freesolo-flash-dev 1.4.13__tar.gz → 1.4.15__tar.gz

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/.env.example

@@ -57,7 +57,7 @@ FREESOLO_INTERNAL_KEY=
 # Run without a Freesolo backend. Off by default. With it set, the plane stops calling
 # out for project/environment/billing validation and trusts FREESOLO_INTERNAL_KEY as a
 # single-tenant operator credential; external bearer tokens are REJECTED rather than
-# accepted unverified. Single tenant - see SELF_HOSTING.md before enabling.
+# accepted unverified. Single tenant: all authenticated clients share the same resources.
 # FLASH_STANDALONE=1
 
 # --- optional: deployment topology ---

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/.github/CODEOWNERS

@@ -21,6 +21,5 @@
 /pyproject.toml             @DavidBShan
 /uv.lock                    @DavidBShan
 
-# Security policy and the operator-facing credential template.
-/SECURITY.md                @DavidBShan
+# Operator-facing credential template.
 /.env.example               @DavidBShan

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -6,7 +6,7 @@ body:
     attributes:
       value: |
         Do not paste API keys, tokens, or credentials. Redact them before posting.
-        For security vulnerabilities, use private reporting instead (see SECURITY.md).
+        For security vulnerabilities, use private vulnerability reporting on GitHub instead.
 
   - type: textarea
     id: what-happened

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/.github/workflows/dev-kernel-cache.yml

@@ -2,6 +2,7 @@ name: dev kernel-cache candidate
 
 # dev pushes only run the metadata detector. the scheduled or manual run builds the newest
 # missing candidate, so several daytime changes coalesce into one off-peak gpu bake.
+# a dev -> main promotion builds missing candidates immediately and retries its readiness gate.
 
 on:
   push:
@@ -11,11 +12,12 @@ on:
       - .github/workflows/worker-image.yml
       - .github/workflows/bake-kernel-cache.yml
       - .github/workflows/dev-kernel-cache.yml
-      - docker/kernel_fingerprint.py
-      - docker/make_rp_handler.py
-      - docker/extract_cudart_fix.py
+      - docker/**
       - flash/**
       - pyproject.toml
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
   schedule:
     # 09:00 utc is 01:00 pst / 02:00 pdt.
     - cron: "0 9 * * *"
@@ -33,7 +35,15 @@ permissions:
   packages: write
 
 concurrency:
-  group: dev-kernel-cache
+  # metadata pushes and rejected PRs must not replace a queued bake in the pending slot.
+  group: >-
+    dev-kernel-cache-${{
+      (github.event_name == 'workflow_dispatch' ||
+       (github.event_name == 'pull_request' &&
+        github.event.pull_request.head.repo.full_name == github.repository &&
+        github.event.pull_request.head.ref == 'dev' && !github.event.pull_request.draft))
+      && 'build' || 'detect'
+    }}
   cancel-in-progress: false
 
 jobs:
@@ -48,7 +58,11 @@ jobs:
         run: gh workflow run dev-kernel-cache.yml --repo "$GITHUB_REPOSITORY" --ref dev
 
   detect:
-    if: github.repository == 'freesolo-co/flash' && github.event_name != 'schedule'
+    if: >-
+      github.repository == 'freesolo-co/flash' && github.event_name != 'schedule' &&
+      (github.event_name != 'pull_request' ||
+       (github.event.pull_request.head.repo.full_name == github.repository &&
+        github.event.pull_request.head.ref == 'dev' && !github.event.pull_request.draft))
     runs-on: ubuntu-latest
     timeout-minutes: 15
     outputs:
@@ -63,7 +77,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.sha }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Resolve source metadata
         id: source
@@ -143,7 +157,7 @@ jobs:
 
