[Levius-Fubuki]

Required human contributor answers

Confirmed by @Levius-Fubuki in the implementation task on 2026-10-28 before implementation:

1. What outcome are you trying to achieve?
   Serve the fixed d3-turbo package through the existing /v1/systemone interface for reproducible text/JSON and single-image decisions, with a repository-compliant draft PR.
2. What is the highest-leverage variable for that outcome?
   Integration correctness and reproducibility: answers, typed errors, usage and package identity verification.
3. How will this work move that variable rather than create busywork?
   Reuse the D3 worker and official AutoModel, then freeze preparation/answer fixtures, regression tests and a Public231 baseline to reduce semantic drift and validation cost for later native work. The reference milestone does not promise acceleration.
4. Who is the customer or user, and what do they actually need?
   System1-Omni users need a consistent interface and clear setup instructions; later native developers need a precise model contract and trustworthy comparison data.

Is a PR needed? Yes. The contributor explicitly authorized implementing and submitting this integration as a draft.

Bug-fix evidence: Primarily a new-model reference feature, not a bug-fix request. Package-isolation hardening also includes observed RED/GREEN regressions for sourceless packages and stale Hugging Face ancestor namespaces.

Purpose

Refs #190; delivers its reference-serving milestone only, leaving native correctness and optimized execution open.

Adds explicit --profile turbo to the existing D3 worker. Legacy remains the default with its own immutable package gate, image/video paths and request-level error policy. Turbo delegates to the pinned public AutoModel.system_one, preserving official state-once, per-question typed errors, calibration/order and usage.

Pin: vllm-sr/d3-turbo@a0f3e9e59ebd1202fe1d4de1c4c0f9a986758cbb; manifest SHA-256 54a65af0871c21b3440cbdadaccfd752a8e2173b86334d1b3290f005e49699fe. Verify runtime/wrapper/compose and non-weight load inputs before import; refuse mixed profiles/packages and stale copied modules.

First scope: text/JSON, zero or one inline PNG/JPEG, choice/noul/score, default 32,768-token policy, explicit transport/media limits. Unsupported fields, media placements and types reject explicitly. No native CUDA, quantization, general cache, batcher or scheduler changes.

Test Plan

• CPU D3 legacy/turbo, package isolation, HTTP recovery, typed warmup and fixture integrity checks; new CI step runs these without Torch/Transformers.
• Separate pinned state-once and full-row processes; exact preparation/code order/tensors/positions, answers/errors/usage and predeclared numerical tolerance 1e-6.
• Real A800 first/repeated requests, rejection recovery, direct/frontend parity and graceful shutdown.
• Public231 contract smoke, warmup 5, concurrency 1, three measured rounds per deployment. Report the measured source/device, complete counts, quality and pooled p50/p95; supplementary images/many-question cases remain separate.

System1-Omni version: historical GPU deployment 821d6f93336c45c61576a2787e26d3897aae9f27; admission/inventory follow-up head ae54a529f873db53aab3f1bbc4e6655f1a63172c. Fixture cleanup at 7df2e3384 changed only test-side storage, its generator/loader/tests and documentation; all 297 non-Markdown production/benchmark/build inputs were then byte-identical to the measured deployment. Follow-up 4b9c0b898 clarified verification docstrings and operator guidance. The current follow-up changes turbo admission error handling and package inventory verification, so the current production source is no longer byte-identical to the measured deployment. The Turbo executor class and legacy dispatch ASTs are unchanged; reference fixtures and their generation provenance 074ea2259f615932db4559a67e64f7fd91cbdbad are unchanged. GPU results remain historical evidence, not GPU validation of these later admission/verification changes.

