freesolo-flash-dev 1.2.69__tar.gz → 1.2.87__tar.gz

{freesolo_flash_dev-1.2.69 → freesolo_flash_dev-1.2.87}/.github/workflows/auto-rebake.yml

@@ -5,9 +5,8 @@ name: auto-rebake per-arch kernel cache
 # the per-arch tags pointing at the OLD base until rebaked. "Out of date" has two flavors, keyed off
 # the fp_cache / fp_base labels worker-image.yml stamps on :cu128 (docker/kernel_fingerprint.py):
 #
-#   * fp_cache changed -> the baked Triton/Inductor mega-cache is INVALID -> a real GPU re-warm is
-#     required (bake-kernel-cache.yml). PAID, and AUTO-fired by this detection (no manual approval) --
-#     fp_cache only moves on a deliberate toolchain bump, so spend stays tied to real need.
+#   * fp_cache changed -> promote a matching dev-ready cache by free re-layer. a real gpu re-warm is
+#     only the fail-safe when the required candidate is absent.
 #   * fp_cache same but fp_base changed -> the cache is still valid, the base just moved (FA wheel /
 #     causal-conv1d / rp_handler / a non-kernel dep) -> a FREE re-layer grafts the existing cache onto
 #     the fresh base (docker/Dockerfile.kernelcache.relayer), no GPU.
@@ -54,7 +53,7 @@ jobs:
     timeout-minutes: 15
     outputs:
       proceed: ${{ steps.base.outputs.proceed }}
-      relayer_sms: ${{ steps.classify.outputs.relayer_sms }}
+      relayer_matrix: ${{ steps.classify.outputs.relayer_matrix }}
       gpu_sms: ${{ steps.classify.outputs.gpu_sms }}
       fp_cache: ${{ steps.base.outputs.fp_cache }}
       fp_base: ${{ steps.base.outputs.fp_base }}
@@ -138,9 +137,23 @@ jobs:
               pc="(missing)"; pb="(missing)"
             fi
             if [ "$pc" != "$FP_CACHE" ]; then
-              gpu+=("$sm"); action="GPU re-warm (cache invalid)"
+              candidate="ghcr.io/freesolo-co/flash-worker:cu128-dev-ready-$sm"
+              candidate_pc=""; candidate_ref=""
+              if candidate_digest=$(crane digest "$candidate" 2>/dev/null); then
+                candidate_ref="${candidate%:*}@$candidate_digest"
+              fi
+              if [ -n "$candidate_ref" ] && candidate_cfg=$(crane config "$candidate_ref" 2>/dev/null); then
+                candidate_pc=$(echo "$candidate_cfg" | jq -r '.config.Labels["co.freesolo.flash.kernelcache.fp_cache"] // ""')
+              fi
+              if [ "$candidate_pc" = "$FP_CACHE" ]; then
+                relayer+=("$(jq -cn --arg sm "$sm" --arg source "$candidate_ref" '{sm:$sm, source:$source}')")
+                action="promote dev cache (free)"
+              else
+                gpu+=("$sm"); action="gpu re-warm (candidate missing)"
+              fi
             elif [ "$pb" != "$FP_BASE" ]; then
-              relayer+=("$sm"); action="re-layer (free)"
+              relayer+=("$(jq -cn --arg sm "$sm" --arg source "$img" '{sm:$sm, source:$source}')")
