hypernix 0.72.6.post4__tar.gz → 0.72.7__tar.gz

hypernix-0.72.7/.github/workflows/ci.yml

@@ -0,0 +1,786 @@
+name: ci
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # An autofix commit says, in its trailers, exactly which tests its change
+  # can affect. When one is present there is nothing to learn from re-running
+  # the 16-way matrix over a scaled sleep constant, so the matrix is skipped
+  # and `autofix-verify` runs that named set instead. Only autofix-F writes
+  # these trailers: it edits the bodies of the tests it names and nothing
+  # else. autofix-B and autofix-E touch src/, so their commits carry no
+  # trailer and get the full matrix like any other change.
+  triage:
+    name: triage
+    runs-on: ubuntu-latest
+    outputs:
+      narrow: ${{ steps.scope.outputs.narrow }}
+      scope: ${{ steps.scope.outputs.scope }}
+      tests: ${{ steps.scope.outputs.tests }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - id: scope
+        name: Read the Autofix-Scope trailer, if any
+        shell: bash
+        run: |
+          message="$(git log -1 --pretty=%B)"
+          scope="$(printf '%s\n' "$message" | sed -n 's/^Autofix-Scope:[[:space:]]*//p' | tail -1)"
+          tests="$(printf '%s\n' "$message" | sed -n 's/^Autofix-Tests:[[:space:]]*//p' | tail -1)"
+          if [ -n "$scope" ]; then
+            echo "narrow=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::autofix commit for scope '$scope' — verifying only its tests"
+          else
+            echo "narrow=false" >> "$GITHUB_OUTPUT"
+          fi
+          echo "scope=$scope" >> "$GITHUB_OUTPUT"
+          echo "tests=$tests" >> "$GITHUB_OUTPUT"
+
+  lint:
+    name: ruff lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      - run: pip install "ruff>=0.5"
+      - run: ruff check src tests
+
+  # Static types for the modules 0.72.7 adds or reworks ([tool.mypy] in
+  # pyproject.toml), checked against the oldest and the newest Python
+  # hyperNix-pip supports.
+  typecheck:
+    name: mypy (py${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.15"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
+      - run: pip install "mypy>=1.11"
+      - run: mypy --python-version ${{ matrix.python-version }}
+
+  test:
+    name: test (py${{ matrix.python-version }} on ${{ matrix.os }})
+    needs: triage
+    if: needs.triage.outputs.narrow != 'true'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, ubuntu-22.04, macos-latest, windows-latest]
+        # hyperNix-pip requires Python 3.12 or newer and supports 3.12-3.15.
+        python-version: ["3.12", "3.13", "3.14", "3.15"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
+          cache: pip
+
+      # PyTorch publishes no CPython 3.15 wheels yet (torch 2.14.1 stops at
+      # cp314). On 3.15 everything else is installed and the package itself
+      # with --no-deps; the tests that need torch skip and say so. Remove
+      # this branch when torch ships cp315 wheels.
+      - name: Install torch (CPU wheels)
+        if: matrix.python-version != '3.15'
+        run: |
+          python -m pip install --upgrade pip
+          pip install --index-url https://download.pytorch.org/whl/cpu torch
+
+      - name: Install rich (required by tvtop / cli)
+        run: pip install "rich>=13"
+
+      - name: Editable install + dev extras
+        shell: bash
+        run: |
+          if [ "${{ matrix.python-version }}" = "3.15" ]; then
+            python -m pip install --upgrade pip
+            python scripts/ci/requirements_without_torch.py dev security t1api > reqs.txt
+            pip install -r reqs.txt
+            pip install --no-deps -e .