Test Result

• Local D3 suite: 160 passed, using uv run --no-project --python 3.12 --with pytest --with pillow env PYTHONPATH=src python -m pytest tests/d3 -q. Includes deep-request HTTP rejection/recovery, recursive package inventory, file-symlink/download-cache compatibility, shared-storage roundtrip, reference integrity, conflict/rollback and corruption regressions; no Torch/Transformers is required.
• Local workspace format, strict Clippy with omni-laya/serve, release build and tests: passed; 389 Rust tests passed, 88 ignored. Ignored GPU/native checks are not GPU parity.
• Benchmark tooling: 133 tests passed; contract manifest validates 4 requests.
• mkdocs build --strict: passed.
• Historical A800 80GB PCIe / compute capability 8.0 qualification: both oracle modes were checked at the measured source, 6 cases and 83 tensor arrays per mode passed. The cleanup preserves those exact inputs/outputs and tensor bytes; GPU inference was not rerun for this storage-only change.
• Real first/repeated requests, client-rejection recovery, direct/frontend semantic parity and all four graceful process shutdowns passed (SIGINT, exit 0, no forced kill).
• Observed cleanup-head CI and Docs: all build/test jobs passed at 7df2e3384fc68669e513f028b027c4ae2bd14b7d. Docs deployment is intentionally skipped for PRs.

Public231 deployment	Successful / planned	Pooled p50	Pooled p95
Official public AutoModel + bundled HTTP	693 / 693	236.629 ms	927.310 ms
Turbo worker + Rust frontend	693 / 693	233.832 ms	930.212 ms

Same NVIDIA A800 80GB PCIe, compute capability 8.0, BF16 backbone/FP32 readout; torch 2.12.1+cu130, torchvision 0.27.1+cu130, Transformers 5.17.0, FLA 0.5.2. causal_conv1d was absent, so both use the package's PyTorch fallback for that op. Default state-once; no cross-request reuse, quantization or native path.

Each service ran warmup 5, concurrency 1, three full measured rounds, no retries. Clock includes POST, complete body receipt, JSON and schema validation. Pool all 693 successful samples per service: median p50 and nearest-rank p95, not averages of round percentiles. Startup/readiness, supplementary image/many-question requests and the independent full-row process are excluded.

All 693 paired bodies are semantically exact, including numeric values, key/question order and usage: max numeric delta 0, classification flips 0. Each round has Choice 128/139, Noul 67/74 and Score MAE 0.12536653832015168 (18). The frozen manifest is JevBench 7ce310c7262ed49cc85853339a8a42459298e3f3; its canonical dataset SHA is dc3995d8ae1e2fc8e81ce38431add509eb8bb39b85aadfd0c7c32079382dde51. The measured JSONL SHA (with freshly observed prompt lengths, absent thinking) is be49d5ba1bbfe81ea78a57d3e8b40a8aeb66ac2fb54b393c0efe63687c96e162. Canonical reconstruction and unchanged wire inputs/targets were independently checked.

Services ran serially in fixed order, not randomized. System1 round medians were 222.81 / 216.44 / 254.00 ms. Mixed percentile changes and this variation do not establish acceleration. This is the initial reference baseline, not an optimization KEEP.

Public231 max prompt: 3970 tokens. Supplementary synthetic PNG and 1/4/16-question cases stay separate; they are not an image-quality/full-context benchmark. Legacy GPU checkpoint inference was not rerun at this head; legacy CPU/transport/media regressions passed.

Fixture hygiene cleanup

This follows the contributor's explicit request to remove redundant fixtures:

