soup-cli 0.71.3__tar.gz → 0.71.4__tar.gz

{soup_cli-0.71.3 → soup_cli-0.71.4}/CHANGELOG.md

@@ -12,6 +12,51 @@ reproducing 70+ versions of notes.
 
 ## [Unreleased]
 
+## [0.71.4] - 2026-06-02
+
+### Added
+- **Live canary verdict for `soup adapters merge`** — `--canary <suite.json>`
+  scores the merged adapter against the first input and classifies
+  **OK / MINOR / MAJOR** using the Quant-Lobotomy taxonomy (drop <2% OK, <5%
+  MINOR, else MAJOR). `--strict-verdict` exits 2 on MAJOR. Pre-scored
+  `{"baseline_scores","candidate_scores"}` suites run with no model load; a
+  `{"tasks":[...]}` suite uses an injectable scorer. Replaces the v0.57 `UNKNOWN`
+  stub.
+- **Live evolutionary merge** — `soup adapters merge --strategy cmaes --eval
+  <suite> --budget <t>` now runs the full CMA-ES loop: each candidate is merged,
+  materialised, scored against the eval suite, and the best-weighted merge is
+  written to `--output`. Replaces the v0.67 plan-only stub.
+- **Publish an adapter PR to GitHub** — `soup adapters pr <title> --base-sha
+  <hex> --adapter <path> --push owner/repo#N` posts the rendered PR Markdown as a
+  GitHub PR comment via `gh api` (argv-list, body over JSON stdin; no shell).
+  Token resolves from `GITHUB_TOKEN` / `GH_TOKEN`.
+- **Pre-wired `soup loop` production stages** — `soup loop init --pre-wired` (or
+  `soup loop watch --pre-wired`) swaps the v0.58 no-op stage stubs for real
+  harvest (traces → preference pairs) → DPO train → eval-gate → canary-deploy
+  callables. `soup loop status` now shows the `pre_wired` flag.
+- **Loop iterations as Soup Cans + Registry lineage** — `soup loop watch
+  --pack-cans` packs each successful iteration as a v0.26 Soup Can and appends a
+  Registry entry (tag `loop-iter`), chaining a real lineage DAG across
+  iterations visible through `soup history`. `soup loop replay <id> --extract
+  <dir>` unpacks a recorded iteration.
+- **Branch pointers into the Registry** — `soup adapters branch <name>
+  --attach-to-registry <id>` links a branch snapshot to a Registry entry (shown
+  as a `branches` node in `soup history`); `soup adapters branch <name>
+  --from-registry <id>` derives a fresh snapshot's config + base from an entry.
+
+### Security
+- The backdoor-scan gate (v0.71.2 #192) and license-conflict gate (v0.60 Part E)
+  now run for **all** merge strategies, including `--strategy cmaes` (previously
+  bypassed because cmaes returned before the gates).
+- `soup loop` canary deploy restricts `SOUP_LOOP_SERVE_ENDPOINT` to loopback /
+  RFC1918-private hosts (a serve endpoint is the operator's own box/LAN), beyond
+  the general webhook SSRF policy which permits any HTTPS host.
+- `soup adapters pr --push` builds the `gh` child environment from an allowlist
+  so unrelated secrets (`HF_TOKEN` / `OPENAI_API_KEY` / …) never reach the
+  subprocess.
+- The canary-suite JSON read uses `O_NOFOLLOW` + `os.fstat` (size cap enforced on
+  the same fd) to close the symlink/size-cap TOCTOU window.
+
 ## [0.71.3] - 2026-06-01
 
 ### Added

{soup_cli-0.71.3 → soup_cli-0.71.4}/CONTRIBUTING.md

@@ -120,7 +120,7 @@ src/soup_cli/
   templates/          - 17 built-in soup.yaml templates (YAML + manifest.json) with load_template loader (v0.39.0, +bco v0.40.0)
   ui/                 - Web UI (FastAPI + HTML/JS SPA)
 