+          else
+            pip install -e ".[dev,security,t1api]"
+          fi
+
+      - name: pytest
+        run: pytest -q
+
+      - name: CLI smoke tests
+        run: |
+          hypernix --help
+          python -m hypernix --help
+          hypernix doctor || true
+
+      # cctvtop is a compiled C-extension (.so) — only available on Linux/macOS
+      - name: CLI smoke test — tvtop (Linux/macOS only)
+        if: runner.os != 'Windows'
+        run: tvtop --help
+
+      - name: New module import checks (v0.70.0)
+        if: matrix.python-version != '3.15'   # these modules import torch
+        run: |
+          python -c "from hypernix.pressure_cooker_v3 import PressureCookerV3, PressureCookerV3Plus, PressureCookerV2Plus; print('pressure_cooker_v3 OK')"
+          python -c "from hypernix.compute_framework import ComputeFramework, ComputeArch; print('compute_framework OK')"
+          python -c "from hypernix.abbicus import Abbicus, AbbicusConfig; print('abbicus OK')"
+          python -c "from hypernix.tv import TVTop, Frame, LogTail, sparkline; print('tv OK')"
+          python -c "from hypernix.tvtop import TVTop, Frame, LogTail, cli_main; print('tvtop OK')"
+          python -c "from hypernix.ethanol import Ethanol, overclock; print('ethanol OK')"
+          python -c "from hypernix.ups import UPS, ThreatStatus; print('ups OK')"
+
+      - name: New module import checks (v0.71.0)
+        run: |
+          python -c "from hypernix.keymaster import Keymaster, T1KeyGenerator, KeyType, KeyScope, KeyMeta; print('keymaster OK')"
+          python -c "from hypernix.gatekeeper import Gatekeeper, Quota, QuotaViolation; print('gatekeeper OK')"
+          python -c "from hypernix.gkey_cli import main; print('gkey_cli OK')"
+          gkey --help
+
+      - name: setup.py compatibility
+        run: |
+          python setup.py --name
+          python setup.py --version
+
+  # The four Python 3.15 features hyperNix-pip uses (PEP 798, 799, 810,
+  # 831), verbosely, on 3.15 itself; the same suite also runs inside every
+  # `test` job, where on 3.12-3.14 it checks the compatibility boundary.
+  python315:
+    name: Python 3.15 features (PEP 798/799/810/831)
+    needs: triage
+    if: needs.triage.outputs.narrow != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.15"
+          allow-prereleases: true
+      - name: Install (no torch wheel for 3.15 yet)
+        run: |
+          python -m pip install --upgrade pip setuptools
+          python scripts/ci/requirements_without_torch.py dev security t1api > reqs.txt
+          pip install -r reqs.txt
+          pip install --no-deps -e .
+      - name: Interpreter facts the suite relies on
+        run: |
+          python -c "import sys, sysconfig; print(sys.version); print(sysconfig.get_config_var('CFLAGS'))"
+      - run: pytest -v tests/python315
+      - name: Native build keeps frame pointers (PEP 831)
+        run: |
+          cmake -S native/ggml-hnx -B build-fp -DCMAKE_BUILD_TYPE=Release
+          cmake --build build-fp -j
+          ctest --test-dir build-fp --output-on-failure
+          objdump -d build-fp/libggml-hnx.a | grep -A3 "<hnx_dequantize_rows>:" | grep -Eq "mov[q]?[[:space:]]+%rsp,[[:space:]]*%rbp"
+
+  # Startup, import, API, serialisation, native and profiling timings on
+  # every supported Python, saved as an artifact. Informational: shared
+  # runners are too noisy to gate on, so compare runs, not single numbers.
+  benchmarks:
+    name: benchmarks (py${{ matrix.python-version }})
+    needs: triage
+    if: needs.triage.outputs.narrow != 'true'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13", "3.14", "3.15"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
+          cache: pip
+      - name: Install
+        shell: bash
+        run: |
+          python -m pip install --upgrade pip
+          if [ "${{ matrix.python-version }}" != "3.15" ]; then
+            pip install --index-url https://download.pytorch.org/whl/cpu torch
+          fi
+          python scripts/ci/requirements_without_torch.py security t1api > reqs.txt
+          pip install -r reqs.txt "httpx"
+          pip install --no-deps -e .
+      - run: python benchmarks/bench.py --repeat 7 --json bench-${{ matrix.python-version }}.json
+      - uses: actions/upload-artifact@v4
+        with:
+          name: bench-${{ matrix.python-version }}
+          path: bench-${{ matrix.python-version }}.json
+
+  # ---------------------------------------------------------------------
+  # Live integration: a real server, a real key, a fake model.
+  # ---------------------------------------------------------------------
+  #
+  # Two jobs run after the tests pass, each minting its own T2 key and
+  # tearing it down afterwards. One drives the API; the other drives the
+  # iPhone app.
+  #
+  # A note on the shape, because it is not the obvious one. Hosted runners
+  # cannot reach each other over the network, so "job A hosts the server,
+  # job B connects to it" is not expressible here — there is no route
+  # between two runners. Each job therefore brings up the server it needs
+  # on its own runner. The split that matters is preserved: one job proves
+  # the API works against a client that authenticates from outside the
+  # process, the other proves the app works against a real server, and the
+  # release waits on both.
