soup-cli 0.71.2__tar.gz → 0.71.4__tar.gz

{soup_cli-0.71.2 → soup_cli-0.71.4}/CHANGELOG.md

@@ -12,6 +12,86 @@ reproducing 70+ versions of notes.
 
 ## [Unreleased]
 
+## [0.71.4] - 2026-06-02
+
+### Added
+- **Live canary verdict for `soup adapters merge`** — `--canary <suite.json>`
+  scores the merged adapter against the first input and classifies
+  **OK / MINOR / MAJOR** using the Quant-Lobotomy taxonomy (drop <2% OK, <5%
+  MINOR, else MAJOR). `--strict-verdict` exits 2 on MAJOR. Pre-scored
+  `{"baseline_scores","candidate_scores"}` suites run with no model load; a
+  `{"tasks":[...]}` suite uses an injectable scorer. Replaces the v0.57 `UNKNOWN`
+  stub.
+- **Live evolutionary merge** — `soup adapters merge --strategy cmaes --eval
+  <suite> --budget <t>` now runs the full CMA-ES loop: each candidate is merged,
+  materialised, scored against the eval suite, and the best-weighted merge is
+  written to `--output`. Replaces the v0.67 plan-only stub.
+- **Publish an adapter PR to GitHub** — `soup adapters pr <title> --base-sha
+  <hex> --adapter <path> --push owner/repo#N` posts the rendered PR Markdown as a
+  GitHub PR comment via `gh api` (argv-list, body over JSON stdin; no shell).
+  Token resolves from `GITHUB_TOKEN` / `GH_TOKEN`.
+- **Pre-wired `soup loop` production stages** — `soup loop init --pre-wired` (or
+  `soup loop watch --pre-wired`) swaps the v0.58 no-op stage stubs for real
+  harvest (traces → preference pairs) → DPO train → eval-gate → canary-deploy
+  callables. `soup loop status` now shows the `pre_wired` flag.
+- **Loop iterations as Soup Cans + Registry lineage** — `soup loop watch
+  --pack-cans` packs each successful iteration as a v0.26 Soup Can and appends a
+  Registry entry (tag `loop-iter`), chaining a real lineage DAG across
+  iterations visible through `soup history`. `soup loop replay <id> --extract
+  <dir>` unpacks a recorded iteration.
+- **Branch pointers into the Registry** — `soup adapters branch <name>
+  --attach-to-registry <id>` links a branch snapshot to a Registry entry (shown
+  as a `branches` node in `soup history`); `soup adapters branch <name>
+  --from-registry <id>` derives a fresh snapshot's config + base from an entry.
+
+### Security
+- The backdoor-scan gate (v0.71.2 #192) and license-conflict gate (v0.60 Part E)
+  now run for **all** merge strategies, including `--strategy cmaes` (previously
+  bypassed because cmaes returned before the gates).
+- `soup loop` canary deploy restricts `SOUP_LOOP_SERVE_ENDPOINT` to loopback /
+  RFC1918-private hosts (a serve endpoint is the operator's own box/LAN), beyond
+  the general webhook SSRF policy which permits any HTTPS host.
+- `soup adapters pr --push` builds the `gh` child environment from an allowlist
+  so unrelated secrets (`HF_TOKEN` / `OPENAI_API_KEY` / …) never reach the
+  subprocess.
+- The canary-suite JSON read uses `O_NOFOLLOW` + `os.fstat` (size cap enforced on
+  the same fd) to close the symlink/size-cap TOCTOU window.
+
+## [0.71.3] - 2026-06-01
+
+### Added
+- **Energy & CO2 measurement for training** — `soup train --track-energy` wraps
+  the training window in a codecarbon **offline** tracker (no IP-geolocation
+  network call) and reports kWh / CO2 / grid intensity, feeding those numbers
+  into `--annex-xi`. New `EnergyTracker` context manager; graceful no-op when
+  codecarbon is absent (`pip install soup-cli[carbon]`). `--energy-country`
+  picks the ISO-3166 alpha-3 grid for the CO2 estimate (default `USA`).
+- **PDF Annex XI/XII documents** — `soup train --annex-xi report.pdf` now renders
+  a reportlab PDF (a `.md` path still renders markdown). `pip install
+  soup-cli[pdf]`.
+- **Auto-populated training-corpus domains in Annex XI/XII** — the top crawled
+  domains (with shares) are now extracted from the training JSONL and listed in
+  the EU AI Act docs, replacing the previous empty placeholder.
+- **Soup Can manifest v3 with embedded attestations** — `soup can pack --attest
+  <statement.json>` (repeatable) embeds in-toto Statements into a v3 can
+  manifest; v1/v2 cans still load. Each statement is shape- and size-validated.
+- **Local audit log auto-instrumentation** — every `soup` command now appends one
+  HIPAA/SOC2-shaped record to `~/.soup/audit.jsonl` (secrets redacted, args
+  capped). Opt out per-invocation with `--no-audit-log` or globally with
+  `SOUP_NO_AUDIT_LOG=1`. Tail/rotate with `soup audit-log`.
+- **Reproducibility receipt in airgap bundles** — `soup airgap-bundle
+  --repro-receipt <receipt.json>` embeds an SR 11-7 receipt as
+  `repro-receipt.json`; auto-detected from `<model>/repro-receipt.json` when not
+  supplied.
+
+### Security
+- `soup can pack --attest` now rejects oversize attestation files by their raw
+  size *before* parsing them into memory (defence against memory-exhaustion).
+- The new file-loading paths (attestation JSON, airgap receipt, training-corpus
+  scan, PDF write) are all cwd-contained + TOCTOU symlink-rejected and
+  size-capped; the audit auto-log redacts `hf_`/`sk-`/`Bearer` tokens and never
+  crashes the CLI on a broken log.
+
 ## [0.71.2] - 2026-06-01
 
