tokenfold-select-runtime 0.6.0__py3-none-any.whl

tokenfold_select_runtime/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.6.0"

tokenfold_select_runtime/__main__.py

@@ -0,0 +1,10 @@
+import sys
+if __name__ == '__main__':
+    if len(sys.argv)>1 and sys.argv[1]=='provision':
+        from .provision import main
+        main(sys.argv[2:])
+    elif sys.argv[1:]==['worker']:
+        from .worker import main
+        raise SystemExit(main())
+    else:
+        raise SystemExit('expected provision or worker')

tokenfold_select_runtime/ettin.py

@@ -0,0 +1,222 @@
+"""Explicit, unqualified Ettin Select-v3 scorer for a dedicated owned process.
+
+No downloads, trainer imports, base-weight loading, generation or CPU fallback.
+512-group/multiwindow admission is an experimental inference policy, not evidence
+that the development fit covered those shapes. Existing v2 APIs are unchanged.
+"""
+import importlib.metadata
+import json
+import os
+from pathlib import Path
+import re
+
+from .integrity import sha
+from .protocol import RESPONSE_BYTES, decode, encode_response, validate_request
+
+PROFILE = 'ettin7999-whole-group-query-repeat-v1'
+CONTEXT = 7999
+MAX_WINDOWS = 64
+MAX_TOTAL_TOKENS = MAX_WINDOWS * CONTEXT
+LIMITS = dict(tokens=CONTEXT, groups=512, windows=MAX_WINDOWS,
+              total_tokens=MAX_TOTAL_TOKENS, request_bytes=1048576, response_bytes=65536)
+CAPS = {'model.safetensors': 1024**3, 'config.json': 65536,
+        'tokenizer.json': 32*1024**2, 'tokenizer_config.json': 65536}
+ENVIRONMENT = {'torch': '2.11.0+cu128', 'transformers': '5.19.0', 'safetensors': '0.8.0',
+               'tokenizers': '0.23.2', 'huggingface_hub': '1.33.0'}
+
+
+def inspect_bundle(directory, manifest_sha256):
+    """Caller-pinned, confined byte/geometry inspection, never rights/quality proof."""
+    root = Path(directory)
+    if not root.is_absolute() or not isinstance(manifest_sha256, str) or not re.fullmatch('[0-9a-f]{64}', manifest_sha256):
+        raise ValueError('absolute_bundle_and_exact_manifest_pin_required')
+    root = root.resolve(strict=True)
+    path = root / 'ettin-manifest.json'
+    if not path.resolve(strict=True).is_relative_to(root) or sha(path, 65536) != manifest_sha256:
+        raise ValueError('ettin_manifest_pin_mismatch')
+    manifest = decode(path.read_bytes())
+    if (not isinstance(manifest, dict)
+            or manifest.get('kind') != 'tokenfold-select-v3-ettin-joint-development-bundle-v1'
+            or manifest.get('profile') != PROFILE or manifest.get('limits') != LIMITS
+            or manifest.get('base_model') != dict(repository='cross-encoder/ettin-reranker-150m-v1',
+                revision='025501c4e0f9bbeb4c5b198318e0089ff061cc14')
+            or manifest.get('architecture') != 'EttinJointGroupMeanNonlinear-v1'
+            or manifest.get('trained_group_cap') != 24
+            or manifest.get('qualification') is not False or manifest.get('publication_authorized') is not False
+            or not isinstance(manifest.get('revision'), str) or not re.fullmatch('[0-9a-f]{64}', manifest['revision'])
+            or not isinstance(manifest.get('files'), dict) or set(manifest['files']) != set(CAPS)):
+        raise ValueError('exact_unqualified_ettin_bundle_profile_required')
+    for name, cap in CAPS.items():
+        path = root / name
+        pin = manifest['files'][name]
+        if (not path.resolve(strict=True).is_relative_to(root) or not isinstance(pin, dict)
+                or set(pin) != {'bytes', 'sha256'}
+                or type(pin['bytes']) is not int or not 0 < pin['bytes'] <= cap
+                or path.stat().st_size != pin['bytes'] or sha(path, cap) != pin['sha256']):
+            raise ValueError('ettin_bundle_file_pin_mismatch')
+    if manifest['files']['model.safetensors']['sha256'] != manifest['revision']:
+        raise ValueError('checkpoint_revision_mismatch')
+    config = decode((root / 'config.json').read_bytes())
+    if (not isinstance(config, dict) or config.get('architectures') != ['ModernBertModel'] or config.get('hidden_size') != 768
+            or config.get('num_hidden_layers') != 22 or config.get('max_position_embeddings') != CONTEXT
+            or config.get('vocab_size') != 50368):
+        raise ValueError('complete_original_ettin_geometry_required')
+    return manifest
