freesolo-flash-dev 1.4.11__tar.gz → 1.4.13__tar.gz

{freesolo_flash_dev-1.4.11 → freesolo_flash_dev-1.4.13}/.github/workflows/bake-kernel-cache.yml

@@ -2,7 +2,7 @@ name: flash worker kernel-cache (per-arch)
 
 # Builds per-SM worker images with compiled kernel caches baked in to reuse matching kernels
 # on cold workers. Each matrix leg:
-#   1. offloads the warmup to a Modal GPU of that arch (GH runners have none) -> build/kernel_cache,
+#   1. offloads the warmup to a Modal GPU of that arch (GH runners have none) -> base-source/build/kernel_cache,
 #   2. builds docker/Dockerfile.kernelcache -> ghcr.io/freesolo-co/flash-worker:cu128-<sm>,
 #   3. pushes it. After live qualification, record its immutable digest in QUALIFIED_WORKER_IMAGES
 #      (flash/providers/_lifecycle/net/worker.py); publishing a tag does not enable it for workers.
@@ -10,12 +10,9 @@ name: flash worker kernel-cache (per-arch)
 # Depends on the base ghcr.io/freesolo-co/flash-worker:cu128 image existing (worker-image.yml) — the
 # warmup runs INSIDE it so the cache matches the image's pinned torch/triton/fla/liger toolchain.
 #
-# Secrets: MODAL_TOKEN_ID + MODAL_TOKEN_SECRET (the warmup GPU sandbox) + HF_TOKEN (the temp dataset that ferries code + the
-# cache artifact) are native repo Actions secrets, synced from Infisical (prod:/flash-ci) by the
-# github-ci-flash Secret Sync; the GHCR push uses the default GITHUB_TOKEN. Heavy + paid,
-# but UNGATED: the fingerprint detection in auto-rebake.yml decides WHEN this runs (only on a real
-# kernel-toolchain change), so there is no manual approval step. Invoked by hand (workflow_dispatch)
-# OR automatically by auto-rebake.yml (workflow_call) when the kernel toolchain changed.
+# Modal credentials launch the warmup sandbox. A dedicated Azure build identity writes
+# only the build-artifacts container and issues bounded sandbox SAS credentials.
+# GHCR publication uses GITHUB_TOKEN. Automatic invocation remains fingerprint-gated.
 
 on:
   workflow_dispatch:
@@ -199,13 +196,22 @@ jobs:
             echo "revision=$(echo "$cfg" | jq -r '.config.Labels["org.opencontainers.image.revision"] // ""')" >> "$GITHUB_OUTPUT"
           fi
 
-      # Pin the checkout to the base's source commit so the warmed flash code matches the base exactly
-      # (the cache is content-keyed by the code that compiled it). Falls back to the event sha if the
-      # base predates the revision label.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # Transport and its dependencies follow this workflow, even when manually rebaking an
+      # older image whose helper still required Hugging Face artifact credentials.
+      - name: Checkout bake transport
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        if: steps.gate.outputs.run == 'true'
+        with:
+          ref: ${{ github.workflow_sha }}
+          path: bake-tools
+
+      # Only the warmup source and thin image recipe follow the base image's source revision.
+      - name: Checkout base warmup source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.gate.outputs.run == 'true'
         with:
           ref: ${{ steps.base.outputs.revision || github.sha }}
+          path: base-source
 
       - name: Install uv
         if: steps.gate.outputs.run == 'true'
@@ -218,29 +224,30 @@ jobs:
           # marks the whole job red even though the bake + push already succeeded.
           enable-cache: false
 
-      - name: Sync deps (flash + modal + hf)
+      - name: Sync deps (flash + modal + Azure)
         if: steps.gate.outputs.run == 'true'
-        run: uv sync --extra server
+        run: uv sync --project bake-tools --extra server --locked
 