+              action="re-layer (free)"
             else
               action="up to date"
             fi
@@ -148,12 +161,12 @@ jobs:
             summary="$summary| $sm | \`$pc\` | \`$pb\` | $action |\n"
           done
           if [ ${#relayer[@]} -gt 0 ]; then
-            relayer_json=$(printf '%s\n' "${relayer[@]}" | jq -R . | jq -cs .)
+            relayer_json=$(printf '%s\n' "${relayer[@]}" | jq -cs .)
           else
             relayer_json='[]'
           fi
           gpu_csv=$(IFS=,; echo "${gpu[*]}")
-          echo "relayer_sms=$relayer_json" >> "$GITHUB_OUTPUT"
+          echo "relayer_matrix=$relayer_json" >> "$GITHUB_OUTPUT"
           echo "gpu_sms=$gpu_csv" >> "$GITHUB_OUTPUT"
           {
             echo "### auto-rebake plan (base rev \`$REV\`, fp_cache \`$FP_CACHE\` fp_base \`$FP_BASE\`)"
@@ -189,7 +202,7 @@ jobs:
   # FREE path: graft the existing valid cache onto the fresh base, no GPU. Runs automatically.
   relayer:
     needs: gate
-    if: needs.gate.outputs.proceed == 'true' && needs.gate.outputs.relayer_sms != '[]' && needs.gate.outputs.relayer_sms != ''
+    if: needs.gate.outputs.proceed == 'true' && needs.gate.outputs.relayer_matrix != '[]' && needs.gate.outputs.relayer_matrix != ''
     runs-on: ubuntu-24.04-8core
     # The graft pulls two ~20GB images and pushes one. 21min is the slowest auto-rebake run on
     # record; 60 covers a slow registry without holding the org's larger runner indefinitely.
@@ -197,7 +210,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        sm: ${{ fromJson(needs.gate.outputs.relayer_sms || '[]') }}
+        include: ${{ fromJson(needs.gate.outputs.relayer_matrix || '[]') }}
     env:
       BASE_REF: ${{ needs.gate.outputs.base_ref }}
       FP_CACHE: ${{ needs.gate.outputs.fp_cache }}
@@ -232,10 +245,14 @@ jobs:
       - name: Resolve old per-arch cache digest
         id: old
         run: |
-          img="ghcr.io/freesolo-co/flash-worker:cu128-${{ matrix.sm }}"
-          digest=$(docker buildx imagetools inspect "$img" --format '{{.Manifest.Digest}}')
-          # canonical digest ref (repo@sha256, no tag) for the FROM in the relayer build.
-          echo "ref=${img%:*}@$digest" >> "$GITHUB_OUTPUT"
+          img="${{ matrix.source }}"
+          if [[ "$img" == *@sha256:* ]]; then
+            echo "ref=$img" >> "$GITHUB_OUTPUT"
+          else
+            digest=$(docker buildx imagetools inspect "$img" --format '{{.Manifest.Digest}}')
+            # canonical digest ref (repo@sha256, no tag) for the FROM in the relayer build.
+            echo "ref=${img%:*}@$digest" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Re-layer cache onto the fresh base (no GPU)
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0