 ### Added

{soup_cli-0.71.2 → soup_cli-0.71.4}/CONTRIBUTING.md

@@ -33,6 +33,8 @@ This installs:
   pulled in too (since v0.71.0 these are an opt-in extra, not core deps)
 - `cryptography` — `[dev]` also pulls it in (it's the `[sign]` extra) so the
   ed25519 signing tests (`soup adapters sign` / `soup attest`) run in CI
+- `reportlab` — `[dev]` also pulls it in (it's the `[pdf]` extra) so the
+  Annex XI/XII PDF tests (`soup train --annex-xi *.pdf`) run in CI
 
 ### 3. Verify Setup
 
@@ -118,7 +120,7 @@ src/soup_cli/
   templates/          - 17 built-in soup.yaml templates (YAML + manifest.json) with load_template loader (v0.39.0, +bco v0.40.0)
   ui/                 - Web UI (FastAPI + HTML/JS SPA)
 
-tests/                - Test suite (272 files, 12259 tests)
+tests/                - Test suite (274 files, 12474 tests)
 examples/             - Real-world config examples and datasets
 ```
 

{soup_cli-0.71.2 → soup_cli-0.71.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: soup-cli
-Version: 0.71.2
+Version: 0.71.4
 Summary: Fine-tune LLMs in one command. No SSH, no config hell.
 Project-URL: Homepage, https://github.com/MakazhanAlpamys/Soup
 Project-URL: Repository, https://github.com/MakazhanAlpamys/Soup
@@ -39,6 +39,8 @@ Requires-Dist: librosa>=0.10.0; extra == 'audio'
 Requires-Dist: soundfile>=0.12.0; extra == 'audio'
 Provides-Extra: awq
 Requires-Dist: autoawq>=0.2.0; extra == 'awq'
+Provides-Extra: carbon
+Requires-Dist: codecarbon>=2.0.0; extra == 'carbon'
 Provides-Extra: cce
 Requires-Dist: cut-cross-entropy>=24.10.0; extra == 'cce'
 Provides-Extra: data
@@ -59,6 +61,7 @@ Requires-Dist: peft>=0.7.0; extra == 'dev'
 Requires-Dist: pre-commit>=3.5.0; extra == 'dev'
 Requires-Dist: pytest-cov>=4.0; extra == 'dev'
 Requires-Dist: pytest>=7.0; extra == 'dev'
+Requires-Dist: reportlab>=4.0.0; extra == 'dev'
 Requires-Dist: ruff>=0.1.0; extra == 'dev'
 Requires-Dist: torch>=2.0.0; extra == 'dev'
 Requires-Dist: transformers<5.0.0,>=4.36.0; extra == 'dev'
@@ -80,6 +83,8 @@ Requires-Dist: mlx-lm>=0.20.0; extra == 'mlx'
 Requires-Dist: mlx>=0.20.0; extra == 'mlx'
 Provides-Extra: onnx
 Requires-Dist: optimum[onnxruntime]>=1.16.0; extra == 'onnx'
+Provides-Extra: pdf
+Requires-Dist: reportlab>=4.0.0; extra == 'pdf'
 Provides-Extra: qat
 Requires-Dist: torchao>=0.4.0; extra == 'qat'
 Provides-Extra: remote
@@ -178,19 +183,21 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.71.2 — Governance & supply-chain live.** Real signatures and supply-chain gates:
-
-- **ed25519 signing** — `soup adapters sign --backend ed25519 --key priv.pem` (or `--generate-key`)
-  produces a real detached signature over the adapter's Merkle root; `soup adapters verify
-  --public-key trusted.pem` does cryptographic authentication. Same for `soup attest emit
-  --sign ed25519` + the new `soup attest verify`. Install with `pip install soup-cli[sign]`.
-- **Anti-AI-Jacking namespace pin** — Hub model downloads now refuse a repo whose author silently
-  changed (or whose creation date jumped backward), the classic namespace-re-creation attack.
-- **License-conflict gate at merge** — `soup adapters merge` auto-detects each adapter's license
-  (from `adapter_config.json` / model card) and refuses incompatible combinations unless you pass
-  `--license-override <reason>` (logged to the audit trail).
-- **Backdoor-scan gate at merge** — refuses to merge any adapter that `soup adapters scan` flags
-  FAIL unless you pass `--allow-unscanned`.
+**v0.71.4 — Adapter lifecycle + loop wiring.** The merge, PR, and continuous-loop surfaces go live:
+
+- **Canary verdict on merge** — `soup adapters merge … --canary suite.json` scores the merged
+  adapter and reports **OK / MINOR / MAJOR**; `--strict-verdict` exits non-zero on a MAJOR
