soup-cli 0.71.35__tar.gz → 0.71.37__tar.gz

{soup_cli-0.71.35 → soup_cli-0.71.37}/CHANGELOG.md

@@ -12,6 +12,110 @@ reproducing 70+ versions of notes.
 
 ## [Unreleased]
 
+## [0.71.37] - 2026-07-17
+
+**Every `pip install soup-cli[extra]` command now works on Windows `cmd.exe`**, and
+eval-gate benchmark tasks run instead of always failing.
+
+### Fixed
+
+- **Install hints are now quoted so they work in every shell.** Soup printed
+  `pip install 'soup-cli[ui]'` — bash / zsh / PowerShell syntax. `cmd.exe` has no
+  single-quote quoting, so it hands the quotes to pip verbatim and pip refuses:
+
+  ```
+  ERROR: Invalid requirement: "'soup-cli[train]'": Expected package name at the start of dependency specifier
+  ```
+
+  Every hint, README command, and docs example now uses `pip install
+  "soup-cli[extra]"`, which works in cmd, PowerShell, bash, and zsh alike — the
+  same spelling the repo already used for `pip install -e ".[dev]"`. Measured on
+  Windows: single quotes fail only on `cmd.exe`; double quotes pass everywhere;
+  dropping the quotes passes on Windows but breaks zsh, which globs the bracket.
+
+  Nothing in Soup can rescue the command after it is typed — pip and the shell
+  own it, and Soup is not installed yet when the README command runs — so the
+  fix is the spelling we print. A regression test now scans the package and every
+  docs code block for the single-quoted form.
+
+  If you followed an older tutorial and hit `Invalid requirement`, swap the `'`
+  for `"`; nothing is wrong with the package.
+
+- **Eval-gate `type: benchmark` tasks now actually run.** `eval/gate.py` probed
+  for a `forgetting.run_mini_benchmark` helper that never existed, so every
+  `type: benchmark` task in a gate suite failed 100% of the time — while
+  advising an `[eval]` extras install that could not fix it. The gate now calls
+  `ForgettingDetector` directly (the same way `soup ship` already did), and an
+  unknown benchmark name fails with the list of valid names. Thanks
+  [@Sanjays2402](https://github.com/Sanjays2402)!
+  ([#315](https://github.com/MakazhanAlpamys/Soup/pull/315), closes
+  [#310](https://github.com/MakazhanAlpamys/Soup/issues/310))
+
+## [0.71.36] - 2026-07-16
+
+**Data Moat II** — a semantic layer over your training data, plus two tools for
+what a fine-tune forgets and leaks.
+
+### Added
+
+- **`soup data dedup --semantic`** — near-duplicate removal over embedding
+  cosine instead of MinHash shingling. Catches *reworded* duplicates that
+  MinHash misses (measured: 0.88–0.91 cosine on rewordings MinHash scored as
+  distinct) while correctly keeping distinct-but-similar instructions. Zero new
+  dependencies: uses `transformers` from the `[train]` extra. **Read the
+  known-limitation below before lowering `--threshold`.**
+- **`soup data topics <data>`** — cluster a dataset and label each cluster with
+  c-TF-IDF terms, plus a coverage table (`82% code · 6% math`) and a warning for
+  thin topics. Labels are *emergent term clusters*, not a fixed taxonomy.
+- **`soup data canary insert|check`** — Secret-Sharer memorization probe. Insert
+  K high-entropy secrets, then check any model/adapter: each secret's loss is
+  ranked against never-inserted controls drawn from the same space. Exit 2 on
+  MAJOR so CI can gate. Measured on SmolLM2-135M: a memorized set lands at
+  percentile 0.0 (loss 1.7–2.5) against a clean model's 4.1–6.2.
+- **`soup train --replay old.jsonl --replay-ratio 0.1`** — continual-learning
+  rehearsal. Interleaves a seeded sample of an old dataset into training so a
+  new task does not erase the old one. `r` is the fraction of the **final**
+  mixed set (`n_replay = round(r/(1-r) · n_new)`), rows are interleaved rather
+  than appended, and an undersized pool reports the shortfall instead of
+  repeating rows. Mixed into `train` only — validation stays pure new-task.
+
+### Fixed
+
+- **The hardware-fit gate refused to train any local checkpoint.** A merged
+  model (`soup merge -o ./mymodel`) has no size marker in its name, so the size
+  guesser returned its 7B default, predicted ~16 GB of VRAM and refused. Local
+  checkpoints are now *measured* from their safetensors header (0.135B actual vs
+  7.0B guessed) — this had blocked `soup merge` → train-from-merged entirely.
+  Third instance of this class after the v0.71.32 (Whisper) and v0.71.33
+  (`M` suffix) fixes.
+- **`pip install 'soup-cli[extra]'` hints printed without the extra.** Rich ate
+  the bracket, so every "install the missing dependency" message across 17 sites
+  told users to run `pip install 'soup-cli'` — which succeeds and still leaves
+  the feature broken. Affected `[eval]`, `[data]`, `[serve]`, `[ui]`, `[tui]`,
+  `[compile]`, `[mcp]`, `[carbon]` and others, including Typer help text.
+- Replay rows bypassed the image/audio path-traversal validation that the
+  primary dataset receives.
+
+### Known limitations
+
+- **Semantic dedup is not a paraphrase detector.** Measured with
+  all-MiniLM-L6-v2, paraphrase cosines (0.49–0.76) **overlap** with
+  genuinely-distinct rows (0.54–0.76): "Add two numbers" vs "Multiply two
+  numbers" scores 0.759, *higher* than the true paraphrase "reverse a string" /
+  "invert the order of characters" at 0.491. **No threshold separates them**, so
+  lowering `--threshold` to chase paraphrases deletes real training rows. The
+  default (0.8) is deliberately conservative.
+- **Replay is validated at proof-of-mechanism scale.** On SmolLM2-135M + LoRA,
+  replay retained the old task 7% better than a no-replay control — the correct
+  direction — but forgetting without it was only +4%, i.e. mild. The effect size
+  at full fine-tuning or 7B+ is unproven on a 4 GB box.
+- **Canary exposure is the sampled-control approximation**, not full-space rank
+  enumeration. "No exposure" is not proof of no memorization.
+- **`data topics` / `dedup --semantic` require `[train]`** (torch) and download
+  an embedding model. Plain MinHash `dedup` stays on the light core.
+- Replay v1 is `sft`/`pretrain` only and is incompatible with
+  `packing`/`multipack`.
+
 ## [0.71.35] - 2026-07-15
 