{freesolo_flash_dev-1.2.69 → freesolo_flash_dev-1.2.87}/.github/workflows/bake-kernel-cache.yml

@@ -24,6 +24,10 @@ on:
         description: "comma-separated sm list to bake; default is all validated arches"
         default: "sm80,sm86,sm89,sm90,sm120,sm100"
         required: false
+      target_tag_prefix:
+        description: "target image tag before the -sm suffix"
+        default: "cu128"
+        required: false
   # auto-rebake.yml calls this for the EXPENSIVE path (the cache is invalid and must be re-warmed on a
   # real GPU). It passes the arch subset, the fingerprints to stamp, and a digest-pinned base so the
   # warm runs inside the exact :cu128 the per-arch tag will sit on.
@@ -48,6 +52,10 @@ on:
         type: string
         required: false
         default: ""
+      target_tag_prefix:
+        type: string
+        required: false
+        default: "cu128"
 
 permissions:
   contents: read
@@ -85,51 +93,36 @@ jobs:
           - {
               sm: sm80,
               arch: "8.0",
-              gpu_type_id: "NVIDIA A100 80GB PCIe",
               allowed_cuda: "",
             }
           - {
               sm: sm86,
               arch: "8.6",
-              gpu_type_id: "NVIDIA RTX A6000",
               allowed_cuda: "",
             }
-          # sm89 (Ada): warm on the L40S -- a DATACENTER Ada card with reliable secure-cloud capacity --
-          # instead of the consumer RTX 4090 (scarce/cold on secure cloud, where the bake pod often never
-          # finished pulling the ~20GB image before the deadline). The cache is sm-keyed, so an L40S-warmed
-          # sm89 cache is valid on every sm89 card (4090/L40/L4). NB: verify the exact RunPod gpuTypeId.
+          # the controller walks ordered same-sm secure-cloud gpu types from its per-sm map.
+          # preferred datacenter cards stay first, but one empty sku cannot strand this architecture
+          # on a stale image and send ordinary starts through jit.
           - {
               sm: sm89,
               arch: "8.9",
-              gpu_type_id: "NVIDIA L40S",
               allowed_cuda: "",
             }
-          # sm90 (Hopper): warm on the H200 (141GB, sm90) -- better secure-cloud capacity than the
-          # heavily-contended H100 80GB HBM3 (which cold-pull-stalled the bake). Same sm90, so the cache
-          # is valid on every H100/H200. H200 is in flash's validated GPU catalog (providers/base.py).
           - {
               sm: sm90,
               arch: "9.0",
-              gpu_type_id: "NVIDIA H200",
               allowed_cuda: "",
             }
-          # Blackwell needs CUDA-13 hosts to JIT its PTX (matches min_cuda_for in the provider). Bake
-          # sm120 on the RTX Pro 6000 (Server Edition): it's the same sm120 (cache is sm-keyed, so it's
-          # valid for RTX 5090 too) but has far better secure-cloud on-demand capacity -- the RTX 5090
-          # pool repeatedly returned "machine does not have the resources" at create_pod.
+          # blackwell needs cuda-13 hosts to jit its ptx (matches min_cuda_for in the provider).
           - {
               sm: sm120,
               arch: "12.0",
-              gpu_type_id: "NVIDIA RTX PRO 6000 Blackwell Server Edition",
               allowed_cuda: "13.0",
             }
-          # datacenter blackwell (sm100, distinct from the sm120 rtx pro 6000). b200 has 180 gb,
-          # good secure-cloud capacity, and is validated. promote its image only after a successful
-          # real-b200 bake, then include it in default and automatic rebakes.
+          # datacenter blackwell is distinct from sm120. b200 is the only validated sm100 type.
           - {
               sm: sm100,
               arch: "10.0",
-              gpu_type_id: "NVIDIA B200",
               allowed_cuda: "13.0",
             }
     steps:
@@ -202,7 +195,7 @@ jobs:
 
       - name: Install uv
         if: steps.gate.outputs.run == 'true'
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           # no cache: the post-run cache-prune calls `uv`, but the "Free disk space" step deletes
           # /opt/hostedtoolcache (where setup-uv put uv), so the post step fails ("uv not found") and
@@ -227,7 +220,6 @@ jobs:
         run: |
           uv run python docker/bake_kernel_cache.py \
             --arch "${{ matrix.arch }}" --sm "${{ matrix.sm }}" \
-            --gpu-type-id "${{ matrix.gpu_type_id }}" \
             --allowed-cuda "${{ matrix.allowed_cuda }}" \
             --image "$BASE_IMAGE" \
             --out build/kernel_cache
@@ -256,7 +248,7 @@ jobs:
           context: .
           file: docker/Dockerfile.kernelcache
           push: true
-          tags: ghcr.io/freesolo-co/flash-worker:cu128-${{ matrix.sm }}
+          tags: ghcr.io/freesolo-co/flash-worker:${{ inputs.target_tag_prefix || 'cu128' }}-${{ matrix.sm }}
           provenance: false
           build-args: |
             BASE=${{ steps.base.outputs.ref }}

{freesolo_flash_dev-1.2.69 → freesolo_flash_dev-1.2.87}/.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -156,7 +156,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           python-version: "3.11"
 