+
+
+def pack_windows(tokenizer, request, revision):
+    """Admit all original groups/windows BEFORE any model construction/forward."""
+    request = validate_request(request, revision)
+    # Conservative finite-FP32 JSON score allowance: reject before inference,
+    # not after spending GPU work on a response that cannot fit the protocol.
+    if len(encode_response(request, [0.0] * len(request['groups']))) + 32*len(request['groups']) > RESPONSE_BYTES:
+        raise ValueError('response_capacity_preflight')
+    tokenizer.no_truncation()
+    tokenizer.no_padding()
+    if tokenizer.token_to_id('[CLS]') != 50281 or tokenizer.token_to_id('[SEP]') != 50282:
+        raise ValueError('native_ettin_special_tokens_required')
+
+    def encode(text):
+        ids = tokenizer.encode(text, add_special_tokens=False).ids
+        if not ids or any(type(token) is not int or not 0 <= token < 50368 for token in ids):
+            raise ValueError('complete_nonempty_token_content_required')
+        return ids
+
+    query = [50281] + encode(request['query']) + [50282]
+    if len(query) + 2 > CONTEXT:
+        raise ValueError('query_context_cap')
+    content = [encode(group['text']) for group in request['groups']]
+    if any(len(query) + len(ids) + 1 > CONTEXT for ids in content):
+        raise ValueError('whole_group_context_cap')
+    windows = []
+    ids, ranges, indices = list(query), [], []
+    for index, tokens in enumerate(content):
+        if len(ids) + len(tokens) + 1 > CONTEXT:
+            windows.append((ids, ranges, indices))
+            ids, ranges, indices = list(query), [], []
+        start = len(ids)
+        ids.extend(tokens)
+        ranges.append((start, len(ids)))
+        ids.append(50282)
+        indices.append(index)
+    windows.append((ids, ranges, indices))
+    total = sum(len(window[0]) for window in windows)
+    if len(windows) > MAX_WINDOWS or total > MAX_TOTAL_TOKENS:
+        raise ValueError('whole_request_window_or_total_cap')
+    if [index for _, _, indices in windows for index in indices] != list(range(len(content))):
+        raise ValueError('complete_original_group_alignment_required')
+    return windows, dict(profile=PROFILE, windows=len(windows), groups=len(content),
+        total_encoded_tokens=total, max_window_tokens=max(len(window[0]) for window in windows),
+        context_copies=0, outside_training_group_counts=any(not 2 <= len(w[1]) <= 24 for w in windows),
+        cross_window_context_unqualified=len(windows) > 1, qualification=False)
+
+
+class EttinDevelopmentScorer:
+    """Concurrency one; caller owns original process lifetime/deadline/memory guards."""
+
+    def __init__(self, directory, manifest_sha256, *, development=False, precision=None, device='cuda:0'):
+        if (development is not True or device not in ('cpu', 'cuda:0')
+                or precision != ('fp32' if device == 'cpu' else 'fp32-parameters-bf16-autocast')):
+            raise ValueError('explicit_ettin_development_precision_required')
+        self.device = device
+        self.root = Path(directory).resolve()
+        self.pin = manifest_sha256
+        self.manifest = inspect_bundle(directory, manifest_sha256)
+        self.revision = self.manifest['revision']
+        self._tokenizer = self._model = self._torch = None
+        self.last_receipt = None
+
+    def _load(self):
+        cuda = self.device == 'cuda:0'
+        required = (('HF_HUB_OFFLINE', '1'), ('TRANSFORMERS_OFFLINE', '1'))
+        if cuda:
+            required += (('CUDA_VISIBLE_DEVICES', '0'),)
+        if any(os.environ.get(key) != value for key, value in required):
+            raise ValueError('explicit_cuda0_offline_environment_required' if cuda
+                             else 'explicit_cpu_offline_environment_required')
+        for name, expected in ENVIRONMENT.items():
+            actual = importlib.metadata.version(name)
+            if actual != expected and not (name == 'torch' and not cuda and actual in ('2.11.0', '2.11.0+cpu')):
+                raise ValueError('exact_ettin_runtime_environment_required')
+        inspect_bundle(self.root, self.pin)
+        import torch
+        from safetensors.torch import load_file
+        from transformers.initialization import no_init_weights
+        from transformers.models.modernbert.configuration_modernbert import ModernBertConfig
