freesolo-flash-dev 1.4.24__tar.gz → 1.4.26__tar.gz

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.26}/.github/workflows/auto-rebake.yml

@@ -73,7 +73,7 @@ jobs:
           set -euo pipefail
           ver=v0.20.2
           sha=c14340087103ba9dadf61d45acd20675490fd0ccbd56ac7901fc1b502137f44b
-          curl -fsSL -o /tmp/crane.tar.gz \
+          curl -fsSL --retry 4 --retry-delay 2 --connect-timeout 15 --max-time 120 -o /tmp/crane.tar.gz \
             "https://github.com/google/go-containerregistry/releases/download/${ver}/go-containerregistry_Linux_x86_64.tar.gz"
           echo "${sha}  /tmp/crane.tar.gz" | sha256sum -c -
           sudo tar -xz -C /usr/local/bin -f /tmp/crane.tar.gz crane

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.26}/.github/workflows/bake-kernel-cache.yml

@@ -154,7 +154,7 @@ jobs:
           set -euo pipefail
           ver=v0.20.2
           sha=c14340087103ba9dadf61d45acd20675490fd0ccbd56ac7901fc1b502137f44b
-          curl -fsSL -o /tmp/crane.tar.gz \
+          curl -fsSL --retry 4 --retry-delay 2 --connect-timeout 15 --max-time 120 -o /tmp/crane.tar.gz \
             "https://github.com/google/go-containerregistry/releases/download/${ver}/go-containerregistry_Linux_x86_64.tar.gz"
           echo "${sha}  /tmp/crane.tar.gz" | sha256sum -c -
           sudo tar -xz -C /usr/local/bin -f /tmp/crane.tar.gz crane

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.26}/.github/workflows/deploy-modal-dev.yml

@@ -27,6 +27,7 @@ jobs:
         # free. (in freesolo the app WAS the root of its own tree and used cwd-relative imports.)
         working-directory: .
     env:
+      LAMBDA_API_KEY: ${{ secrets.LAMBDA_API_KEY }}
       MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
       MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
       HF_TOKEN: ${{ secrets.HF_TOKEN }}
@@ -118,7 +119,7 @@ jobs:
           # pinned to the exact client pyproject declares; see deploy-modal.yml for why an
           # unbounded range is unsafe for the deploy path.
           # exact pins keep the deploy client bootstrap reproducible across runner image changes.
-          uv pip install --system "modal==1.6.2" "python-dotenv==1.2.3"
+          uv pip install --system "modal==1.6.2" "python-dotenv==1.2.3" "httpx==0.28.1"
 
       - name: Verify development deployment inputs
         if: steps.gate.outputs.deploy == 'true'
@@ -230,6 +231,26 @@ jobs:
           fi
           echo "Development Supabase flash.hosted_lora_adapters is queryable."
 
+      # This independent app keeps orphan VM cleanup running across serving releases.
+      - name: Validate inference provider
+        id: provider
+        if: steps.gate.outputs.deploy == 'true'
+        run: |
+          python3 - <<'PYCODE'
+          import os
+          import runpy
+          policy = runpy.run_path("flash/serving/app/inference_provider.py")
+          enabled = policy["INFERENCE_PROVIDER"] != "modal"
+          if enabled and not os.environ.get("LAMBDA_API_KEY"):
+              raise SystemExit("LAMBDA_API_KEY is required for lambda/all inference")
+          with open(os.environ["GITHUB_OUTPUT"], "a") as output:
+              output.write(f"lambda_enabled={str(enabled).lower()}\n")
+          PYCODE
+
+      - name: Deploy Lambda fleet control
+        if: steps.gate.outputs.deploy == 'true' && steps.provider.outputs.lambda_enabled == 'true'
+        run: modal deploy --strategy rolling --env dev -m flash.serving.lambda_cloud.control_app
+
       - name: Deploy development serving
         if: steps.gate.outputs.deploy == 'true'
         run: modal deploy --strategy rolling --env dev flash/serving/app/modal_app.py

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.26}/.github/workflows/deploy-modal.yml