 ### Added

{soup_cli-0.71.35 → soup_cli-0.71.37}/CONTRIBUTING.md

@@ -120,7 +120,7 @@ src/soup_cli/
   templates/          - 21 built-in soup.yaml templates (YAML + manifest.json) with load_template loader (v0.39.0, +bco v0.40.0, +4 compliance v0.71.35)
   ui/                 - Web UI (FastAPI + HTML/JS SPA)
 
-tests/                - Test suite (313 files, 16001 tests)
+tests/                - Test suite (315 files, 16288 tests)
 examples/             - Real-world config examples and datasets
 ```
 
@@ -150,7 +150,7 @@ pytest tests/test_data.py::test_detect_alpaca_format -v
 pytest tests/ --cov=soup_cli --cov-report=html
 ```
 
-### Test Files (307 files)
+### Test Files (313 files)
 
 > A representative sample of the suite below. Run `pytest tests/ -v` for the complete list.
 
@@ -388,7 +388,7 @@ If adding a new training algorithm:
 
 1. Create `trainer/your_trainer.py` wrapping the appropriate TRL trainer
 2. Add config fields to `config/schema.py` (Pydantic v2)
-3. Add template to `config/schema.py` (see existing 15 templates)
+3. Add a template YAML under `src/soup_cli/templates/` + a `manifest.json` entry (see the existing 21 templates)
 4. Update `commands/train.py` to route to your trainer
 5. Add 30+ tests in `tests/test_your_trainer.py`
 6. Update `README.md` + the relevant page under `docs/`