+  regression. Works with no model load using a pre-scored canary suite.
+- **Evolutionary merge for real** — `soup adapters merge --strategy cmaes --eval suite --budget 1h`
+  now runs the full CMA-ES search (merge → score → optimise) and writes the best blend, instead of
+  just printing a plan.
+- **Publish an adapter PR** — `soup adapters pr <title> --base-sha <hex> --adapter <path> --push
+  owner/repo#42` posts the rendered PR straight to a GitHub PR comment.
+- **Continuous fine-tuning loop, wired up** — `soup loop watch --pre-wired` runs the real
+  traces → DPO → eval-gate → canary pipeline; `--pack-cans` snapshots every iteration as a
+  shareable Soup Can with Registry lineage (`soup loop replay <id> --extract dir`).
+- **Branches ↔ Registry** — `soup adapters branch <name> --attach-to-registry <id>` /
+  `--from-registry <id>` links training-env snapshots into the Registry lineage DAG.
 
 Full history: [CHANGELOG.md](CHANGELOG.md) &middot; [GitHub Releases](https://github.com/MakazhanAlpamys/Soup/releases).
 

{soup_cli-0.71.2 → soup_cli-0.71.4}/README.md

@@ -49,19 +49,21 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.71.2 — Governance & supply-chain live.** Real signatures and supply-chain gates:
-
-- **ed25519 signing** — `soup adapters sign --backend ed25519 --key priv.pem` (or `--generate-key`)
-  produces a real detached signature over the adapter's Merkle root; `soup adapters verify
-  --public-key trusted.pem` does cryptographic authentication. Same for `soup attest emit
-  --sign ed25519` + the new `soup attest verify`. Install with `pip install soup-cli[sign]`.
-- **Anti-AI-Jacking namespace pin** — Hub model downloads now refuse a repo whose author silently
-  changed (or whose creation date jumped backward), the classic namespace-re-creation attack.
-- **License-conflict gate at merge** — `soup adapters merge` auto-detects each adapter's license
-  (from `adapter_config.json` / model card) and refuses incompatible combinations unless you pass
-  `--license-override <reason>` (logged to the audit trail).
-- **Backdoor-scan gate at merge** — refuses to merge any adapter that `soup adapters scan` flags
-  FAIL unless you pass `--allow-unscanned`.
+**v0.71.4 — Adapter lifecycle + loop wiring.** The merge, PR, and continuous-loop surfaces go live:
+
+- **Canary verdict on merge** — `soup adapters merge … --canary suite.json` scores the merged
+  adapter and reports **OK / MINOR / MAJOR**; `--strict-verdict` exits non-zero on a MAJOR
+  regression. Works with no model load using a pre-scored canary suite.
+- **Evolutionary merge for real** — `soup adapters merge --strategy cmaes --eval suite --budget 1h`
+  now runs the full CMA-ES search (merge → score → optimise) and writes the best blend, instead of
+  just printing a plan.
+- **Publish an adapter PR** — `soup adapters pr <title> --base-sha <hex> --adapter <path> --push
+  owner/repo#42` posts the rendered PR straight to a GitHub PR comment.
+- **Continuous fine-tuning loop, wired up** — `soup loop watch --pre-wired` runs the real
+  traces → DPO → eval-gate → canary pipeline; `--pack-cans` snapshots every iteration as a
+  shareable Soup Can with Registry lineage (`soup loop replay <id> --extract dir`).
+- **Branches ↔ Registry** — `soup adapters branch <name> --attach-to-registry <id>` /
+  `--from-registry <id>` links training-env snapshots into the Registry lineage DAG.
 
 Full history: [CHANGELOG.md](CHANGELOG.md) &middot; [GitHub Releases](https://github.com/MakazhanAlpamys/Soup/releases).
 

{soup_cli-0.71.2 → soup_cli-0.71.4}/docs/adapters-and-governance.md

@@ -34,6 +34,8 @@ v0.57 shipped `adapters diff / merge / blame / branch`. v0.67 finishes the lifec
 