@@ -41,9 +41,8 @@ jobs:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     # Include the full router drain window before the canary, its GPU cold start,
-    # accounting settlement, image builds, and a rollback with its own readiness
-    # poll. The workflow contract test sums these budgets so rollback is never
-    # cut off by the job timeout.
+    # accounting settlement and image builds. The workflow contract test checks
+    # these budgets against the job timeout.
     timeout-minutes: 300
     # serialize serving deploys across runs because each deploy mutates the live app. github can still
     # replace a pending run, so the gate compares against the sha reported by the deployed app rather
@@ -61,6 +60,7 @@ jobs:
         working-directory: .
     env:
       # Modal CLI auth (read from the environment by `modal`).
+      LAMBDA_API_KEY: ${{ secrets.LAMBDA_API_KEY }}
       MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
       MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
       # runtime secrets forwarded into the serving app's Modal secret at deploy time.
@@ -97,12 +97,7 @@ jobs:
           DEPLOYED_HEALTH_URL: https://serve.freesolo.co/healthz
         run: |
           deploy=false
-          # the sha reported by the LIVE app is read ONCE, before any decision, because it serves
-          # two purposes: it bounds the undeployed diff below, and it is the rollback target for a
-          # failed promotion. `modal deploy` overwrites the app in place, so after that point there
-          # is no way left to ask what the previous release was. reading it on workflow_dispatch
-          # too -- where the deploy decision does not need it -- is what makes a dispatched deploy
-          # rollback-capable rather than one-way.
+          # Read the live revision to bound the undeployed diff.
           read_ok=true
           last_deployed_sha="$(python3 - <<'PY'
           import json
@@ -126,11 +121,8 @@ jobs:
           if [ "$read_ok" != "true" ]; then
             last_deployed_sha=""
           fi
-          # an empty previous sha means rollback is IMPOSSIBLE for this run. the rollback step below
-          # says so out loud rather than reporting a restore it never performed.
-          echo "previous_sha=$last_deployed_sha" >> "$GITHUB_OUTPUT"
 
-          # A failed promotion may leave this SHA live after refusing rollback.
+          # A failed promotion may leave this SHA live; an explicit rerun must reverify it.
           # An explicit rerun must re-prove it, not pass by skipping the canary.
           if [ "$EVENT" = "workflow_dispatch" ] || [ "${GITHUB_RUN_ATTEMPT:-1}" -gt 1 ]; then
             deploy=true
@@ -176,7 +168,7 @@ jobs:
           # pinned to the exact client pyproject declares and the provisioning path was validated
           # against: deploy behaviour (app lifecycle, tags, lookup) is client-version sensitive, so
           # an unbounded range lets a future release change deploys with no diff here.
-          python -m pip install "modal==1.6.2" "python-dotenv==1.2.3"
+          python -m pip install "modal==1.6.2" "python-dotenv==1.2.3" "httpx==0.28.1"
 
       - name: Verify Modal auth is configured
         if: steps.gate.outputs.deploy == 'true'
@@ -319,6 +311,26 @@ jobs:
             sleep "$sleep_seconds"
           done
 
+      # This independent app keeps orphan VM cleanup running across serving releases.
+      - name: Validate inference provider
+        id: provider
+        if: steps.gate.outputs.deploy == 'true'
+        run: |
+          python3 - <<'PYCODE'
+          import os
+          import runpy
+          policy = runpy.run_path("flash/serving/app/inference_provider.py")
+          enabled = policy["INFERENCE_PROVIDER"] != "modal"
+          if enabled and not os.environ.get("LAMBDA_API_KEY"):
+              raise SystemExit("LAMBDA_API_KEY is required for lambda/all inference")
+          with open(os.environ["GITHUB_OUTPUT"], "a") as output:
+              output.write(f"lambda_enabled={str(enabled).lower()}\n")
+          PYCODE
+
+      - name: Deploy Lambda fleet control
+        if: steps.gate.outputs.deploy == 'true' && steps.provider.outputs.lambda_enabled == 'true'
+        run: modal deploy --strategy rolling --env main -m flash.serving.lambda_cloud.control_app
+
       - name: Deploy serving
         id: deploy_serving
         if: steps.gate.outputs.deploy == 'true'
@@ -442,143 +454,6 @@ jobs:
         # argument would put them in the process table and in the step's own command echo.
         run: python -m flash.serving.promotion.gate
 