-tests/                - Test suite (273 files, 12342 tests)
+tests/                - Test suite (274 files, 12474 tests)
 examples/             - Real-world config examples and datasets
 ```
 

{soup_cli-0.71.3 → soup_cli-0.71.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: soup-cli
-Version: 0.71.3
+Version: 0.71.4
 Summary: Fine-tune LLMs in one command. No SSH, no config hell.
 Project-URL: Homepage, https://github.com/MakazhanAlpamys/Soup
 Project-URL: Repository, https://github.com/MakazhanAlpamys/Soup
@@ -183,19 +183,21 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.71.3 — Compliance / annex / audit / energy.** The EU AI Act + carbon + audit surfaces go live:
-
-- **Energy & CO2 measurement** — `soup train --track-energy` measures the training window with an
-  offline carbon tracker (no network) and reports kWh / CO2, feeding them into the Annex doc.
-  Install with `pip install soup-cli[carbon]`.
-- **PDF compliance docs** — `soup train --annex-xi report.pdf` now renders a real PDF of the
-  EU AI Act Annex XI/XII (a `.md` path still gives markdown). The top crawled domains of your
-  training corpus are auto-listed. `pip install soup-cli[pdf]`.
-- **Per-command audit log** — every `soup` command appends one HIPAA/SOC2 record to
-  `~/.soup/audit.jsonl` (secrets redacted). Opt out with `--no-audit-log` or `SOUP_NO_AUDIT_LOG=1`.
-- **Signed Soup Cans + airgap receipts** — `soup can pack --attest statement.json` embeds in-toto
-  attestations into a can; `soup airgap-bundle --repro-receipt receipt.json` ships a reproducibility
-  receipt inside the offline bundle.
+**v0.71.4 — Adapter lifecycle + loop wiring.** The merge, PR, and continuous-loop surfaces go live:
+
+- **Canary verdict on merge** — `soup adapters merge … --canary suite.json` scores the merged
+  adapter and reports **OK / MINOR / MAJOR**; `--strict-verdict` exits non-zero on a MAJOR
+  regression. Works with no model load using a pre-scored canary suite.
+- **Evolutionary merge for real** — `soup adapters merge --strategy cmaes --eval suite --budget 1h`
+  now runs the full CMA-ES search (merge → score → optimise) and writes the best blend, instead of
+  just printing a plan.
+- **Publish an adapter PR** — `soup adapters pr <title> --base-sha <hex> --adapter <path> --push
+  owner/repo#42` posts the rendered PR straight to a GitHub PR comment.
+- **Continuous fine-tuning loop, wired up** — `soup loop watch --pre-wired` runs the real
+  traces → DPO → eval-gate → canary pipeline; `--pack-cans` snapshots every iteration as a
+  shareable Soup Can with Registry lineage (`soup loop replay <id> --extract dir`).
+- **Branches ↔ Registry** — `soup adapters branch <name> --attach-to-registry <id>` /
+  `--from-registry <id>` links training-env snapshots into the Registry lineage DAG.
 
