hypernix 0.72.4__tar.gz → 0.72.4.post3__tar.gz

{hypernix-0.72.4 → hypernix-0.72.4.post3}/.github/workflows/ci.yml

@@ -395,6 +395,107 @@ jobs:
             exit 1
           fi
 
+  # The patcher against a real llama.cpp, which is the only thing that
+  # would have caught what shipped broken: the fake tree in
+  # tests/test_ggml_hnx.py modelled one type_traits table, upstream has
+  # had two for a while, and every test passed while no real checkout
+  # compiled. A fake can only be as right as the person who wrote it.
+  #
+  # Separate job, and only ggml-base + ggml-cpu rather than all of
+  # llama.cpp: those two are where the registration lands, so they are
+  # where a bad patch fails, and stopping there is about two minutes
+  # instead of eight.
+  llamacpp:
+    name: patcher against real llama.cpp
+    needs: triage
+    if: needs.triage.outputs.narrow != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Clone llama.cpp
+        run: git clone --depth 1 https://github.com/ggml-org/llama.cpp /tmp/llama.cpp
+
+      - name: Patch it
+        run: |
+          set -euo pipefail
+          python native/ggml-hnx/tools/patch_llamacpp.py /tmp/llama.cpp --check
+          python native/ggml-hnx/tools/patch_llamacpp.py /tmp/llama.cpp
+
+      - name: Build the parts the registration lands in
+        run: |
+          set -euo pipefail
+          cmake -S /tmp/llama.cpp -B /tmp/llama.cpp/build \
+            -DCMAKE_BUILD_TYPE=Release -DLLAMA_CURL=OFF -DGGML_CCACHE=OFF \
+            -DLLAMA_BUILD_TESTS=OFF -DLLAMA_BUILD_EXAMPLES=OFF \
+            -DLLAMA_BUILD_TOOLS=OFF
+          cmake --build /tmp/llama.cpp/build --target ggml-base ggml-cpu \
+            -j"$(nproc)"
+
+      # Compiling is not the same as registering. This asks the built
+      # ggml what it thinks the five types are, which is what a model
+      # loader will ask.
+      - name: Ask ggml about the types
+        run: |
+          set -euo pipefail
+          cat > /tmp/typecheck.c <<'EOF'
+          #include <stdio.h>
+          #include <string.h>
+          #include "ggml.h"
+          int main(void) {
+              struct { int id; const char *name; size_t size; } want[] = {
+                  {200, "IQ0.9_L", 30}, {201, "IQ0.75_M", 26},
+                  {202, "IQ0.5_XXXL", 18}, {203, "IQ0.25_UXL", 8},
+                  {204, "INT1", 34},
+              };
+              int bad = 0;
+              for (unsigned i = 0; i < sizeof(want)/sizeof(want[0]); ++i) {
+                  enum ggml_type t = (enum ggml_type) want[i].id;
+                  const char *n = ggml_type_name(t);
+                  int ok = n && !strcmp(n, want[i].name)
+                        && ggml_type_size(t) == want[i].size
+                        && ggml_blck_size(t) == 256 && ggml_is_quantized(t);
+                  printf("  %-3d %-12s %s\n", want[i].id, n ? n : "(null)",
+                         ok ? "ok" : "MISMATCH");
+                  if (!ok) bad = 1;
+              }
+              if (strcmp(ggml_type_name(GGML_TYPE_Q4_0), "q4_0") != 0) {
+                  printf("  upstream Q4_0 was disturbed\n");
+                  bad = 1;
+              }
+              return bad;
+          }
+          EOF
+          cc -I/tmp/llama.cpp/ggml/include -o /tmp/typecheck /tmp/typecheck.c \
+            -L/tmp/llama.cpp/build/bin -lggml-base \
+            -Wl,-rpath,/tmp/llama.cpp/build/bin
+          /tmp/typecheck
+
+      # Studio's local engine, against the llama.cpp that is now here.
+      # The stub build is covered by ctest in the `native` job; this is
+      # the other configuration, and it is the one with a real API to
+      # drift against.
+      - name: Studio — compile the local engine against it
+        run: |
+          set -euo pipefail
+          c++ -std=c++17 -Wall -Wextra -Werror -DHNX_STUDIO_LOCAL_LLAMA \
+            -Idesktop/src -I/tmp/llama.cpp/include -I/tmp/llama.cpp/ggml/include \
+            -c desktop/src/LocalEngine.cpp -o /tmp/LocalEngine.o
+
+      - name: And revert cleanly
+        run: |
+          set -euo pipefail
+          python native/ggml-hnx/tools/patch_llamacpp.py /tmp/llama.cpp --revert
+          cd /tmp/llama.cpp
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "::error::--revert did not restore the tree"
+            git status --porcelain
+            exit 1
+          fi
+
   # The CUDA kernels, compiled. Separate from `native` on purpose: the
   # toolkit is ~2 GB and `native` runs on every full pass, so folding it
   # in would add minutes to every run for a file that changes rarely.

