sciveo 0.2.76__tar.gz → 0.2.78__tar.gz

{sciveo-0.2.76/sciveo.egg-info → sciveo-0.2.78}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: sciveo
-Version: 0.2.76
+Version: 0.2.78
 Description-Content-Type: text/markdown
 Provides-Extra: mon
 Provides-Extra: agent
@@ -933,32 +933,80 @@ SCIVEYOLO.build("detector.pt", "detector-trt.sciveyolo", engine="trt")
 ```
 
 This creates an ONNX payload marked for TensorRT; it does not contain a
-compiled TensorRT engine. Loading it never starts a TensorRT build by default.
-Sciveo uses a compatible cached TensorRT runtime when one is available for the
-incoming tensor shape. If no cached runtime exists, or the cached runtime does
-not accept that shape, inference falls back to the artifact's normal ONNX
-backend.
+compiled TensorRT engine. New TRT artifacts also embed a native PT fallback,
+including its verified state and architecture metadata. Loading an artifact
+never starts a TensorRT build by default. Sciveo tries every compatible cached
+TensorRT profile for the incoming tensor shape, then uses the configured
+fallback. The default is `pt`; `onnx` and `error` are explicit alternatives:
 
-TensorRT compilation must be explicitly allowed. The incoming batches and
-frame sizes determine which runtimes ONNX Runtime builds and caches; no fixed
-batch or image dimensions are required by Sciveo:
+```python
+model = SCIVEYOLO("detector-trt.sciveyolo", device="cuda:0", trt_fallback="pt")
+model = SCIVEYOLO("detector-trt.sciveyolo", device="cuda:0", trt_fallback="onnx")
+model = SCIVEYOLO("detector-trt.sciveyolo", device="cuda:0", trt_fallback="error")
+```
+
+For an older TRT artifact without an embedded PT state, point to a prebuilt PT
+artifact. A raw checkpoint is intentionally rejected because fallback setup
+must not trigger conversion:
 
 ```python
 model = SCIVEYOLO(
+    "detector-trt.sciveyolo",
+    device="cuda:0",
+    trt_fallback="pt",
+    trt_fallback_model="detector-pt.sciveyolo",
+)
+```
+
+The equivalent environment options are `SCIVEO_SCIVEYOLO_TRT_FALLBACK` and
+`SCIVEO_SCIVEYOLO_TRT_FALLBACK_PATH`.
+
+TensorRT compilation must be explicitly allowed and should run outside the
+production workers. Build the observed batch/image profiles in a one-off
+process:
+
+```python
+builder = SCIVEYOLO(
     "detector-trt.sciveyolo",
     device="cuda:0",
     engine="trt",
     allow_trt_build=True,
 )
+builder.compile_trt_profiles([
+    {"batch": 16, "imgsz": [320, 640]},
+    {"batch": 32, "imgsz": [320, 640]},
+])
+```
+
+Each shape gets an independent context under `profiles/`, with a verified
+manifest recording the exact NCHW profile. A cross-process lock prevents
+concurrent builders from writing the same cache. Production processes omit
+`allow_trt_build`; `engine="trt"` by itself is always cache-only. They can load
+multiple validated contexts, choose one per batch, and apply the fallback for
+missing or rejected profiles. Partial, legacy engine-only, and invalid contexts
+are never rebuilt implicitly.
+
+`allow_trt_build=True` grants permission to `compile_trt_profiles()` but does
+not make `predict()` compile. Ad-hoc build-on-prediction behavior requires the
+additional explicit `trt_build_on_predict=True` option (or
+`SCIVEO_SCIVEYOLO_TRT_BUILD_ON_PREDICT=1`) and is not intended for production
+workers.
+
+Inspect runtime coverage and rank profiles worth compiling:
+
+```python
+statistics = model.runtime_statistics()
+print(statistics["trt"]["profile_hits"])
+print(statistics["fallback"]["profile_candidates"])
+
+suggested_shapes = [item["shape"] for item in statistics["fallback"]["profile_candidates"][:3]]
+# Run this only in the separate builder process created above.
+builder.compile_trt_profiles(suggested_shapes)
 ```
 
-The first run of each new tensor shape may build or update its cached runtime
-only in this explicit mode. A cross-process lock prevents concurrent workers
-from building the same cache at once. Later processes can reuse a validated,
-whole-model TensorRT context without build permission; partial or invalid
-contexts use the ONNX fallback. `engine="trt"` by itself remains cache-only,
-and automatic engine selection may benchmark a TRT artifact without compiling
-it because the same fallback policy applies.
+Statistics include TRT hit batches/images, runtime rejections, fallback
+batches/images and rates, reasons, per-shape counts, and loaded profile paths.
+Pass `reset=True` to return the current snapshot and reset the counters.
 
 Build-time conversion may use a separate environment with export tooling. The
 production runtime only needs the dependencies required by the artifact engine,
@@ -1197,9 +1245,12 @@ Policy evaluation is deliberately small and predictable:
   string, boolean, and null conditions follow AWS identity-policy form.
 - `s3:ListBucket` applies to the bucket ARN and can restrict `s3:prefix` and
   `s3:delimiter`. It is separate from object read and write permission.
-- `s3:GetObject` authorizes both GET and HEAD. `s3:PutObject` authorizes regular,
-  presigned, POST, copy-destination, and multipart writes. Copy also requires
-  `s3:GetObject` on its source. Tagging, multipart listing/abort, bucket
+- AWS-compatible `s3:GetObject` authorizes both GET and HEAD. Sciveo additionally
+  accepts `s3:HeadObject` as a policy extension that authorizes HEAD without
+  authorizing GET; boto3 still sends the ordinary S3 `HeadObject` request and
+  requires no client changes. An explicit deny matching either action denies
+  HEAD. `s3:PutObject` authorizes regular, presigned, POST, copy-destination,
+  and multipart writes. Copy also requires `s3:GetObject` on its source. Tagging, multipart listing/abort, bucket
   lifecycle, and bulk deletion retain their distinct S3 actions.
 - Bucket CORS configuration uses the distinct `s3:GetBucketCORS`,
   `s3:PutBucketCORS`, and `s3:DeleteBucketCORS` actions on the bucket ARN.

{sciveo-0.2.76 → sciveo-0.2.78}/README.md

@@ -909,32 +909,80 @@ SCIVEYOLO.build("detector.pt", "detector-trt.sciveyolo", engine="trt")
 ```
 