   build-base:
     needs: detect
-    if: github.event_name == 'workflow_dispatch' && needs.detect.outputs.needs_bake == 'true'
+    if: (github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request') && needs.detect.outputs.needs_bake == 'true'
     uses: ./.github/workflows/worker-image.yml
     with:
       tag: cu128-dev-${{ needs.detect.outputs.revision }}
@@ -152,11 +166,11 @@ jobs:
 
   bake:
     needs: [detect, build-base]
-    if: github.event_name == 'workflow_dispatch' && needs.detect.outputs.needs_bake == 'true'
+    if: (github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request') && needs.detect.outputs.needs_bake == 'true'
     uses: ./.github/workflows/bake-kernel-cache.yml
     with:
       sms: ${{ needs.detect.outputs.sms }}
-      deadline_minutes: ${{ fromJSON(format('{0}', inputs.deadline_minutes)) }}
+      deadline_minutes: ${{ fromJSON(github.event_name == 'pull_request' && '90' || format('{0}', inputs.deadline_minutes)) }}
       fp_cache: ${{ needs.build-base.outputs.fp_cache }}
       fp_base: ${{ needs.build-base.outputs.fp_base }}
       base_ref: ${{ needs.build-base.outputs.base_ref }}
@@ -166,7 +180,7 @@ jobs:
 
   publish-ready:
     needs: [detect, bake]
-    if: github.event_name == 'workflow_dispatch' && needs.detect.outputs.needs_bake == 'true'
+    if: (github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request') && needs.detect.outputs.needs_bake == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
@@ -213,7 +227,26 @@ jobs:
               "$repo:cu128-dev-ready-$sm"
           done
 
-      - name: Re-run production readiness for dev
+  refresh-readiness:
+    needs: [detect, publish-ready]
+    # a queued revision may find compatible caches published by the preceding bake.
+    # always() permits the skipped publication dependency; failed/cancelled work stays red.
+    if: >-
+      always() && !cancelled() && needs.detect.result == 'success' &&
+      (github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request') &&
+      (needs.detect.outputs.needs_bake == 'false' || needs['publish-ready'].result == 'success')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Re-run failed production readiness for this revision
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh workflow run production-kernel-cache-ready.yml --repo "$GITHUB_REPOSITORY" --ref dev
+          REVISION: ${{ needs.detect.outputs.revision }}
+        run: |
+          set -euo pipefail
+          runs=$(gh run list --repo "$GITHUB_REPOSITORY" \
+            --workflow production-kernel-cache-ready.yml --commit "$REVISION" \
+            --event pull_request --status failure --json databaseId --jq '.[].databaseId')
+          for run_id in $runs; do
+            gh run rerun "$run_id" --repo "$GITHUB_REPOSITORY" --failed
+          done

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/.github/workflows/publish-serving-image.yml

@@ -128,7 +128,7 @@ jobs:
             publish=true
           elif ! changed="$(git diff --name-only "$last_published_sha" "$CURRENT_SHA" 2>/dev/null)"; then
             publish=true
-          elif grep -qE "^(flash/|docker/patch_vllm_moe_lora\.py$|Dockerfile\.serve$|\.dockerignore$|serve_launch\.py$|pyproject\.toml$|uv\.lock$|README\.md$|LICENSE$|NOTICE$|\.github/workflows/publish-serving-image\.yml$)" <<< "$changed"; then
+          elif grep -qE "^(flash/|docker/patch_vllm_moe_lora\.py$|Dockerfile\.serve$|\.dockerignore$|serve_launch\.py$|pyproject\.toml$|uv\.lock$|LICENSE$|NOTICE$|\.github/workflows/publish-serving-image\.yml$)" <<< "$changed"; then
             publish=true
           fi
           echo "publish=$publish" >> "$GITHUB_OUTPUT"

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/Dockerfile.serve

@@ -24,7 +24,7 @@ RUN python -c 'import sys; assert sys.version_info[:2] == (3, 12)' \
         --require-hashes -r /tmp/uv-requirements.txt \
     && rm -f /tmp/uv-requirements.txt
 