 Full history: [CHANGELOG.md](CHANGELOG.md) &middot; [GitHub Releases](https://github.com/MakazhanAlpamys/Soup/releases).
 

{soup_cli-0.71.3 → soup_cli-0.71.4}/README.md

@@ -49,19 +49,21 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.71.3 — Compliance / annex / audit / energy.** The EU AI Act + carbon + audit surfaces go live:
-
-- **Energy & CO2 measurement** — `soup train --track-energy` measures the training window with an
-  offline carbon tracker (no network) and reports kWh / CO2, feeding them into the Annex doc.
-  Install with `pip install soup-cli[carbon]`.
-- **PDF compliance docs** — `soup train --annex-xi report.pdf` now renders a real PDF of the
-  EU AI Act Annex XI/XII (a `.md` path still gives markdown). The top crawled domains of your
-  training corpus are auto-listed. `pip install soup-cli[pdf]`.
-- **Per-command audit log** — every `soup` command appends one HIPAA/SOC2 record to
-  `~/.soup/audit.jsonl` (secrets redacted). Opt out with `--no-audit-log` or `SOUP_NO_AUDIT_LOG=1`.
-- **Signed Soup Cans + airgap receipts** — `soup can pack --attest statement.json` embeds in-toto
-  attestations into a can; `soup airgap-bundle --repro-receipt receipt.json` ships a reproducibility
-  receipt inside the offline bundle.
+**v0.71.4 — Adapter lifecycle + loop wiring.** The merge, PR, and continuous-loop surfaces go live:
+
+- **Canary verdict on merge** — `soup adapters merge … --canary suite.json` scores the merged
+  adapter and reports **OK / MINOR / MAJOR**; `--strict-verdict` exits non-zero on a MAJOR
+  regression. Works with no model load using a pre-scored canary suite.
+- **Evolutionary merge for real** — `soup adapters merge --strategy cmaes --eval suite --budget 1h`
+  now runs the full CMA-ES search (merge → score → optimise) and writes the best blend, instead of
+  just printing a plan.
+- **Publish an adapter PR** — `soup adapters pr <title> --base-sha <hex> --adapter <path> --push
+  owner/repo#42` posts the rendered PR straight to a GitHub PR comment.
+- **Continuous fine-tuning loop, wired up** — `soup loop watch --pre-wired` runs the real
+  traces → DPO → eval-gate → canary pipeline; `--pack-cans` snapshots every iteration as a
+  shareable Soup Can with Registry lineage (`soup loop replay <id> --extract dir`).
+- **Branches ↔ Registry** — `soup adapters branch <name> --attach-to-registry <id>` /
+  `--from-registry <id>` links training-env snapshots into the Registry lineage DAG.
 
 Full history: [CHANGELOG.md](CHANGELOG.md) &middot; [GitHub Releases](https://github.com/MakazhanAlpamys/Soup/releases).
 

{soup_cli-0.71.3 → soup_cli-0.71.4}/docs/adapters-and-governance.md

@@ -34,6 +34,8 @@ v0.57 shipped `adapters diff / merge / blame / branch`. v0.67 finishes the lifec
 