-      # MODAL_TOKEN_ID + MODAL_TOKEN_SECRET (the warmup GPU sandbox) + HF_TOKEN (the temp dataset that ferries code/cache) are
-      # native repo Actions secrets, synced from Infisical (prod:/flash-ci) by the github-ci-flash
-      # Secret Sync. No Infisical CLI/login at job time -- Infisical stays the source of truth and
-      # rotations propagate via the sync. BASE_IMAGE
-      # is digest-pinned so the warm runs inside the EXACT base the per-arch tag will sit on.
-      - name: Warm kernels on a Modal ${{ matrix.sm }} GPU -> build/kernel_cache
+      # The digest-pinned base keeps the warmup toolchain identical to the published image.
+      - name: Warm kernels on a Modal ${{ matrix.sm }} GPU -> base-source/build/kernel_cache
         if: steps.gate.outputs.run == 'true'
         env:
           MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
           MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
-          HF_TOKEN: ${{ secrets.HF_TOKEN }}
+          FLASH_ARTIFACT_BLOB_ACCOUNT_URL: https://freesoloenvs.blob.core.windows.net
+          FLASH_ARTIFACT_BLOB_CONTAINER: build-artifacts
+          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+          AZURE_CLIENT_ID: ${{ secrets.AZURE_BUILD_CLIENT_ID }}
+          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_BUILD_CLIENT_SECRET }}
           BASE_IMAGE: ${{ steps.base.outputs.ref }}
           BAKE_DEADLINE_MINUTES: ${{ inputs.deadline_minutes }}
         run: |
-          uv run python docker/bake_kernel_cache.py \
+          uv run --project bake-tools --locked python bake-tools/docker/bake_kernel_cache.py \
             --arch "${{ matrix.arch }}" --sm "${{ matrix.sm }}" \
             --image "$BASE_IMAGE" \
+            --source-root base-source \
             --deadline-min "$BAKE_DEADLINE_MINUTES" \
-            --out build/kernel_cache
+            --out base-source/build/kernel_cache
 
       - name: Free disk space
         if: steps.gate.outputs.run == 'true'
@@ -263,8 +270,8 @@ jobs:
         if: steps.gate.outputs.run == 'true'
         uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
-          context: .
-          file: docker/Dockerfile.kernelcache
+          context: base-source
+          file: base-source/docker/Dockerfile.kernelcache
           push: true
           tags: ghcr.io/freesolo-co/flash-worker:${{ inputs.target_tag_prefix || 'cu128' }}-${{ matrix.sm }}
           provenance: false

{freesolo_flash_dev-1.4.11 → freesolo_flash_dev-1.4.13}/CHANGELOG.md

@@ -18,6 +18,10 @@ This file starts at 1.1.35. Earlier releases are not reconstructed here; use
 
 ## Unreleased
 
+- Correct artifact diagnostics, generated training guidance, and internal documentation to name
+  Azure storage. Upstream model/tokenizer downloads and explicit Hugging Face exports remain
+  supported; legacy serialized storage-field names remain compatible.
+
 ### Removed
 
 - Removed built-in OPD completely: training workers, managed teacher API and ledger, configuration,

{freesolo_flash_dev-1.4.11 → freesolo_flash_dev-1.4.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: freesolo-flash-dev
-Version: 1.4.11
+Version: 1.4.13
 Summary: Flash — managed LoRA post-training (SFT/GRPO) for Freesolo environments, driven by the `flash` CLI
 Project-URL: Homepage, https://github.com/freesolo-co/flash
 Project-URL: Repository, https://github.com/freesolo-co/flash

{freesolo_flash_dev-1.4.11 → freesolo_flash_dev-1.4.13}/docker/bake_kernel_cache.py

@@ -27,17 +27,16 @@ def log(msg: str) -> None:
     print(f"[bake-ci] {msg}", flush=True)
 
 
-def _upload_flash_code(api, repo: str, token: str) -> None:
-    """Mirror the worker's upload_code: push the running flash package to code/flash (exact mirror)."""
-    import flash
+def _upload_flash_code(api, repo: str, source_root) -> None:
+    """Upload the base-pinned warmup package without importing it into the transport process."""
+    from pathlib import Path
 