-COPY pyproject.toml uv.lock README.md LICENSE NOTICE ./
+COPY pyproject.toml uv.lock LICENSE NOTICE ./
 COPY flash ./flash
 COPY docker/patch_vllm_moe_lora.py ./docker/patch_vllm_moe_lora.py
 COPY serve_launch.py ./serve_launch.py

freesolo_flash_dev-1.4.15/PKG-INFO

@@ -0,0 +1,104 @@
+Metadata-Version: 2.5
+Name: freesolo-flash-dev
+Version: 1.4.15
+Summary: Flash — managed LoRA post-training (SFT/GRPO) for Freesolo environments, driven by the `flash` CLI
+Project-URL: Homepage, https://github.com/freesolo-co/flash
+Project-URL: Repository, https://github.com/freesolo-co/flash
+Author: Freesolo
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Keywords: fine-tuning,freesolo,grpo,llm,lora,rl,sft
+Classifier: Development Status :: 4 - Beta
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: <3.13,>=3.11
+Provides-Extra: custom
+Requires-Dist: torch==2.10.0; extra == 'custom'
+Provides-Extra: dev
+Requires-Dist: cloudpickle>=3.0; extra == 'dev'
+Requires-Dist: cryptography>=46; extra == 'dev'
+Requires-Dist: datasets>=2.19; extra == 'dev'
+Requires-Dist: fastapi<1,>=0.136; extra == 'dev'
+Requires-Dist: freesolo>=0.4.2; extra == 'dev'
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: huggingface-hub>=1.2.0; extra == 'dev'
+Requires-Dist: jsonschema>=4.23; extra == 'dev'
+Requires-Dist: modal==1.6.2; extra == 'dev'
+Requires-Dist: mypy>=1.13.0; extra == 'dev'
+Requires-Dist: orjson>=3.10; extra == 'dev'
+Requires-Dist: packaging<27,>=24; extra == 'dev'
+Requires-Dist: pillow>=11.0.0; extra == 'dev'
+Requires-Dist: pydantic-settings>=2.7; extra == 'dev'
+Requires-Dist: pytest>=9.0.3; extra == 'dev'
+Requires-Dist: referencing>=0.28.4; extra == 'dev'
+Requires-Dist: regex>=2024.11.6; extra == 'dev'
+Requires-Dist: requests<3,>=2.32; extra == 'dev'
+Requires-Dist: ruff<0.18,>=0.6; extra == 'dev'
+Requires-Dist: tokenizers>=0.22; extra == 'dev'
+Requires-Dist: transformers<5.13,>=5.8; extra == 'dev'
+Requires-Dist: uvicorn<1,>=0.52; extra == 'dev'
+Provides-Extra: gpu
+Requires-Dist: accelerate>=1.4; extra == 'gpu'
+Requires-Dist: azure-identity<2,>=1.19; extra == 'gpu'
+Requires-Dist: azure-storage-blob<13,>=12.24; extra == 'gpu'
+Requires-Dist: datasets>=2.19; extra == 'gpu'
+Requires-Dist: freesolo>=0.4.2; extra == 'gpu'
+Requires-Dist: httpx>=0.27; extra == 'gpu'
+Requires-Dist: huggingface-hub>=1.2.0; extra == 'gpu'
+Requires-Dist: peft>=0.19; extra == 'gpu'
+Requires-Dist: requests<3,>=2.32; extra == 'gpu'
+Requires-Dist: tokenizers>=0.22; extra == 'gpu'
+Requires-Dist: torch==2.10.0; extra == 'gpu'
+Requires-Dist: transformers<5.13,>=5.8; extra == 'gpu'