 ```bash
 # 1. Evolutionary merge: search the simplex of merge weights via CMA-ES.
+#    v0.71.4 makes this a LIVE loop — each candidate is merged, scored against
+#    --eval, and the best blend is written to --output.
 soup adapters merge \
   adapter-finance/ adapter-medical/ adapter-legal/ \
   --strategy cmaes \
@@ -43,6 +45,12 @@ soup adapters merge \
   --max-generations 20 \
   --output merged/
 
+# 1b. One-shot merge with a live canary verdict (v0.71.4). Scores the merged
+#     adapter vs the first input → OK / MINOR / MAJOR; --strict-verdict exits 2
+#     on a MAJOR regression. A pre-scored canary suite needs no model load.
+soup adapters merge adapter-a/ adapter-b/ -o merged/ \
+  --canary evals/canary.json --strict-verdict
+
 # 2. Render the merge as a GitHub PR for review (eval deltas + sample diffs).
 soup adapters pr "merge: 3-domain blend" \
   --base-sha $(git rev-parse HEAD) \
@@ -52,6 +60,12 @@ soup adapters pr "merge: 3-domain blend" \
   --dataset-diff data/diff.txt \
   --format markdown -o pr.md
 
+# 2b. Post it straight to a GitHub PR comment (v0.71.4). Auth via GITHUB_TOKEN
+#     / GH_TOKEN; uses `gh api` under the hood (no secret leaks to the child).
+soup adapters pr "merge: 3-domain blend" \
+  --base-sha $(git rev-parse HEAD) --adapter merged/ \
+  --eval evals/deltas.json --push your-org/your-repo#42
+
 # 3. Lock a reproducible run state. Closure = sha(base + dataset + env).
 soup env lock                                     # v0.64 — capture env hash
 soup lock write \
@@ -93,6 +107,16 @@ soup loop status
 # Run the daemon (foreground)
 soup loop watch --poll-interval 300
 
+# Pre-wired production stages (v0.71.4): real traces → DPO → eval-gate → canary,
+# instead of the v0.58 no-op stubs. Opt in once via `loop init --pre-wired` or
+# per-run via --pre-wired. Pack each iteration as a shareable Soup Can with
+# Registry lineage via --pack-cans.
+soup loop init registry://abc12 --eval evals/lock.json --baseline registry://prod --pre-wired
+soup loop watch --pre-wired --pack-cans --poll-interval 300
+
+# Unpack a recorded iteration's Soup Can for what-if analysis (v0.71.4)
+soup loop replay iter-20260515T120000-abcdef01 --extract ./iter-dump
+
 # Background subprocess (writes PID, no shell)
 soup loop watch --detach
 
@@ -240,6 +264,14 @@ soup adapters blame ./run-v18 --dataset train.jsonl --layer q_proj.7 \
 soup adapters branch v18 --config soup.yaml --base meta-llama/Llama-3.1-8B \
   --dataset train.jsonl
 
+# Link a branch into the Registry lineage DAG (v0.71.4) — shows as a
+# `branches` node under the entry in `soup history`.
+soup adapters branch v18 --config soup.yaml --base meta-llama/Llama-3.1-8B \
+  --attach-to-registry reg_20260601_abc123
+
+# Or derive a fresh snapshot's config + base straight from a Registry entry (v0.71.4)
+soup adapters branch v18-from-reg --from-registry reg_20260601_abc123
+
 # Restore the snapshot's config (refuses if source SHA drifted)
 soup adapters checkout v18 --output soup.yaml
 
@@ -264,7 +296,9 @@ soup adapters branches
 - Branch pointers live under `~/.soup/branches/` (override via `SOUP_BRANCHES_DIR`, constrained to `$HOME` / `$CWD` / `$TMPDIR`).
 - `soup adapters checkout` SHA-checks the source config — refuses to restore when the source has drifted from the snapshot, so reproducibility never silently lies.
 