{hypernix-0.72.4 → hypernix-0.72.4.post3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hypernix
-Version: 0.72.4
+Version: 0.72.4.post3
 Summary: Download and quantize the HyperNix PyTorch model to GGUF (fp32/fp16/Q8_0/Q6_K/Q4_K_M).
 Home-page: https://github.com/trail-b1az3r/hypernix-pip
 Author: HyperNix contributors
@@ -78,7 +78,7 @@ Dynamic: license-file
 </p>
 
 <p align="center">
-  <img alt="PyPI" src="https://img.shields.io/badge/PyPI-v0.72.3.post8-ff2d55?style=for-the-badge&logo=pypi&logoColor=white" />
+  <img alt="PyPI" src="https://img.shields.io/badge/PyPI-v0.72.4.post1-ff2d55?style=for-the-badge&logo=pypi&logoColor=white" />
   <img alt="Python" src="https://img.shields.io/badge/Python-3.10--3.14-00c9ff?style=for-the-badge&logo=python&logoColor=white" />
   <img alt="License" src="https://img.shields.io/badge/License-HOS%20/%20LLU-00c853?style=for-the-badge" />
 </p>

{hypernix-0.72.4 → hypernix-0.72.4.post3}/README.md

@@ -4,7 +4,7 @@
 </p>
 
 <p align="center">
-  <img alt="PyPI" src="https://img.shields.io/badge/PyPI-v0.72.3.post8-ff2d55?style=for-the-badge&logo=pypi&logoColor=white" />
+  <img alt="PyPI" src="https://img.shields.io/badge/PyPI-v0.72.4.post1-ff2d55?style=for-the-badge&logo=pypi&logoColor=white" />
   <img alt="Python" src="https://img.shields.io/badge/Python-3.10--3.14-00c9ff?style=for-the-badge&logo=python&logoColor=white" />
   <img alt="License" src="https://img.shields.io/badge/License-HOS%20/%20LLU-00c853?style=for-the-badge" />
 </p>

{hypernix-0.72.4 → hypernix-0.72.4.post3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hypernix"
-version = "0.72.4"
+version = "0.72.4.post3"
 description = "Download and quantize the HyperNix PyTorch model to GGUF (fp32/fp16/Q8_0/Q6_K/Q4_K_M)."
 readme = { file = "README.md", content-type = "text/markdown" }
 license = { text = "HOL-1.0" }

{hypernix-0.72.4 → hypernix-0.72.4.post3}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = hypernix
-version = 0.72.4
+version = 0.72.4.post3
 description = Download and quantize the HyperNix PyTorch model to GGUF (fp32/fp16/Q8_0/Q6_K/Q4_K_M).
 long_description = file: README.md
 long_description_content_type = text/markdown

{hypernix-0.72.4 → hypernix-0.72.4.post3}/src/hypernix/__init__.py

@@ -63,7 +63,7 @@ import importlib.util
 import sys
 from typing import TYPE_CHECKING, Any
 
-__version__ = "0.72.4"
+__version__ = "0.72.4.post3"
 DEFAULT_REPO_ID = "ray0rf1re/hyper-Nix.2"
 DEFAULT_MODEL = "qwen3.5-4b"  # New default model
 

{hypernix-0.72.4 → hypernix-0.72.4.post3}/src/hypernix.egg-info/SOURCES.txt

@@ -426,6 +426,7 @@ tests/test_shakers_and_torchcompat.py
 tests/test_snapshot_roundtrip.py
 tests/test_sspkid_and_key_config.py
 tests/test_studio_core.py
+tests/test_studio_local.py
 tests/test_subbit_quantization.py
 tests/test_t1_model_index.py
 tests/test_t1_v1_0_26_8_1_1.py