{soup_cli-0.71.35 → soup_cli-0.71.37}/CONTRIBUTORS.md

@@ -52,6 +52,8 @@ Listed by first contribution. PR numbers link the work.
   - Honor configured vocab expansion in the ORPO / SimPO / GRPO trainers ([#295](https://github.com/MakazhanAlpamys/Soup/pull/295))
 - **Ekaanksh Patil** ([@Ekaanksh-dev](https://github.com/Ekaanksh-dev))
   - Batch the PRM reward forward pass in `PRMScorer.__call__` (single `[B, T]` forward) ([#301](https://github.com/MakazhanAlpamys/Soup/pull/301))
+- **Sanjay Santhanam** ([@Sanjays2402](https://github.com/Sanjays2402))
+  - Run built-in benchmark gate tasks through `ForgettingDetector` — every `type: benchmark` eval-gate task had always failed ([#315](https://github.com/MakazhanAlpamys/Soup/pull/315))
 
 ---
 

{soup_cli-0.71.35 → soup_cli-0.71.37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: soup-cli
-Version: 0.71.35
+Version: 0.71.37
 Summary: Fine-tune and post-train LLMs in one command. No SSH, no config hell.
 Project-URL: Homepage, https://github.com/MakazhanAlpamys/Soup
 Project-URL: Repository, https://github.com/MakazhanAlpamys/Soup
@@ -176,7 +176,7 @@ Description-Content-Type: text/markdown
 Soup turns the pain of LLM fine-tuning into a simple workflow. One config, one command, done.
 
 ```bash
-pip install 'soup-cli[train]'   # add [train] to fine-tune; bare `soup-cli` is the light CLI
+pip install "soup-cli[train]"   # add [train] to fine-tune; bare `soup-cli` is the light CLI
 soup init --template chat
 soup train
 ```
@@ -193,34 +193,36 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.71.35 — the compliance pack.** Ship a regulated fine-tune with the paperwork it needs: start from a regulation-shaped config, publish a provenance-carrying model card, and gate every PR in CI.
-
-- **`soup init --template hipaa|soc2|eu-ai-act|sr-11-7`.** Four regulation-shaped starting
-  configs, each documenting the exact commands for that regime — PHI scrubbing + air-gap,
-  BOM/attest/sign, EU Annex XI + energy tracking, or repro-receipt + diagnose/ship.
-- **`soup card <registry-id>` → `MODELCARD.md`.** Turn a registry entry into a publishable HF
-  model card: training config, eval scorecard, config/data hashes, lineage, and every
-  registered artifact. `soup push --card` uploads it as the README, so every public push
-  carries its provenance.
-- **`soup ci init` — fine-tuning CI.** Writes a GitHub Actions gate that runs
-  `data validate` → `expect` → `ship --evidence` on each PR; a regression exits 2 and
-  blocks the merge.
-- **Compliance quickstart** ([docs/compliance.md](docs/compliance.md)) — the whole path from
-  template to air-gapped, signed, attested, carded model.
-- **GGUF export fixed on Windows.** Validated end-to-end for the first time (SmolLM2 →
-  q4_0/q4_k_m/q8_0/f16 → Ollama → live inference), which surfaced four real bugs: the export
-  cloned llama.cpp into your *current directory*, its first run **downgraded your PyTorch to
-  CPU-only** (breaking CUDA), a correctly-built llama.cpp wasn't found under MSVC, and
-  `deploy ollama` rejected relative GGUF paths. All fixed.
-- **Hardening:** the model-card generator (including the existing `soup push` card) no longer
-  interpolates unescaped config values — a crafted `base`/`scheduler` can't smuggle HTML into
-  a card published on the Hub.
+**v0.71.36 — Data Moat II.** A semantic layer over your training data, plus two tools for what a fine-tune forgets and what it leaks.
+
+- **`soup data dedup --semantic`** — dedup by meaning, not by shared tokens. Catches
+  *reworded* duplicates MinHash's shingling scores as distinct. Zero new dependencies.
+- **`soup data topics <data>`** — cluster your data and get a coverage table
+  (`82% code · 6% math · 1% safety`) with a warning for thin topics, so you can see what
+  you are actually training on.
+- **`soup data canary insert|check`** — insert unique secrets, then prove whether a model
+  memorized them: each secret's loss is ranked against never-inserted controls. Exit 2 on a
+  leak, so CI can gate. On SmolLM2-135M a memorized set lands at percentile 0.0 against a
+  clean model's 4%–93% spread.
+- **`soup train --replay old.jsonl`** — continual-learning rehearsal: interleave your old
+  data so the new task doesn't erase it.
+- **Honest result:** semantic dedup is **not** a paraphrase detector. Measured, paraphrase
+  cosines (0.49–0.76) *overlap* with genuinely-distinct rows (0.54–0.76) — "Add two numbers"
+  vs "Multiply two numbers" scores **higher** than a real paraphrase — so no threshold
+  separates them. The default is deliberately conservative; see the CHANGELOG.
+- **Two blocking bugs fixed:** the hardware-fit gate **refused to train any model you merged
+  yourself** (a local checkpoint's name has no size marker, so it guessed 7B and predicted
+  16 GB), and every `pip install "soup-cli[extra]"` hint printed **without the extra** —
+  17 sites where the suggested command succeeds and leaves the feature still broken.
 
 ```bash
-soup adapters arithmetic "coder - toxic" \
-  --adapter coder=./coder-lora --adapter toxic=./toxic-lora -o ./cleaned
+soup data topics train.jsonl                    # what am I actually training on?
+soup data dedup train.jsonl --semantic -o clean.jsonl
 
-soup train --config sft.yaml   # with training.lisa_enabled: true, lisa_num_layers: 2
+soup data canary insert train.jsonl -o canaried.jsonl --manifest secrets.json
+soup data canary check --manifest secrets.json --base ./my-model  # exit 2 = leak
+
+soup train --config sft.yaml --replay old_task.jsonl --replay-ratio 0.1
 ```
 