freesolo_flash_dev-1.2.87/.github/workflows/dev-kernel-cache.yml

@@ -0,0 +1,212 @@
+name: dev kernel-cache candidate
+
+# dev pushes only run the metadata detector. the scheduled or manual run builds the newest
+# missing candidate, so several daytime changes coalesce into one off-peak gpu bake.
+
+on:
+  push:
+    branches: [dev]
+    paths:
+      - Dockerfile.worker
+      - .github/workflows/worker-image.yml
+      - .github/workflows/bake-kernel-cache.yml
+      - .github/workflows/dev-kernel-cache.yml
+      - docker/kernel_fingerprint.py
+      - docker/make_rp_handler.py
+      - docker/extract_cudart_fix.py
+      - flash/**
+      - pyproject.toml
+  schedule:
+    # 09:00 utc is 01:00 pst / 02:00 pdt.
+    - cron: "0 9 * * *"
+  workflow_dispatch:
+
+permissions:
+  actions: write
+  contents: read
+  packages: write
+
+concurrency:
+  group: dev-kernel-cache
+  cancel-in-progress: false
+
+jobs:
+  dispatch-dev:
+    if: github.repository == 'freesolo-co/flash' && github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: Dispatch the dev workflow definition
+        run: gh workflow run dev-kernel-cache.yml --repo "$GITHUB_REPOSITORY" --ref dev
+
+  detect:
+    if: github.repository == 'freesolo-co/flash' && github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    outputs:
+      needs_bake: ${{ steps.classify.outputs.needs_bake }}
+      revision: ${{ steps.source.outputs.revision }}
+      fp_cache: ${{ steps.fp.outputs.fp_cache }}
+      fp_base: ${{ steps.fp.outputs.fp_base }}
+      sms: ${{ steps.source.outputs.sms }}
+    env:
+      FA2_SPEC: https://github.com/mjun0812/flash-attention-prebuild-wheels/releases/download/v0.9.0/flash_attn-2.8.3%2Bcu128torch2.10-cp312-cp312-linux_x86_64.whl
+      FA2_SHA256: a58c95a080363606e691c342d47dd173b510f4c013a8c5fcb8744def12e36a0f
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+
+      - name: Resolve source metadata
+        id: source
+        run: |
+          echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          arches=$(python3 docker/kernel_fingerprint.py --print-baked-arches)
+          echo "sms=$(echo "$arches" | tr ' ' ',')" >> "$GITHUB_OUTPUT"
+
+      - name: Compute kernel fingerprints
+        id: fp
+        run: python3 docker/kernel_fingerprint.py --format github --fa2-spec "$FA2_SPEC" --fa2-sha256 "$FA2_SHA256" >> "$GITHUB_OUTPUT"
+
+      - name: Install crane
+        run: |
+          set -euo pipefail
+          ver=v0.20.2
+          sha=c14340087103ba9dadf61d45acd20675490fd0ccbd56ac7901fc1b502137f44b
+          curl -fsSL -o /tmp/crane.tar.gz \
+            "https://github.com/google/go-containerregistry/releases/download/${ver}/go-containerregistry_Linux_x86_64.tar.gz"
+          echo "${sha}  /tmp/crane.tar.gz" | sha256sum -c -
+          sudo tar -xz -C /usr/local/bin -f /tmp/crane.tar.gz crane
+          rm -f /tmp/crane.tar.gz
+          crane version
+
+      - name: Log in to GHCR
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check published caches
+        id: classify
+        env:
+          FP_CACHE: ${{ steps.fp.outputs.fp_cache }}
+          REVISION: ${{ steps.source.outputs.revision }}
+        run: |
+          set -euo pipefail
+          arches=$(python3 docker/kernel_fingerprint.py --print-baked-arches)
+          uncovered=false
+          summary="| arch | production | dev candidate |\n|---|---|---|\n"
+          for sm in $arches; do
+            prod="ghcr.io/freesolo-co/flash-worker:cu128-$sm"
+            candidate="ghcr.io/freesolo-co/flash-worker:cu128-dev-ready-$sm"
+
+            prod_pc=""
+            if cfg=$(crane config "$prod" 2>/dev/null); then
+              prod_pc=$(echo "$cfg" | jq -r '.config.Labels["co.freesolo.flash.kernelcache.fp_cache"] // ""')
+            fi
+            candidate_pc=""; candidate_rev=""
+            if cfg=$(crane config "$candidate" 2>/dev/null); then
+              candidate_pc=$(echo "$cfg" | jq -r '.config.Labels["co.freesolo.flash.kernelcache.fp_cache"] // ""')