+Requires-Dist: uv>=0.5; extra == 'gpu'
+Requires-Dist: vllm==0.19.1; extra == 'gpu'
+Provides-Extra: serve-runtime
+Requires-Dist: azure-identity<2,>=1.19; extra == 'serve-runtime'
+Requires-Dist: azure-storage-blob<13,>=12.24; extra == 'serve-runtime'
+Requires-Dist: fastapi<0.137,>=0.136; extra == 'serve-runtime'
+Requires-Dist: huggingface-hub>=1.2.0; extra == 'serve-runtime'
+Requires-Dist: pillow>=11.0.0; extra == 'serve-runtime'
+Requires-Dist: safetensors<1,>=0.8; extra == 'serve-runtime'
+Requires-Dist: tokenizers>=0.22; extra == 'serve-runtime'
+Requires-Dist: transformers<5.13,>=5.8; extra == 'serve-runtime'
+Requires-Dist: uvicorn<1,>=0.52; extra == 'serve-runtime'
+Requires-Dist: vllm==0.23.0; extra == 'serve-runtime'
+Provides-Extra: server
+Requires-Dist: azure-identity<2,>=1.19; extra == 'server'
+Requires-Dist: azure-storage-blob<13,>=12.24; extra == 'server'
+Requires-Dist: cryptography>=46; extra == 'server'
+Requires-Dist: datasets>=2.19; extra == 'server'
+Requires-Dist: fastapi<1,>=0.136; extra == 'server'
+Requires-Dist: freesolo>=0.4.2; extra == 'server'
+Requires-Dist: httpx>=0.27; extra == 'server'
+Requires-Dist: huggingface-hub>=1.2.0; extra == 'server'
+Requires-Dist: jinja2>=3.1.0; extra == 'server'
+Requires-Dist: jsonschema>=4.23; extra == 'server'
+Requires-Dist: modal==1.6.2; extra == 'server'
+Requires-Dist: orjson>=3.10; extra == 'server'
+Requires-Dist: pillow>=11.0.0; extra == 'server'
+Requires-Dist: pydantic-settings>=2.7; extra == 'server'
+Requires-Dist: referencing>=0.28.4; extra == 'server'
+Requires-Dist: regex>=2024.11.6; extra == 'server'
+Requires-Dist: requests<3,>=2.32; extra == 'server'
+Requires-Dist: transformers<5.13,>=5.8; extra == 'server'
+Requires-Dist: uvicorn<1,>=0.52; extra == 'server'
+Provides-Extra: serving
+Requires-Dist: anyio<5,>=4.0; extra == 'serving'
+Requires-Dist: azure-identity<2,>=1.19; extra == 'serving'
+Requires-Dist: azure-storage-blob<13,>=12.24; extra == 'serving'
+Requires-Dist: fastapi<1,>=0.136; extra == 'serving'
+Requires-Dist: httpx>=0.27.0; extra == 'serving'
+Requires-Dist: modal==1.6.2; extra == 'serving'
+Requires-Dist: orjson>=3.10; extra == 'serving'
+Requires-Dist: orjson>=3.10.0; extra == 'serving'
+Requires-Dist: pillow>=11.0.0; extra == 'serving'
+Requires-Dist: pydantic-settings>=2.6.0; extra == 'serving'
+Requires-Dist: pydantic-settings>=2.7; extra == 'serving'
+Requires-Dist: pydantic>=2.7.0; extra == 'serving'
+Requires-Dist: python-dotenv>=1.0.0; extra == 'serving'
+Requires-Dist: starlette<2,>=0.46; extra == 'serving'