+        from transformers.models.modernbert.modeling_modernbert import ModernBertModel
+        if cuda:
+            if not torch.cuda.is_available() or not torch.cuda.is_bf16_supported():
+                raise ValueError('cuda_bf16_required_no_fallback')
+            torch.cuda.set_device(0)
+        torch.set_num_threads(1)
+        if torch.get_num_interop_threads() != 1:
+            torch.set_num_interop_threads(1)
+        if cuda:
+            torch.set_float32_matmul_precision('highest')
+            torch.backends.cuda.matmul.allow_tf32 = False
+            torch.backends.cudnn.allow_tf32 = False
+        config = ModernBertConfig.from_pretrained(self.root, local_files_only=True)
+        config._attn_implementation = 'sdpa'
+
+        class Model(torch.nn.Module):
+            def __init__(self):
+                super().__init__()
+                self.encoder = ModernBertModel(config)
+                self.head = torch.nn.Sequential(torch.nn.Linear(768, 768, bias=False), torch.nn.GELU(),
+                    torch.nn.LayerNorm(768, eps=1e-5), torch.nn.Linear(768, 1, bias=True))
+
+            def forward(self, input_ids, attention_mask, ranges):
+                if (input_ids.ndim != 2 or input_ids.shape[0] != 1
+                        or attention_mask.shape != input_ids.shape or input_ids.shape[1] > CONTEXT
+                        or not 1 <= len(ranges) <= 512 or not attention_mask.all()):
+                    raise ValueError('complete_single_joint_window_required')
+                previous = 0
+                for start, end in ranges:
+                    if not previous <= start < end <= input_ids.shape[1]:
+                        raise ValueError('ordered_nonempty_content_ranges_required')
+                    previous = end
+                states = self.encoder(input_ids=input_ids, attention_mask=attention_mask).last_hidden_state[0]
+                pooled = torch.stack([states[start:end].mean(0) for start, end in ranges])
+                return self.head(pooled).squeeze(-1)
+
+        with no_init_weights():
+            model = Model()
+        model.load_state_dict(load_file(str(self.root / 'model.safetensors'), device='cpu'), strict=True, assign=True)
+        if sum(p.numel() for p in model.parameters()) != 149606401 or any(p.dtype != torch.float32 for p in model.parameters()):
+            raise ValueError('complete_fp32_ettin_checkpoint_required')
+        model.to(self.device).eval()
+        if any(p.device != torch.device(self.device) for p in model.parameters()):
+            raise ValueError('actual_cuda0_placement_required' if cuda else 'actual_cpu_placement_required')
+        self._torch, self._model = torch, model
+
+    def admit(self, request):
+        request = validate_request(request, self.revision)
+        if self._tokenizer is None:
+            from tokenizers import Tokenizer
+            self._tokenizer = Tokenizer.from_file(str(self.root / 'tokenizer.json'))
+        windows, receipt = pack_windows(self._tokenizer, request, self.revision)
+        return windows, receipt
+
+    def score_admitted(self, request, windows, receipt):
+        if self._model is None:
+            self._load()
+        torch = self._torch
+        result = []
+        with torch.inference_mode():
+            for ids, ranges, indices in windows:
+                inputs = torch.tensor([ids], dtype=torch.long, device=self.device)
+                with (torch.autocast('cuda', dtype=torch.bfloat16, cache_enabled=False) if self.device == 'cuda:0'
+                      else torch.autocast('cpu', enabled=False)):
+                    scores = self._model(inputs, torch.ones_like(inputs), ranges)
+                if scores.ndim != 1 or len(scores) != len(indices) or not torch.isfinite(scores).all():
+                    raise ValueError('finite_aligned_ettin_scores_required')
+                if self.device == 'cuda:0':
+                    torch.cuda.synchronize(0)
+                result.extend(scores.float().cpu().tolist())
+        response = decode(encode_response(request, result))
+        self.last_receipt = receipt
+        return response
+
+    def score(self, request):
+        windows, receipt = self.admit(request)
+        return self.score_admitted(request, windows, receipt)

