in this narrowly scoped step.
cargo publish --locked --no-verify --token "$CARGO_REGISTRY_TOKEN"
fi
- name: Verify crates.io bytes
shell: bash
run: |
set -euo pipefail
expected=$(awk '{print $1}' "$RUNNER_TEMP/release-crate.sha256")
downloaded="$RUNNER_TEMP/hf2q-${EXPECTED_VERSION}.crate"
for _ in $(seq 1 24); do
if curl --fail --location --silent --show-error \
"https://static.crates.io/crates/hf2q/hf2q-${EXPECTED_VERSION}.crate" \
--output "$downloaded"; then
actual=$(shasum -a 256 "$downloaded" | awk '{print $1}')
test "$actual" = "$expected"
exit 0
fi
sleep 5
done
exit 1
- name: Install and smoke-test crates.io artifact
shell: bash
run: |
set -euo pipefail
downloaded="$RUNNER_TEMP/hf2q-${EXPECTED_VERSION}.crate"
registry_root="$RUNNER_TEMP/hf2q-registry"
install_root="$RUNNER_TEMP/hf2q-registry-install"
mkdir -p "$registry_root"
tar -xzf "$downloaded" -C "$registry_root"
cargo install \
--path "$registry_root/hf2q-${EXPECTED_VERSION}" \
--locked \
--root "$install_root"
"$install_root/bin/hf2q" --help >/dev/null
- name: Tag and create GitHub release
shell: bash
env:
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
tag="v${EXPECTED_VERSION}"
tag_sha=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$tag" --jq .object.sha 2>/dev/null || true)
if [[ -n "$tag_sha" ]]; then
test "$tag_sha" = "$EXPECTED_SHA"
else
gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" \
-f ref="refs/tags/$tag" \
-f sha="$EXPECTED_SHA" >/dev/null
fi
if ! gh release view "$tag" >/dev/null 2>&1; then
gh release create "$tag" \
--target "$EXPECTED_SHA" \
--title "hf2q ${EXPECTED_VERSION}" \
--generate-notes \
--verify-tag
fi
test "$(gh release view "$tag" --json targetCommitish --jq .targetCommitish)" = "$EXPECTED_SHA"
gh release upload "$tag" \
"target/package/hf2q-${EXPECTED_VERSION}.crate" \
"$RUNNER_TEMP/release-crate.sha256" \
--clobber
- name: Verify GitHub release bytes
shell: bash
env:
GH_TOKEN: ${{ github.token }}
run: |
set -euo pipefail
tag="v${EXPECTED_VERSION}"
expected=$(awk '{print $1}' "$RUNNER_TEMP/release-crate.sha256")
release_dir="$RUNNER_TEMP/github-release"
mkdir -p "$release_dir"
gh release download "$tag" \
--pattern "hf2q-${EXPECTED_VERSION}.crate" \
--pattern "release-crate.sha256" \
--dir "$release_dir"
actual=$(shasum -a 256 "$release_dir/hf2q-${EXPECTED_VERSION}.crate" | awk '{print $1}')
test "$actual" = "$expected"
checksum="$release_dir/release-crate.sha256"
test "$(grep -cve '^[[:space:]]*$' "$checksum")" -eq 1
test "$(awk 'NF {print $1}' "$checksum")" = "$expected"
test "$(awk 'NF {print $2}' "$checksum")" = \
"target/package/hf2q-${EXPECTED_VERSION}.crate"