-**v0.66.0:** `soup adapters blame` is now LIVE — the v0.57 `NotImplementedError` stub (#171) is lifted via a DataInf-style influence-function approximation. Pass `--top-k 50` to control the reported top-influencer count; pass a real `probe_fn` (Python API) to feed real gradients, or use the default deterministic synthetic probe for offline planning. `MergeReport.verdict` remains the `UNKNOWN` stub (live canary eval in v0.57.1).
+**v0.66.0:** `soup adapters blame` is now LIVE — the v0.57 `NotImplementedError` stub (#171) is lifted via a DataInf-style influence-function approximation. Pass `--top-k 50` to control the reported top-influencer count; pass a real `probe_fn` (Python API) to feed real gradients, or use the default deterministic synthetic probe for offline planning.
+
+**v0.71.4:** the merge verdict is now LIVE — `soup adapters merge … --canary suite.json` lifts the `MergeReport.verdict` `UNKNOWN` stub. A pre-scored `{"baseline_scores","candidate_scores"}` suite classifies the blend OK / MINOR / MAJOR with no model load; a `{"tasks":[...]}` suite uses an injectable scorer. `--strict-verdict` exits 2 on MAJOR. The backdoor-scan and license-conflict gates now run for **every** strategy, including `cmaes`. `soup adapters branch <name> --from-registry <id>` / `--attach-to-registry <id>` link training-env snapshots into the Registry lineage DAG (shown as a `branches` node in `soup history`).
 
 
 ## Soup Cans (Shareable Recipes)
@@ -275,6 +309,9 @@ Share a reproducible recipe as a single `.can` file — a tarball of the manifes
 # Pack a registry entry into a .can
 soup can pack --entry-id llama31-chat-v1 --out ./llama31-chat.can
 
+# Embed in-toto attestations into the manifest (v3 cans; repeatable)
+soup can pack --entry-id llama31-chat-v1 --out ./signed.can --attest att.json
+
 # Preview the manifest without extracting
 soup can inspect ./llama31-chat.can
 
@@ -358,29 +395,45 @@ Render an EU AI Act Annex XI (technical documentation, Sections 1+2) or Annex XI
 (Article 53(1)(d) public training summary) directly from a training run:
 
 ```bash
-soup train --config soup.yaml --annex-xi annex.md
+soup train --config soup.yaml --annex-xi annex.md           # markdown
+soup train --config soup.yaml --annex-xi annex.pdf           # PDF (pip install soup-cli[pdf])
+soup train --config soup.yaml --track-energy --annex-xi annex.md  # + measured kWh/CO2
 ```
 
 Top-10 domains by share, modality breakdown, training compute / kWh / CO₂, model
-description, base model, run id. Markdown body now; PDF in v0.59.1. Operator-controlled
-fields are escape-neutralised (`|[](){}!<>` + newline / CR / tab) so a malicious model
-name can't inject a forged heading into downstream PDF/HTML renderers.
+description, base model, run id. A `.pdf` output path renders a reportlab PDF (a `.md`
+path renders markdown). The **top crawled domains** are auto-extracted from the training
+JSONL (`cfg.data.train`). With `--track-energy`, the measured energy is recorded in the
+doc. Operator-controlled fields are escape-neutralised (`|[](){}!<>` + newline / CR / tab)
+so a malicious model name can't inject a forged heading into downstream renderers.
+
+### Energy & CO₂ measurement (`--track-energy`)
+
+`soup train --track-energy` wraps the training window in a codecarbon **offline** tracker
+(no IP-geolocation network call). It reports kWh / CO₂ / grid intensity and feeds them into
+`--annex-xi`. `--energy-country <ISO3>` picks the grid for the CO₂ estimate (default `USA`;
+the kWh figure itself is country-independent). Requires `pip install soup-cli[carbon]`;
+without it, `--track-energy` is a graceful no-op.
 
 
 ## Audit Log (`soup audit-log`)
 
-Tail or rotate the HIPAA/SOC2-shaped JSONL audit log at `~/.soup/audit.jsonl` (override
-via `SOUP_AUDIT_LOG_PATH`, containment-checked to `$HOME / $CWD / $TMPDIR`):
+**Every `soup` command** now appends one HIPAA/SOC2-shaped record to the JSONL audit log at
+`~/.soup/audit.jsonl` (override via `SOUP_AUDIT_LOG_PATH`, containment-checked to
+`$HOME / $CWD / $TMPDIR`). Opt out per-invocation with `soup --no-audit-log <cmd>` or
+globally with `SOUP_NO_AUDIT_LOG=1`. Tail or rotate:
 
 ```bash
 soup audit-log tail --limit 50          # Rich table view
 soup audit-log tail --json              # raw JSONL for SIEM ingestion
 soup audit-log rotate --cap-mb 100      # force a rotation pass
+soup --no-audit-log version             # skip the audit line for this command
 ```
 
 PII redaction across **every** string field (`hf_*` / `sk-*` / `Bearer …` → `<redacted>`)
 via the v0.40.3 `_SECRET_RE` policy. POSIX `O_NOFOLLOW` + `0o600` perms, atomic-append,
-rotation at 100 MiB with symlink rejection at the backup path.
+rotation at 100 MiB with symlink rejection at the backup path. The auto-instrumentation is
+best-effort — a broken audit log never crashes the CLI.
 