 <details>
@@ -246,11 +248,38 @@ Full history: [CHANGELOG.md](CHANGELOG.md) &middot; [GitHub Releases](https://gi
 ### 1. Install
 
 ```bash
-pip install soup-cli            # light: CLI + config + data tools (no PyTorch)
-pip install 'soup-cli[train]'   # add the training stack (torch, transformers, peft, trl, …)
-pip install git+https://github.com/MakazhanAlpamys/Soup.git   # latest dev
+# Light core: CLI + config + data tools, no PyTorch
+pip install soup-cli
+
+# Add the training stack (torch, transformers, peft, trl, datasets, …)
+pip install "soup-cli[train]"
+
+# Everything (train + serve + ui + data) in one shot
+pip install "soup-cli[all]"
+
+# Or from GitHub (latest dev)
+pip install git+https://github.com/MakazhanAlpamys/Soup.git
 ```
 
+The full extras table (`fast`, `mlx`, `serve`, `eval`, `ui`, `vision`, `audio`, …) lives in
+[`docs/models.md`](docs/models.md#optional-extras).
+
+> **Use double quotes around the extra.** They are the only spelling that works in
+> every shell — `cmd.exe`, PowerShell, bash, and zsh.
+>
+> Older tutorials and videos (including some of ours) show the single-quoted
+> `pip install 'soup-cli[train]'`. That is bash / zsh / PowerShell syntax, and it
+> fails on Windows `cmd.exe`, which has no single-quote quoting and hands the
+> quotes straight to pip:
+>
+> ```
+> ERROR: Invalid requirement: "'soup-cli[train]'": Expected package name at the start of dependency specifier
+> ```
+>
+> If you hit that, swap the `'` for `"` — pip is rejecting a literal quote
+> character, nothing is wrong with the package. (Dropping the quotes entirely
+> works on Windows too, but zsh then reads `[train]` as a glob and fails.)
+
 `soup init`, `soup data …`, and the other data/inspection commands work on the light install.
 Fine-tuning (`soup train`) needs the `[train]` extra.
 