-    pkg_dir = os.path.realpath(os.path.dirname(os.path.abspath(flash.__file__)))
+    pkg_dir = Path(source_root).resolve() / "flash"
+    if not (pkg_dir / "engine/worker/runtime/kernel_warmup.py").is_file():
+        raise ValueError("bake source must contain the base image's Flash warmup package")
     api.create_repo(repo_id=repo, repo_type="dataset", private=True, exist_ok=True)
-    # mirror upload_code: force private even if the id pre-existed as a public repo, before any
-    # flash source is uploaded.
-    api.update_repo_settings(repo_id=repo, repo_type="dataset", private=True)
     api.upload_folder(
-        folder_path=pkg_dir,
+        folder_path=str(pkg_dir),
         path_in_repo="code/flash",
         repo_id=repo,
         repo_type="dataset",
@@ -47,11 +46,39 @@ def _upload_flash_code(api, repo: str, token: str) -> None:
     log(f"uploaded flash code -> {repo}:code/flash (from {pkg_dir})")
 
 
-def main() -> int:
+def _bake_image(modal, image_ref, entry):
+    """Seed the same standalone Azure client used by managed worker bootstrap."""
     from pathlib import Path
 
-    from huggingface_hub import HfApi, snapshot_download
+    import flash.artifacts
+
+    image = (
+        modal.Image.from_registry(image_ref)
+        .pip_install("azure-storage-blob==12.31.1", "azure-identity==1.27.0")
+        .add_local_file(str(entry), "/opt/flash/bake.py", copy=True)
+    )
+    package = Path(flash.artifacts.__file__).parent
+    for module in ("api", "config", "manifest", "storage"):
+        image = image.add_local_file(
+            str(package / f"{module}.py"), f"/opt/flash/artifact_{module}.py", copy=True
+        )
+    return image
+
+
+def _delete_artifacts(repo):
+    from flash.artifacts.config import open_container
+    from flash.artifacts.manifest import repo_prefix
+
+    with open_container() as container:
+        for blob in container.list_blobs(name_starts_with=repo_prefix(repo) + "/"):
+            container.delete_blob(blob.name)
 
+
+def main() -> int:
+    from pathlib import Path
+
+    from flash.artifacts.api import ArtifactStore, download_snapshot
+    from flash.artifacts.config import runtime_environment
     from flash.providers.modal import api as modal_api
 
     parser = argparse.ArgumentParser(description="Bake worker kernels on Modal")
@@ -59,17 +86,23 @@ def main() -> int:
     parser.add_argument("--sm", required=True, choices=tuple(GPU_BY_SM))
     parser.add_argument("--image", required=True)
     parser.add_argument("--out", default="build/kernel_cache")
+    parser.add_argument(
+        "--source-root",
+        type=Path,
+        default=Path(__file__).resolve().parents[1],
+        help="Checkout matching the base image; transport runs from this helper's checkout",
+    )
     parser.add_argument("--deadline-min", type=int, default=90)
     parser.add_argument("--run-id", default="")
     args = parser.parse_args()
     if not 1 <= args.deadline_min <= 1440:
         parser.error("deadline must be between 1 and 1440 minutes")
-    token = os.environ["HF_TOKEN"]
-    hf = HfApi(token=token)
+    artifacts = ArtifactStore()
+    worker_secrets = runtime_environment()
+    if not worker_secrets:
+        raise RuntimeError("Azure build artifact storage is not configured")
     suffix = args.run_id or f"{int(time.time())}-{uuid.uuid4().hex[:8]}"
-    repo = (
-        f"{os.environ.get('FLASH_HF_NAMESPACE', ARTIFACT_NAMESPACE)}/kernel-bake-{args.sm}-{suffix}"
-    )
+    repo = f"{os.environ.get('FLASH_ARTIFACT_NAMESPACE', ARTIFACT_NAMESPACE)}/kernel-bake-{args.sm}-{suffix}"
     entry = Path(__file__).with_name("bake_sandbox_entry.py")
 