 
 ## Reproducibility Receipt (`soup train --repro-receipt`)
@@ -490,7 +543,16 @@ merge with exit 3 unless you pass `--allow-unscanned`.
 
 Single signed tarball with model + datasets + wheels + CUDA kernels +
 embedded `manifest.json` listing SHA-256 per file. Sized for one-way
-physical-media transfer through a data diode. Default 100 GiB cap;
+physical-media transfer through a data diode. A reproducibility receipt is
+embedded as a top-level `repro-receipt.json` when you pass
+`--repro-receipt <receipt.json>` (or auto-detected from
+`<model>/repro-receipt.json`):
+
+```bash
+soup airgap-bundle --model ./out --output bundle.tar --repro-receipt repro.json
+```
+
+Default 100 GiB cap;
 refuses oversize. Deterministic dataset labeling by sorted basename
 (NOT argv order) so the same inputs in different argv order produce
 identical manifests. TOCTOU defence: `os.lstat + S_ISLNK` re-check on

{soup_cli-0.71.2 → soup_cli-0.71.4}/docs/commands.md

@@ -109,12 +109,12 @@ soup cost --config soup.yaml --gpu H100      Estimate training cost for specific
 soup adapters list ./output/                 Scan for LoRA adapters
 soup adapters info ./output/checkpoint-500/  Show adapter metadata
 soup adapters compare adapter1/ adapter2/    Compare two adapters
-soup loop init <model> --eval <s> --baseline <b>  Create .soup/loop.yaml (data flywheel)
-soup loop status                              Counters + status (traces / pairs / runs / shipped)
-soup loop watch [--detach] [--max-iter N]    Harvest → train → gate → deploy daemon
+soup loop init <model> --eval <s> --baseline <b> [--pre-wired]  Create .soup/loop.yaml (data flywheel; --pre-wired = real stages)
+soup loop status                              Counters + status + pre_wired flag
+soup loop watch [--detach] [--max-iter N] [--pre-wired] [--pack-cans]  Harvest → train → gate → deploy daemon (pre-wired stages + Soup Can packing)
 soup loop pause / soup loop resume           Atomic status flip
 soup loop canary <adapter> --traffic 5%      Promote canary + auto-rollback on MAJOR
-soup loop replay [<iter-id>]                 Replay a recorded iteration manifest
+soup loop replay [<iter-id>] [--extract <dir>]  Replay / unpack a recorded iteration manifest
 soup serve --model m --adapters chat=./c code=./d  Multi-adapter serving
 soup migrate --from llamafactory config.yaml  Import config from LLaMA-Factory
 soup migrate --from axolotl config.yml        Import config from Axolotl
@@ -157,7 +157,13 @@ soup adapters check-safetensors <adapter> [--strict]  Refuse pickle / PyTorch-cl
 soup adapters merge ... [--license <id>] [--license-override <reason>] [--allow-unscanned]  License + backdoor-scan gates (auto-detect license; scan FAIL refused)
 soup attest emit ... [--sign ed25519 --key <pem>] [-o att.json]  in-toto/SLSA-3 attestation (+ .sig sidecar)
 soup attest verify <statement> --signature <sig> [--public-key <pem>]  Verify ed25519 attestation signature
-soup airgap-bundle --model <m> --output <out.tar>  Signed tarball for data-diode transfer
+soup airgap-bundle --model <m> --output <out.tar> [--repro-receipt <r.json>]  Signed tarball for data-diode transfer (embeds repro-receipt)
+soup train --config soup.yaml --annex-xi <out.md|out.pdf>  EU AI Act Annex XI/XII doc (markdown or PDF; top_domains auto-filled)
+soup train --config soup.yaml --track-energy [--energy-country USA]  codecarbon offline kWh/CO2 → annex-xi (pip install soup-cli[carbon])
+soup train --config soup.yaml --repro-receipt <out.json>  SR 11-7 reproducibility receipt
+soup can pack --entry-id <id> --out r.can --attest <statement.json>  Embed in-toto Statements into a v3 can manifest
+soup audit-log tail / rotate  Tail / rotate the per-command HIPAA/SOC2 audit log (~/.soup/audit.jsonl)
+soup --no-audit-log <cmd> / SOUP_NO_AUDIT_LOG=1  Opt out of the per-command audit line
 soup eval unlearning <run-id> --benchmark tofu|muse|wmdp  Forget Quality + Model Utility + PrivLeak verdict
 soup edit set --base <m> --method rome|memit|alphaedit --subject "..." --target "..."  Surgical knowledge edit (--plan-only available)
 soup edit diff <before-run> <after-run> --probes p.jsonl  Knowledge-injection diff visualizer
@@ -182,8 +188,11 @@ soup probe interference <losses.json> [--output o.json]  Pairwise N×N adapter i
 soup probe pack <base> [--output o.json]      Per-base calibrated probe pack manifest (v0.66.0)
 soup probe pack --list                        List bundled probe-pack bases (v0.66.0)
 soup adapters blame ... --top-k 50            Live DataInf-style influence runner (v0.66.0, closes #171)
-soup adapters merge ... --strategy cmaes --eval <s> --budget 1h  CMA-ES evolutionary merge (v0.67.0)
+soup adapters merge ... --strategy cmaes --eval <s> --budget 1h  CMA-ES evolutionary merge — live loop (v0.67.0 schema / v0.71.4 live)
+soup adapters merge ... --canary <suite.json> [--strict-verdict]  Live OK/MINOR/MAJOR canary verdict, exit 2 on MAJOR (v0.71.4)
 soup adapters pr <title> --base-sha <hex> --adapter <path>  GitHub-shaped adapter PR Markdown / JSON (v0.67.0)
+soup adapters pr <title> ... --push owner/repo#N  Post the PR as a GitHub comment via gh api (v0.71.4)
+soup adapters branch <name> --from-registry <id> | --attach-to-registry <id>  Branch ↔ Registry lineage (v0.71.4)
 soup adapters bisect <ckpt>... --eval-command "..."  Binary search over training history (v0.67.0)
 soup lock write --base-sha <h> --dataset-sha <h> --env-hash <h>  Write soup.lock (v0.67.0)
 soup lock write --base-sha <h> --dataset-sha <h> --env-lock soup-env.lock  Auto-derive --env-hash from soup-env.lock (v0.71.1)