 ```bash
 # 1. Evolutionary merge: search the simplex of merge weights via CMA-ES.
+#    v0.71.4 makes this a LIVE loop — each candidate is merged, scored against
+#    --eval, and the best blend is written to --output.
 soup adapters merge \
   adapter-finance/ adapter-medical/ adapter-legal/ \
   --strategy cmaes \
@@ -43,6 +45,12 @@ soup adapters merge \
   --max-generations 20 \
   --output merged/
 
+# 1b. One-shot merge with a live canary verdict (v0.71.4). Scores the merged
+#     adapter vs the first input → OK / MINOR / MAJOR; --strict-verdict exits 2
+#     on a MAJOR regression. A pre-scored canary suite needs no model load.
+soup adapters merge adapter-a/ adapter-b/ -o merged/ \
+  --canary evals/canary.json --strict-verdict
+
 # 2. Render the merge as a GitHub PR for review (eval deltas + sample diffs).
 soup adapters pr "merge: 3-domain blend" \
   --base-sha $(git rev-parse HEAD) \
@@ -52,6 +60,12 @@ soup adapters pr "merge: 3-domain blend" \
   --dataset-diff data/diff.txt \
   --format markdown -o pr.md
 
+# 2b. Post it straight to a GitHub PR comment (v0.71.4). Auth via GITHUB_TOKEN
+#     / GH_TOKEN; uses `gh api` under the hood (no secret leaks to the child).
+soup adapters pr "merge: 3-domain blend" \
+  --base-sha $(git rev-parse HEAD) --adapter merged/ \
+  --eval evals/deltas.json --push your-org/your-repo#42
+
 # 3. Lock a reproducible run state. Closure = sha(base + dataset + env).
 soup env lock                                     # v0.64 — capture env hash
 soup lock write \
@@ -93,6 +107,16 @@ soup loop status
 # Run the daemon (foreground)
 soup loop watch --poll-interval 300
 
+# Pre-wired production stages (v0.71.4): real traces → DPO → eval-gate → canary,
+# instead of the v0.58 no-op stubs. Opt in once via `loop init --pre-wired` or
+# per-run via --pre-wired. Pack each iteration as a shareable Soup Can with
+# Registry lineage via --pack-cans.
+soup loop init registry://abc12 --eval evals/lock.json --baseline registry://prod --pre-wired
+soup loop watch --pre-wired --pack-cans --poll-interval 300
+
+# Unpack a recorded iteration's Soup Can for what-if analysis (v0.71.4)
+soup loop replay iter-20260515T120000-abcdef01 --extract ./iter-dump
+
 # Background subprocess (writes PID, no shell)
 soup loop watch --detach
 
@@ -240,6 +264,14 @@ soup adapters blame ./run-v18 --dataset train.jsonl --layer q_proj.7 \
 soup adapters branch v18 --config soup.yaml --base meta-llama/Llama-3.1-8B \
   --dataset train.jsonl
 
+# Link a branch into the Registry lineage DAG (v0.71.4) — shows as a
+# `branches` node under the entry in `soup history`.
+soup adapters branch v18 --config soup.yaml --base meta-llama/Llama-3.1-8B \
+  --attach-to-registry reg_20260601_abc123
+
+# Or derive a fresh snapshot's config + base straight from a Registry entry (v0.71.4)
+soup adapters branch v18-from-reg --from-registry reg_20260601_abc123
+
 # Restore the snapshot's config (refuses if source SHA drifted)
 soup adapters checkout v18 --output soup.yaml
 
@@ -264,7 +296,9 @@ soup adapters branches
 - Branch pointers live under `~/.soup/branches/` (override via `SOUP_BRANCHES_DIR`, constrained to `$HOME` / `$CWD` / `$TMPDIR`).
 - `soup adapters checkout` SHA-checks the source config — refuses to restore when the source has drifted from the snapshot, so reproducibility never silently lies.
 
-**v0.66.0:** `soup adapters blame` is now LIVE — the v0.57 `NotImplementedError` stub (#171) is lifted via a DataInf-style influence-function approximation. Pass `--top-k 50` to control the reported top-influencer count; pass a real `probe_fn` (Python API) to feed real gradients, or use the default deterministic synthetic probe for offline planning. `MergeReport.verdict` remains the `UNKNOWN` stub (live canary eval in v0.57.1).
+**v0.66.0:** `soup adapters blame` is now LIVE — the v0.57 `NotImplementedError` stub (#171) is lifted via a DataInf-style influence-function approximation. Pass `--top-k 50` to control the reported top-influencer count; pass a real `probe_fn` (Python API) to feed real gradients, or use the default deterministic synthetic probe for offline planning.
+
+**v0.71.4:** the merge verdict is now LIVE — `soup adapters merge … --canary suite.json` lifts the `MergeReport.verdict` `UNKNOWN` stub. A pre-scored `{"baseline_scores","candidate_scores"}` suite classifies the blend OK / MINOR / MAJOR with no model load; a `{"tasks":[...]}` suite uses an injectable scorer. `--strict-verdict` exits 2 on MAJOR. The backdoor-scan and license-conflict gates now run for **every** strategy, including `cmaes`. `soup adapters branch <name> --from-registry <id>` / `--attach-to-registry <id>` link training-env snapshots into the Registry lineage DAG (shown as a `branches` node in `soup history`).
 