 This creates an ONNX payload marked for TensorRT; it does not contain a
-compiled TensorRT engine. Loading it never starts a TensorRT build by default.
-Sciveo uses a compatible cached TensorRT runtime when one is available for the
-incoming tensor shape. If no cached runtime exists, or the cached runtime does
-not accept that shape, inference falls back to the artifact's normal ONNX
-backend.
+compiled TensorRT engine. New TRT artifacts also embed a native PT fallback,
+including its verified state and architecture metadata. Loading an artifact
+never starts a TensorRT build by default. Sciveo tries every compatible cached
+TensorRT profile for the incoming tensor shape, then uses the configured
+fallback. The default is `pt`; `onnx` and `error` are explicit alternatives:
 
-TensorRT compilation must be explicitly allowed. The incoming batches and
-frame sizes determine which runtimes ONNX Runtime builds and caches; no fixed
-batch or image dimensions are required by Sciveo:
+```python
+model = SCIVEYOLO("detector-trt.sciveyolo", device="cuda:0", trt_fallback="pt")
+model = SCIVEYOLO("detector-trt.sciveyolo", device="cuda:0", trt_fallback="onnx")
+model = SCIVEYOLO("detector-trt.sciveyolo", device="cuda:0", trt_fallback="error")
+```
+
+For an older TRT artifact without an embedded PT state, point to a prebuilt PT
+artifact. A raw checkpoint is intentionally rejected because fallback setup
+must not trigger conversion:
 
 ```python
 model = SCIVEYOLO(
+    "detector-trt.sciveyolo",
+    device="cuda:0",
+    trt_fallback="pt",
+    trt_fallback_model="detector-pt.sciveyolo",
+)
+```
+
+The equivalent environment options are `SCIVEO_SCIVEYOLO_TRT_FALLBACK` and
+`SCIVEO_SCIVEYOLO_TRT_FALLBACK_PATH`.
+
+TensorRT compilation must be explicitly allowed and should run outside the
+production workers. Build the observed batch/image profiles in a one-off
+process:
+
+```python
+builder = SCIVEYOLO(
     "detector-trt.sciveyolo",
     device="cuda:0",
     engine="trt",
     allow_trt_build=True,
 )
+builder.compile_trt_profiles([
+    {"batch": 16, "imgsz": [320, 640]},
+    {"batch": 32, "imgsz": [320, 640]},
+])
+```
+
+Each shape gets an independent context under `profiles/`, with a verified
+manifest recording the exact NCHW profile. A cross-process lock prevents
+concurrent builders from writing the same cache. Production processes omit
+`allow_trt_build`; `engine="trt"` by itself is always cache-only. They can load
+multiple validated contexts, choose one per batch, and apply the fallback for
+missing or rejected profiles. Partial, legacy engine-only, and invalid contexts
+are never rebuilt implicitly.
+
+`allow_trt_build=True` grants permission to `compile_trt_profiles()` but does
+not make `predict()` compile. Ad-hoc build-on-prediction behavior requires the
+additional explicit `trt_build_on_predict=True` option (or
+`SCIVEO_SCIVEYOLO_TRT_BUILD_ON_PREDICT=1`) and is not intended for production
+workers.
+
+Inspect runtime coverage and rank profiles worth compiling:
+
+```python
+statistics = model.runtime_statistics()
+print(statistics["trt"]["profile_hits"])
+print(statistics["fallback"]["profile_candidates"])
+
+suggested_shapes = [item["shape"] for item in statistics["fallback"]["profile_candidates"][:3]]
+# Run this only in the separate builder process created above.
+builder.compile_trt_profiles(suggested_shapes)
 ```
 