tokenfold_select_runtime/integrity.py

@@ -0,0 +1,59 @@
+"""Bounded integrity and immutable approval helpers, no ML imports."""
+import hashlib
+import json
+from pathlib import Path
+import re
+import sys
+from . import __version__
+from .protocol import decode
+
+SOURCE_FILES = ('__init__.py', '__main__.py', 'ettin.py', 'integrity.py', 'protocol.py', 'provision.py', 'worker.py')
+
+def sha(path, limit):
+    digest = hashlib.sha256()
+    total = 0
+    with Path(path).open('rb') as stream:
+        while chunk := stream.read(1024 * 1024):
+            total += len(chunk)
+            if total > limit: raise ValueError('artifact_byte_limit')
+            digest.update(chunk)
+    return digest.hexdigest()
+
+def source_digest(directory=None):
+    root = Path(directory or Path(__file__).parent).resolve(strict=True)
+    if any(p.name not in SOURCE_FILES and p.name != "__pycache__" for p in root.iterdir()): raise ValueError("unapproved_source_entry")
+    data = bytearray()
+    for name in SOURCE_FILES:
+        path = root / name
+        if not path.resolve(strict=True).is_relative_to(root): raise ValueError('source_path_escape')
+        with path.open("rb") as stream: raw = stream.read(256*1024+1)
+        if len(raw) > 256*1024: raise ValueError('source_byte_limit')
+        data.extend(name.encode() + b'\0' + raw + b'\0')
+    return hashlib.sha256(data).hexdigest()
+
+def validate_approval(config, *, inspect_model=True):
+    from .ettin import inspect_bundle
+    required = {'python_executable', 'python_sha256', 'runtime_source', 'runtime_source_sha256',
+                'runtime_version', 'bundle', 'manifest_sha256', 'revision', 'device', 'precision',
+                'approved_by', 'scratch_root', 'startup_timeout_ms', 'inference_timeout_ms', 'cleanup_timeout_ms'}
+    if sys.version_info < (3,12): raise ValueError('python312_required')
+    if not isinstance(config, dict) or set(config) != required: raise ValueError('invalid_approval')
+    for key in ('python_executable', 'runtime_source', 'bundle', 'scratch_root'):
+        if not isinstance(config[key], str) or not Path(config[key]).is_absolute(): raise ValueError('absolute_paths_required')
+    for key in ('python_sha256','runtime_source_sha256','manifest_sha256','revision'):
+        if not isinstance(config[key], str) or not re.fullmatch('[0-9a-f]{64}',config[key]): raise ValueError('exact_pin_required')
+    if (config['runtime_version'] != __version__ or not isinstance(config['approved_by'],str)
+            or not config['approved_by'].strip() or len(config['approved_by'].encode()) > 256
+            or config['device'] not in ('cpu','cuda:0')
+            or config['precision'] != ('fp32' if config['device']=='cpu' else 'fp32-parameters-bf16-autocast')):
+        raise ValueError('approved_profile_required')
+    for key,lo,hi in (('startup_timeout_ms',1,120000),('inference_timeout_ms',1000,30000),('cleanup_timeout_ms',1,1000)):
+        if type(config[key]) is not int or not lo <= config[key] <= hi: raise ValueError('invalid_timeout')
+    if Path(config['python_executable']).resolve(strict=True) != Path(sys.executable).resolve(strict=True): raise ValueError('python_path_mismatch')
+    if sha(config['python_executable'],64*1024*1024) != config['python_sha256']: raise ValueError('python_pin_mismatch')
+    if Path(config['runtime_source']).resolve(strict=True) != Path(__file__).parent.resolve(): raise ValueError('source_path_mismatch')
+    if source_digest(config['runtime_source']) != config['runtime_source_sha256']: raise ValueError('source_pin_mismatch')
+    if inspect_model:
+        manifest=inspect_bundle(config['bundle'],config['manifest_sha256'])
+        if manifest['revision'] != config['revision']: raise ValueError('revision_mismatch')
+    return config

tokenfold_select_runtime/protocol.py

@@ -0,0 +1,69 @@
+"""Existing Select schema one, with bounded fail-closed JSON handling."""
+import json
+import math
+
+REQUEST_BYTES = 1024 * 1024
+RESPONSE_BYTES = 65536
+
+
+def _unique(pairs):
+    value = {}
+    for key, item in pairs:
+        if key in value:
+            raise ValueError('duplicate_JSON_key')
+        value[key] = item
+    return value
+
+
+def _number(text):
+    value = float(text)
+    if not math.isfinite(value):
+        raise ValueError('nonfinite_JSON')
+    return value
+
+
+def _constant(_):
+    raise ValueError('nonfinite_JSON')
+
+
+def decode(data):
+    return json.loads(data, object_pairs_hook=_unique, parse_float=_number, parse_constant=_constant)
+
+
+def load_request(data, revision):
+    if not isinstance(data, bytes) or len(data) > REQUEST_BYTES:
+        raise ValueError('request_byte_limit')
+    request = decode(data)
+    return validate_request(request, revision)
+
+
+def validate_request(request, revision):
+    if (not isinstance(request, dict)
+            or set(request) != {'schema_version', 'model_revision', 'query', 'groups'}
+            or type(request['schema_version']) is not int or request['schema_version'] != 1
+            or request['model_revision'] != revision
+            or not isinstance(request['query'], str) or not request['query'].strip()
+            or len(request['query'].encode('utf8')) > 4096):
+        raise ValueError('invalid_select_request')
+    groups = request['groups']
+    if (not isinstance(groups, list) or not 1 <= len(groups) <= 512
+            or any(not isinstance(g, dict) or set(g) != {'id', 'text'}
+                   or not isinstance(g['id'], str) or not g['id'] or len(g['id'].encode('utf8')) > 256
+                   or not isinstance(g['text'], str) or not g['text'] for g in groups)
+            or len({g['id'] for g in groups}) != len(groups)):
+        raise ValueError('invalid_groups')
+    if len(json.dumps(request, ensure_ascii=False, allow_nan=False).encode('utf8')) > REQUEST_BYTES:
+        raise ValueError('request_byte_limit')
+    return request
+
+
+def encode_response(request, scores):
+    if (not isinstance(scores, list) or len(scores) != len(request['groups'])
+            or any(type(value) not in (int, float) or not math.isfinite(value) for value in scores)):
+        raise ValueError('invalid_scores')
+    response = dict(schema_version=1, model_revision=request['model_revision'],
+                    scores=[[g['id'], value] for g, value in zip(request['groups'], scores)])
+    raw = json.dumps(response, ensure_ascii=False, allow_nan=False).encode('utf8')
+    if len(raw) > RESPONSE_BYTES:
+        raise ValueError('response_byte_limit')
+    return raw