     async def bake(modal, client):
@@ -79,9 +112,7 @@ def main() -> int:
             create_if_missing=True,
             client=client,
         )
-        image = modal.Image.from_registry(args.image).add_local_file(
-            str(entry), "/opt/flash/bake.py", copy=True
-        )
+        image = _bake_image(modal, args.image, entry)
         sandbox = await modal.Sandbox.create.aio(
             "python",
             "-u",
@@ -97,7 +128,7 @@ def main() -> int:
             memory=(32768, 131072),
             secrets=[
                 modal.Secret.from_dict(
-                    {"BAKE_HF_REPO": repo, "BAKE_ARCH": args.arch, "HF_TOKEN": token}
+                    {"BAKE_ARTIFACT_REPO": repo, "BAKE_ARCH": args.arch, **worker_secrets}
                 )
             ],
             client=client,
@@ -116,37 +147,41 @@ def main() -> int:
             await sandbox.terminate.aio(wait=True)
 
     try:
-        _upload_flash_code(hf, repo, token)
+        _upload_flash_code(artifacts, repo, args.source_root)
         modal_api.call(bake, timeout=args.deadline_min * 60 + 120)
-        if not _status_present(hf, repo, retries=3):
+        if not _status_present(artifacts, repo, retries=3):
             raise RuntimeError("kernel warmup finished without its completion marker")
         import tempfile
 
         with tempfile.TemporaryDirectory(prefix="flash-kernel-") as temp:
-            snapshot_download(
+            download_snapshot(
                 repo_id=repo,
                 repo_type="dataset",
                 allow_patterns=["out/**"],
                 local_dir=temp,
-                token=token,
             )
-            shutil.copytree(Path(temp) / "out", args.out, dirs_exist_ok=True)
-            archive = Path(args.out) / "kernel_cache.tar.gz"
-            if archive.exists():
-                _extract_cache_archive(archive, Path(args.out))
-                archive.unlink()
-            # The base image can contain an older warmup.log inside its cache tree. Keep the
-            # current subprocess log authoritative after archive extraction.
-            log_path = Path(temp) / "out" / "bake-warmup.log"
-            if log_path.exists():
-                shutil.copy2(log_path, Path(args.out) / "bake-warmup.log")
-                shutil.copy2(log_path, Path(args.out) / "warmup.log")
-        return _verify(args.out, args.sm)
+            staging = Path(temp) / "out"
+            status = (staging / "STATUS").read_text()
+            if status != f"rc=0\narch={args.arch}\n":
+                raise RuntimeError("kernel warmup returned an invalid completion marker")
+            archive = staging / "kernel_cache.tar.gz"
+            current_log = (staging / "bake-warmup.log").read_bytes()
+            _extract_cache_archive(archive, staging)
+            archive.unlink()
+            # A cache may contain an older log. Keep this run's subprocess log authoritative.
+            (staging / "bake-warmup.log").write_bytes(current_log)
+            (staging / "warmup.log").write_bytes(current_log)
+            result = _verify(str(staging), args.sm)
+            if result == 0:
+                shutil.copytree(staging, args.out, dirs_exist_ok=True)
+            return result
     finally:
         try:
-            hf.delete_repo(repo_id=repo, repo_type="dataset")
+            _delete_artifacts(repo)
         except Exception:
-            log(f"WARNING: could not delete temporary repository {repo}; remove it manually")
+            log(
+                f"WARNING: could not delete temporary Azure artifacts for {repo}; remove it manually"
+            )
 
 
 def _extract_cache_archive(archive_path, destination) -> None:
@@ -168,13 +203,13 @@ def _extract_cache_archive(archive_path, destination) -> None:
 
 
 def _status_present(api, repo: str, retries: int = 1) -> bool:
-    """Authoritative out/STATUS check, retried to ride out a transient HF list error."""
+    """Authoritative out/STATUS check, retried to ride out a transient Azure read error."""
     for i in range(retries):
         try:
             if "out/STATUS" in api.list_repo_files(repo, repo_type="dataset"):
                 return True
         except Exception as e:
-            log(f"hf list err (status recheck {i + 1}/{retries}): {str(e)[:100]}")
+            log(f"artifact status recheck {i + 1}/{retries}: {type(e).__name__}")
         if i < retries - 1:
             time.sleep(5)
     return False

{freesolo_flash_dev-1.4.11 → freesolo_flash_dev-1.4.13}/docker/bake_sandbox_entry.py

@@ -1,16 +1,9 @@
-"""Sandbox-side entry for the kernel-cache bake (runs INSIDE the cu128 worker image on a GPU sandbox).
+"""Warm kernels using private Azure source and output artifacts.
 