@@ -285,7 +314,7 @@ A complete `soup.yaml`:
 ```yaml
 base: meta-llama/Llama-3.1-8B-Instruct
 task: sft
-# backend: unsloth  # 2-5x faster, pip install 'soup-cli[fast]'
+# backend: unsloth  # 2-5x faster, pip install "soup-cli[fast]"
 
 data:
   train: ./data/train.jsonl
@@ -320,6 +349,7 @@ The full feature reference lives in [`docs/`](docs/). Start here:
 | [Evaluation & probes](docs/evaluation.md) | Eval design/gate, eval-gated training, benchmarks, NLG metrics, calibration, Elo arena, diagnose, post-train X-ray probes, A/B, drift, tunability, `soup advise` |
 | [Serving & export](docs/serving-and-export.md) | OpenAI-compatible server, batch inference, benchmarking, merge/export, Anthropic Messages endpoint, speculative decoding (train + measure your own draft), deploy autopilot, Web UI, Agent Forge |
 | [Adapters, registry & governance](docs/adapters-and-governance.md) | Adapter lifecycle/management, model registry, Soup Cans, the data flywheel (`soup loop`), knowledge editing, steering, supply-chain controls (scan/sign/BOM/attest/audit/airgap) |
+| [Compliance & governance quickstart](docs/compliance.md) | HIPAA/SOC2/EU-AI-Act/SR-11-7 `init` templates, provenance (BOM/attest/repro-receipt), audit log, air-gap, model-card autogen (`soup card`), CI gate (`soup ci init`) |
 | [Backends, platform & ops](docs/backends-and-ops.md) | MLX/Unsloth backends, alternative hubs, HF Hub integration, autopilot, experiment tracking, plan/apply, env lockfiles, hardware-fit, completions, plugins, utility commands |
 | [Command reference](docs/commands.md) | The full `soup` command list |
 | [Supported models & extras](docs/models.md) | Recommended model families, the VRAM size guide, the pip extras matrix |

{soup_cli-0.71.35 → soup_cli-0.71.37}/README.md

@@ -32,7 +32,7 @@
 Soup turns the pain of LLM fine-tuning into a simple workflow. One config, one command, done.
 
 ```bash
-pip install 'soup-cli[train]'   # add [train] to fine-tune; bare `soup-cli` is the light CLI
+pip install "soup-cli[train]"   # add [train] to fine-tune; bare `soup-cli` is the light CLI
 soup init --template chat
 soup train
 ```
@@ -49,34 +49,36 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.71.35 — the compliance pack.** Ship a regulated fine-tune with the paperwork it needs: start from a regulation-shaped config, publish a provenance-carrying model card, and gate every PR in CI.
-
-- **`soup init --template hipaa|soc2|eu-ai-act|sr-11-7`.** Four regulation-shaped starting
-  configs, each documenting the exact commands for that regime — PHI scrubbing + air-gap,
-  BOM/attest/sign, EU Annex XI + energy tracking, or repro-receipt + diagnose/ship.
-- **`soup card <registry-id>` → `MODELCARD.md`.** Turn a registry entry into a publishable HF
-  model card: training config, eval scorecard, config/data hashes, lineage, and every
-  registered artifact. `soup push --card` uploads it as the README, so every public push
-  carries its provenance.
-- **`soup ci init` — fine-tuning CI.** Writes a GitHub Actions gate that runs
-  `data validate` → `expect` → `ship --evidence` on each PR; a regression exits 2 and
-  blocks the merge.
-- **Compliance quickstart** ([docs/compliance.md](docs/compliance.md)) — the whole path from
-  template to air-gapped, signed, attested, carded model.
-- **GGUF export fixed on Windows.** Validated end-to-end for the first time (SmolLM2 →
-  q4_0/q4_k_m/q8_0/f16 → Ollama → live inference), which surfaced four real bugs: the export
-  cloned llama.cpp into your *current directory*, its first run **downgraded your PyTorch to
-  CPU-only** (breaking CUDA), a correctly-built llama.cpp wasn't found under MSVC, and
-  `deploy ollama` rejected relative GGUF paths. All fixed.
-- **Hardening:** the model-card generator (including the existing `soup push` card) no longer
-  interpolates unescaped config values — a crafted `base`/`scheduler` can't smuggle HTML into
-  a card published on the Hub.
+**v0.71.36 — Data Moat II.** A semantic layer over your training data, plus two tools for what a fine-tune forgets and what it leaks.
+
+- **`soup data dedup --semantic`** — dedup by meaning, not by shared tokens. Catches
+  *reworded* duplicates MinHash's shingling scores as distinct. Zero new dependencies.
+- **`soup data topics <data>`** — cluster your data and get a coverage table
+  (`82% code · 6% math · 1% safety`) with a warning for thin topics, so you can see what
+  you are actually training on.
+- **`soup data canary insert|check`** — insert unique secrets, then prove whether a model
+  memorized them: each secret's loss is ranked against never-inserted controls. Exit 2 on a
+  leak, so CI can gate. On SmolLM2-135M a memorized set lands at percentile 0.0 against a
+  clean model's 4%–93% spread.
+- **`soup train --replay old.jsonl`** — continual-learning rehearsal: interleave your old
+  data so the new task doesn't erase it.
+- **Honest result:** semantic dedup is **not** a paraphrase detector. Measured, paraphrase
+  cosines (0.49–0.76) *overlap* with genuinely-distinct rows (0.54–0.76) — "Add two numbers"
+  vs "Multiply two numbers" scores **higher** than a real paraphrase — so no threshold
+  separates them. The default is deliberately conservative; see the CHANGELOG.
+- **Two blocking bugs fixed:** the hardware-fit gate **refused to train any model you merged
+  yourself** (a local checkpoint's name has no size marker, so it guessed 7B and predicted
+  16 GB), and every `pip install "soup-cli[extra]"` hint printed **without the extra** —
+  17 sites where the suggested command succeeds and leaves the feature still broken.
 
