inductive-mlxrl 0.2.2__tar.gz → 0.2.4__tar.gz

inductive_mlxrl-0.2.4/.github/scripts/audit_dependencies.py

@@ -0,0 +1,52 @@
+"""Audit every registry version in uv.lock, including other-platform dependencies."""
+
+from __future__ import annotations
+
+import subprocess
+import tempfile
+import tomllib
+from pathlib import Path
+
+
+def main() -> None:
+    lock = tomllib.loads(Path("uv.lock").read_text())
+    groups: list[dict[str, str]] = []
+    for package in lock["package"]:
+        if package["source"] == {"editable": "."}:
+            continue
+        if package["source"].get("registry") != "https://pypi.org/simple":
+            raise ValueError(f"Unrecognized dependency source for {package['name']}.")
+        hashes = {wheel["hash"] for wheel in package.get("wheels", [])}
+        if "sdist" in package:
+            hashes.add(package["sdist"]["hash"])
+        if not hashes:
+            raise ValueError(f"Missing locked hashes for {package['name']}.")
+        requirement = f"{package['name']}=={package['version']} " + " ".join(
+            f"--hash={digest}" for digest in sorted(hashes)
+        )
+        # pip-audit rejects duplicate names even when versions target other Pythons.
+        for group in groups:
+            if package["name"] not in group:
+                group[package["name"]] = requirement
+                break
+        else:
+            groups.append({package["name"]: requirement})
+    with tempfile.TemporaryDirectory(prefix="mlxrl-dependency-audit-") as directory:
+        for index, group in enumerate(groups):
+            requirements = Path(directory) / f"requirements-{index}.txt"
+            requirements.write_text("\n".join(group.values()) + "\n")
+            subprocess.run(
+                [
+                    "pip-audit",
+                    "--strict",
+                    "--disable-pip",
+                    "--require-hashes",
+                    "-r",
+                    str(requirements),
+                ],
+                check=True,
+            )
+
+
+if __name__ == "__main__":
+    main()

inductive_mlxrl-0.2.4/.github/scripts/verify_release.py

@@ -0,0 +1,78 @@
+"""Require versioned tags to identify a main commit with successful push CI."""
+
+from __future__ import annotations
+
+import ast
+import json
+import os
+import re
+import subprocess
+import tomllib
+import urllib.parse
+import urllib.request
+from pathlib import Path
+
+
+def verify_release(ref: str, sha: str, version: str, repository: str, token: str) -> None:
+    if not ref.startswith("refs/tags/"):
+        return
+    if not re.fullmatch(r"refs/tags/v[0-9]+\.[0-9]+\.[0-9]+", ref):
+        raise ValueError("Release tags must use vX.Y.Z.")
+    if ref != f"refs/tags/v{version}":
+        raise ValueError("Release tag must match the package version.")
+    if not re.fullmatch(r"[0-9a-f]{40}", sha):
+        raise ValueError("Release commit must be a full SHA.")
+    tagged = subprocess.check_output(["git", "rev-parse", f"{ref}^{{commit}}"], text=True).strip()
+    if tagged != sha:
+        raise ValueError("Release tag and workflow commit differ.")
+    if subprocess.run(["git", "merge-base", "--is-ancestor", sha, "origin/main"]).returncode:
+        raise ValueError("Release commit must already be on origin/main.")
+    query = urllib.parse.urlencode(
+        {"head_sha": sha, "branch": "main", "event": "push", "status": "success"}
+    )
+    request = urllib.request.Request(
+        f"https://api.github.com/repos/{repository}/actions/workflows/ci.yml/runs?{query}",
+        headers={
+            "Authorization": f"Bearer {token}",
+            "Accept": "application/vnd.github+json",
+            "X-GitHub-Api-Version": "2022-11-28",
+        },
+    )
+    with urllib.request.urlopen(request, timeout=30) as response:
+        runs = json.load(response)["workflow_runs"]
+    if not any(
+        run["head_sha"] == sha
+        and run["head_branch"] == "main"
+        and run["event"] == "push"
+        and run["status"] == "completed"
+        and run["conclusion"] == "success"
+        and run["path"] == ".github/workflows/ci.yml"
+        for run in runs
+    ):
+        raise ValueError("Release commit needs successful push CI on main.")
+
+
+def main() -> None:
+    version = tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"]
+    module = ast.parse(Path("mlxrl/__init__.py").read_text())
+    package_version = next(
+        ast.literal_eval(node.value)
+        for node in module.body
+        if isinstance(node, ast.Assign)
+        and any(
+            isinstance(target, ast.Name) and target.id == "__version__" for target in node.targets
+        )
+    )
+    if package_version != version:
+        raise ValueError("Package and distribution versions must match.")
+    verify_release(
+        os.environ["GITHUB_REF"],
+        os.environ["GITHUB_SHA"],
+        version,
+        os.environ["GITHUB_REPOSITORY"],
+        os.environ.get("GH_TOKEN", ""),
+    )
+
+
+if __name__ == "__main__":
+    main()