{hypernix-0.72.4 → hypernix-0.72.4.post3}/tests/test_ggml_hnx.py

@@ -210,16 +210,33 @@ def _fake_llamacpp(root: Path) -> Path:
     Deliberately not a real clone: the point is to test the patcher's
     edits, and a 200 MB download to do that would mean this test only
     ever ran somewhere with a network.
+
+    It has to be shaped like the *current* upstream, though, and the
+    first version of it was not. It modelled one ``type_traits`` table
+    holding every field, which is how ggml looked once and has not
+    looked for a while: upstream split it, leaving the format
+    description (``type_name``, ``blck_size``, ``to_float``) in
+    ``ggml.c`` and moving everything the CPU computes with
+    (``from_float``, ``vec_dot``, ``vec_dot_type``, ``nrows``) into
+    ``ggml_type_traits_cpu`` in ``ggml-cpu/ggml-cpu.c``. A fake with one
+    table let the patcher write ``.vec_dot`` into ``ggml.c`` and every
+    test here pass, while a real build failed with "no member named
+    vec_dot" and "ggml_vec_dot_t undeclared".
+
+    ``GGML_TYPE_COUNT`` is likewise a literal here, because it is one
+    upstream -- not a value that falls out of the enum's length. Adding
+    members before it does not grow it, so the patcher has to rewrite
+    it, and a fake that let it grow on its own would hide that.
     """
     (root / "ggml" / "include").mkdir(parents=True)
-    (root / "ggml" / "src").mkdir(parents=True)
+    (root / "ggml" / "src" / "ggml-cpu").mkdir(parents=True)
     (root / "src").mkdir(parents=True)
 
     (root / "ggml" / "include" / "ggml.h").write_text(
         "enum ggml_type {\n"
         "    GGML_TYPE_F32 = 0,\n"
         "    GGML_TYPE_Q4_0 = 2,\n"
-        "    GGML_TYPE_COUNT = 39,\n"
+        "    GGML_TYPE_COUNT   = 43,\n"
         "};\n",
         encoding="utf-8",
     )
@@ -231,12 +248,32 @@ def _fake_llamacpp(root: Path) -> Path:
         "};\n",
         encoding="utf-8",
     )
+    (root / "ggml" / "src" / "ggml-cpu" / "ggml-cpu.c").write_text(
+        '#include "ggml-impl.h"\n'
+        "\n"
+        "static const struct ggml_type_traits_cpu "
+        "type_traits_cpu[GGML_TYPE_COUNT] = {\n"
+        "    [GGML_TYPE_F32] = { .vec_dot_type = GGML_TYPE_F32 },\n"
+        "};\n",
+        encoding="utf-8",
+    )
     (root / "ggml" / "src" / "CMakeLists.txt").write_text(
         "add_library(ggml\n    ggml.c\n    ggml-alloc.c\n)\n", encoding="utf-8"
     )
     return root
 
 
+def _patcher():
+    """The patcher module, imported from tools/ without installing it."""
+    sys.path.insert(0, str(TOOLS))
+    try:
+        import patch_llamacpp
+
+        return patch_llamacpp
+    finally:
+        sys.path.pop(0)
+
+
 class TestThePatcher:
     def test_check_reports_a_clean_tree_as_ready(self, tmp_path, capsys):
         sys.path.insert(0, str(TOOLS))
@@ -283,6 +320,88 @@ class TestThePatcher:
         after = (root / "ggml" / "src" / "ggml.c").read_text(encoding="utf-8")
         assert after == before
 