tokenfold_select_runtime/provision.py

@@ -0,0 +1,84 @@
+"""Explicit dependency setup; imports and fits never provision."""
+import argparse
+import importlib.metadata
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import venv
+from . import __version__
+from .integrity import sha, source_digest
+from .ettin import inspect_bundle, ENVIRONMENT
+
+
+def dependency_commands(python, device):
+    if device not in ('cpu','cuda:0'): raise ValueError('explicit_device_required')
+    suffix, index = ('cpu','cpu') if device=='cpu' else ('cu128','cu128')
+    base = [str(python), '-I', '-m', 'pip', 'install', '--disable-pip-version-check']
+    return [base + ['--index-url','https://download.pytorch.org/whl/'+index,'torch==2.11.0+'+suffix],
+            base + ['--index-url','https://pypi.org/simple'] + [name+'=='+version for name,version in ENVIRONMENT.items() if name!='torch']]
+
+
+def provision(bundle, manifest_sha256, device, config_out, approved_by, scratch_root):
+    output=Path(config_out)
+    scratch=Path(scratch_root)
+    if not output.is_absolute() or not scratch.is_absolute() or not scratch.is_dir() or not approved_by.strip():
+        raise ValueError('absolute_destination_and_owned_scratch_required')
+    environment=output.with_name(output.name+'.venv')
+    # Atomic mkdir reserves this destination. Never replace an existing environment/approval.
+    if output.exists(): raise FileExistsError('approval_exists_use_new_destination')
+    manifest=inspect_bundle(bundle,manifest_sha256)
+    environment.mkdir()
+    venv.EnvBuilder(with_pip=False).create(environment)
+    python=environment/('Scripts/python.exe' if os.name=='nt' else 'bin/python')
+    run_setup([str(python),'-I','-m','ensurepip','--upgrade','--default-pip'])
+    for command in dependency_commands(python,device):
+        run_setup(command)
+    expected=dict(ENVIRONMENT)
+    expected['torch']='2.11.0+cpu' if device=='cpu' else '2.11.0+cu128'
+    check="import importlib.metadata,json; print(json.dumps({n:importlib.metadata.version(n) for n in "+repr(list(expected))+"}))"
+    versions=json.loads(run_setup([str(python),'-I','-c',check],capture_output=True,text=True,timeout=30).stdout)
+    if versions!=expected: raise ValueError('exact_dependency_profile_required')
+    config=dict(python_executable=str(python.absolute()),python_sha256=sha(python,64*1024*1024),
+        runtime_source=str(Path(__file__).parent.resolve()),runtime_source_sha256=source_digest(),runtime_version=__version__,
+        bundle=str(Path(bundle).resolve()),manifest_sha256=manifest_sha256,revision=manifest['revision'],device=device,
+        precision='fp32' if device=='cpu' else 'fp32-parameters-bf16-autocast',approved_by=approved_by,
+        scratch_root=str(scratch.resolve()),startup_timeout_ms=120000,inference_timeout_ms=5000,cleanup_timeout_ms=1000)
+    atomic_approval(output,config)
+    return config
+
+
+def run_setup(command, *, timeout=1200, **kwargs):
+    return subprocess.run(command,check=True,timeout=timeout,env=provision_environment(),**kwargs)
+
+
+def provision_environment():
+    # No provider credentials, user pip config, proxies or inherited Python injection.
+    allowed=('SystemRoot','WINDIR','PATH','TEMP','TMP','HOME','USERPROFILE')
+    env={k:os.environ[k] for k in allowed if k in os.environ}
+    env.update(PIP_CONFIG_FILE=os.devnull,PIP_NO_INPUT='1')
+    return env
+
+
+def atomic_approval(path,config):
+    path=Path(path)
+    temporary=path.with_name(path.name+'.pending')
+    with temporary.open('x',encoding='utf8') as stream:
+        json.dump(config,stream,allow_nan=False,sort_keys=True)
+        stream.flush()
+        os.fsync(stream.fileno())
+    try:
+        # Hard link is atomic and refuses an existing destination (unlike replace).
+        os.link(temporary,path)
+    finally:
+        temporary.unlink()
+
+
+def main(arguments):
+    p=argparse.ArgumentParser(description=__doc__)
+    p.add_argument('--bundle',required=True);p.add_argument('--manifest-sha256',required=True)
+    p.add_argument('--device',choices=('cpu','cuda:0'),required=True);p.add_argument('--config-out',required=True)
+    p.add_argument('--approved-by',required=True);p.add_argument('--scratch-root',required=True)
+    a=p.parse_args(arguments)
+    provision(a.bundle,a.manifest_sha256,a.device,a.config_out,a.approved_by,a.scratch_root)