{inductive_mlxrl-0.2.2 → inductive_mlxrl-0.2.4}/CHANGELOG.md

@@ -5,6 +5,46 @@ All notable changes to this project are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project uses semantic versioning once releases are cut.
 
+## [0.2.4] - 2026-10-22
+
+### Security
+
+- Require MLX-LM 0.32.0 or later with its MLX 0.32.2 minimum, and disable custom
+  model and tokenizer Python execution in library, example, and benchmark loaders. The older minimum
+  allowed the unsafe `model_file` behavior addressed by upstream's
+  [CVE-2026-5843 fix](https://github.com/ml-explore/mlx-lm/pull/1385).
+- Parse answer and action tags in linear time to prevent malformed model
+  output from stalling reward evaluation and multi-turn rollouts.
+- Reject CLI output paths whose symlinks resolve outside the working directory.
+- Pin release actions to verified commits, freeze build and validation tools,
+  audit all locked dependencies in CI, and require release tags to match a
+  package version on main with successful push CI.
+- Add security reporting guidance, ownership of release controls, and weekly
+  dependency and action updates.
+
+## [0.2.3] - 2026-10-21
+
+### Changed
+
+- Project only completion positions through the output head for stock Qwen2,
+  Qwen3, and Llama models, reducing training logit memory while preserving
+  logprobs and gradients. Custom subclasses and wrappers retain the full
+  forward path. Thanks to @TarangKhanna for PR #6.
+- Refresh runtime, development, and benchmark dependencies while preserving
+  the seven-day package-age cutoff in the lockfile.
+- Include the Pillow, aiohttp, AnyIO, and urllib3 updates from Dependabot
+  PRs #1 through #4.
+
+### Fixed
+
+- Support MLX-LM 0.32 prompt-cache cloning while retaining older cache support.
+  Thanks to @TarangKhanna for PR #5.
+- Use valid prefix lengths when building compiled decode caches from MLX-LM
+  0.32 cache buffers, and restore random state through MLX 0.32's mutable key.
+- Keep scalar metric conversions compatible with the current MLX type stubs.
+- Override the benchmark-only mlx-tune dependency's old datasets constraint
+  to use patched datasets 5.x (CVE-2026-66007).
+
 ## [0.2.2] - 2026-06-25
 
 ### Added

{inductive_mlxrl-0.2.2 → inductive_mlxrl-0.2.4}/CONTRIBUTING.md

@@ -72,6 +72,15 @@ runtime dependencies marked for macOS arm64 and Python `<3.15` so universal
 resolvers do not try to solve MLX wheels for unsupported platform or Python
 splits.
 
+The development environment overrides mlx-tune 0.6's `datasets<4` constraint
+with `datasets>=5.0.1,<6` to avoid CVE-2026-66007. This only affects the external
+benchmark tools; the published package depends on MLX and MLX-LM. Remove the
+override when mlx-tune accepts a patched datasets release.
+
+Certifi and Pillow use a one-day package-age cutoff so their October 2026
+security patches can be installed promptly. Other dependencies retain the
+configured default cutoff.
+
 ## Release Cycle
 
 Releases are tag-driven and publish to PyPI through Trusted Publishing. Do not
@@ -85,21 +94,34 @@ One-time PyPI setup:
 - set environment name to `pypi`;
 - require manual approval on the GitHub `pypi` environment before publishing.
 