+    def test_the_type_count_is_raised_past_the_new_ids(self, tmp_path):
+        """The bug that made a real build fail while every test passed.
+
+        Upstream pins ``GGML_TYPE_COUNT`` to a literal instead of letting
+        it fall out of the enum, and it sizes both trait tables. Insert
+        ids at 200 without raising it and ``[GGML_TYPE_HNX_IQ0_9]`` is
+        initialising element 200 of a 43-element array -- "array index in
+        initializer exceeds array bounds", before the compiler even gets
+        to the interesting error.
+        """
+        patcher = _patcher()
+        root = _fake_llamacpp(tmp_path / "llama.cpp")
+        assert patcher.main([str(root)]) == 0
+
+        header = (root / "ggml" / "include" / "ggml.h").read_text(encoding="utf-8")
+        # The declaring line, not the "was:" comment that records the
+        # old one -- a plain search finds the comment first, which is
+        # how the first version of this test managed to fail on a
+        # correctly patched tree.
+        declarations = [
+            line for line in header.splitlines()
+            if "GGML_TYPE_COUNT" in line and not line.lstrip().startswith("//")
+        ]
+
+        assert len(declarations) == 1, declarations
+        count = re.search(r"GGML_TYPE_COUNT\s*=\s*(\d+)", declarations[0])
+        assert count is not None
+        assert int(count.group(1)) == patcher.HNX_TYPE_COUNT
+        assert int(count.group(1)) > 204, "the highest HyperNix id"
+
+    def test_vec_dot_goes_in_the_cpu_table_not_the_format_one(self, tmp_path):
+        """The other half of the same failure.
+
+        ``ggml_type_traits`` in ggml.c has no ``vec_dot`` member and
+        cannot see ``ggml_vec_dot_t`` at all -- both moved to
+        ``ggml_type_traits_cpu`` in ggml-cpu/ggml-cpu.c. Writing them
+        into the wrong table is not a warning, it is four errors per
+        type.
+        """
+        patcher = _patcher()
+        root = _fake_llamacpp(tmp_path / "llama.cpp")
+        assert patcher.main([str(root)]) == 0
+
+        base = (root / "ggml" / "src" / "ggml.c").read_text(encoding="utf-8")
+        cpu = (root / "ggml" / "src" / "ggml-cpu" / "ggml-cpu.c").read_text(
+            encoding="utf-8")
+
+        assert ".vec_dot" not in base, "vec_dot must not go in ggml.c"
+        assert "ggml_vec_dot_t" not in base
+        assert ".to_float" in base, "but to_float belongs there"
+
+        assert ".vec_dot" in cpu
+        assert ".vec_dot_type" in cpu
+        assert ".to_float" not in cpu, "to_float must not go in the cpu table"
+        for suffix in ("iq0_9", "iq0_75", "iq0_5", "iq0_25", "int1"):
+            assert f"hnx_ggml_vec_dot_{suffix}" in cpu
+            assert f"hnx_ggml_to_float_{suffix}" in base
+
+    def test_both_files_get_the_shim_include(self, tmp_path):
+        """Each table names functions the other file does not declare."""
+        patcher = _patcher()
+        root = _fake_llamacpp(tmp_path / "llama.cpp")
+        assert patcher.main([str(root)]) == 0
+
+        for path in (root / "ggml" / "src" / "ggml.c",
+                     root / "ggml" / "src" / "ggml-cpu" / "ggml-cpu.c"):
+            assert '#include "ggml-hnx-shim.h"' in path.read_text(encoding="utf-8")
+
+    def test_reverting_the_count_restores_upstreams_value(self, tmp_path):
+        """Not a guess at what it used to be: the original line is
+        carried in the marker comment, so a checkout whose count is 43
+        goes back to 43 and one at 51 goes back to 51."""
+        patcher = _patcher()
+        root = _fake_llamacpp(tmp_path / "llama.cpp")
+        header = root / "ggml" / "include" / "ggml.h"
+        before = header.read_text(encoding="utf-8")
+
+        assert patcher.main([str(root)]) == 0
+        assert patcher.main([str(root), "--revert"]) == 0
+
+        assert header.read_text(encoding="utf-8") == before
+
     def test_a_moved_anchor_changes_nothing(self, tmp_path, capsys):
         """The failure mode a .patch file has and this must not: a
         half-applied patch that still compiles. Everything is read and
@@ -348,6 +467,65 @@ class TestThePatcher:
             patch_llamacpp.main([str(tmp_path)])
 