+  #
+  # The model is a stub speaking the OpenAI shape rather than a mock
+  # patched into the bridge, so the bridge, the routing engine and the
+  # serialisation are all the real ones. A mock would prove the mock works.
+
+  integration-api:
+    name: integration — live API + fake model
+    needs: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      # Both halves must agree on where the keys live. The server reads
+      # T1_KEYMASTER_DIR and so does gkey; leaving either to infer it from
+      # $HOME is how a key gets minted into a store the server is not
+      # reading, which looks exactly like a rejected key.
+      T1_KEYMASTER_DIR: ${{ github.workspace }}/.ci-keys
+      T1_DB_PATH: ${{ github.workspace }}/.ci-t1.sqlite3
+      T1_HYPERLINK_ENABLED: "1"
+      T1_LMSTUDIO_ENABLED: "1"
+      T1_LMSTUDIO_URL: http://127.0.0.1:1234
+      T1_ENVIRONMENT: development
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install with the server extra
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e '.[t1api]'
+
+      - name: Start the fake model
+        run: |
+          nohup python scripts/ci/fake_model_server.py --port 1234 \
+            > fake-model.log 2>&1 &
+          python scripts/ci/wait_for_http.py http://127.0.0.1:1234/v1/models \
+            --timeout 60 --name "the fake model" --log fake-model.log
+
+      - name: Start the T1 API
+        run: |
+          export T1_TOKEN_SECRET="$(python -c 'import secrets;print(secrets.token_hex(32))')"
+          echo "T1_TOKEN_SECRET=$T1_TOKEN_SECRET" >> "$GITHUB_ENV"
+          nohup python -m uvicorn hypernix.t1api.app:create_app --factory \
+            --host 127.0.0.1 --port 8000 > t1api.log 2>&1 &
+          python scripts/ci/wait_for_http.py http://127.0.0.1:8000/health \
+            --timeout 90 --name "the T1 API" --log t1api.log
+
+      - name: Mint a key, authorise it, and chat through the fake model
+        run: python scripts/ci/integration_probe.py --url http://127.0.0.1:8000
+
+      - name: Shut it down and prove no keys are left behind
+        if: always()
+        run: |
+          pkill -f 'uvicorn hypernix.t1api' || true
+          pkill -f fake_model_server || true
+          remaining="$(ls -1 "$T1_KEYMASTER_DIR"/*.json 2>/dev/null | wc -l | tr -d ' ')"
+          echo "keys still in the store: $remaining"
+          # The bootstrap key is expected — it is loopback-only and expires
+          # in three days. Anything the probe minted must be gone.
+          if [ "$remaining" -gt 1 ]; then
+            echo "::error::the probe left ${remaining} keys behind"
+            ls -la "$T1_KEYMASTER_DIR" || true
+            exit 1
+          fi
+          rm -rf "$T1_KEYMASTER_DIR" "$T1_DB_PATH"
+
+      - name: Server logs (on failure)
+        if: failure()
+        run: |
+          echo '--- t1api ---'; tail -n 100 t1api.log || true
+          echo '--- fake model ---'; tail -n 40 fake-model.log || true
+
+  integration-ios:
+    name: integration — iPhone simulator + live API
+    needs: test
+    runs-on: macos-latest
+    timeout-minutes: 40
+    env:
+      T1_KEYMASTER_DIR: ${{ github.workspace }}/.ci-keys
+      T1_DB_PATH: ${{ github.workspace }}/.ci-t1.sqlite3
+      T1_HYPERLINK_ENABLED: "1"
+      T1_LMSTUDIO_ENABLED: "1"
+      T1_LMSTUDIO_URL: http://127.0.0.1:1234
+      T1_ENVIRONMENT: development
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install with the server extra
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e '.[t1api]'
+
+      - name: Start the fake model and the T1 API
+        run: |
+          nohup python scripts/ci/fake_model_server.py --port 1234 > fake-model.log 2>&1 &
+          export T1_TOKEN_SECRET="$(python -c 'import secrets;print(secrets.token_hex(32))')"
+          echo "T1_TOKEN_SECRET=$T1_TOKEN_SECRET" >> "$GITHUB_ENV"
+          nohup python -m uvicorn hypernix.t1api.app:create_app --factory \
+            --host 127.0.0.1 --port 8000 > t1api.log 2>&1 &
+          # Both, not just the API. This job used to wait only for port
+          # 8000, and a macOS runner is slow enough starting a Python
+          # process that the probe reached the bridge before the fake
+          # model was listening — which fails as MODEL_UNAVAILABLE and
+          # reads as a broken bridge rather than a race.