+Restrict the environment to tags matching `v*`, disable administrator bypass
+for environment approval, and protect release-tag creation, updates, and
+deletion so only repository administrators can perform them. Require the
+`Linux CPU-safe checks` status on main and retain pull-request review.
+
+The publisher runs the official PyPA container by digest. When updating it,
+resolve the upstream release's commit-tagged image from
+`ghcr.io/pypa/gh-action-pypi-publish`, verify its content digest and source
+metadata, and update the digest and source-commit comment together. Other
+actions use commit pins maintained by Dependabot.
+
 For each release:
 
-1. Update the version in `pyproject.toml`.
+1. Update the version in `pyproject.toml` and `mlxrl/__init__.py`, then run `uv lock`.
 2. Add the release notes to `CHANGELOG.md`.
 3. Run the local gates:
 
 ```bash
-UV_CACHE_DIR=.uv-cache uv run pytest
-UV_CACHE_DIR=.uv-cache uv run ruff check .
-UV_CACHE_DIR=.uv-cache uv run pyright
-UV_CACHE_DIR=.uv-cache uv build
-UV_CACHE_DIR=.uv-cache uv run --no-project --python 3.11 --with twine twine check dist/*
+UV_CACHE_DIR=.uv-cache uv sync --frozen --all-groups
+UV_CACHE_DIR=.uv-cache uv run --no-sync pytest
+UV_CACHE_DIR=.uv-cache uv run --no-sync ruff check .
+UV_CACHE_DIR=.uv-cache uv run --no-sync pyright
+UV_CACHE_DIR=.uv-cache uv run --no-sync python .github/scripts/audit_dependencies.py
+UV_CACHE_DIR=.uv-cache uv build --no-build-isolation --python .venv/bin/python
+UV_CACHE_DIR=.uv-cache uv run --no-sync twine check dist/*
 ```
 
-4. Commit and merge the release prep.
+4. Commit and merge the release prep, then wait for main's push CI to pass.
 5. Tag the release from `main`:
 
 ```bash
@@ -107,12 +129,13 @@ git tag -a vX.Y.Z -m "Release vX.Y.Z"
 git push origin vX.Y.Z
 ```
 
-The `Release` workflow builds the source distribution and wheel, checks package
-metadata with Twine, stores the artifacts, publishes them to PyPI from the
-`pypi` environment, and creates a GitHub Release with the built distributions
-attached. Running the workflow manually builds and checks artifacts without
-publishing because the publish and GitHub Release jobs only run for `v*.*.*`
-tags.
+The `Release` workflow first checks that the tag matches the package version,
+identifies a commit already on main, and has successful main push CI. It builds
+with frozen validation and build tools, checks metadata with Twine, stores the
+artifacts, and publishes signed distributions from the protected `pypi`
+environment after maintainer approval. The GitHub Release receives the same
+files. Manual runs on branches only build and check artifacts; manual runs on
+version tags must satisfy all publication controls.
 
 The PyPI distribution name is `inductive-mlxrl`; the Python import package and
 CLI command remain `mlxrl`.

{inductive_mlxrl-0.2.2 → inductive_mlxrl-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: inductive-mlxrl
-Version: 0.2.2
+Version: 0.2.4
 Summary: Small single-process RL post-training for LLMs on Apple Silicon with MLX.
 Project-URL: Homepage, https://github.com/inductiveML/mlxrl
 Project-URL: Repository, https://github.com/inductiveML/mlxrl
@@ -19,8 +19,8 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Requires-Python: >=3.11
-Requires-Dist: mlx-lm>=0.31.3; python_version < '3.15' and platform_system == 'Darwin' and platform_machine == 'arm64'
-Requires-Dist: mlx>=0.31.2; python_version < '3.15' and platform_system == 'Darwin' and platform_machine == 'arm64'
+Requires-Dist: mlx-lm>=0.32.0; python_version < '3.15' and platform_system == 'Darwin' and platform_machine == 'arm64'
+Requires-Dist: mlx>=0.32.2; python_version < '3.15' and platform_system == 'Darwin' and platform_machine == 'arm64'
 Description-Content-Type: text/markdown
 