{soup_cli-0.71.2 → soup_cli-0.71.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "soup-cli"
-version = "0.71.2"
+version = "0.71.4"
 description = "Fine-tune LLMs in one command. No SSH, no config hell."
 readme = "README.md"
 license = "Apache-2.0"
@@ -54,7 +54,7 @@ wandb = ["wandb>=0.15.0,<0.18.0"]
 # Self-references `[train]` so CI / contributors get the full training stack
 # (CI runs `pip install -e ".[dev]"`; without this every test would fail at
 # `import torch`).
-dev = ["soup-cli[train]", "cryptography>=41.0.0", "pytest>=7.0", "ruff>=0.1.0", "pytest-cov>=4.0", "httpx>=0.24.0", "mypy>=1.8.0", "pre-commit>=3.5.0"]
+dev = ["soup-cli[train]", "cryptography>=41.0.0", "reportlab>=4.0.0", "pytest>=7.0", "ruff>=0.1.0", "pytest-cov>=4.0", "httpx>=0.24.0", "mypy>=1.8.0", "pre-commit>=3.5.0"]
 ui = ["fastapi>=0.104.0", "uvicorn>=0.24.0"]
 serve = ["fastapi>=0.104.0", "uvicorn>=0.24.0"]
 serve-fast = ["vllm>=0.4.0", "fastapi>=0.104.0", "uvicorn>=0.24.0"]
@@ -89,6 +89,11 @@ data-pro = ["langdetect>=1.0.9", "presidio-analyzer>=2.2.0"]
 # adapters sign`. Pure-offline; Sigstore keyless (OIDC + Fulcio/Rekor network)
 # stays infra-blocked and is NOT bundled here.
 sign = ["cryptography>=41.0.0"]
+# v0.71.3 #181 — reportlab PDF rendering for `soup train --annex-xi *.pdf`.
+pdf = ["reportlab>=4.0.0"]
+# v0.71.3 #180 — codecarbon offline energy/CO2 measurement for
+# `soup train --track-energy` (offline; no IP-geolocation network call).
+carbon = ["codecarbon>=2.0.0"]
 
 [project.scripts]
 soup = "soup_cli.cli:run"

{soup_cli-0.71.2 → soup_cli-0.71.4}/src/soup_cli/__init__.py

@@ -1,3 +1,3 @@
 """Soup CLI — Fine-tune LLMs in one command."""
 