 
 ## Soup Cans (Shareable Recipes)

{soup_cli-0.71.3 → soup_cli-0.71.4}/docs/commands.md

@@ -109,12 +109,12 @@ soup cost --config soup.yaml --gpu H100      Estimate training cost for specific
 soup adapters list ./output/                 Scan for LoRA adapters
 soup adapters info ./output/checkpoint-500/  Show adapter metadata
 soup adapters compare adapter1/ adapter2/    Compare two adapters
-soup loop init <model> --eval <s> --baseline <b>  Create .soup/loop.yaml (data flywheel)
-soup loop status                              Counters + status (traces / pairs / runs / shipped)
-soup loop watch [--detach] [--max-iter N]    Harvest → train → gate → deploy daemon
+soup loop init <model> --eval <s> --baseline <b> [--pre-wired]  Create .soup/loop.yaml (data flywheel; --pre-wired = real stages)
+soup loop status                              Counters + status + pre_wired flag
+soup loop watch [--detach] [--max-iter N] [--pre-wired] [--pack-cans]  Harvest → train → gate → deploy daemon (pre-wired stages + Soup Can packing)
 soup loop pause / soup loop resume           Atomic status flip
 soup loop canary <adapter> --traffic 5%      Promote canary + auto-rollback on MAJOR
-soup loop replay [<iter-id>]                 Replay a recorded iteration manifest
+soup loop replay [<iter-id>] [--extract <dir>]  Replay / unpack a recorded iteration manifest
 soup serve --model m --adapters chat=./c code=./d  Multi-adapter serving
 soup migrate --from llamafactory config.yaml  Import config from LLaMA-Factory
 soup migrate --from axolotl config.yml        Import config from Axolotl
@@ -188,8 +188,11 @@ soup probe interference <losses.json> [--output o.json]  Pairwise N×N adapter i
 soup probe pack <base> [--output o.json]      Per-base calibrated probe pack manifest (v0.66.0)
 soup probe pack --list                        List bundled probe-pack bases (v0.66.0)
 soup adapters blame ... --top-k 50            Live DataInf-style influence runner (v0.66.0, closes #171)
-soup adapters merge ... --strategy cmaes --eval <s> --budget 1h  CMA-ES evolutionary merge (v0.67.0)
+soup adapters merge ... --strategy cmaes --eval <s> --budget 1h  CMA-ES evolutionary merge — live loop (v0.67.0 schema / v0.71.4 live)
+soup adapters merge ... --canary <suite.json> [--strict-verdict]  Live OK/MINOR/MAJOR canary verdict, exit 2 on MAJOR (v0.71.4)
 soup adapters pr <title> --base-sha <hex> --adapter <path>  GitHub-shaped adapter PR Markdown / JSON (v0.67.0)
+soup adapters pr <title> ... --push owner/repo#N  Post the PR as a GitHub comment via gh api (v0.71.4)
+soup adapters branch <name> --from-registry <id> | --attach-to-registry <id>  Branch ↔ Registry lineage (v0.71.4)
 soup adapters bisect <ckpt>... --eval-command "..."  Binary search over training history (v0.67.0)
 soup lock write --base-sha <h> --dataset-sha <h> --env-hash <h>  Write soup.lock (v0.67.0)
 soup lock write --base-sha <h> --dataset-sha <h> --env-lock soup-env.lock  Auto-derive --env-hash from soup-env.lock (v0.71.1)

{soup_cli-0.71.3 → soup_cli-0.71.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "soup-cli"
-version = "0.71.3"
+version = "0.71.4"
 description = "Fine-tune LLMs in one command. No SSH, no config hell."
 readme = "README.md"
 license = "Apache-2.0"

{soup_cli-0.71.3 → soup_cli-0.71.4}/src/soup_cli/__init__.py

@@ -1,3 +1,3 @@
 """Soup CLI — Fine-tune LLMs in one command."""
 
-__version__ = "0.71.3"
+__version__ = "0.71.4"