+          python scripts/ci/wait_for_http.py http://127.0.0.1:1234/v1/models \
+            --timeout 90 --name "the fake model" --log fake-model.log
+          python scripts/ci/wait_for_http.py http://127.0.0.1:8000/health \
+            --timeout 90 --name "the T1 API" --log t1api.log
+
+      - name: Mint this job's own key and check the API from outside
+        run: python scripts/ci/integration_probe.py --url http://127.0.0.1:8000
+
+      - name: Generate the Xcode project
+        run: |
+          brew install xcodegen
+          cd ios && xcodegen generate
+
+      - name: Boot an iPhone simulator
+        id: sim
+        run: |
+          device="$(python3 ios/scripts/pick_simulator.py)"
+          echo "device=$device" >> "$GITHUB_OUTPUT"
+          echo "picked: $device"
+          xcrun simctl boot "$device" || true
+          xcrun simctl bootstatus "$device" -b || true
+
+      - name: Build and test the app on the simulator
+        run: |
+          cd ios
+          xcodebuild test \
+            -project HyperLink.xcodeproj \
+            -scheme HyperLink \
+            -destination "id=${{ steps.sim.outputs.device }}" \
+            CODE_SIGNING_ALLOWED=NO \
+            | xcpretty || xcodebuild test \
+            -project HyperLink.xcodeproj \
+            -scheme HyperLink \
+            -destination "id=${{ steps.sim.outputs.device }}" \
+            CODE_SIGNING_ALLOWED=NO
+
+      - name: Shut it all down and delete the keys
+        if: always()
+        run: |
+          xcrun simctl shutdown all || true
+          pkill -f 'uvicorn hypernix.t1api' || true
+          pkill -f fake_model_server || true
+          remaining="$(ls -1 "$T1_KEYMASTER_DIR"/*.json 2>/dev/null | wc -l | tr -d ' ')"
+          echo "keys still in the store: $remaining"
+          if [ "$remaining" -gt 1 ]; then
+            echo "::error::the probe left ${remaining} keys behind"
+            exit 1
+          fi
+          rm -rf "$T1_KEYMASTER_DIR" "$T1_DB_PATH"
+
+      - name: Logs (on failure)
+        if: failure()
+        run: |
+          echo '--- t1api ---'; tail -n 100 t1api.log || true
+          echo '--- fake model ---'; tail -n 40 fake-model.log || true
+
+  # The two C/C++ pieces: the ggml sub-bit decoder and Studio's tool
+  # policy. Both are deliberately free of their heavy dependency -- the
+  # decoder needs no ggml, the policy needs no Qt -- precisely so they
+  # can be built and tested on a plain runner rather than only where a
+  # 200 MB checkout or a Qt install happens to exist.
+  #
+  # The Python suite compiles both too (tests/quant/test_ggml_hnx.py,
+  # tests/desktop/test_studio_core.py). This job runs them through their own
+  # CMake as well, because that is how a developer builds them and a
+  # build file that only works when driven from pytest is a build file
+  # that is about to stop working.
+  native:
+    name: native (ggml-hnx + studio core)
+    needs: triage
+    if: needs.triage.outputs.narrow != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install the package (for the cross-check vectors)
+        run: pip install -e .
+
+      - name: ggml-hnx — build and cross-check against Python
+        run: |
+          set -euo pipefail
+          cmake -S native/ggml-hnx -B build/ggml-hnx -DCMAKE_BUILD_TYPE=Release
+          cmake --build build/ggml-hnx -j"$(nproc)"
+          ctest --test-dir build/ggml-hnx --output-on-failure
+
+      - name: ggml-hnx — the patcher against a checkout it does not own
+        run: |
+          set -euo pipefail
+          # A real llama.cpp clone would be 200 MB for a test of four
+          # string edits; tests/quant/test_ggml_hnx.py builds a tree with the
+          # anchors instead. This step proves the CLI itself runs.