• Total additions after cleanup: 12,620 → 3,973 at 7df2e3384; the review follow-ups make the current total 4,068. Production Python additions are 345, including verification/error-policy hardening and docstrings. Changed authored Python lines are 1,687 (1,661 additions / 26 deletions), below the 3,000 authored-code routing threshold.
• Oracle JSON: 10,416 → 1,401 lines: one 887-line turbo-preparation.json plus two 257-line mode response files. Scalar arrays stay inline; repeated derived token slices are reconstructed from full token IDs and exact state boundaries.
• One 72,796-byte turbo-inputs.npz replaces the two byte-identical NPZ files. It still contains all 83 arrays, with unchanged SHA-256 94e4b72521949be9534a70dade7dd5dbd0cbafc81c5df29b29e223574730c9c5.
• Against pre-cleanup head f4a0c6c39a0f6a84a1f2276737074e167a594a72, both reconstructed documents preserve all 8,708 scalar values, types, dictionary/list ordering, six cases per mode, metadata/provenance, probabilities, answers/errors and usage exactly. Only the intended tensor filename changes. The pinned package manifest and PNG/JPEG bytes remain unchanged.
• The generator and freeze --check consume the same normalized format as the tests. Mode files pin shared preparation by SHA-256; preparation pins the NPZ. Conflicting shared inputs and corrupt/unsafe references fail before replacing prior fixtures. Original checks and 1e-6 tolerance remain intact.
• Spec and code-quality reviews passed; 147 D3 CPU tests and strict MkDocs passed. This is lossless test-data normalization, with no inference/serving or performance change and no new paid GPU run.
• Historical source commits and the evidence release below are retained unchanged. All test bodies/helpers/fixtures stay under root tests/; raw runs, local migration audit output and planning notes remain outside Git.

Demo / evidence

Evidence release, raw archive, SHA256SUMS, independent review, shutdown receipt.

Public archive SHA-256: 5fef059d255fe2e1952dc53729262cac3c7a32c5ad471909374b70a0297f7ae6. The original 126-file sealed evidence/source inventory and all six maintained offline summaries were independently verified. Public artifacts were downloaded again, their hashes checked and all six summaries/recomputed pooled metrics replayed successfully. Seven log files have only absolute filesystem paths redacted; raw request/response/config/timing bytes and measured source archive are unchanged. Dataset MIT attribution is included. No weights, private SSH endpoints or credentials are published.

After verified local evidence download and independent recomputation, the A800 platform shutdown command returned 0 and a fresh SSH probe returned 255. The earlier insufficient-memory instance was also stopped.

Operator recipe, model contract, oracle/fixture tool.

The shared preparation JSON/NPZ, two mode-specific output oracles and synthetic PNG/JPEG are consumed by fixture integrity tests and opt-in numerical replay. Raw one-off campaign output stays outside the source tree. Review production loaders/protocol/dispatch, CPU regressions, shared fixture storage and oracle replay, then operator docs/CI separately.

The production target is H200 / SM90; actual results use the measured A800 / SM80 identity. H200, Metal, native execution, full 32K capacity, quantization and cross-request scheduling are unverified. No illustrative video is needed for this nonvisual serving integration.

Review follow-up (2026-10-31)

Addressed F-1 (P3) in 4b9c0b89857902a3ab068effd582be46946f9390. The operator recipe now explicitly requires full for first-time package admission and after weight replacement/modification; fast is for subsequent starts of the fully verified unchanged package and cannot detect same-size corruption in weight shards larger than 64 MiB. Removed the overstated identity claim from the module docstring and clarified the verifier docstring. Defaults and executable logic are unchanged.

• Personally run: uv run --no-project --python 3.12 --with pytest --with pillow env PYTHONPATH=src python -m pytest tests/d3 -q → 147 passed; this includes the existing large-shard size-versus-hash regression.
• Personally run: strict MkDocs build and git diff --check passed. AST comparison after stripping docstrings confirms no executable change in turbo.py.
• Observed CI and Docs both passed at 4b9c0b89857902a3ab068effd582be46946f9390: CI, Docs. These runs do not validate the later admission/verification follow-up.
• Refreshed upstream main to e573260cc; git merge-tree --write-tree HEAD origin/main reported no conflicts. Main has not been merged into this draft. Sync and revalidate CI before any ready-for-review transition.
• No GPU run, server restart, evidence-release modification, reviewer reply, readiness transition or merge was performed.