+              candidate_rev=$(echo "$cfg" | jq -r '.config.Labels["org.opencontainers.image.revision"] // ""')
+            fi
+            if [ "$prod_pc" != "$FP_CACHE" ] && [ "$candidate_pc" != "$FP_CACHE" ]; then
+              uncovered=true
+            fi
+
+            summary="$summary| $sm | \`${prod_pc:-missing}\` | \`${candidate_pc:-missing}\` at \`${candidate_rev:-unknown}\` |\n"
+          done
+
+          if [ "$uncovered" = true ]; then
+            echo "needs_bake=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "needs_bake=false" >> "$GITHUB_OUTPUT"
+          fi
+          {
+            echo "### dev kernel-cache candidate"
+            echo ""
+            echo "source revision: \`$REVISION\`"
+            echo ""
+            echo -e "$summary"
+            if [ "${{ github.event_name }}" = push ] && [ "$uncovered" = true ]; then
+              echo "A bake is pending for the next off-peak run. Use workflow dispatch for an urgent release."
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  build-base:
+    needs: detect
+    if: github.event_name == 'workflow_dispatch' && needs.detect.outputs.needs_bake == 'true'
+    uses: ./.github/workflows/worker-image.yml
+    with:
+      tag: cu128-dev-${{ needs.detect.outputs.revision }}
+      source_ref: ${{ needs.detect.outputs.revision }}
+    secrets: inherit
+
+  bake:
+    needs: [detect, build-base]
+    if: github.event_name == 'workflow_dispatch' && needs.detect.outputs.needs_bake == 'true'
+    uses: ./.github/workflows/bake-kernel-cache.yml
+    with:
+      sms: ${{ needs.detect.outputs.sms }}
+      fp_cache: ${{ needs.build-base.outputs.fp_cache }}
+      fp_base: ${{ needs.build-base.outputs.fp_base }}
+      base_ref: ${{ needs.build-base.outputs.base_ref }}
+      base_revision: ${{ needs.build-base.outputs.base_revision }}
+      target_tag_prefix: cu128-dev-${{ needs.detect.outputs.revision }}
+    secrets: inherit
+
+  publish-ready:
+    needs: [detect, bake]
+    if: github.event_name == 'workflow_dispatch' && needs.detect.outputs.needs_bake == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Install crane
+        run: |
+          set -euo pipefail
+          ver=v0.20.2
+          sha=c14340087103ba9dadf61d45acd20675490fd0ccbd56ac7901fc1b502137f44b
+          curl -fsSL -o /tmp/crane.tar.gz \
+            "https://github.com/google/go-containerregistry/releases/download/${ver}/go-containerregistry_Linux_x86_64.tar.gz"
+          echo "${sha}  /tmp/crane.tar.gz" | sha256sum -c -
+          sudo tar -xz -C /usr/local/bin -f /tmp/crane.tar.gz crane
+          rm -f /tmp/crane.tar.gz
+          crane version
+
+      - name: Log in to GHCR
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Publish ready aliases
+        env:
+          FP_CACHE: ${{ needs.detect.outputs.fp_cache }}
+          REVISION: ${{ needs.detect.outputs.revision }}
+          SMS: ${{ needs.detect.outputs.sms }}
+        run: |
+          set -euo pipefail
+          repo=ghcr.io/freesolo-co/flash-worker
+          for sm in ${SMS//,/ }; do
+            source="$repo:cu128-dev-$REVISION-$sm"
+            cfg=$(crane config "$source")
+            pc=$(echo "$cfg" | jq -r '.config.Labels["co.freesolo.flash.kernelcache.fp_cache"] // ""')
+            rev=$(echo "$cfg" | jq -r '.config.Labels["org.opencontainers.image.revision"] // ""')
+            if [ "$pc" != "$FP_CACHE" ] || [ "$rev" != "$REVISION" ]; then
+              echo "candidate validation failed for $sm: fp_cache=$pc revision=$rev" >&2
+              exit 1
+            fi
+          done
+          for sm in ${SMS//,/ }; do
+            crane copy \
+              "$repo:cu128-dev-$REVISION-$sm" \
+              "$repo:cu128-dev-ready-$sm"
+          done
+
+      - name: Re-run production readiness for dev
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run production-kernel-cache-ready.yml --repo "$GITHUB_REPOSITORY" --ref dev