+          python native/ggml-hnx/tools/patch_llamacpp.py --help >/dev/null
+          if python native/ggml-hnx/tools/patch_llamacpp.py . --check; then
+            echo "::error::the patcher accepted a directory that is not llama.cpp"
+            exit 1
+          fi
+
+      - name: Studio core — build and test, with no Qt installed
+        run: |
+          set -euo pipefail
+          cmake -S desktop -B build/studio -DSTUDIO_CORE_ONLY=ON \
+            -DCMAKE_BUILD_TYPE=Release
+          cmake --build build/studio -j"$(nproc)"
+          ctest --test-dir build/studio --output-on-failure
+
+      # Qt as a separate step, after the core. The core is the part that
+      # must build anywhere; this is the part that needs 300 MB of Qt,
+      # and keeping them apart means a Qt packaging change cannot mask a
+      # failure in the security-critical half.
+      - name: Install Qt 6
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends \
+            qt6-base-dev qt6-declarative-dev \
+            qml6-module-qtquick-controls qml6-module-qtquick-layouts \
+            qml6-module-qtquick-templates qml6-module-qtquick-dialogs \
+            qml6-module-qtquick-window qml6-module-qtqml-workerscript
+
+      - name: Studio — compile the Qt application
+        run: |
+          set -euo pipefail
+          cmake -S desktop -B build/studio-qt -DCMAKE_BUILD_TYPE=Release
+          cmake --build build/studio-qt -j"$(nproc)"
+
+      # The compiler does not check QML. Running the binary offscreen
+      # instantiates every .qml file the engine reaches, which is the only
+      # way a typo in a binding is found before somebody launches it --
+      # and it is how five "Unable to assign [undefined] to QString"
+      # warnings in the approval dialog were found, each of which left a
+      # property showing the *previous* request's value.
+      - name: Studio — load every QML file
+        run: |
+          set -euo pipefail
+          output="$(QT_QPA_PLATFORM=offscreen timeout 20 \
+            ./build/studio-qt/hypernix-studio 2>&1 || true)"
+          echo "$output"
+          if echo "$output" | grep -qE "Unable to assign|is not a type|failed to load component|^(qrc|file):.*error"; then
+            echo "::error::QML errors on startup"
+            exit 1
+          fi
+
+  # The patcher against a real llama.cpp, which is the only thing that
+  # would have caught what shipped broken: the fake tree in
+  # tests/quant/test_ggml_hnx.py modelled one type_traits table, upstream has
+  # had two for a while, and every test passed while no real checkout
+  # compiled. A fake can only be as right as the person who wrote it.
+  #
+  # Separate job, and only ggml-base + ggml-cpu rather than all of
+  # llama.cpp: those two are where the registration lands, so they are
+  # where a bad patch fails, and stopping there is about two minutes
+  # instead of eight.
+  llamacpp:
+    name: patcher against real llama.cpp
+    needs: triage
+    if: needs.triage.outputs.narrow != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Clone llama.cpp
+        run: git clone --depth 1 https://github.com/ggml-org/llama.cpp /tmp/llama.cpp
+
+      - name: Patch it
+        run: |
+          set -euo pipefail
+          python native/ggml-hnx/tools/patch_llamacpp.py /tmp/llama.cpp --check
+          python native/ggml-hnx/tools/patch_llamacpp.py /tmp/llama.cpp
+
+      - name: Build the parts the registration lands in
+        run: |
+          set -euo pipefail
+          cmake -S /tmp/llama.cpp -B /tmp/llama.cpp/build \
+            -DCMAKE_BUILD_TYPE=Release -DLLAMA_CURL=OFF -DGGML_CCACHE=OFF \
+            -DLLAMA_BUILD_TESTS=OFF -DLLAMA_BUILD_EXAMPLES=OFF \
+            -DLLAMA_BUILD_TOOLS=OFF
+          cmake --build /tmp/llama.cpp/build --target ggml-base ggml-cpu \
+            -j"$(nproc)"
+
+      # Compiling is not the same as registering. This asks the built
+      # ggml what it thinks the five types are, which is what a model
+      # loader will ask.