Admission / inventory follow-up (2026-11-01)

Verified and addressed both P3 findings in the follow-up comment, commit ae54a529f873db53aab3f1bbc4e6655f1a63172c:

• Deep JSON: reproduced HTTP 500 for 1,500-level state and criteria payloads in Python 3.12. Catch RecursionError only during turbo request admission and return HTTP 400 before decoding/inference. Regression tests verify no executor call for the rejected request, then a successful HTTP 200 request on the same server.
• Nested package files: reproduced acceptance of unlisted nested source, bytecode, extension and data files in both verification modes. Inventory now walks visible subdirectories (including assets/namespace packages) and rejects unlisted files and directory symlinks. Root hidden download/VCS metadata keeps its prior exemption; runtime import checks remain in force. Manifest-listed assets and file symlinks still pass the existing size/hash rules.
• Actual RED evidence before fixes: 11 failed, 1 passed in the focused suite (-k 'deep_turbo_json or unlisted_nested or symlink_inventory or listed_nested_assets'). Failures were the two HTTP 500 responses, eight missing nested-file rejections, and the directory-symlink bypass. Added file-symlink compatibility coverage afterward.
• GREEN: 160 D3 CPU tests passed, strict MkDocs build and git diff --check passed. No new test/helper/fixture is outside root tests/. No model math, calibration, usage, fixtures, dependency pins, Rust source or historical evidence was changed.
• GPU/package-load qualification at this new head remains unverified: no weights were loaded and no server was restarted. Historical A800/Public231 results above retain their original source revision.
• Admission/inventory-head CI subsequently passed at ae54a529; the synchronized current-head qualification and CI are recorded below. Draft state and unchecked human review boxes remain retained.

Self-review

Agent-assisted full-diff, spec, independent code-quality and independent raw-evidence reviews completed with no unresolved findings. The storage cleanup also passed separate spec/code-quality reviews and exact old-versus-expanded fixture comparisons. Two import-verification findings were fixed with observed RED/GREEN regressions. Contributor and maintainer review remain separate; the author checklist below is intentionally left for human review.

• I have reviewed the full diff and addressed the issues I found.
• I have checked that the change follows the project's architecture and stays focused on the stated purpose.
• I have run the checks appropriate to this change and reported commands, results, and anything I could not verify above.
• I have checked that the PR description, documentation, and any accuracy or performance claims match the implementation and available evidence.

Keep draft. Ready-for-review and merge each require separate explicit owner approval.

Current-main qualification (2026-11-01)

Current head a0b73803288d32305de6e1f60853f5a3d56a7d24 merges main 5fa5179d57f9267bb0d20162004d8ce26352aa9d after the admission/inventory fix. All 840 tracked files match the qualified source before and after checks. The focused PR diff remains 1,687 authored-code / 4,104 total text changed lines across24files.

Personally executed in an empty independent build directory on the supplied RTX4090 host:

• 160 D3 CPU tests passed in Python3.12, including deep-JSON HTTP400/recovery, recursive inventory, symlink and listed-asset compatibility. Pytest emitted one warning; the complete output is retained.
• Workspace fmt, strict all-target Clippy with omni-laya/serve, release build and tests: 393 passed / 0 failed / 90 ordinarily ignored. Benchmark tooling133, CUDA checker68/backend26, manifest smoke and strict MkDocs passed.
• Observed current-head CI and Docs passed, including Rust, benchmarks, CUDA contract and all declared backend compilation.

Real-package loading/inference at this current admission/verifier head remains unverified. The supplied device is a single RTX4090 24GB; the pinned27B BF16 package exceeds its capacity. No quantization/offload substitute was introduced. Historical A800/Public231 results retain their original source revision and are not counted as a current-head GPU pass.

Current-device evidence and reproduction retains source archives, per-file identities, actual executables/libraries, raw checks/calls, all failed attempts and their corrections. Archive SHA256: 7d75a73dafa39b0481ba93c345fcbd34ab5c8934a4494d9999ce6472d7c6c149. Local download verification checks every archived payload and recomputes the HTTP summary. Final qualification uses empty independent Cargo targets per source and verifies the actual test inventory; the earlier shared/copy-target attempts are explicitly rejected. No numerical tolerance was changed.