-The published worker image ships DEPS only — the flash code (incl. kernel_warmup.py) is fetched from
-HF at runtime, exactly like a real worker. So this entry:
-  1. snapshot_downloads the flash package (code/**) the CI helper uploaded to a temp HF dataset,
-  2. warms kernels at their final /opt/flash/kernelcache path in the training interpreter,
-  3. replays an exported copy, then uploads the verified archive back under out/,
-  4. writes an out/STATUS marker LAST so the helper knows the run finished (and its rc).
-
-It is invoked by the CI helper via the sandbox command. Env:
-  BAKE_HF_REPO  the temp HF dataset (private) holding code/** and receiving out/
-  BAKE_ARCH     TORCH_CUDA_ARCH_LIST target, e.g. "9.0"
-  HF_TOKEN      write token for BAKE_HF_REPO
+The CI helper seeds the standalone Azure client into the sandbox image. The entry
+fetches code/**, compiles and replays the exported cache, then publishes out/STATUS
+last. BAKE_ARTIFACT_REPO names the disposable namespace; BAKE_ARCH selects CUDA.
+Only a bounded Azure container SAS reaches the sandbox.
 """
 
 import io
@@ -36,18 +29,16 @@ def _replace_cache_with_exported_copy(cache_dir: str, archive_path: str) -> None
 
 
 def main() -> int:
-    os.environ["HF_HUB_DISABLE_XET"] = "1"
-    from huggingface_hub import HfApi, snapshot_download
+    from artifact_api import ArtifactStore, download_snapshot
 
-    repo = os.environ["BAKE_HF_REPO"]
-    token = os.environ["HF_TOKEN"]
+    repo = os.environ["BAKE_ARTIFACT_REPO"]
     arch = os.environ.get("BAKE_ARCH", "")
-    api = HfApi(token=token)
+    api = ArtifactStore()
 
     # Upload a STARTED marker FIRST -- before the code download / warmup -- so a CI-side
     # timeout can tell whether this entrypoint even ran. Present on a timeout = the warmup started (so it
     # hung or was slow); absent = the pod ran the wrong entrypoint, OR this upload itself failed while
-    # the warmup is still running. Retry a few times so a transient HF blip doesn't drop the marker and
+    # the warmup is still running. Retry a few times so a transient Azure error doesn't drop the marker and
     # make the helper misread a slow run as a wrong entrypoint.
     started_uploaded = False
     for attempt in range(3):
@@ -63,7 +54,10 @@ def main() -> int:
             break
         except Exception as e:
             # keep the "out/STARTED" token in the line so it greps the same as the success/WARNING lines
-            print(f"[bake] out/STARTED upload attempt {attempt + 1}/3 failed: {e}", flush=True)
+            print(
+                f"[bake] out/STARTED upload attempt {attempt + 1}/3 failed: {type(e).__name__}",
+                flush=True,
+            )
             if attempt < 2:  # no point sleeping after the last attempt
                 time.sleep(3)
     if not started_uploaded:
@@ -72,12 +66,11 @@ def main() -> int:
         print("[bake] WARNING: out/STARTED never uploaded; warmup still proceeds", flush=True)
 
     # the flash code the helper uploaded (upload_code -> code/flash); run the warmup from it.
-    snapshot_download(
+    download_snapshot(
         repo_id=repo,
         repo_type="dataset",
         allow_patterns=["code/**"],
         local_dir="/runcode",
-        token=token,
     )
 
     env = {**os.environ, "PYTHONPATH": "/runcode/code"}
@@ -124,8 +117,7 @@ def main() -> int:
     with open(os.path.join(cache_dir, "cache_validation.json"), "w") as output:
         json.dump(validation, output)
     print(f"[bake] kernel_warmup rc={rc}", flush=True)
-    # Hub repositories reject nested .cache paths (FlashInfer uses one). Transport the exact
-    # directory layout as an archive, compiled at its final image path, without a second tree copy.
+    # Preserve nested cache paths and their absolute compilation locations in one archive.
     try:
         with tarfile.open(CACHE_ARCHIVE, "w:gz", compresslevel=1) as archive:
             archive.add(cache_dir, arcname=".")
@@ -143,7 +135,7 @@ def main() -> int:
         )
     except Exception as e:
         rc = 1
-        print(f"[bake] artifact upload failed: {e}", flush=True)
+        print(f"[bake] artifact upload failed: {type(e).__name__}", flush=True)
     # STATUS marker LAST: its presence is the helper's completion signal.
     api.upload_file(
         path_or_fileobj=io.BytesIO(f"rc={rc}\narch={arch}\n".encode()),