-      - name: Restore the previous release
-        # `failure()` alone is too broad. It also fires for the steps that run BEFORE any deploy --
-        # installing Modal, verifying auth, verifying the runtime secrets, waiting for the adapter
-        # schema. Restoring there would `modal deploy` the previous SHA over a live app this run never
-        # replaced, using the very secret set whose verification just failed: a healthy release
-        # overwritten by a rollback that had nothing to roll back. Gating on the deploy step's own
-        # outcome keeps the case the previous comment was right about -- a deploy that half-succeeded
-        # and then failed readiness is `failure`, not skipped, so it still restores. Any outcome other
-        # than an attempted deploy (empty, `skipped`) means production is untouched and must stay so.
-        if: >-
-          failure() && steps.gate.outputs.deploy == 'true'
-          && (steps.deploy_serving.outcome == 'success' || steps.deploy_serving.outcome == 'failure')
-        working-directory: .
-        env:
-          PREVIOUS_SHA: ${{ steps.gate.outputs.previous_sha }}
-          CURRENT_SHA: ${{ github.sha }}
-          # a distinct attempt id so /healthz cannot report the FORWARD deploy's identity and be
-          # mistaken for a completed rollback.
-          ROLLBACK_DEPLOYMENT_ID: ${{ github.run_id }}-${{ github.run_attempt }}-rollback
-          HEALTH_URL: https://serve.freesolo.co/healthz
-        run: |
-          set -euo pipefail
-          if [ -z "$PREVIOUS_SHA" ]; then
-            echo "::error::Promotion failed and NO previous release was recorded, so the broken release is still live. Restore production manually."
-            exit 1
-          fi
-          if ! git merge-base --is-ancestor "$PREVIOUS_SHA" "$CURRENT_SHA" 2>/dev/null; then
-            # refusing here is the safe branch: redeploying a sha that is not an ancestor of this
-            # head would deploy an unknown tree rather than the release that was actually live.
-            echo "::error::Recorded previous release ${PREVIOUS_SHA} is not an ancestor of ${CURRENT_SHA}; refusing to redeploy an unverified tree. Restore production manually."
-            exit 1
-          fi
-
-          # Capture the forward dispatch contract before checkout removes its code.
-          # A bare predecessor deploy deletes new engine handles held by live routers.
-          rollback_bundle="$(mktemp -d)"
-          trap 'rm -rf "$rollback_bundle"' EXIT
-          if ! python -m flash.serving.app.rollback snapshot \
-            --source-sha "$CURRENT_SHA" --directory "$rollback_bundle"; then
-            echo "::error::Cannot preserve forward engine identities; refusing unsafe rollback."
-            exit 1
-          fi
-          echo "Promotion failed; restoring ${PREVIOUS_SHA}."
-          git checkout --quiet --force "$PREVIOUS_SHA"
-
-          # resolve the entrypoint in the restored tree, including releases before the source move.
-          if [ -f flash/serving/app/modal_app.py ]; then
-            rollback_app=flash/serving/app/modal_app.py
-          elif [ -f flash/serving/modal_app.py ]; then
-            rollback_app=flash/serving/modal_app.py
-          else
-            echo "::error::Previous release has no supported serving entrypoint. Restore production manually."
-            exit 1
-          fi
-
-          # A source ancestor can be incompatible after an irreversible schema cutover.
-          # Probe its own column contract before replacing the schema-compatible app.
-          columns_file=flash/serving/src/store/persisted_columns.py
-          if [ ! -f "$columns_file" ]; then
-            columns_file=flash/serving/src/persisted_columns.py
-          fi
-          if ! columns="$(python -c 'import runpy, sys; print(runpy.run_path(sys.argv[1])["PERSISTED_COLUMNS"])' "$columns_file")" || [ -z "$columns" ]; then
-            echo "::error::Cannot verify the previous release's schema contract; refusing rollback. Restore production manually."
-            exit 1
-          fi
-          if ! schema_status="$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
-            --connect-timeout 5 --max-time 15 \
-            --header "apikey: $SUPABASE_SERVICE_ROLE_KEY" --header "Accept-Profile: flash" \
-            "${SUPABASE_URL%/}/rest/v1/hosted_lora_adapters?select=${columns}&limit=1")" || [ "$schema_status" != "200" ]; then
-            echo "::error::Previous release is not compatible with the current database schema or its schema could not be verified; refusing rollback. Restore production manually."
-            exit 1
-          fi
-
-          # Build a compatibility artifact from the predecessor: retain forward handles,
-          # restore the predecessor's engine implementation, and gate router startup on
-          # active restored pools. Failure occurs before Modal mutates the deployment.
-          if ! python "$rollback_bundle/rollback.py" prepare \
-            --manifest "$rollback_bundle/manifest.json" --entrypoint "$rollback_app"; then
-            echo "::error::Previous release cannot retain active engine handles; refusing unsafe rollback."
-            exit 1
-          fi
-
-          # The source behavior is the predecessor; the distinct attempt identifies
-          # this rollback artifact and its forward-handle compatibility overlay.
-          FREESOLO_DEPLOYMENT_SHA="$PREVIOUS_SHA" \
-          FREESOLO_DEPLOYMENT_ID="$ROLLBACK_DEPLOYMENT_ID" \
-            modal deploy --strategy rolling "$rollback_app"
-
-          response_file="$(mktemp)"
-          trap 'rm -f "$response_file"; rm -rf "$rollback_bundle"' EXIT
-          # Match router startup: its full engine budget plus 60 seconds of headroom.
-          deadline=$((SECONDS + 3660))
-          restored=false
-          while (( SECONDS < deadline )); do
-            if curl --silent --show-error --output "$response_file" --fail \
-              --connect-timeout 5 --max-time 10 "$HEALTH_URL"; then
-              if python3 - "$response_file" "$PREVIOUS_SHA" "$ROLLBACK_DEPLOYMENT_ID" <<'PY'
-          import json
-          import sys
-
-
-          def reject_constant(_value: str) -> None:
-              raise ValueError
-
-
-          try:
-              with open(sys.argv[1], encoding="utf-8") as response:
-                  payload = json.load(response, parse_constant=reject_constant)
-          except (OSError, UnicodeDecodeError, ValueError):
-              sys.exit(1)
-
-          restored = (
-              isinstance(payload, dict)
-              and payload.get("ok") is True
-              and payload.get("deployment_sha") == sys.argv[2]
-              and payload.get("deployment_id") == sys.argv[3]
-          )
-          sys.exit(0 if restored else 1)
-          PY
-              then
-                restored=true
-                break
-              fi
-            fi
-            sleep 10
-          done
-
-          if [ "$restored" != "true" ]; then
-            echo "::error::Rollback to ${PREVIOUS_SHA} was deployed but production never reported the restored release. Production may be serving a broken release; intervene manually."
-            exit 1
-          fi
-          # exit nonzero regardless: a restored predecessor means production is serving again, NOT
-          # that this promotion succeeded. reporting green here would mark an unpromotable commit as
-          # deployed and let the next push build on a release that never passed its gate.
-          echo "::error::Promotion failed; production was restored to ${PREVIOUS_SHA}. This commit is NOT deployed."
-          exit 1
-
       - name: Nothing to deploy
         if: steps.gate.outputs.deploy != 'true'
         run: echo "No serving changes in this push; skipping deploy."