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/_internal/channel.py

@@ -22,8 +22,8 @@ _CLI_SCRIPT_NAMES = (
     else frozenset({"flash", "flash-cli"})
 )
 
-# The `-m` form of the same entry point, which README/CONTRIBUTING/SELF_HOSTING all name as the
-# way around the shadowing. Not channel-dependent: the dev build renames the console scripts but
+# The `-m` form of the same entry point works around shadowing.
+# Not channel-dependent: the dev build renames the console scripts but
 # ships the identical `flash` package, so this module path is its escape hatch too.
 _CLI_MODULE = "flash.cli"
 

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/cli/commands/env/testing/eval.py

@@ -436,8 +436,8 @@ def _require_accessible_project(project_id: object) -> str:
             f"not logged in — run `{CLI_NAME} login` with your freesolo API key (or set FREESOLO_API_KEY)"
         )
     # pass `api_url` so self-hosted planes get shape validation without sending
-    # `FREESOLO_INTERNAL_KEY` to api.freesolo.co (SELF_HOSTING.md,
-    # `_verifies_against_freesolo`). upload may still fail later, but credential leakage is worse.
+    # `FREESOLO_INTERNAL_KEY` to api.freesolo.co (see `_verifies_against_freesolo`).
+    # upload may still fail later, but credential leakage is worse.
     return resolve_project_id(project_id, api_key, api_url)
 
 

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/client/__init__.py

@@ -36,9 +36,8 @@ def resolve_project(
     only validated for SHAPE -- exactly what ``flash/server/domain/registry/projects.py`` does under
     ``standalone()`` when the same run is submitted. Without this the ownership lookup went to
     ``api.freesolo.co``, which has no relationship with the operator's key and answers 401, so
-    ``flash env setup`` died before writing a file on the very quickstart SELF_HOSTING.md
-    documents. A backend-less plane exposes no project routes at all, so there is nothing else to
-    ask.
+    ``flash env setup`` died before writing a file on a standalone plane. A backend-less plane
+    exposes no project routes at all, so there is nothing else to ask.
 
     ``api_url`` is passed in rather than re-read from config because the caller has already
     resolved it (and because ``FLASH_STANDALONE`` lives on the SERVER, so the client cannot see

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/client/http.py

@@ -131,8 +131,8 @@ def has_freesolo_backend(api_url: str) -> bool:
     send a self-hosted plane's operator key to it.
 
     The presence of ``FREESOLO_API_KEY`` deliberately does NOT count. It looks like a hosted
-    signal but cannot be one: ``SELF_HOSTING.md`` has self-hosters log in with the
-    plane-controlling ``FREESOLO_INTERNAL_KEY``, and ``cmd_login`` reads that env var as the login
+    signal but cannot be one: self-hosters log in with the plane-controlling
+    ``FREESOLO_INTERNAL_KEY``, and ``cmd_login`` reads that env var as the login
     key, so its value is as likely to be the operator key as a hosted account key. Nothing marks
     which, and guessing wrong ships the plane credential to Freesolo. A hosted account reached
     from a self-hosted plane needs ``FREESOLO_BASE_URL`` set explicitly.

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/core/catalog.py

@@ -571,8 +571,7 @@ def get_model(model_id: str) -> ModelInfo:
         allowed = ", ".join(MODELS)
         raise ValueError(
             f"unsupported model {model_id!r}; choose one of: {allowed} — or, to train another "
-            f"model, fork Flash and add a ModelInfo entry for it to flash/core/catalog.py "
-            f"(see SELF_HOSTING.md)"
+            "model, fork Flash and add a ModelInfo entry for it to flash/core/catalog.py"
         ) from exc
 
 

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/envs/loading/staged.py

@@ -75,6 +75,7 @@ def _reference_for_environment_id(env_id: str) -> tuple[str, Any]:
 
 def is_staged_environment_transient_error(exc: BaseException) -> bool:
     """Classify timeout, connection, rate-limit, and server failures across clients."""
+    from flash.artifacts.errors import artifact_error_transience
     from flash.envs.meta.identity import GitHubTransientError
     from flash.envs.registry.azure import RegistryError
     from flash.providers.artifacts.channel import artifact_status_code
@@ -87,6 +88,9 @@ def is_staged_environment_transient_error(exc: BaseException) -> bool:
             return True
         if isinstance(current, (StagedEnvironmentTransientError, GitHubTransientError)):
             return True
+        transience = artifact_error_transience(current)
+        if transience is not None:
+            return transience
         status = artifact_status_code(current)
         if status == 429 or (status is not None and status >= 500):
             return True