 
+class TestTheBuildScript:
+    """`build.sh` is the thing people actually run.
+
+    It pins a llama.cpp revision, and a pin is a promise that the
+    revision builds. b4585 stopped keeping that promise: its
+    src/llama-mmap.h uses uint32_t without including <cstdint>, which
+    worked only while libstdc++ handed <cstdint> out behind <vector> and
+    <memory>. GCC 15 and 16 stopped, and `./build.sh` on a current
+    toolchain died with "'uint32_t' does not name a type" -- in a file
+    the patcher never touches.
+    """
+
+    SCRIPT = NATIVE / "build.sh"
+
+    def test_the_pin_is_not_the_one_that_stopped_building(self):
+        text = self.SCRIPT.read_text(encoding="utf-8")
+        pin = re.search(r'LLAMA_REF="\$\{LLAMA_REF:-([^}"]+)\}"', text)
+
+        assert pin is not None, "LLAMA_REF is no longer set the way this reads"
+        assert pin.group(1) != "b4585", (
+            "b4585 does not compile on GCC 15+; see the comment above the pin"
+        )
+
+    def test_it_forces_cstdint_ahead_of_every_translation_unit(self):
+        """The durable half. Moving the pin fixes the one file upstream
+        fixed; hundreds more still get their fixed-width integer types
+        from somebody else's header, so the next compiler to tighten its
+        transitive includes breaks a different one. `-include` costs
+        nothing and edits no upstream source.
+        """
+        text = self.SCRIPT.read_text(encoding="utf-8")
+
+        assert "-include cstdint" in text
+        assert "-include stdint.h" in text
+        assert "CMAKE_CXX_FLAGS" in text and "CMAKE_C_FLAGS" in text
+
+    def test_forcing_it_can_be_turned_off(self):
+        """MSVC spells it /FI. A flag no compiler has to accept should
+        not be the thing that stops a build."""
+        text = self.SCRIPT.read_text(encoding="utf-8")
+
+        assert "HNX_FORCE_STDINT" in text
+
+    def test_an_existing_checkout_is_reported_not_silently_reused(self):
+        """How somebody pulls a patcher fix, re-runs this, and rebuilds
+        the same stale tree: the clone step is skipped when the
+        directory is there, and nothing said so."""
+        text = self.SCRIPT.read_text(encoding="utf-8")
+
+        assert "using the checkout already at" in text
+        assert "this script pins" in text
+
+    def test_it_is_still_valid_shell(self):
+        result = subprocess.run(["bash", "-n", str(self.SCRIPT)],
+                                capture_output=True, text=True, check=False)
+
+        assert result.returncode == 0, result.stderr
+
+
 class TestTheCudaKernels:
     """Beta 1 shipped these types CPU-only. These are the GPU kernels.
 