 ```bash
-soup adapters arithmetic "coder - toxic" \
-  --adapter coder=./coder-lora --adapter toxic=./toxic-lora -o ./cleaned
+soup data topics train.jsonl                    # what am I actually training on?
+soup data dedup train.jsonl --semantic -o clean.jsonl
 
-soup train --config sft.yaml   # with training.lisa_enabled: true, lisa_num_layers: 2
+soup data canary insert train.jsonl -o canaried.jsonl --manifest secrets.json
+soup data canary check --manifest secrets.json --base ./my-model  # exit 2 = leak
+
+soup train --config sft.yaml --replay old_task.jsonl --replay-ratio 0.1
 ```
 
 <details>
@@ -102,11 +104,38 @@ Full history: [CHANGELOG.md](CHANGELOG.md) &middot; [GitHub Releases](https://gi
 ### 1. Install
 
 ```bash
-pip install soup-cli            # light: CLI + config + data tools (no PyTorch)
-pip install 'soup-cli[train]'   # add the training stack (torch, transformers, peft, trl, …)
-pip install git+https://github.com/MakazhanAlpamys/Soup.git   # latest dev
+# Light core: CLI + config + data tools, no PyTorch
+pip install soup-cli
+
+# Add the training stack (torch, transformers, peft, trl, datasets, …)
+pip install "soup-cli[train]"
+
+# Everything (train + serve + ui + data) in one shot
+pip install "soup-cli[all]"
+
+# Or from GitHub (latest dev)
+pip install git+https://github.com/MakazhanAlpamys/Soup.git
 ```
 
+The full extras table (`fast`, `mlx`, `serve`, `eval`, `ui`, `vision`, `audio`, …) lives in
+[`docs/models.md`](docs/models.md#optional-extras).
+
+> **Use double quotes around the extra.** They are the only spelling that works in
+> every shell — `cmd.exe`, PowerShell, bash, and zsh.
+>
+> Older tutorials and videos (including some of ours) show the single-quoted
+> `pip install 'soup-cli[train]'`. That is bash / zsh / PowerShell syntax, and it
+> fails on Windows `cmd.exe`, which has no single-quote quoting and hands the
+> quotes straight to pip:
+>
+> ```
+> ERROR: Invalid requirement: "'soup-cli[train]'": Expected package name at the start of dependency specifier
+> ```
+>
+> If you hit that, swap the `'` for `"` — pip is rejecting a literal quote
+> character, nothing is wrong with the package. (Dropping the quotes entirely
+> works on Windows too, but zsh then reads `[train]` as a glob and fails.)
+
 `soup init`, `soup data …`, and the other data/inspection commands work on the light install.
 Fine-tuning (`soup train`) needs the `[train]` extra.
 
@@ -141,7 +170,7 @@ A complete `soup.yaml`:
 ```yaml
 base: meta-llama/Llama-3.1-8B-Instruct
 task: sft
-# backend: unsloth  # 2-5x faster, pip install 'soup-cli[fast]'
+# backend: unsloth  # 2-5x faster, pip install "soup-cli[fast]"
 