tokenfold_select_runtime/worker.py

@@ -0,0 +1,87 @@
+"""Protocol 2 direct-child resident worker. Protocol 1 snapshot remains unchanged."""
+import contextlib
+import json
+import os
+import struct
+import sys
+from .protocol import REQUEST_BYTES, RESPONSE_BYTES, decode, validate_request
+from .integrity import validate_approval
+
+
+def read_exact(stream,size):
+    data=bytearray()
+    while len(data)<size:
+        chunk=stream.read(size-len(data))
+        if not chunk: raise EOFError()
+        data.extend(chunk)
+    return bytes(data)
+
+
+def read_frame(stream):
+    size=struct.unpack('<I',read_exact(stream,4))[0]
+    if not 0<size<=REQUEST_BYTES: raise ValueError('frame_limit')
+    value=decode(read_exact(stream,size))
+    if (not isinstance(value,dict) or set(value)!={'protocol_version','request_id','op','body'}
+            or type(value['protocol_version']) is not int or value['protocol_version']!=2
+            or type(value['request_id']) is not int or not 0<value['request_id']<=9007199254740991
+            or value['op'] not in ('load','score','close')): raise ValueError('envelope')
+    if value["op"]!="score" and size>4096: raise ValueError("control_frame_limit")
+    return value
+
+
+def write_frame(stream,request_id,op,body):
+    raw=json.dumps(dict(protocol_version=2,request_id=request_id,op=op,body=body),ensure_ascii=False,allow_nan=False,separators=(',',':')).encode()
+    if len(raw)>(RESPONSE_BYTES if op=='scores' else 4096): raise ValueError('response_frame_limit')
+    stream.write(struct.pack('<I',len(raw))+raw);stream.flush()
+
+
+def offline(event,_):
+    if event in ('socket.connect','socket.getaddrinfo','socket.bind','subprocess.Popen','os.system'):
+        raise ValueError('offline_direct_child_only')
+
+
+def serve(input_stream,output_stream):
+    from .ettin import EttinDevelopmentScorer
+    scorer=None;previous=0;request_id=0
+    while True:
+        try:
+            frame=read_frame(input_stream);request_id=frame['request_id']
+            if request_id<=previous: raise ValueError('monotonic_id_required')
+            previous=request_id;op=frame['op'];body=frame['body']
+            if op=='close':
+                if body!={}: raise ValueError('close_body')
+                write_frame(output_stream,request_id,'closed',{});return 0
+            if op=='load':
+                if not isinstance(body,dict) or set(body)!={'config','warmup'} or type(body['warmup']) is not bool:
+                    raise ValueError('load_body')
+                config=validate_approval(body['config'])
+                if scorer is None:
+                    scorer=EttinDevelopmentScorer(config['bundle'],config['manifest_sha256'],development=True,device=config['device'],precision=config['precision'])
+                elif config!=approved_config: raise ValueError('load_config_changed')
+                approved_config=config
+                if body['warmup'] and scorer._model is None: scorer._load()
+                write_frame(output_stream,request_id,'ready',dict(phase='loaded' if body['warmup'] else 'initialized'))
+            elif op=='score':
+                if scorer is None: raise ValueError('load_required')
+                request=validate_request(body,scorer.revision)
+                try: windows,receipt=scorer.admit(request)
+                except ValueError:
+                    write_frame(output_stream,request_id,'error',dict(code='selection_limit'));return 1
+                write_frame(output_stream,request_id,'ready',dict(phase='admitted'))
+                if scorer._model is None: scorer._load()
+                write_frame(output_stream,request_id,'ready',dict(phase='loaded'))
+                response=scorer.score_admitted(request,windows,receipt)
+                write_frame(output_stream,request_id,'scores',dict(response=response,diagnostics={k:receipt[k] for k in ('outside_training_group_counts','cross_window_context_unqualified')}))
+        except EOFError: return 0
+        except Exception:
+            if request_id: write_frame(output_stream,request_id,'error',dict(code='failure'))
+            return 1
+
+
+def main():
+    os.environ.update(HF_HUB_OFFLINE='1',TRANSFORMERS_OFFLINE='1',CUDA_VISIBLE_DEVICES='0',
+        TOKENIZERS_PARALLELISM='false',USERNAME='tokenfold-worker')
+    sys.addaudithook(offline)
+    # Native libraries may print diagnostics; never mix them into transport or log input.
+    with open(os.devnull,'w') as quiet,contextlib.redirect_stdout(quiet),contextlib.redirect_stderr(quiet):
+        return serve(sys.stdin.buffer,sys.__stdout__.buffer)