hypernix-0.72.4.post3/tests/test_studio_local.py

@@ -0,0 +1,253 @@
+"""HyperNix Studio running a model on this machine, with no server.
+
+Studio began as a client: chat went over HTTP to a HyperNix server, and
+a laptop with a GGUF sitting on it still needed something running
+somewhere. This covers the other path.
+
+Three things get checked here that the C++ suites cannot check alone:
+
+**The build without llama.cpp is the one most people get**, and it has
+to be honest rather than broken. `local_engine_test` is compiled and run
+in that configuration on every pass.
+
+**The GGUF parser's input is hostile.** A model file is something
+somebody downloaded, and every length in its header is a 64-bit number
+the parser would otherwise be told to allocate. `model_catalogue_test`
+builds headers that lie and checks each one is refused.
+
+**The tool boundary does not move.** A local model gets exactly the
+reach a remote one had -- file operations inside the workspace, each
+approved -- so the source scan for process spawning covers the new files
+too, and the C++ that runs the model must not have acquired a way to run
+anything else.
+"""
+from __future__ import annotations
+
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+DESKTOP = Path(__file__).resolve().parent.parent / "desktop"
+SRC = DESKTOP / "src"
+TESTS = DESKTOP / "tests"
+QML = DESKTOP / "qml"
+
+_POSIX_ONLY = pytest.mark.skipif(
+    sys.platform == "win32",
+    reason="Studio ships on Linux; see tests/test_studio_core.py for why the "
+           "compile-and-run halves are POSIX-only.",
+)
+
+
+def _compiler() -> str | None:
+    for name in ("c++", "g++", "clang++"):
+        found = shutil.which(name)
+        if found:
+            return found
+    return None
+
+
+def _build(name: str, sources: list[str], tmp_path: Path) -> Path:
+    compiler = _compiler()
+    if compiler is None:
+        pytest.skip("no C++ compiler on this machine")
+    out = tmp_path / name
+    result = subprocess.run(
+        [compiler, "-std=c++17", "-O1", "-Wall", "-Wextra", "-Werror",
+         str(TESTS / f"{name}.cpp"),
+         *[str(SRC / s) for s in sources],
+         "-pthread", "-o", str(out)],
+        capture_output=True, text=True, check=False,
+    )
+    if result.returncode != 0:
+        pytest.fail(f"{name} does not compile cleanly:\n{result.stderr}")
+    return out
+
+
+@_POSIX_ONLY
+class TestTheCatalogue:
+    """Reading a GGUF header without loading the model."""
+
+    def test_it_compiles_and_every_check_passes(self, tmp_path):
+        binary = _build("model_catalogue_test", ["ModelCatalogue.cpp"], tmp_path)
+        result = subprocess.run([str(binary)], capture_output=True, text=True,
+                                check=False)
+
+        assert result.returncode == 0, result.stdout + result.stderr
+        assert "0 failures" in result.stdout
+
+    def test_it_needs_neither_qt_nor_llama_cpp(self):
+        """The point of it being separate.
+
+        A person browsing models on a machine with no llama.cpp should
+        still be told what is on the disk, and told that an IQ0.5_XXXL
+        file is an IQ0.5_XXXL file -- the build that cannot run it is
+        exactly the build where a bare "type 202" is least useful.
+        """
+        source = (SRC / "ModelCatalogue.cpp").read_text(encoding="utf-8")
+        header = (SRC / "ModelCatalogue.h").read_text(encoding="utf-8")
+
+        for banned in ("<QtCore", "<QString", "llama.h", "ggml.h", "QObject"):
+            assert banned not in source, f"{banned} in ModelCatalogue.cpp"
+            assert banned not in header, f"{banned} in ModelCatalogue.h"
+
+    def test_it_names_the_hypernix_types_itself(self):
+        """Not by asking ggml, which may not be linked in."""
+        source = (SRC / "ModelCatalogue.cpp").read_text(encoding="utf-8")
+
+        for name in ("IQ0.9_L", "IQ0.75_M", "IQ0.5_XXXL", "IQ0.25_UXL", "INT1"):
+            assert f'"{name}"' in source, name
+
+    def test_every_header_number_is_bounded_before_it_is_used(self):
+        """The property the hostile-header tests exercise, asserted from
+        the other side: the constants that bound it are actually there.
+
+        A parser that reserved on the strength of a length in the file
+        could be made to allocate 16 exabytes by a malformed download.
+        """
+        source = (SRC / "ModelCatalogue.cpp").read_text(encoding="utf-8")
+
+        for limit in ("kMaxHeaderBytes", "kMaxTensors", "kMaxKeys",
+                      "kMaxStringBytes", "kMaxArrayItems"):
+            assert limit in source, limit
+        # And the string read is checked against what is *left* of the
+        # buffer, not only against a constant -- "longer than this file"
+        # and "2^63" are the same mistake.
+        assert "size_ - pos_" in source
+
+
+@_POSIX_ONLY
+class TestTheEngineWithoutLlamaCpp:
+    """The build nearly every machine gets."""
+
+    def test_it_compiles_and_the_stub_is_honest(self, tmp_path):
+        binary = _build("local_engine_test",
+                        ["LocalEngine.cpp", "ModelCatalogue.cpp"], tmp_path)
+        result = subprocess.run([str(binary)], capture_output=True, text=True,
+                                check=False)
+
+        assert result.returncode == 0, result.stdout + result.stderr
+        assert "0 failures" in result.stdout
+        assert "local inference is OFF" in result.stdout
+
+    def test_the_reason_says_what_to_do(self):