{freesolo_flash_dev-1.4.11 → freesolo_flash_dev-1.4.13}/docs/azure-artifacts.md

@@ -50,52 +50,39 @@ revision data; physical reclamation of unreferenced objects is intentionally not
 part of this cutover. Do not attach an age-only Blob lifecycle deletion policy:
 it can delete objects still referenced by pinned checkpoints.
 
+## Kernel-cache builds
+
+Kernel-cache CI uses the separate private `build-artifacts` container. Its dedicated
+identity has Blob Data Contributor on that container and Blob Delegator on the
+account. GitHub uses `AZURE_BUILD_CLIENT_ID` and `AZURE_BUILD_CLIENT_SECRET`, with
+the existing tenant setting. It cannot access dev or production training artifacts.
+The GPU sandbox receives only a bounded SAS; the CI identity deletes its disposable
+source/cache namespace afterward. Hugging Face is no longer used for build transport.
+
 ## Three-day migration
 
-The migration tool is the only Hugging Face reader for Flash-owned storage. It is
-an operator tool, never imported by the runtime. It freezes a rolling **72-hour**
-UTC window when the plan is created. It selects files by their authoritative
-last-commit timestamps at pinned source revisions. A checkpoint is selected as a
-whole by its newest file, so an upload crossing the cutoff does not lose shards.
-Older checkpoints are excluded even when their repository has a recent heartbeat.
-Unknown timestamps fail the plan rather than widening the window.
-
-1. Drain active training runs and pause submissions on the old release. Back up
-   the private run records and checkpoint/serving registry. Export the registry's
-   immutable artifact pins into `serving-references.json`, an array of
-   `{"repo":"Freesolo-Co/flashrun-...","revision":"<40-hex>","path":"sft/<run>/checkpoints/step-1/adapter"}`. Use `[]` only
-   after confirming no registry pins need preservation. Nonterminal run-state source,
-   environment, warm-start, and custom-resume pins are collected automatically.
-2. Create a plan for each controller/container. Keep the plan outside Git:
-
-   ```sh
-   PYTHONPATH=. python scripts/migrate_recent_hf_artifacts.py plan /secure/recent-artifacts.json \
-     --run-state-directory /backup/.flash/runs \
-     --references /secure/serving-references.json
-   ```
-
-3. Review its UTC cutoff/end, repositories, exact revisions, paths, sizes, and
-   source hashes. A required pin outside the window is an explicit planning error;
-   retire that binding or run before proceeding. Do not silently broaden the
-   three-day window. Stop source writes while planning and copying; otherwise
-   create a fresh plan after the final drain.
-4. With the intended Azure destination configured, apply the reviewed inventory:
-
-   ```sh
-   PYTHONPATH=. python scripts/migrate_recent_hf_artifacts.py apply /secure/recent-artifacts.json
-   ```
-
-   Every file is checked against its pinned Git/LFS identity, streamed to Azure,
-   downloaded again, and verified before its manifest and original-revision alias
-   are published. The operation can be rerun. It never overwrites an existing
-   Azure head and never deletes source Hub data. Inspect the `.verified.json`
-   report before cutover. Reusing a destination with an existing head preserves
-   that head; reconcile deliberately if it predates the reviewed inventory.
-5. Deploy the matching Flash controller, worker source, and serving changes, plus
-   the Freesolo companion. Check the selected run's logs, checkpoint listing,
-   adapter download/export, a paid SFT save/resume, custom restore, and serving
-   generation in dev before promoting. The Modal image extension installs the
-   Azure SDK even when a qualified base image predates this release.
+The one-time importer was retired after the final inventory was published and
+verified. The completed window is **2026-10-30 04:33:53.792845 UTC through
+2026-11-02 04:33:53.792845 UTC**. Files were selected by authoritative last-commit
+timestamps at pinned revisions; whole checkpoints were selected by their newest
+file, so the cutoff did not split checkpoint shards.
+
+The import verified 11,159 distinct repository/content objects (601,802,167,791
+bytes), then published and read back 629 revision snapshots covering 29,321 file
+entries. Original Hub revision aliases preserve existing checkpoint bindings.
+673 staged objects outside the final referenced inventory were removed only after
+checking every published manifest. Source Hugging Face data was not deleted.
+
+The private inventory and per-object verification receipts remain with the migration
+operator. The importer can be recovered from the pre-cleanup Git revision for an
+explicitly reviewed recovery; it is no longer shipped with Flash. See
+[the migration evidence](azure-migration-evidence-20261102.json).
+
+Deployment is a separate step: keep submissions paused while switching the matching
+Flash controller, serving release, and Freesolo configuration. Verify production
+checkpoint downloads and generation before reopening submissions. Dev SFT and
+custom save/resume, exact checkpoint/optimizer restoration, downloads, and hosted
+serving already passed before the production drain.
 