tokenfold_select_runtime-0.6.0.dist-info/METADATA

@@ -0,0 +1,96 @@
+Metadata-Version: 2.4
+Name: tokenfold-select-runtime
+Version: 0.6.0
+Summary: Explicit pinned offline resident Select v3 runtime
+License-Expression: Apache-2.0
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+License-File: PROVENANCE.json
+Dynamic: license-file
+
+# tokenfold-select-runtime 0.6.0
+
+Lightweight maintained Select v3 runtime. Importing this package does not import
+Torch, load weights, download assets or start a process. It contains no weights.
+The archived Select protocol 1 and hash-listed v3 model snapshot are unchanged.
+See `PROVENANCE.json` and `LICENSE` for port origins and deliberate differences.
+
+## Explicit setup
+
+Acquire a complete local v3 bundle separately at an immutable revision. Install
+this runtime package into Python >=3.12, then explicitly provision a new destination:
+
+```sh
+python -m tokenfold_select_runtime provision --bundle /absolute/bundle --manifest-sha256 EXACT_SHA256 --device cpu --config-out /absolute/select-runtime.json --approved-by OWNER --scratch-root /absolute/caller-owned-scratch
+```
+
+Only this command may fetch dependencies. It reserves a dedicated environment next
+to the config, installs exact CPU or CUDA (`--device cuda:0`) package pins and
+atomically publishes approval without overwriting an existing approval/environment.
+Even ensurepip bootstrap uses the same isolated, sanitized, deadline-bounded setup
+path; setup never mutates the calling process environment.
+Failed setup leaves the reserved environment unapproved; use a new destination.
+CPU uses FP32. CUDA requires FP32 parameters, BF16 autocast with its cache disabled,
+and TF32 disabled; it never falls back to another device/precision.
+
+Approval pins the executable, maintained Python source bytes/version, local model
+manifest/revision, profile, owner and scratch root. Protect those assets and the
+config from modification; changing any pin requires explicit reapproval. Native
+startup rechecks executable/source/manifest, and the offline worker checks complete
+model files/geometry and exact package versions before inference. Dependency wheel
+installation and functionality on a newly provisioned platform require their own
+evidence; this repository's existing-environment functional probes are not that proof.
+
+## Native lifecycle
+
+`SelectRuntimeConfig::from_path`/`from_json` creates immutable configuration;
+`scorer_info()` provides the expected Core pin. One `ScorerDispatcher` (also named
+`ResidentScorer`) owns a lazy direct child and FIFO. `submit(request, cancellation,
+queue_deadline)` returns immediately with a `ScoreTicket`. Native async bindings
+must use `try_take()` and `on_complete()` to schedule host work, not block a Core or
+libuv executor on admission. Completion callbacks must only schedule work. `wait()`
+and synchronous `ResidentScorer::score()` are for synchronous host callers.
+`ScoreCompletion::into_reply(action_id)` passes typed diagnostics and timings to
+Core, which alone creates the receipt. Immediate submission failures can use
+`RuntimeError::score_failure()`; Busy/Closed/Cancelled/Config are raised, not fallback
+receipts. Drop cancels only unfinished tickets; dropping a consumed score cannot
+cancel its enclosing fit.
+
+Defaults are 32 waiting jobs (configurable 0..128), 5s queue wait, 120s cold
+startup/load, 5s inference (configurable 1..30s) and 1s graceful cleanup. A saturated
+queue rejects admission with Busy; queued cancellation/expiry does not touch the
+active worker. `warmup()` explicitly loads weights and coalesces existing startup;
+`close()` rejects admission, wakes waiters, kills/waits as needed and is idempotent.
+The shared owner reaps its direct child on Drop too. No global pool, within-fit
+retry, automatic provisioning, truncation or device/precision fallback exists.
+
+Protocol 2 uses bounded little-endian length-prefixed JSON and monotonic IDs.
+`load` initializes without weights unless explicitly warming up. `score` admits the
+whole request/window layout, emits `ready/admitted`, loads weights if needed,
+emits `ready/loaded`, then scores. The single cold startup/load deadline runs until
+loaded; inference has a separate deadline. A post-start admission refusal counts
+as an attempted `selection_limit`; native prestart size admission does not. An OS
+spawn call that fails still counts as a start attempt. Malformed/duplicate frames,
+stale IDs, nonfinite scores, crash, timeout and active cancellation invalidate/reap
+the worker; only a later explicit request may cold-start again.
+
+Cleared environments, startup-hook-free (`-I -S`) Python, isolated source imports,
+and explicitly admitted dependency paths (without `.pth`/sitecustomize processing),
+offline audit guards, bounded
+reader/writer threads and confined owned scratch cleanup are not an OS sandbox or
+hard memory quota. Applications own OS enforcement and permissions. Selection
+quality remains unqualified, especially group counts outside training and multiple
+windows. Callers must group/require semantic dependencies.
+
+## Checks
+
+```sh
+python -m unittest discover -s packages/tokenfold-select-runtime/tests -v
+cargo test -p tokenfold-adapters --locked --test select_runtime
+python packages/tokenfold-select-runtime/tests/functional_runtime.py --python /absolute/existing/python --bundle /absolute/bundle --device cpu --scratch-root /absolute/owned/scratch
+```
+
+The last probe never installs anything. Invoke CUDA separately with `--device cuda:0`;
+unavailable CUDA is explicitly skipped, never passed or replaced with CPU.