+        """"Not available" on its own sends someone to the issue tracker."""
+        source = (SRC / "LocalEngine.cpp").read_text(encoding="utf-8")
+
+        assert "STUDIO_LOCAL_LLAMA" in source
+        assert "LLAMA_ROOT" in source
+
+    def test_local_inference_is_off_by_default(self):
+        """The server path does not need llama.cpp. Making the harder
+        dependency mandatory would stop Studio building for everyone who
+        only wants to connect to a HyperNix box."""
+        cmake = (DESKTOP / "CMakeLists.txt").read_text(encoding="utf-8")
+
+        assert 'option(STUDIO_LOCAL_LLAMA' in cmake
+        block = cmake.split("option(STUDIO_LOCAL_LLAMA", 1)[1][:200]
+        assert "OFF)" in block
+
+
+class TestTheToolBoundaryDidNotMove:
+    """A local model gets no more reach than a remote one had."""
+
+    def test_the_new_files_cannot_run_a_command(self):
+        """test_studio_core.py sweeps src/*.cpp already; this says out
+        loud that the files added for local models are in that sweep,
+        so removing them from it would fail here rather than silently."""
+        forbidden = ("system(", "popen(", "execv", "execl", "execp", "fork(",
+                     "QProcess", "posix_spawn")
+        for name in ("LocalEngine.cpp", "LocalEngine.h", "ModelCatalogue.cpp",
+                     "ModelCatalogue.h", "LocalSession.cpp", "LocalSession.h"):
+            text = (SRC / name).read_text(encoding="utf-8")
+            for token in forbidden:
+                assert token not in text, f"{name} contains {token!r}"
+
+    def test_running_a_model_locally_still_goes_through_the_policy(self):
+        """The approval flow is untouched: onToolCall and runApproved are
+        the only route to a mutating tool, whichever end the model is
+        at. A second path for local models would be a second place to
+        get the boundary wrong."""
+        bridge = (SRC / "StudioBridge.cpp").read_text(encoding="utf-8")
+
+        assert bridge.count("runner_->policy().Decide(") == 1
+        assert "sendToLocal" in bridge
+
+
+class TestTheBridgeRoutes:
+    def test_send_dispatches_on_the_source(self):
+        bridge = (SRC / "StudioBridge.cpp").read_text(encoding="utf-8")
+
+        assert "void StudioBridge::send(" in bridge
+        assert "sendToLocal(text)" in bridge
+        assert "sendToServer(text)" in bridge
+
+    def test_the_engine_runs_off_the_gui_thread(self):
+        """Loading a 7B model takes seconds and generating takes as long
+        as it takes. On the GUI thread the window stops repainting and
+        the desktop offers to kill it."""
+        session = (SRC / "LocalSession.cpp").read_text(encoding="utf-8")
+
+        assert "moveToThread" in session
+        assert "Qt::QueuedConnection" in session
+
+    def test_cancel_is_not_queued(self):
+        """The one call that must not be. The worker thread is *inside*
+        Generate, so a queued cancel would sit in its event queue until
+        the generation it is meant to stop had finished."""
+        session = (SRC / "LocalSession.cpp").read_text(encoding="utf-8")
+        body = session.split("void LocalSession::cancel()", 1)[1][:400]
+
+        assert "QueuedConnection" not in body
+        assert "worker_->cancel()" in body
+
+    def test_the_streaming_index_is_bounds_checked(self):
+        """The conversation can be cleared while a generation is in
+        flight. Writing past the end of the list would be the last thing
+        this process did."""
+        bridge = (SRC / "StudioBridge.cpp").read_text(encoding="utf-8")
+
+        assert "streamingIndex_ >= messages_.size()" in bridge
+        assert "streamingIndex_ = -1;" in bridge
+
+
+class TestTheUiDoesNotAskForAServerItDoesNotNeed:
+    def test_the_composer_gates_on_ready_not_connected(self):
+        """`connected` is false forever in local mode. Gating the input
+        on it left the composer dead with a model loaded and running."""
+        chat = (QML / "ChatView.qml").read_text(encoding="utf-8")
+
+        assert "studio.ready && !studio.busy" in chat
+        assert "enabled: studio.connected && !studio.busy" not in chat
+
+    def test_the_connect_form_is_hidden_in_local_mode(self):
+        sidebar = (QML / "Sidebar.qml").read_text(encoding="utf-8")
+
+        assert 'studio.source !== "local"' in sidebar
+
+    def test_a_generating_model_can_be_stopped(self):
+        """A long answer on a slow machine is a minute of watching, and
+        closing the window should not be the way out."""
+        chat = (QML / "ChatView.qml").read_text(encoding="utf-8")
+
+        assert "studio.stopGenerating()" in chat
+
+    def test_the_models_view_reads_both_shapes(self):
+        """A server model calls it displayName and a local one calls it
+        name. An undefined binding here does not throw -- it leaves the
+        property at its *previous* value, which is how a list showed the
+        last model's name against this model's row."""
+        models = (QML / "ModelsView.qml").read_text(encoding="utf-8")
+
+        assert "modelData.displayName !== undefined" in models
+        assert "studio.localModels" in models
+
+    def test_an_unreadable_model_is_shown_not_hidden(self):
+        """A file that is there and broken is something you want to see."""
+        models = (QML / "ModelsView.qml").read_text(encoding="utf-8")
+
+        assert "modelData.ok === false" in models
+        assert "unreadable" in models