 Archived worker source from before this cutover is retained only as data. The new
 bootstrap refuses to execute its retired HF backend. Start a new run from a migrated

freesolo_flash_dev-1.4.13/docs/azure-migration-evidence-20261102.json

@@ -0,0 +1,17 @@
+{
+  "window": {
+    "cutoff": "2026-10-30T04:33:53.792845+00:00",
+    "end": "2026-11-02T04:33:53.792845+00:00"
+  },
+  "container": "artifacts",
+  "snapshots": 629,
+  "repositories": 423,
+  "manifest_file_entries": 29321,
+  "verified_distinct_objects": 11159,
+  "verified_distinct_bytes": 601802167791,
+  "errors": 0,
+  "aliases_manifests_heads_read_back": true,
+  "unreferenced_staging_objects_removed": 673,
+  "unreferenced_staging_bytes_removed": 41242800594,
+  "source_hugging_face_data_deleted": false
+}

{freesolo_flash_dev-1.4.11 → freesolo_flash_dev-1.4.13}/flash/adapters/artifacts.py

@@ -115,7 +115,7 @@ def _index_shard_names(names: set[str], suffix: str) -> set[str]:
 
 
 # The largest attempt identity any artifact name may carry. An attempt number reaches a filename and
-# an HF path, so it is bounded rather than merely nonnegative: an unbounded int would still format,
+# an artifact path, so it is bounded rather than merely nonnegative: an unbounded int would still format,
 # and the resulting name is the one thing a later reader has to match exactly.
 MAX_ATTEMPT_ID = (1 << 63) - 1
 

{freesolo_flash_dev-1.4.11 → freesolo_flash_dev-1.4.13}/flash/adapters/config.py

@@ -6,7 +6,7 @@ actually serve? Answering it separately let them drift -- customer-owned resolut
 config that hosted admission accepted, so the same artifact was refused before provisioning on one
 path and refused inside the paid container on the other.
 
-Every rule here is decidable from the config alone. Nothing in this module reads the hub, the
+Every rule here is decidable from the config alone. Nothing in this module reads artifact storage, the
 filesystem, or a provider, so a verdict costs a caller nothing beyond the bytes it already holds.
 That is why it sits beside the rank and target rules rather than under a deployment path: the
 GPU-side materializer revalidates a cache entry it already holds, and it needs the same verdict
@@ -44,7 +44,7 @@ class _DuplicateConfigKey(AdapterConfigError):
 def parse_declared_adapter_config(raw: bytes, *, source: str) -> DeclaredAdapterConfig:
     """read one adapter's declared provenance, or refuse the bytes.
 