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.26}/.github/workflows/dev-kernel-cache.yml

@@ -95,7 +95,7 @@ jobs:
           set -euo pipefail
           ver=v0.20.2
           sha=c14340087103ba9dadf61d45acd20675490fd0ccbd56ac7901fc1b502137f44b
-          curl -fsSL -o /tmp/crane.tar.gz \
+          curl -fsSL --retry 4 --retry-delay 2 --connect-timeout 15 --max-time 120 -o /tmp/crane.tar.gz \
             "https://github.com/google/go-containerregistry/releases/download/${ver}/go-containerregistry_Linux_x86_64.tar.gz"
           echo "${sha}  /tmp/crane.tar.gz" | sha256sum -c -
           sudo tar -xz -C /usr/local/bin -f /tmp/crane.tar.gz crane
@@ -189,7 +189,7 @@ jobs:
           set -euo pipefail
           ver=v0.20.2
           sha=c14340087103ba9dadf61d45acd20675490fd0ccbd56ac7901fc1b502137f44b
-          curl -fsSL -o /tmp/crane.tar.gz \
+          curl -fsSL --retry 4 --retry-delay 2 --connect-timeout 15 --max-time 120 -o /tmp/crane.tar.gz \
             "https://github.com/google/go-containerregistry/releases/download/${ver}/go-containerregistry_Linux_x86_64.tar.gz"
           echo "${sha}  /tmp/crane.tar.gz" | sha256sum -c -
           sudo tar -xz -C /usr/local/bin -f /tmp/crane.tar.gz crane

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.26}/.github/workflows/production-kernel-cache-ready.yml