+      - name: Ask ggml about the types
+        run: |
+          set -euo pipefail
+          cat > /tmp/typecheck.c <<'EOF'
+          #include <stdio.h>
+          #include <string.h>
+          #include "ggml.h"
+          int main(void) {
+              struct { int id; const char *name; size_t size; } want[] = {
+                  {200, "IQ0.9_L", 30}, {201, "IQ0.75_M", 26},
+                  {202, "IQ0.5_XXXL", 18}, {203, "IQ0.25_UXL", 8},
+                  {204, "INT1", 34},
+              };
+              int bad = 0;
+              for (unsigned i = 0; i < sizeof(want)/sizeof(want[0]); ++i) {
+                  enum ggml_type t = (enum ggml_type) want[i].id;
+                  const char *n = ggml_type_name(t);
+                  int ok = n && !strcmp(n, want[i].name)
+                        && ggml_type_size(t) == want[i].size
+                        && ggml_blck_size(t) == 256 && ggml_is_quantized(t);
+                  printf("  %-3d %-12s %s\n", want[i].id, n ? n : "(null)",
+                         ok ? "ok" : "MISMATCH");
+                  if (!ok) bad = 1;
+              }
+              if (strcmp(ggml_type_name(GGML_TYPE_Q4_0), "q4_0") != 0) {
+                  printf("  upstream Q4_0 was disturbed\n");
+                  bad = 1;
+              }
+              return bad;
+          }
+          EOF
+          cc -I/tmp/llama.cpp/ggml/include -o /tmp/typecheck /tmp/typecheck.c \
+            -L/tmp/llama.cpp/build/bin -lggml-base \
+            -Wl,-rpath,/tmp/llama.cpp/build/bin
+          /tmp/typecheck
+
+      # Studio's local engine, against the llama.cpp that is now here.
+      # The stub build is covered by ctest in the `native` job; this is
+      # the other configuration, and it is the one with a real API to
+      # drift against.
+      - name: Studio — compile the local engine against it
+        run: |
+          set -euo pipefail
+          c++ -std=c++17 -Wall -Wextra -Werror -DHNX_STUDIO_LOCAL_LLAMA \
+            -Idesktop/src -I/tmp/llama.cpp/include -I/tmp/llama.cpp/ggml/include \
+            -c desktop/src/LocalEngine.cpp -o /tmp/LocalEngine.o
+
+      - name: And revert cleanly
+        run: |
+          set -euo pipefail
+          python native/ggml-hnx/tools/patch_llamacpp.py /tmp/llama.cpp --revert
+          cd /tmp/llama.cpp
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "::error::--revert did not restore the tree"
+            git status --porcelain
+            exit 1
+          fi
+
+  # The CUDA kernels, compiled. Separate from `native` on purpose: the
+  # toolkit is ~2 GB and `native` runs on every full pass, so folding it
+  # in would add minutes to every run for a file that changes rarely.
+  #
+  # The checks that catch the failure that *matters* -- a template
+  # constant drifting from hypernix.quant.gguf, which produces a model
+  # that runs on the GPU and talks nonsense -- are source-level and run
+  # in `native` without any toolkit. This job proves the thing compiles
+  # and that the templates instantiate with the constants the launchers
+  # pass, which only nvcc can say.
+  cuda:
+    name: cuda kernels
+    needs: triage
+    if: needs.triage.outputs.narrow != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install nvcc
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends nvidia-cuda-toolkit
+          nvcc --version
+
+      - name: Install the package (for the block-size registry)
+        run: pip install -e . && pip install pytest
+
+      - name: Build with the CUDA kernels
+        run: |
+          set -euo pipefail
+          # sm_61 only: Pascal is this project's floor and building every
+          # architecture would triple the time for no extra coverage of
+          # the thing being tested.