-    ``source`` names the file in every message, so a caller that fetched the config from the hub and
+    ``source`` names the file in every message, so a caller that fetched the config from artifact storage and
     one that read it off disk both report a location the reader can go look at.
     """
 

{freesolo_flash_dev-1.4.11 → freesolo_flash_dev-1.4.13}/flash/adapters/lora_rank.py

@@ -105,13 +105,9 @@ def _positive_int(value: Any, *, source: str, field: str) -> int:
 
 
 def _file_identity(file_info: Any) -> str:
-    # the producer is `ArtifactStore.list_repo_tree`, which yields `ArtifactFile` -- whose `__init__` always
-    # sets `path`/`size`/`blob_id` and builds `lfs` as a `BlobLfsInfo` (field `sha256`, no `oid`).
-    # verified at the declared floor `huggingface-hub>=1.2.0` and at the installed 1.27.0, so the
-    # mapping-shaped `lfs` and the `lfs.oid` spelling have no producer in the supported range.
-    # `getattr` stays only on `lfs` itself, which is legitimately optional (non-LFS files), and on
-    # the entry object, because a listing also yields `RepoFolder` -- no size, no blob_id -- which
-    # must fail closed rather than hash to a folder's tree id.
+    # Azure ArtifactFile entries carry path, size and the content digest in blob_id.
+    # lfs.sha256 remains accepted for saved source metadata from before the migration.
+    # reject entries without file identity rather than hashing a folder or missing metadata.
     lfs = getattr(file_info, "lfs", None)
     oid = getattr(lfs, "sha256", None)
     size = getattr(lfs, "size", None)
@@ -487,7 +483,7 @@ def inspect_adapter_config(
 def load_artifact_adapter_config(
     adapter_ref: str, token: str | None = None, revision: str | None = None
 ) -> Mapping[str, Any]:
-    """Read ``adapter_config.json`` for a Flash adapter ref from Hugging Face datasets."""
+    """Read ``adapter_config.json`` for a Flash adapter ref from private Azure storage."""
     repo, filename = adapter_config_path_from_ref(adapter_ref)
     try:
         from flash.artifacts.api import download_file

{freesolo_flash_dev-1.4.11 → freesolo_flash_dev-1.4.13}/flash/artifacts/api.py

@@ -70,16 +70,17 @@ class ArtifactStore:
                 revision = store.commit(repo_id, {})
         return SimpleNamespace(oid=revision)
 
-    def update_repo_settings(self, repo_id, *, repo_type="dataset", private=True):
-        if not private:
-            raise ValueError("Flash artifact storage is private")
-        with open_container(self.token) as container:
-            if container.get_container_properties().public_access:
-                raise ValueError("Flash artifact container must deny public access")
-
     def upload_file(
-        self, *, path_or_fileobj, path_in_repo, repo_id, repo_type="dataset", commit_message=None
+        self,
+        *,
+        path_or_fileobj,
+        path_in_repo,
+        repo_id,
+        repo_type="dataset",
+        commit_message=None,
+        immutable=False,
     ):
+        # immutable=True is reserved for finalized files that cannot change until this call returns.
         validate_path(path_in_repo)
         with tempfile.TemporaryDirectory(prefix="flash-artifact-upload-") as temporary:
             source = path_or_fileobj
@@ -94,7 +95,10 @@ class ArtifactStore:
                         shutil.copyfileobj(path_or_fileobj, output, length=1024 * 1024)
             with open_container(self.token) as container:
                 store = BlobArtifacts(container)
-                entry = {**store.put_file(repo_id, source), "modified": time.time()}
+                entry = {
+                    **store.put_file(repo_id, source, immutable=immutable),
+                    "modified": time.time(),
+                }
                 revision = store.commit(repo_id, {path_in_repo: entry})
         return SimpleNamespace(oid=revision)
 
@@ -110,7 +114,9 @@ class ArtifactStore:
         delete_patterns=None,
         commit_message=None,
         parent_commit=None,
+        immutable=False,
     ):
+        # immutable=True requires the caller to keep every file stable for the entire publication.
         if path_in_repo:
             validate_path(path_in_repo)
         root = Path(folder_path).resolve()
@@ -131,7 +137,7 @@ class ArtifactStore:
                 ):
                     continue
                 additions[prefix + relative] = {
-                    **store.put_file(repo_id, path),
+                    **store.put_file(repo_id, path, immutable=immutable),
                     "modified": time.time(),
                 }
             revision = store.commit(