@@ -35,7 +35,7 @@ jobs:
           set -euo pipefail
           ver=v0.20.2
           sha=c14340087103ba9dadf61d45acd20675490fd0ccbd56ac7901fc1b502137f44b
-          curl -fsSL -o /tmp/crane.tar.gz \
+          curl -fsSL --retry 4 --retry-delay 2 --connect-timeout 15 --max-time 120 -o /tmp/crane.tar.gz \
             "https://github.com/google/go-containerregistry/releases/download/${ver}/go-containerregistry_Linux_x86_64.tar.gz"
           echo "${sha}  /tmp/crane.tar.gz" | sha256sum -c -
           sudo tar -xz -C /usr/local/bin -f /tmp/crane.tar.gz crane

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.26}/.github/workflows/publish-image.yml

@@ -104,8 +104,11 @@ jobs:
           context: .
           file: ./Dockerfile
           push: true
+          # INSTALL_NEBIUS=true adds the pinned Nebius CLI that the optional Spot provider drives;
+          # it stays inert until an operator mounts a Nebius profile and sets FLASH_NEBIUS_*.
           build-args: |
             INSTALL_INFISICAL=true
+            INSTALL_NEBIUS=true
           tags: ${{ steps.tags.outputs.tags }}
           cache-from: type=gha
           cache-to: type=gha,mode=min

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.26}/Dockerfile

@@ -54,7 +54,7 @@ RUN if [ "${INSTALL_INFISICAL}" = "true" ]; then \
             *) echo "no pinned infisical build for dpkg arch: ${arch}" >&2; exit 1 ;; \
         esac; \
         deb="/tmp/infisical.deb"; \
-        curl -fsSL -o "${deb}" \
+        curl -fsSL --retry 4 --retry-delay 2 --connect-timeout 15 --max-time 120 -o "${deb}" \
             "https://github.com/Infisical/cli/releases/download/v${INFISICAL_VERSION}/infisical_${INFISICAL_VERSION}_linux_${arch}.deb"; \
         # Verify BEFORE dpkg touches it: a mismatch must fail the build, never install.
         echo "${sha}  ${deb}" | sha256sum -c -; \
@@ -65,7 +65,40 @@ RUN if [ "${INSTALL_INFISICAL}" = "true" ]; then \
         infisical --version; \
     fi
 
-# Source changes reuse the operating-system and optional Infisical layers.
+# Optional Nebius CLI, required only by the Nebius Spot provider (`[gpu] spot = true`): Flash
+# drives Nebius through `nebius ... --no-browser` and treats the provider as unconfigured when the
+# binary is absent (flash/providers/nebius/config.py). OFF by default, like Infisical, so a plain
+# `docker build .` stays vendor-free; Freesolo's published images turn it on
+# (.github/workflows/publish-image.yml passes INSTALL_NEBIUS=true). The binary alone grants
+# nothing: the operator still mounts an authenticated service-account profile at /root/.nebius
+# and sets FLASH_NEBIUS_* (see SELF_HOSTING.md).
+#
+# Pinned by version AND sha256 rather than piping the vendor's install.sh into a shell. Nebius
+# publishes the binaries at artifacts.nebius.cloud/cli/release/<version>/linux/<arch>/nebius
+# without a checksums file, so the digests below were taken from those exact release binaries.
+# Bump NEBIUS_CLI_VERSION and both digests together; a mismatch fails the build.
+ARG INSTALL_NEBIUS=false
+ARG NEBIUS_CLI_VERSION=0.12.302
+ARG NEBIUS_CLI_SHA256_AMD64=44315ff3fec500bcf3e7836f738ab456dcdf2b796c79b531ded6ca8f40622f56
+ARG NEBIUS_CLI_SHA256_ARM64=0d4781905d777b3a4fc295158d0f382691e453cc7828c02dca2212cf331712b9
+RUN if [ "${INSTALL_NEBIUS}" = "true" ]; then \
+        set -eu; \
+        case "$(dpkg --print-architecture)" in \
+            amd64) arch="x86_64"; sha="${NEBIUS_CLI_SHA256_AMD64}" ;; \
+            arm64) arch="arm64"; sha="${NEBIUS_CLI_SHA256_ARM64}" ;; \
+            *) echo "no pinned nebius CLI build for this architecture" >&2; exit 1 ;; \
+        esac; \
+        bin="/tmp/nebius"; \
+        curl -fsSL -o "${bin}" \
+            "https://artifacts.nebius.cloud/cli/release/${NEBIUS_CLI_VERSION}/linux/${arch}/nebius"; \
+        # Verify BEFORE installing: a mismatch must fail the build, never install.
+        echo "${sha}  ${bin}" | sha256sum -c -; \
+        install -m 0755 "${bin}" /usr/local/bin/nebius; \
+        rm -f "${bin}"; \
+        test "$(nebius version)" = "${NEBIUS_CLI_VERSION}"; \
+    fi
+
+# Source changes reuse the operating-system and optional Infisical and Nebius layers.
 COPY . .
 RUN pip install --no-cache-dir ".[server]"
 