freesolo_flash_dev-1.2.87/.github/workflows/production-kernel-cache-ready.yml

@@ -0,0 +1,98 @@
+name: production kernel-cache readiness
+
+# this check is registry-only and never starts a gpu. branch protection can require its named job
+# to prove every production sm already has the cache or has a compatible dev candidate to promote.
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  ready:
+    name: production kernel cache ready
+    if: github.repository == 'freesolo-co/flash'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      FA2_SPEC: https://github.com/mjun0812/flash-attention-prebuild-wheels/releases/download/v0.9.0/flash_attn-2.8.3%2Bcu128torch2.10-cp312-cp312-linux_x86_64.whl
+      FA2_SHA256: a58c95a080363606e691c342d47dd173b510f4c013a8c5fcb8744def12e36a0f
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Compute proposed kernel fingerprint
+        id: fp
+        run: python3 docker/kernel_fingerprint.py --format github --fa2-spec "$FA2_SPEC" --fa2-sha256 "$FA2_SHA256" >> "$GITHUB_OUTPUT"
+
+      - name: Install crane
+        run: |
+          set -euo pipefail
+          ver=v0.20.2
+          sha=c14340087103ba9dadf61d45acd20675490fd0ccbd56ac7901fc1b502137f44b
+          curl -fsSL -o /tmp/crane.tar.gz \
+            "https://github.com/google/go-containerregistry/releases/download/${ver}/go-containerregistry_Linux_x86_64.tar.gz"
+          echo "${sha}  /tmp/crane.tar.gz" | sha256sum -c -
+          sudo tar -xz -C /usr/local/bin -f /tmp/crane.tar.gz crane
+          rm -f /tmp/crane.tar.gz
+          crane version
+
+      - name: Log in to GHCR
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Verify every sm cache is ready
+        env:
+          FP_CACHE: ${{ steps.fp.outputs.fp_cache }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          arches=$(python3 docker/kernel_fingerprint.py --print-baked-arches)
+          missing=()
+          summary="| arch | production | dev candidate | result |\n|---|---|---|---|\n"
+          for sm in $arches; do
+            prod="ghcr.io/freesolo-co/flash-worker:cu128-$sm"
+            candidate="ghcr.io/freesolo-co/flash-worker:cu128-dev-ready-$sm"
+
+            prod_pc=""
+            if cfg=$(crane config "$prod" 2>/dev/null); then
+              prod_pc=$(echo "$cfg" | jq -r '.config.Labels["co.freesolo.flash.kernelcache.fp_cache"] // ""')
+            fi
+
+            candidate_pc=""; candidate_rev=""
+            if cfg=$(crane config "$candidate" 2>/dev/null); then
+              candidate_pc=$(echo "$cfg" | jq -r '.config.Labels["co.freesolo.flash.kernelcache.fp_cache"] // ""')
+              candidate_rev=$(echo "$cfg" | jq -r '.config.Labels["org.opencontainers.image.revision"] // ""')
+            fi
+
+            if [ "$prod_pc" = "$FP_CACHE" ]; then
+              result="production ready"
+            elif [ "$candidate_pc" = "$FP_CACHE" ]; then
+              result="dev candidate ready"
+            else
+              result="missing"
+              missing+=("$sm")
+            fi
+            summary="$summary| $sm | \`${prod_pc:-missing}\` | \`${candidate_pc:-missing}\` at \`${candidate_rev:-unknown}\` | $result |\n"
+          done
+
+          {
+            echo "### production kernel-cache readiness"
+            echo ""
+            echo "required fp_cache: \`$FP_CACHE\`"
+            echo ""
+            echo -e "$summary"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          if [ ${#missing[@]} -gt 0 ]; then
+            echo "::error::missing kernel-cache candidates for: ${missing[*]}. Run the dev kernel-cache candidate workflow for $HEAD_SHA."
+            exit 1
+          fi

{freesolo_flash_dev-1.2.69 → freesolo_flash_dev-1.2.87}/.github/workflows/publish-dev.yml

@@ -136,7 +136,7 @@ jobs:
 
       - name: Install uv
         if: steps.decide.outputs.publish == 'true'
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           python-version: "3.11"
 

{freesolo_flash_dev-1.2.69 → freesolo_flash_dev-1.2.87}/.github/workflows/publish.yml

@@ -202,7 +202,7 @@ jobs:
 
       - name: Install uv
         if: github.event_name == 'workflow_dispatch' || steps.changes.outputs.package_changed == 'true'
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           python-version: "3.11"
 

{freesolo_flash_dev-1.2.69 → freesolo_flash_dev-1.2.87}/.github/workflows/worker-image.yml

@@ -12,6 +12,27 @@ name: flash worker image
 # means only the flash COPY+install layer reruns on pure Python changes (~minutes, not hours).
 
 on:
+  workflow_call:
+    inputs:
+      tag:
+        type: string
+        required: true
+      source_ref:
+        type: string
+        required: true
+    outputs:
+      base_ref:
+        description: digest-pinned worker base
+        value: ${{ jobs.build.outputs.base_ref }}
+      fp_cache:
+        description: kernel-cache compatibility fingerprint
+        value: ${{ jobs.build.outputs.fp_cache }}
+      fp_base:
+        description: full worker-base fingerprint
+        value: ${{ jobs.build.outputs.fp_base }}
+      base_revision:
+        description: resolved source revision
+        value: ${{ jobs.build.outputs.base_revision }}
   workflow_dispatch:
     inputs:
       tag:
@@ -46,7 +67,7 @@ permissions:
 # a non-prod `tag=cu128-test` dispatch can't cancel an in-flight prod `cu128` push on the same ref
 # (which would leave :cu128 unpublished for that commit and auto-rebake blind to it).
 concurrency:
-  group: worker-image-${{ github.ref }}-${{ github.event.inputs.tag || 'cu128' }}
+  group: worker-image-${{ github.ref }}-${{ inputs.tag || github.event.inputs.tag || 'cu128' }}
   cancel-in-progress: true
 