-The first run of each new tensor shape may build or update its cached runtime
-only in this explicit mode. A cross-process lock prevents concurrent workers
-from building the same cache at once. Later processes can reuse a validated,
-whole-model TensorRT context without build permission; partial or invalid
-contexts use the ONNX fallback. `engine="trt"` by itself remains cache-only,
-and automatic engine selection may benchmark a TRT artifact without compiling
-it because the same fallback policy applies.
+Statistics include TRT hit batches/images, runtime rejections, fallback
+batches/images and rates, reasons, per-shape counts, and loaded profile paths.
+Pass `reset=True` to return the current snapshot and reset the counters.
 
 Build-time conversion may use a separate environment with export tooling. The
 production runtime only needs the dependencies required by the artifact engine,
@@ -1173,9 +1221,12 @@ Policy evaluation is deliberately small and predictable:
   string, boolean, and null conditions follow AWS identity-policy form.
 - `s3:ListBucket` applies to the bucket ARN and can restrict `s3:prefix` and
   `s3:delimiter`. It is separate from object read and write permission.
-- `s3:GetObject` authorizes both GET and HEAD. `s3:PutObject` authorizes regular,
-  presigned, POST, copy-destination, and multipart writes. Copy also requires
-  `s3:GetObject` on its source. Tagging, multipart listing/abort, bucket
+- AWS-compatible `s3:GetObject` authorizes both GET and HEAD. Sciveo additionally
+  accepts `s3:HeadObject` as a policy extension that authorizes HEAD without
+  authorizing GET; boto3 still sends the ordinary S3 `HeadObject` request and
+  requires no client changes. An explicit deny matching either action denies
+  HEAD. `s3:PutObject` authorizes regular, presigned, POST, copy-destination,
+  and multipart writes. Copy also requires `s3:GetObject` on its source. Tagging, multipart listing/abort, bucket
   lifecycle, and bulk deletion retain their distinct S3 actions.
 - Bucket CORS configuration uses the distinct `s3:GetBucketCORS`,
   `s3:PutBucketCORS`, and `s3:DeleteBucketCORS` actions on the bucket ARN.

{sciveo-0.2.76 → sciveo-0.2.78}/sciveo/iam/access.py

@@ -10,7 +10,7 @@
 #
 
 from sciveo.iam.identity import IAMIdentityStore
-from sciveo.iam.policy import IAMAccessRequest, IAMPolicyDecision, IAMPolicyEvaluator
+from sciveo.iam.policy import IAMAccessDenied, IAMAccessRequest, IAMPolicyDecision, IAMPolicyEvaluator
 
 
 class IAMAccessControl:
@@ -37,6 +37,15 @@ class IAMAccessControl:
       return self.evaluator.require(identity, IAMAccessRequest(action, resource, context))
     return self.evaluator.require(identity, IAMAccessRequest(action, resource, self.identity_context(identity, context)))
 
+  def require_any(self, identity, actions, resource, context=None):
+    decisions = [self.evaluate(identity, action, resource, context=context) for action in actions]
+    if any(decision.explicit_deny for decision in decisions):
+      raise IAMAccessDenied("Access denied")
+    for decision in decisions:
+      if decision.allowed:
+        return decision
+    raise IAMAccessDenied("Access denied")
+
   @staticmethod
   def identity_context(identity, context=None):
     result = dict(context or {})

{sciveo-0.2.76 → sciveo-0.2.78}/sciveo/ml/images/sciveyolo/__init__.py

@@ -12,6 +12,7 @@
 from sciveo.ml.images.sciveyolo.artifact import SCIVEYOLOArtifact
 from sciveo.ml.images.sciveyolo.model import SCIVEYOLO
 from sciveo.ml.images.sciveyolo.results import SCIVEYOLOBoxes, SCIVEYOLOResults, SCIVEYOLOTensor
+from sciveo.ml.images.sciveyolo.runtime_stats import SCIVEYOLORuntimeStats
 from sciveo.ml.images.sciveyolo.train import SCIVEYOLOTrainResult, SCIVEYOLOTrainer
 