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: freesolo-flash-dev
-Version: 1.4.24
+Version: 1.4.26
 Summary: Flash — managed LoRA post-training (SFT/GRPO) for Freesolo environments, driven by the `flash` CLI
 Project-URL: Homepage, https://github.com/freesolo-co/flash
 Project-URL: Repository, https://github.com/freesolo-co/flash

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.26}/SELF_HOSTING.md

@@ -40,7 +40,12 @@ checkpoint whose upload was still in progress. Portal is not used.
 On the control-plane host:
 
 1. Install and authenticate the current Nebius CLI with access to the intended
-   USD-billed project, compute resources and billing pricing policies.
+   USD-billed project, compute resources and billing pricing policies. Freesolo's
+   published control-plane images already contain a pinned CLI (`INSTALL_NEBIUS=true`;
+   a plain `docker build .` omits it). Flash calls it non-interactively with
+   `--no-browser`, so give the container a service-account profile, not a browser
+   login: for example, mount a root-only directory holding `config.yaml` and the
+   authorized-key PEM at `/root/.nebius`.
 2. Set `FLASH_NEBIUS_PROJECT_ID`, `FLASH_NEBIUS_REGION`,
    `FLASH_NEBIUS_SUBNET_ID`, and `FLASH_NEBIUS_IMAGE_ID`. The region must match
    the project and subnet. The configured GPU host image must have Docker,

{freesolo_flash_dev-1.4.24 → freesolo_flash_dev-1.4.26}/flash/runner/supervise/retry_decision.py

@@ -294,12 +294,11 @@ def _finish(
 def _spot_preemption_plan(state: RetryState, chosen) -> tuple[RetryState, RetryPlan]:
     if chosen is None or chosen.provider != "spot":
         return state, RetryPlan(False, "not retrying")
-    if state.infra_used >= state.infra_retries:
-        return state, RetryPlan(False, "not retrying: infrastructure retry budget exhausted")
-    ordinal = state.infra_used + 1
-    # Preemption says nothing about memory requirements: keep the same shape eligible.
-    return replace(state, infra_used=ordinal), RetryPlan(
-        True, "retrying Spot allocation (resume from last checkpoint)", ordinal
+    # Spot eviction is expected, including when the running price cap is hit.
+    # Fresh prices gate the replacement worker; cancellation and the run deadline
+    # bound the wait rather than the failure budget. Keep the same shape eligible.
+    return replace(state, cache_retry_shape=None), RetryPlan(
+        True, "requeuing spot capacity (resume from last checkpoint)"
     )
 
 

freesolo_flash_dev-1.4.26/flash/serving/app/inference_provider.py

@@ -0,0 +1,32 @@
+"""Deployment-time provider policy for hosted Qwen; DeepSeek is independent."""
+
+INFERENCE_PROVIDER = "lambda"  # "modal", "lambda", or "all"; redeploy after changing.
+
+
+def validate_provider(provider):
+    if provider not in {"modal", "lambda", "all"}:
+        raise ValueError("INFERENCE_PROVIDER must be modal, lambda, or all")
+    return provider
+
+
+def replica_limit(provider):
+    return 1 if validate_provider(provider) == "all" else 2
+
+
+def modal_gpus_for(model):
+    from flash.serving.src.engine.model_config import base_models
+
+    if model not in base_models():
+        raise ValueError("Provider policy is only defined for hosted Qwen")
+    if model == "Qwen/Qwen3.6-35B-A3B":
+        return ["H200"]
+    if model == "Qwen/Qwen3.5-0.8B":
+        return ["A10G", "A100-80GB"]
+    if model == "Qwen/Qwen3.5-4B":
+        return ["A10G", "L40S", "A100-80GB"]
+    if model in {"Qwen/Qwen3.5-9B", "Qwen/Qwen3.5-9B-Base"}:
+        return ["L40S", "A100-80GB"]
+    return ["A100-80GB"]
+
+
+validate_provider(INFERENCE_PROVIDER)