tokenfold_select_runtime-0.6.0.dist-info/RECORD

@@ -0,0 +1,14 @@
+tokenfold_select_runtime/__init__.py,sha256=cID1jLnC_vj48GgMN6Yb1FA3JsQ95zNmCHmRYE8TFhY,22
+tokenfold_select_runtime/__main__.py,sha256=BqveGXaXyfaZdM5rOtNzT9dpokPHDSl6QiythDX4Wn8,325
+tokenfold_select_runtime/ettin.py,sha256=lA4xTQtgtkNy73EC9sY6d-cZVLLbnOuAhCudgUYeeis,12216
+tokenfold_select_runtime/integrity.py,sha256=X67uKwdFe90zUPhgV5cUB-N6-Lrdz986WagLuxb-vao,3695
+tokenfold_select_runtime/protocol.py,sha256=EVFf5elo1eOeoi6bMKcXkDqj-qH5c9T2XYmkvSkt6Qg,2635
+tokenfold_select_runtime/provision.py,sha256=8p08K7gOECdttZ7oRBs1bctjNmpa5jNnY57P-xAiWAs,4277
+tokenfold_select_runtime/worker.py,sha256=SHkVyKl55lJTc5_f1TnGiVsJN-df1GgrBw-rol4fsPE,4476
+tokenfold_select_runtime-0.6.0.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+tokenfold_select_runtime-0.6.0.dist-info/licenses/NOTICE,sha256=pzyEOh-XPcCXihIVI9b2V2ziQuBRXqXBPtv_6UE0jiE,749
+tokenfold_select_runtime-0.6.0.dist-info/licenses/PROVENANCE.json,sha256=f38dFrdii2H529irBmWomYhcvPLR1H4TOdApbgkvpOg,1395
+tokenfold_select_runtime-0.6.0.dist-info/METADATA,sha256=ciGE3VoULlpP_xWS5pE82c65QDCzX0uxg9twGRFDyeo,5542
+tokenfold_select_runtime-0.6.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+tokenfold_select_runtime-0.6.0.dist-info/top_level.txt,sha256=AueUWWKVST8MLQuBV4oE2jgCJadoSiCqp64IHDBY8Os,25
+tokenfold_select_runtime-0.6.0.dist-info/RECORD,,

tokenfold_select_runtime-0.6.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

tokenfold_select_runtime-0.6.0.dist-info/licenses/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

tokenfold_select_runtime-0.6.0.dist-info/licenses/NOTICE

@@ -0,0 +1,16 @@
+Tokenfold Select runtime
+Apache-2.0; see LICENSE.
+
+Ported source provenance:
+packages/tokenfold-select/loader/src/tokenfold_select_v3/ettin.py
+SHA-256 4288fea399a065fa732d2c8120e0e5ddc0979156a80b479b1f56fa718e4e0c42
+
+packages/archive/tokenfold-select-v2/sdk-0.5.3/src/tokenfold_select/protocol.py
+SHA-256 11515fe5e968d5e39ea22e9b30a717903aa3faa1f973d4f65d89a4bd292de908
+
+packages/archive/tokenfold-select-v2/sdk-0.5.3/src/tokenfold_select/artifact.py
+SHA-256 8cc467853e1b564432b7f9042426195d6b50eab25fe3bb1a615b83893328baa0
+
+Only v3 model/geometry/integrity and schema-1 protocol helpers are ported.
+No v2 model or fallback. Maintained CUDA autocast disables its cache.
+Model weights are not included; quality and redistribution remain unqualified.

tokenfold_select_runtime-0.6.0.dist-info/licenses/PROVENANCE.json

@@ -0,0 +1,28 @@
+{
+  "license": "Apache-2.0",
+  "sources": [
+    {
+      "path": "packages/tokenfold-select/loader/src/tokenfold_select_v3/ettin.py",
+      "sha256": "4288fea399a065fa732d2c8120e0e5ddc0979156a80b479b1f56fa718e4e0c42"
+    },
+    {
+      "path": "packages/archive/tokenfold-select-v2/sdk-0.5.3/src/tokenfold_select/protocol.py",
+      "sha256": "11515fe5e968d5e39ea22e9b30a717903aa3faa1f973d4f65d89a4bd292de908"
+    },
+    {
+      "path": "packages/archive/tokenfold-select-v2/sdk-0.5.3/src/tokenfold_select/artifact.py",
+      "sha256": "8cc467853e1b564432b7f9042426195d6b50eab25fe3bb1a615b83893328baa0"
+    }
+  ],
+  "ported": [
+    "Ettin v3 geometry, manifest/file integrity, whole-group query-repeated window packing, exact dependency checks, FP32 model and score response validation",
+    "Schema-1 request/response protocol and streaming SHA helper only; no v2 model or fallback"
+  ],
+  "changes": [
+    "Package-local imports",
+    "Separate admission and score_admitted without changing model math or window packing",
+    "CUDA autocast cache_enabled=False is normative in maintained runtime only",
+    "New protocol 2 resident process/provisioning; protocol 1 snapshot unchanged"
+  ],
+  "evidence_boundary": "Deterministic packing/protocol fixtures and separately invoked small CPU/CUDA local functional probes are not research qualification or fresh-profile installation certification"
+}

tokenfold_select_runtime-0.6.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+tokenfold_select_runtime