 # mlxrl
@@ -43,6 +43,9 @@ fields may change before a 1.0 release.
 
 ## Quickstart
 
+Requires Apple Silicon, Python 3.11–3.14, MLX 0.32.2+, and MLX-LM 0.32.0+.
+See [SECURITY.md](SECURITY.md) for model trust boundaries and private reporting.
+
 ```bash
 git clone https://github.com/inductiveML/mlxrl.git
 cd mlxrl

{inductive_mlxrl-0.2.2 → inductive_mlxrl-0.2.4}/README.md

@@ -18,6 +18,9 @@ fields may change before a 1.0 release.
 
 ## Quickstart
 
+Requires Apple Silicon, Python 3.11–3.14, MLX 0.32.2+, and MLX-LM 0.32.0+.
+See [SECURITY.md](SECURITY.md) for model trust boundaries and private reporting.
+
 ```bash
 git clone https://github.com/inductiveML/mlxrl.git
 cd mlxrl

inductive_mlxrl-0.2.4/SECURITY.md

@@ -0,0 +1,35 @@
+# Security policy
+
+Security fixes target the latest released version. Use inductive-mlxrl 0.2.4 or
+later and MLX-LM 0.32.0 or later. Earlier supported MLX-LM versions could execute
+Python from a model's `model_file` configuration without an explicit trust flag.
+See the [upstream fix](https://github.com/ml-explore/mlx-lm/pull/1385).
+
+Report vulnerabilities through the repository's
+[private vulnerability reporting form](https://github.com/inductiveML/mlxrl/security/advisories/new).
+Include the affected version, a minimal reproduction, and the expected impact.
+Keep credentials and private training data out of reports and public issues.
+
+## Trust boundaries
+
+Model completions and action text are untrusted data. Built-in tag parsers scan
+fixed delimiters without regex backtracking. Model loading explicitly disables
+custom remote Python code.
+
+Training configurations, custom Python reward functions, environment callbacks,
+benchmark command adapters, model repositories, and adapter files must come from
+sources you trust. The library runs in the caller's process and does not provide
+a sandbox for these extensions or for native tensor parsers. CLI output paths
+must resolve inside the working directory; this check does not isolate a
+process from another user who can concurrently change its files or symlinks.
+
+## Release controls
+
+Release tags must match the package version, identify a commit already on main,
+and have successful main push CI. CI audits every locked dependency version,
+including packages for other platforms and Python versions. Release actions
+use verified commit pins and build tools come from the frozen lockfile.
+
+GitHub's `pypi` environment restricts publication to protected release tags and
+requires a maintainer's approval. PyPI publication uses OIDC Trusted Publishing
+and signed attestations. Local Metal tests remain a release requirement.

{inductive_mlxrl-0.2.2 → inductive_mlxrl-0.2.4}/benchmarks/external_baseline_worker.py

@@ -317,7 +317,9 @@ def run_mlx_lm_lora(args: argparse.Namespace) -> BenchResult:
         prompt_token_lengths = [
             encoded_prompt_token_count(tokenizer, row["prompt"]) for row in rows
         ]
-        ref_loaded = load(args.model)
+        ref_loaded = load(
+            args.model, tokenizer_config={"trust_remote_code": False}, trust_remote_code=False
+        )
         ref_model = ref_loaded[0]
         ref_model.freeze()
         optimizer = optim.Adam(learning_rate=args.learning_rate)
@@ -453,6 +455,7 @@ def run_mlx_tune(args: argparse.Namespace) -> BenchResult:
         model_name=args.model,
         max_seq_length=args.max_context,
         load_in_4bit=True,
+        trust_remote_code=False,
     )
     prompt_token_lengths = [
         encoded_prompt_token_count(tokenizer, row["prompt"]) for row in rows

{inductive_mlxrl-0.2.2 → inductive_mlxrl-0.2.4}/benchmarks/run_phase4.py

@@ -536,7 +536,9 @@ def run_mlx_lm_worker(args: argparse.Namespace) -> BenchResult:
 
     set_mlx_wired_limit(mx, args.wired_limit_mb)
     mx.random.seed(args.seed)
-    loaded = mlx_lm.load(args.model)
+    loaded = mlx_lm.load(
+        args.model, tokenizer_config={"trust_remote_code": False}, trust_remote_code=False
+    )
     model = loaded[0]
     tokenizer = loaded[1]
     sampler = make_sampler(