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/providers/core/preflight.py

@@ -113,7 +113,7 @@ def require_operator_config() -> None:
         raise PreflightError(
             "the Flash control plane is missing required operator configuration:\n"
             + "\n".join(problems)
-            + "\n\nSet these on the control-plane host. See SELF_HOSTING.md."
+            + "\n\nSet these on the control-plane host."
         )
 
 

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/serve/contract/urls.py

@@ -124,7 +124,7 @@ def serving_base_url() -> str:
             "A standalone plane has no serving backend of its own, and using the hosted one would "
             "send FREESOLO_INTERNAL_KEY - the key that controls this plane - to a service you do "
             "not operate. Point FREESOLO_SERVING_URL at your own multi-LoRA deployment, or export "
-            "the adapter and serve it yourself (see SELF_HOSTING.md). Training does not require "
+            "the adapter and serve it yourself. Training does not require "
             "this."
         )
     return serving_control_url(configured or default_serving_url())

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/serve/deployment/profiles.py

@@ -41,7 +41,7 @@ _CERTIFIED_MODAL_IMAGE_DIGEST = (
     "sha256:9dc811c3458f979ce2e020509ffbbe3e51364f551234df4c3139ef8e497192dc"
 )
 # Azure hydration and generation passed on all shipping Modal profiles on 2026-11-02.
-# See docs/azure-serving-qualification-20261102.json. Older Hub-only images remain blocked.
+# Older Hub-only images remain blocked.
 _AZURE_ARTIFACT_IMAGE_DIGESTS: frozenset[str] = frozenset(
     {"sha256:9dc811c3458f979ce2e020509ffbbe3e51364f551234df4c3139ef8e497192dc"}
 )

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/server/domain/registry/projects.py

@@ -187,7 +187,7 @@ def require_project_access_slug(
             detail=(
                 "publishing environments requires a Freesolo project directory to resolve "
                 "the project slug, which a standalone plane does not have; reference the "
-                "environment from git instead (see SELF_HOSTING.md)"
+                "environment from git instead"
             ),
         )
 

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/server/platform/auth.py

@@ -187,7 +187,8 @@ def standalone() -> bool:
     """True when this self-hosted plane has no Freesolo backend.
 
     Standalone mode trusts ``FREESOLO_INTERNAL_KEY`` as the single-tenant authorization boundary and
-    cannot distinguish organizations. Use it only under the trust model in ``SELF_HOSTING.md``.
+    cannot distinguish organizations. All authenticated clients share one tenant and can access
+    its resources.
     """
     return (os.environ.get(STANDALONE_ENV) or "").strip().lower() in {"1", "true", "yes", "on"}
 

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/serving/app/modal_app.py

@@ -1,7 +1,6 @@
 """Modal app: multi-LoRA serving with one GPU container per base model. ``LoraEngine`` is a
 Modal class parametrized by ``base_model`` (one GPU per base model, sharing its adapters via
-``enable_lora``); ``router`` is the CPU front door that dispatches to the right engine. See
-README to deploy.
+``enable_lora``); ``router`` is the CPU front door that dispatches to the right engine.
 """
 
 import asyncio

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/serving/src/engine/model_config.py

@@ -39,7 +39,7 @@ from flash.serving.src.engine.prequant_config import (
 #
 # sizing rationale. preallocated lora buffers and loaded checkpoint weights dominate engine vram.
 # The dense 0.8B uses L4, the BF16 4B and FP8 9B use L40S, the FP8 27B uses H100, and
-# the BF16 35B MoE uses H200. See the hosted GPU qualification table in app/README.md.
+# the BF16 35B MoE uses H200.
 #   - Qwen3.6-35B-A3B (vision-language MoE; arch ``Qwen3_5MoeForConditionalGeneration``) -> H200
 #     (141 GB) with the base bf16 weights, 6 x 64 LoRA at native 256k. bf16 (not FP8) is the one path giving
 #     full-expert LoRA + CUDA graphs because the fused-MoE LoRA path won't compile on fp8e4nv. see the