+          cmake -S native/ggml-hnx -B build/cuda \
+            -DGGML_HNX_CUDA=ON -DCMAKE_BUILD_TYPE=Release \
+            -DCMAKE_CUDA_ARCHITECTURES=61
+          cmake --build build/cuda -j"$(nproc)"
+          ctest --test-dir build/cuda --output-on-failure
+
+      - name: The kernels instantiate with the CPU's constants
+        run: python -m pytest tests/quant/test_ggml_hnx.py -q -k Cuda
+
+  build-check:
+    name: build sdist + wheel (smoke)
+    needs: triage
+    if: needs.triage.outputs.narrow != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      - run: pip install --upgrade pip build twine
+      - run: python -m build
+      - run: twine check --strict dist/*
+      - name: Verify extras are present in sdist
+        run: |
+          tar tzf dist/*.tar.gz | tee /tmp/sdist-listing
+          for required in tests examples scripts .github/workflows MANIFEST.in setup.py setup.cfg; do
+            if ! grep -q "/$required" /tmp/sdist-listing; then
+              echo "::error::sdist missing $required"
+              exit 1
+            fi
+          done
+      - name: Verify the OpenTUI apps ship without node_modules
+        run: |
+          for archive in dist/*.tar.gz dist/*.whl; do
+            case "$archive" in
+              *.whl) python -m zipfile -l "$archive" > /tmp/listing ;;
+              *) tar tzf "$archive" > /tmp/listing ;;
+            esac
+            for app in hyped_pro_app tvtop_max_app; do
+              if ! grep -q "$app/src/index.ts" /tmp/listing; then
+                echo "::error::$archive is missing $app"
+                exit 1
+              fi
+              if grep -q "$app/node_modules" /tmp/listing; then
+                echo "::error::$archive ships $app/node_modules"
+                exit 1
+              fi
+            done
+          done
+
+  # hyped-pro is a TypeScript app on OpenTUI, which runs on Bun. Its own
+  # tests and the type check run here; tests/interfaces/test_hyped_pro_otui.py covers
+  # the Python launcher and the packaging in `test`, on every platform.
+  hyped-pro:
+    name: hyped-pro (bun test + tsc)
+    needs: triage
+    if: needs.triage.outputs.narrow != 'true'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: src/hypernix/interfaces/hyped_pro_app
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.11"
+      - run: bun install --frozen-lockfile
+      - run: bun x tsc --noEmit
+      - run: bun test
+
+  # tvtop-max is the same kind of app; tests/monitoring/test_tvtop_max.py covers its
+  # launcher, bridge and the script reading behind it.
+  tvtop-max:
+    name: tvtop-max (bun test + tsc)
+    needs: triage
+    if: needs.triage.outputs.narrow != 'true'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: src/hypernix/monitoring/tvtop_max_app
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.11"
+      - run: bun install --frozen-lockfile
+      - run: bun x tsc --noEmit
+      - run: bun test
+
+  # The narrow counterpart to `test`: one interpreter, one OS, and only the
+  # tests the autofix commit named. `scripts/autofix_scope.py --list` is the
+  # same discovery autofix-F used to pick them, so the fallback below selects
+  # the identical set if the Autofix-Tests trailer is ever absent.
+  autofix-verify:
+    name: verify autofix (${{ needs.triage.outputs.scope }})
+    needs: triage
+    if: needs.triage.outputs.narrow == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install torch (CPU wheels)
+        run: |
+          python -m pip install --upgrade pip
+          pip install --index-url https://download.pytorch.org/whl/cpu torch
+
+      - name: Install rich (required by tvtop / cli)
+        run: pip install "rich>=13"
+
+      - name: Editable install + dev extras
+        run: pip install -e ".[dev,security]"
+
+      # The trailers come from a commit message, which on a pull request is
+      # attacker-controlled. They are passed through the environment rather
+      # than interpolated into the script, and every node id is checked
+      # against the category's own discovery before pytest sees it, so a
+      # crafted trailer can neither run a shell command nor widen the run.
+      - name: Run only the tests this autofix commit affects
+        shell: bash
+        env:
+          AUTOFIX_SCOPE: ${{ needs.triage.outputs.scope }}
+          AUTOFIX_TESTS: ${{ needs.triage.outputs.tests }}
+        run: |
+          set -euo pipefail
+          if [ -n "$AUTOFIX_TESTS" ]; then
+            python scripts/autofix_scope.py --category "$AUTOFIX_SCOPE" \
+              --validate "$AUTOFIX_TESTS" > selected-tests.txt
+          else
+            echo "No Autofix-Tests trailer; falling back to the whole scope."
+            python scripts/autofix_scope.py --category "$AUTOFIX_SCOPE" \
+              --list > selected-tests.txt
+          fi
+          if [ ! -s selected-tests.txt ]; then
+            echo "::error::nothing to verify for scope '$AUTOFIX_SCOPE'"
+            exit 1
+          fi
+          echo "Verifying $(wc -l < selected-tests.txt) test(s):"
+          cat selected-tests.txt
+          xargs -a selected-tests.txt -d '\n' pytest -q --
+
+      - name: Confirm the scope table still matches the tree
+        run: pytest -q tests/repo/test_module_layout.py tests/repo/test_autofix_scripts.py