 jobs:
@@ -63,6 +84,11 @@ jobs:
     # vllm and the flash-attn wheels from scratch, while still releasing the runner well before
     # the 6-hour default would.
     timeout-minutes: 90
+    outputs:
+      base_ref: ghcr.io/freesolo-co/flash-worker@${{ steps.image.outputs.digest }}
+      fp_cache: ${{ steps.fp.outputs.fp_cache }}
+      fp_base: ${{ steps.fp.outputs.fp_base }}
+      base_revision: ${{ steps.source.outputs.revision }}
     # Single source for the FlashAttention wheel: used BOTH as a build-arg and as a fingerprint input
     # (so a wheel bump moves fp_base). Keep FA2_SPEC in sync with Dockerfile.worker's ARG default.
     env:
@@ -75,6 +101,16 @@ jobs:
       FA2_SHA256: a58c95a080363606e691c342d47dd173b510f4c013a8c5fcb8744def12e36a0f
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.source_ref || github.sha }}
+
+      - name: Resolve source metadata
+        id: source
+        env:
+          IMAGE_TAG: ${{ inputs.tag || github.event.inputs.tag || 'cu128' }}
+        run: |
+          echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          echo "tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
 
       # Compute the kernel-cache fingerprints (stdlib-only, no uv sync) and stamp them as labels on
       # :cu128 below, so auto-rebake.yml can read what this base was built from. Fails the build if a
@@ -103,6 +139,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build + push worker image
+        id: image
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
@@ -111,14 +148,14 @@ jobs:
           # pin the freesolo-co namespace: runpod, vast, and lambda training paths pull the image
           # declared in flash/providers/_lifecycle/worker.py, so a fork run must not push to its own owner
           # namespace and leave the real image stale.
-          tags: ghcr.io/freesolo-co/flash-worker:${{ github.event.inputs.tag || 'cu128' }}
+          tags: ghcr.io/freesolo-co/flash-worker:${{ steps.source.outputs.tag }}
           provenance: false
           # Stamp the kernel-cache fingerprints + the source commit so auto-rebake.yml can read what
           # this base was built from (docker/kernel_fingerprint.py is the source of truth).
           labels: |
             co.freesolo.flash.kernelcache.fp_cache=${{ steps.fp.outputs.fp_cache }}
             co.freesolo.flash.kernelcache.fp_base=${{ steps.fp.outputs.fp_base }}
-            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.revision=${{ steps.source.outputs.revision }}
           # Install a PREBUILT flash-attn wheel instead of compiling from source (a multi-arch
           # source compile is huge and OOM-kills the runner). The wheel matches the base exactly
           # (cu128 / torch2.10 / cp312). The FA2 spec comes from the job-level env (single source).

{freesolo_flash_dev-1.2.69 → freesolo_flash_dev-1.2.87}/CHANGELOG.md

@@ -21,6 +21,13 @@ This file starts at 1.1.35. Earlier releases are not reconstructed here; use
 
 ### Changed
 
+- `[train] init_from_adapter` now works for every source/target algorithm pair. SFT was rejected as
+  a warm-start target, so an adapter could be continued only by GRPO or OPD; that restriction
+  described the retired trl SFT backend, and the verl backend that replaced it loads a warm-start
+  adapter exactly like the other two. All nine combinations of `sft`, `grpo`, and `opd` are
+  supported, including same-algorithm continuation. A warm-started SFT run also inherits its
+  source's base-model pin instead of resolving its own, so it stays deployable and no longer breaks
+  when the base model's hub tip moves.
 - Managed attempts now pin, verify, and report one immutable Flash source archive across retries and recovery.
 - Multi-turn GRPO now clones each sibling rollout from the task state that produced its prepared
   prompt. Environments that record randomized episode choices on the task during `start_episode`