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/flash/serving/src/store/settings.py

@@ -17,7 +17,7 @@ ADAPTER_CACHE_DIR = HOSTING_CACHE_DIR / "adapters"
 # a value here in code if it ever needs to move.
 TRUST_REMOTE_CODE = True
 DTYPE = "auto"
-# FP8 everywhere, baked in (memory-first; see README "Quantization"). For models without
+# FP8 everywhere, baked in to minimize memory use. For models without
 # `serve_model_id`, vLLM ONLINE-quantizes the normal bf16 HF checkpoint to FP8 (E4M3) at load time.
 # Larger validated tiers can instead set model_config.engine.serve_model_id to load a pre-quantized
 # FP8 checkpoint directly, avoiding the bf16 load transient. The old per-base GPTQ-Int8 repos were

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/pyproject.toml

@@ -1,8 +1,7 @@
 [project]
 name = "freesolo-flash-dev"
-version = "1.4.13"
+version = "1.4.15"
 description ="Flash — managed LoRA post-training (SFT/GRPO) for Freesolo environments, driven by the `flash` CLI"
-readme = "README.md"
 # The training and serving stack is validated on Python 3.11 and 3.12.
 requires-python = ">=3.11,<3.13"
 license = "Apache-2.0"
@@ -211,7 +210,7 @@ artifacts = ["flash/py.typed"]
 # auto-published by .github/workflows/publish-dev.yml: a push to `dev` whose version isn't yet on
 # PyPI publishes it; pushes that don't change it find it already published and no-op. So cutting a
 # dev-channel release = bump this (and [project].version) and merge to `dev`.
-version = "1.4.13"
+version = "1.4.15"
 
 [tool.pytest.ini_options]
 pythonpath = ["."]

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/tests/serving/test_modal_image_paths.py

@@ -17,7 +17,6 @@ from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[2]
 MODAL_APP = ROOT / "flash" / "serving" / "app" / "modal_app.py"
-SERVING_README = ROOT / "flash" / "serving" / "app" / "README.md"
 DEPLOY_WORKFLOWS = ("deploy-modal.yml", "deploy-modal-dev.yml")
 
 
@@ -104,32 +103,12 @@ def test_modal_image_applies_and_verifies_the_shared_vllm_repair() -> None:
     assert command.index(apply) < command.index(verify) < command.index(cleanup)
 
 
-def test_hosted_deploy_docs_and_workflows_point_at_paths_that_exist() -> None:
-    """The documented deploy commands and the workflows that run them must match the move.
-
-    The README's blocks were written when the app was a top-level `serving/` directory, so they said
-    `cd serving` and `modal deploy modal_app.py`. Both are now wrong in a way that fails only when an
-    operator follows them during an incident: there is no repo-root `serving/`, and deploying from
-    the package directory raises `ModuleNotFoundError: No module named 'flash'` because modal's CLI
-    puts the *working directory* on sys.path.
-    """
-    readme = SERVING_README.read_text(encoding="utf-8")
-    assert "cd serving" not in readme
-    # both documented deploys must name the app by its repo-root-relative path.
-    assert readme.count("modal deploy flash/serving/app/modal_app.py") == 1
-    assert readme.count("modal deploy --env dev flash/serving/app/modal_app.py") == 1
-    assert readme.count('export FREESOLO_DEPLOYMENT_ID="manual-production-') == 1
-    assert readme.count('export FREESOLO_DEPLOYMENT_ID="manual-development-') == 1
-
+def test_hosted_deploy_workflows_use_the_repository_root() -> None:
     for workflow in DEPLOY_WORKFLOWS:
         path = ROOT / ".github" / "workflows" / workflow
-        # the README cites these by name; a citation that resolves to nothing stranded the hosted
-        # fleet with no redeploy path, which is why they were ported alongside the app.
         assert path.is_file(), workflow
-        assert workflow in readme, workflow
         body = path.read_text(encoding="utf-8")
         assert "modal deploy" in body
-        # run from the repo root, for the sys.path reason above.
         assert "working-directory: ." in body
 