-__version__ = "0.71.2"
+__version__ = "0.71.4"

{soup_cli-0.71.2 → soup_cli-0.71.4}/src/soup_cli/cans/pack.py

@@ -29,6 +29,7 @@ def _add_text(tar: tarfile.TarFile, name: str, content: str) -> None:
 def pack_entry(
     *, entry_id: str, out_path: str, author: str = "unknown",
     description: Optional[str] = None,
+    attestations: Optional[list[dict]] = None,
 ) -> Path:
     """Pack a registry entry as a ``.can`` tarball.
 
@@ -38,6 +39,8 @@ def pack_entry(
             at call time.
         author: author handle baked into the manifest.
         description: optional free-form description.
+        attestations: optional list of embedded in-toto Statements (v0.71.3
+            #182). Each is shape-validated by the manifest schema.
 
     Returns:
         The absolute path to the written file.
@@ -66,6 +69,7 @@ def pack_entry(
         base_hash=entry.get("entry_hash", ""),
         description=description or entry.get("notes"),
         tags=list(entry.get("tags", [])),
+        attestations=list(attestations or []),
     )
 
     out.parent.mkdir(parents=True, exist_ok=True)

{soup_cli-0.71.2 → soup_cli-0.71.4}/src/soup_cli/cans/schema.py

@@ -2,18 +2,48 @@
 
 from __future__ import annotations
 
+import json
 import re
 from typing import Literal, Optional
 
 from pydantic import BaseModel, Field, field_validator
 
-CAN_FORMAT_VERSION = 2  # v0.33.0: deploy_targets + env capture (additive over v1)
-SUPPORTED_CAN_FORMAT_VERSIONS = (1, 2)
+CAN_FORMAT_VERSION = 3  # v0.71.3 #182: attestations field (additive over v2)
+SUPPORTED_CAN_FORMAT_VERSIONS = (1, 2, 3)
 
 _NAME_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_\-.]{0,127}$")
 _HF_NAME_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_\-./]{0,127}$")
 _HF_REPO_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_\-.]{0,95}/[A-Za-z0-9][A-Za-z0-9_\-.]{0,95}$")
 
+# v0.71.3 #182 — caps on embedded in-toto attestations.
+_MAX_ATTESTATIONS = 64
+_MAX_ATTESTATION_BYTES = 1024 * 1024  # 1 MiB per statement
+
+
+def validate_attestation_statement(stmt: object) -> dict:
+    """Validate one embedded in-toto Statement dict (v0.71.3 #182).
+
+    Shape-only: must be a dict carrying ``_type`` (str) and ``predicateType``
+    (str), and serialise to <= 1 MiB. Returns the statement unchanged.
+    """
+    if not isinstance(stmt, dict):
+        raise ValueError("attestation must be a dict (in-toto Statement)")
+    type_field = stmt.get("_type")
+    predicate_type = stmt.get("predicateType")
+    if not isinstance(type_field, str) or not type_field:
+        raise ValueError("attestation missing a non-empty '_type' string")
+    if not isinstance(predicate_type, str) or not predicate_type:
+        raise ValueError("attestation missing a non-empty 'predicateType' string")
+    try:
+        size = len(json.dumps(stmt).encode("utf-8"))
+    except (TypeError, ValueError) as exc:
+        raise ValueError(f"attestation is not JSON-serialisable: {exc}") from exc
+    if size > _MAX_ATTESTATION_BYTES:
+        raise ValueError(
+            f"attestation too large ({size} > {_MAX_ATTESTATION_BYTES} bytes)"
+        )
+    return stmt
+
 
 class DeployTarget(BaseModel):
     """One declarative deploy target embedded in a can manifest (v2+).
@@ -116,6 +146,23 @@ class Manifest(BaseModel):
         default_factory=list,
         description="Optional declarative deploy targets (v2+)",
     )
+    attestations: list[dict] = Field(
+        default_factory=list,
+        description="Optional embedded in-toto Statements (v3+)",
+    )
+
+    @field_validator("attestations", mode="before")
+    @classmethod
+    def _valid_attestations(cls, value: object) -> list[dict]:
+        if value is None:
+            return []
+        if not isinstance(value, list):
+            raise ValueError("attestations must be a list of in-toto Statements")
+        if len(value) > _MAX_ATTESTATIONS:
+            raise ValueError(
+                f"too many attestations ({len(value)} > {_MAX_ATTESTATIONS})"
+            )
+        return [validate_attestation_statement(s) for s in value]
 
     @field_validator("can_format_version")
     @classmethod