 __all__ = [
@@ -19,6 +20,7 @@ __all__ = [
   "SCIVEYOLOArtifact",
   "SCIVEYOLOBoxes",
   "SCIVEYOLOResults",
+  "SCIVEYOLORuntimeStats",
   "SCIVEYOLOTensor",
   "SCIVEYOLOTrainResult",
   "SCIVEYOLOTrainer",

{sciveo-0.2.76 → sciveo-0.2.78}/sciveo/ml/images/sciveyolo/artifact.py

@@ -141,6 +141,7 @@ class SCIVEYOLOArtifact:
   def __init__(self, path):
     self.path = Path(path)
     self.model_path = self.path
+    self.fallback_model_path = None
     self.metadata = {}
     if self.path.suffix == self.extension:
       try:
@@ -161,7 +162,7 @@ class SCIVEYOLOArtifact:
         package_data = self._prepare_package(extracted_path)
     if package_data is None:
       raise ValueError(f"Could not prepare SCIVEYOLO artifact {self.path}")
-    self.metadata, self.model_path = package_data
+    self.metadata, self.model_path, self.fallback_model_path = package_data
 
   @contextmanager
   def locked_package(self):
@@ -171,7 +172,7 @@ class SCIVEYOLOArtifact:
     extracted_path = self.path.with_name(f"{self.path.name}.unpacked")
     with _SCIVEYOLOArtifactLock(self._lock_path()):
       package_data = self._prepare_package(extracted_path)
-      self.metadata, self.model_path = package_data
+      self.metadata, self.model_path, self.fallback_model_path = package_data
       yield self
 
   def _prepare_package(self, extracted_path):
@@ -206,14 +207,26 @@ class SCIVEYOLOArtifact:
         return None
       if not self._cached_file_matches(extracted_path, marker.get("model")):
         return None
-      metadata, model_path = self._read_extracted_package(extracted_path, verify_model_hash=False)
+      metadata, model_path, fallback_model_path = self._read_extracted_package(extracted_path, verify_model_hash=False)
       model_filename = model_path.relative_to(Path(extracted_path).resolve()).as_posix()
       if model_filename != marker["model"]["filename"]:
         return None
       expected_hash = metadata.get("model", {}).get("sha256")
       if expected_hash and expected_hash != marker["model"]["sha256"]:
         return None
-      return metadata, model_path
+      fallback_metadata = metadata.get("fallback")
+      marker_fallback = marker.get("fallback")
+      if fallback_model_path is None:
+        if fallback_metadata is not None or marker_fallback is not None:
+          return None
+      else:
+        fallback_filename = fallback_model_path.relative_to(Path(extracted_path).resolve()).as_posix()
+        if not self._cached_file_matches(extracted_path, marker_fallback, expected_filename=fallback_filename):
+          return None
+        expected_fallback_hash = fallback_metadata.get("sha256")
+        if expected_fallback_hash and expected_fallback_hash != marker_fallback["sha256"]:
+          return None
+      return metadata, model_path, fallback_model_path
     except (AttributeError, KeyError, OSError, TypeError, UnicodeError, ValueError, zipfile.BadZipFile):
       return None
 
@@ -225,7 +238,7 @@ class SCIVEYOLOArtifact:
     try:
       self._create_cache_owner(partial_path)
       self._safe_extract_package(package, partial_path)
-      metadata, model_path = self._read_extracted_package(partial_path)
+      metadata, model_path, fallback_model_path = self._read_extracted_package(partial_path)
       metadata_path = partial_path / "metadata.json"
       model_hash = metadata.get("model", {}).get("sha256") or self._sha256(model_path)
       marker = {
@@ -236,6 +249,7 @@ class SCIVEYOLOArtifact:
           "filename": model_path.relative_to(partial_path.resolve()).as_posix(),
           "sha256": model_hash,
         },
+        "fallback": self._cache_file_data(partial_path, fallback_model_path) if fallback_model_path is not None else None,
       }
       self._write_private_text(
         partial_path / self.cache_marker_filename,
@@ -271,7 +285,20 @@ class SCIVEYOLOArtifact:
       raise FileNotFoundError(f"SCIVEYOLO artifact does not contain a supported model file: {self.path}")
     if verify_model_hash:
       self._verify_model_hash(model_path=model_path, metadata=metadata)
-    return metadata, model_path
+    fallback_model_path = None
+    fallback_metadata = metadata.get("fallback")
+    if fallback_metadata is not None:
+      if not isinstance(fallback_metadata, dict):
+        raise ValueError(f"SCIVEYOLO artifact fallback metadata is not an object: {self.path}")
+      fallback_filename = fallback_metadata.get("filename")
+      if not fallback_filename:
+        raise ValueError(f"SCIVEYOLO artifact fallback metadata has no filename: {self.path}")
+      fallback_model_path = self._safe_package_path(base_path, fallback_filename)
+      if not fallback_model_path.is_file() or fallback_model_path.is_symlink():
+        raise FileNotFoundError(f"SCIVEYOLO artifact fallback model is missing: {fallback_model_path}")
+      if verify_model_hash:
+        self._verify_fallback_hash(fallback_model_path, fallback_metadata)
+    return metadata, model_path, fallback_model_path
 