 data:
   train: ./data/train.jsonl
@@ -176,6 +205,7 @@ The full feature reference lives in [`docs/`](docs/). Start here:
 | [Evaluation & probes](docs/evaluation.md) | Eval design/gate, eval-gated training, benchmarks, NLG metrics, calibration, Elo arena, diagnose, post-train X-ray probes, A/B, drift, tunability, `soup advise` |
 | [Serving & export](docs/serving-and-export.md) | OpenAI-compatible server, batch inference, benchmarking, merge/export, Anthropic Messages endpoint, speculative decoding (train + measure your own draft), deploy autopilot, Web UI, Agent Forge |
 | [Adapters, registry & governance](docs/adapters-and-governance.md) | Adapter lifecycle/management, model registry, Soup Cans, the data flywheel (`soup loop`), knowledge editing, steering, supply-chain controls (scan/sign/BOM/attest/audit/airgap) |
+| [Compliance & governance quickstart](docs/compliance.md) | HIPAA/SOC2/EU-AI-Act/SR-11-7 `init` templates, provenance (BOM/attest/repro-receipt), audit log, air-gap, model-card autogen (`soup card`), CI gate (`soup ci init`) |
 | [Backends, platform & ops](docs/backends-and-ops.md) | MLX/Unsloth backends, alternative hubs, HF Hub integration, autopilot, experiment tracking, plan/apply, env lockfiles, hardware-fit, completions, plugins, utility commands |
 | [Command reference](docs/commands.md) | The full `soup` command list |
 | [Supported models & extras](docs/models.md) | Recommended model families, the VRAM size guide, the pip extras matrix |

{soup_cli-0.71.35 → soup_cli-0.71.37}/docs/backends-and-ops.md

@@ -79,7 +79,7 @@ Fine-tune on M1-M4 Macs via Apple's [MLX](https://github.com/ml-explore/mlx) fra
 
 ```bash
 # Install MLX support
-pip install 'soup-cli[mlx]'
+pip install "soup-cli[mlx]"
 ```
 
 ```yaml
@@ -108,7 +108,7 @@ Use the [Unsloth](https://github.com/unslothai/unsloth) backend for significantl
 
 ```bash
 # Install unsloth support
-pip install 'soup-cli[fast]'
+pip install "soup-cli[fast]"
 ```
 
 Then add one line to your config:
@@ -143,7 +143,7 @@ app from your `soup.yaml` for serverless, per-second-billed GPU training. The co
 base64-embedded as **data** — no code interpolation, no secrets in the generated stub.
 
 ```bash
-pip install 'soup-cli[modal]'   # only needed for live submit
+pip install "soup-cli[modal]"   # only needed for live submit
 
 # Plan-only (default): write the stub + print the `modal run` command.
 soup train --config soup.yaml --cloud modal --gpu a100
@@ -585,7 +585,7 @@ Full-screen Textual dashboard. Two-pane: run list (left) + selected-run detail
 (right). `r` refreshes, `q` quits.
 
 ```bash
-pip install 'soup-cli[tui]'
+pip install "soup-cli[tui]"
 soup tui --refresh 1.0 --limit 50
 ```
 