 
@@ -238,25 +217,3 @@ def test_serving_workflow_gates_include_the_shared_repair_script() -> None:
         gate_lines = [line for line in source.splitlines() if "grep -qE" in line]
         assert len(gate_lines) == 1, workflow
         assert path in gate_lines[0], workflow
-
-
-def test_self_hosting_docs_name_the_image_the_workflow_actually_publishes() -> None:
-    """The documented `--image` must be the repository the publish workflow pushes to.
-
-    These are two independent strings with no shared constant: the docs said
-    `ghcr.io/freesolo-co/flash-serve` while the workflow publishes
-    `ghcr.io/freesolo-co/freesolo-flash-serve`. A wrong image name is not caught by the deploy
-    dry-run, which only validates that the digest is syntactically well formed -- it fails at
-    provisioning, against the customer's own provider account.
-    """
-    workflow = (ROOT / ".github" / "workflows" / "publish-serving-image.yml").read_text(
-        encoding="utf-8"
-    )
-    published = re.search(r"IMAGE:\s*(\S+)", workflow)
-    assert published is not None, "the publish workflow must state the image it pushes"
-    image = published.group(1)
-
-    docs = (ROOT / "SELF_HOSTING.md").read_text(encoding="utf-8")
-    cited = re.findall(r"ghcr\.io/[\w./-]+(?=@sha256:)", docs)
-    assert cited, "SELF_HOSTING.md must show a pinned --image to deploy"
-    assert set(cited) == {image}, (cited, image)

{freesolo_flash_dev-1.4.13 → freesolo_flash_dev-1.4.15}/tests/serving/test_schemas_coverage.py

@@ -2,8 +2,6 @@
 
 from __future__ import annotations
 
-from pathlib import Path
-
 import pytest
 from pydantic import ValidationError
 
@@ -135,18 +133,6 @@ def test_generate_request_requires_exactly_one_nonempty_prompt_source(
         GenerateRequest.model_validate({"model_id": CHECKPOINT_ID, **sources})
 
 
-def test_serving_readme_uses_generate_request_field_names() -> None:
-    readme = Path(__file__).parents[2] / "flash" / "serving" / "app" / "README.md"
-    text = readme.read_text()
-
-    assert "`POST /generate` with `model_id`" in text
-    assert '"max_tokens": 512' in text
-    assert '"structured_outputs": {' in text
-    assert "adapterId" not in text
-    assert "maxTokens" not in text
-    assert "structuredOutputs" not in text
-
-
 @pytest.mark.parametrize(
     ("field", "value"),
     [

freesolo_flash_dev-1.4.15/tests/test_customer_serving_contract.py

@@ -0,0 +1,19 @@
+"""Customer-owned serving packaging and authentication boundaries."""
+
+import pathlib
+import tomllib
+
+
+def test_serving_does_not_offer_the_removed_modal_extra() -> None:
+    root = pathlib.Path(__file__).resolve().parents[1]
+    extras = tomllib.loads((root / "pyproject.toml").read_text())["project"][
+        "optional-dependencies"
+    ]
+    assert "serve-modal" not in extras
+
+
+def test_customer_app_authenticates_with_bearer_instead_of_the_plane_key() -> None:
+    root = pathlib.Path(__file__).resolve().parents[1]
+    app = (root / "flash" / "serve" / "app" / "http.py").read_text(encoding="utf-8")
+    assert "internal-key" not in app.casefold(), "the packaged app must not read the plane key"
+    assert '"bearer"' in app.casefold(), "the packaged app must authenticate with bearer"