   @staticmethod
   def _package_signature(package):
@@ -420,6 +447,14 @@ class SCIVEYOLOArtifact:
     if actual != expected:
       raise ValueError(f"SCIVEYOLO artifact model hash mismatch for {self.path}")
 
+  def _verify_fallback_hash(self, fallback_model_path, fallback_metadata):
+    expected = fallback_metadata.get("sha256")
+    if not expected:
+      return
+    actual = self._sha256(fallback_model_path)
+    if actual != expected:
+      raise ValueError(f"SCIVEYOLO artifact fallback model hash mismatch for {self.path}")
+
   @classmethod
   def build(cls, source, output, imgsz=640, export_command=None, env=None, extra_args=None, format=None, dynamic=True, engine="pt", device=None, verbose=False):
     engine = cls._normalize_engine(engine if format is None else format)
@@ -486,6 +521,31 @@ class SCIVEYOLOArtifact:
         raise FileNotFoundError(f"SCIVEYOLO export did not create {model_path}")
 
       metadata = cls._export_metadata(model_path)
+      fallback_model_path = None
+      fallback_metadata = None
+      if format == "trt":
+        fallback_model_path = build_path / "fallback_model_state.pt"
+        checkpoint = cls._load_pt_checkpoint(copied_source)
+        checkpoint_model = cls._checkpoint_model(checkpoint)
+        state_dict = cls._checkpoint_state_dict(checkpoint_model)
+        names = cls._checkpoint_names(checkpoint, checkpoint_model)
+        nc = len(names) if names else cls._state_dict_nc(state_dict)
+        scale = cls._checkpoint_scale(checkpoint_model)
+        cls._save_state_dict(fallback_model_path, state_dict)
+        metadata.update({
+          "scale": scale,
+          "model_size": scale,
+          "variant": f"sciveyolo{scale}",
+          "names": names,
+          "nc": nc,
+          "stride": cls._checkpoint_stride(checkpoint_model),
+        })
+        fallback_metadata = {
+          "engine": "pt",
+          "runtime": "torch-native",
+          "filename": "fallback_model_state.pt",
+          "sha256": cls._sha256(fallback_model_path),
+        }
       runtime = {
         "onnx": "onnxruntime",
         "trt": "onnxruntime-tensorrt",
@@ -511,7 +571,9 @@ class SCIVEYOLOArtifact:
           "sha256": cls._sha256(model_path),
         },
       })
-      return cls._write_package(output, model_path, metadata)
+      if fallback_metadata is not None:
+        metadata["fallback"] = fallback_metadata
+      return cls._write_package(output, model_path, metadata, fallback_model_path=fallback_model_path)
 
   @classmethod
   def _build_pt(cls, source, output, imgsz=640):
@@ -555,11 +617,16 @@ class SCIVEYOLOArtifact:
       return cls._write_package(output, state_path, metadata)
 
   @classmethod
-  def _write_package(cls, output, model_path, metadata):
+  def _write_package(cls, output, model_path, metadata, fallback_model_path=None):
     output = Path(output)
     output.parent.mkdir(parents=True, exist_ok=True)
     with zipfile.ZipFile(output, "w", compression=zipfile.ZIP_DEFLATED) as package:
       package.write(model_path, metadata["model"]["filename"])
+      if fallback_model_path is not None:
+        fallback_filename = metadata.get("fallback", {}).get("filename")
+        if not fallback_filename:
+          raise ValueError("SCIVEYOLO fallback model requires metadata with a filename")
+        package.write(fallback_model_path, fallback_filename)
       package.writestr("metadata.json", json.dumps(metadata, indent=2, sort_keys=True))
     return str(output)