{soup_cli-0.71.35 → soup_cli-0.71.37}/docs/commands.md

@@ -11,6 +11,7 @@ soup init [--template chat|code|...|audio]       Create config
 soup init --template hipaa|soc2|eu-ai-act|sr-11-7  Compliance-shaped starting config + the commands for that regime (v0.71.35)
 soup autopilot --model <id> --data d.jsonl --goal <g>  Zero-configsoup train --config soup.yaml                 Start training
 soup train --config soup.yaml --tensorboard   Train with TensorBoard logging
+soup train --config soup.yaml --replay old.jsonl --replay-ratio 0.1  Continual-learning rehearsal: interleave old data so the new task doesn't erase it (sft/pretrain)
 soup train --config soup.yaml --fsdp full_shard  Train with FSDP2
 soup train --config soup.yaml --deepspeed zero++  DeepSpeed ZeRO++ (quantized comms)
 soup train --config soup.yaml --gpus auto|N      Multi-GPU launch hint
@@ -77,6 +78,10 @@ soup data lint <path>                         Preference-data linter: length bia
 soup data convert <path> --to chatml          Convert between formats
 soup data merge data1.jsonl data2.jsonl       Combine datasets
 soup data dedup <path> --threshold 0.8        Remove duplicates (MinHash)
+soup data dedup <path> --semantic             Dedup by embedding cosine — catches rewordings MinHash misses ([train])
+soup data topics <path> [--clusters N|auto]   Cluster + c-TF-IDF labels + coverage table + thin-topic warnings ([train])
+soup data canary insert <path> -o <out> --manifest <m>  Insert K secrets to later prove memorization (manifest = SECRET)
+soup data canary check --manifest <m> --base <model>    Rank each secret's loss vs never-inserted controls; exit 2 = leak
 soup data stats <path>                        Extended statistics
 soup data generate --prompt "..." --count 100 Generate synthetic data
 soup data generate ... --provider ollama      Use local Ollama instance
@@ -250,9 +255,9 @@ soup adapters bisect <ckpt>... --eval-command "..."  Binary search over training
 soup lock write --base-sha <h> --dataset-sha <h> --env-hash <h>  Write soup.lock (v0.67.0)
 soup lock write --base-sha <h> --dataset-sha <h> --env-lock soup-env.lock  Auto-derive --env-hash from soup-env.lock (v0.71.1)
 soup lock show / soup lock check              Show + drift-check (exit 3 on drift)
-soup compile <program.py> --eval <suite> [--optimizer mipro|gepa|textgrad|copro|bootstrap_fewshot] [--plan-only]  DSPy / GEPA / TextGrad prompt-program compiler — live (v0.71.13; pip install 'soup-cli[compile]')
+soup compile <program.py> --eval <suite> [--optimizer mipro|gepa|textgrad|copro|bootstrap_fewshot] [--plan-only]  DSPy / GEPA / TextGrad prompt-program compiler — live (v0.71.13; pip install "soup-cli[compile]")
 soup distill-prompt --traces <jsonl> --teacher <m> --student <m> --strategy sft|preference|kl [--provider ollama|anthropic|vllm] [--base-url <url>] [--temperature F] [--max-rows N]  Distill prompt-heavy traces via a live teacher (v0.71.13)
-soup compile-tools <spec.json|yaml> --eval <jsonl> [--optimizer textgrad|gepa] [--plan-only]  TextGrad / GEPA tool-schema optimiser — live (v0.71.13; pip install 'soup-cli[compile]')
+soup compile-tools <spec.json|yaml> --eval <jsonl> [--optimizer textgrad|gepa] [--plan-only]  TextGrad / GEPA tool-schema optimiser — live (v0.71.13; pip install "soup-cli[compile]")
 soup apple-adapter <source-dir> --direction hf-to-mlx|mlx-to-hf|hf-to-apple|mlx-to-apple --output <dir> [--sign] [--plan-only]  PEFT LoRA <-> mlx-lm adapter conversion — live (v0.71.21; *-to-apple upstream-gated exit 3)
 soup local-rl init --db <path>                Create personal-LLM flywheel SQLite schema (v0.68.0)
 soup local-rl status --db <path>              Print interactions / thumbs-up / thumbs-down counters
@@ -294,7 +299,7 @@ server over **stdio**, so any MCP client — Claude Code, Cursor, Cline, Continu
 can drive Soup conversationally. Install the extra first:
 
 ```bash
-pip install 'soup-cli[mcp]'
+pip install "soup-cli[mcp]"
 ```
 
 Register it with your client. For **Claude Code** (`.mcp.json` in the repo) or