Draft state and the human checklist remain unchanged; this update does not request ready-for-review or merge.

[hsliuustc0106]

Draft PR review: #198 "d3: add pinned d3-turbo reference profile"

Reviewer pass: first review, pass102 (2026-10-31). Verdict: COMMENTED (draft PR — no approval or readiness implied). ## Status block

• Base: main @ 22b7717c9 (PR-declared and merge-base-confirmed). Head: 7df2e3384fc68669e513f028b027c4ae2bd14b7d (matches origin/pr/198 and PR API headRefOid; rechecked this pass).
• Diff (two-dot git diff 22b7717c9..7df2e3384, identical to the GitHub API numbers): 24 files, +3,973/−36 (matches the body's cleanup headline "3,973 additions"). The briefing's "41 files +4009/−733" does not match the current PR state at this head; API and local git agree on 24/+3,973/−36.
• Draft state: DRAFT (API isDraft: true); body ends with "Keep draft. Ready-for-review and merge each require separate explicit owner approval." Human checkboxes intentionally unchecked. Refs #190, delivers only its reference-serving milestone.
• Standing sync note: merge-base 22b7717c9 is an older main; current tip e573260cc. git merge-tree shows no content conflicts against the current tip; a main sync before ready is still required for CI revalidation.
• Author: Levius-Fubuki; head hosted on the Levius-Fubuki fork (codex/d3-turbo-reference).

Skill / evidence provenance

• Skill: .agents/skills/system1-omni-review/SKILL.md, bytes read this pass, SHA-256 58be3bc60806c4c5af7038a0c6a80fadb94f3360d714556a3e965c8903dde108 (commit ef9279638). References read: docs/architecture.md, CONTRIBUTING.md, references/repository-contracts.md.
• Separation of sources: [inspected] = diff/tree read at pinned SHAs; [run] = commands executed locally; [CI] = Actions API at the exact head; [author] = body claims not independently verified.

Template / body check

• Four post-#138 contributor answers: present, at the top of the body, attributed ("Confirmed by @Levius-Fubuki in the implementation task on 2026-10-28 before implementation"), plus "Is a PR needed? Yes" with explicit draft authorization and a bug-fix-evidence statement (feature + RED/GREEN hardening regressions). [inspected]
• Checklist: present, four boxes unchecked with an explicit statement that they are left for human review; "Keep draft" note. Appropriate for a draft.
• Headings follow the template (Purpose / Test Plan with System1-Omni Version / Commit: / Test Result / Fixture hygiene cleanup / Demo / evidence with evidence-release links and redaction notes / Self-review).
• Authored vs total counts reported (1,603 authored Python; 3,973 total; 329 production Python) — below the 3,000 authored routing threshold; split rationale and review order present. [inspected]

Commit-by-commit review [inspected]

1. 2c6e2f2a "Add pinned d3-turbo reference worker profile" — turbo executor, protocol, engine/frontend plumbing (+1,390/−24).
2. 074ea225 "d3: document turbo profile and add fixed-package oracle tooling" — recipe/d3/turbo.md, turbo_reference.py (+586/−10).
3. 781bae7c "Reject sourceless shadow packages and cached HF ancestors" — import-guard hardening (+85/−4).
4. 821d6f93 "d3: freeze turbo preparation tensors and separate oracle modes" — fixture freeze (+10,513; later deduplicated in-place by commit 7).
5. bdbbdb86 "ci: exercise D3 legacy and turbo CPU regressions" — CI step (+4).
6. f4a0c6c3 "docs: record A800 turbo reference qualification and limits" (+47/−3).
7. bbb1a02a "test(d3): share lossless turbo oracle preparation fixtures" — the storage cleanup (−9,955 net dedup of the oversized oracle JSON; shared NPZ).
8. 7df2e338 "docs: explain shared turbo fixtures and safe replay output" (+22/−8).

Linear history; the fixture bloat and its cleanup are both preserved honestly. Clean hygiene.

Contract review

What is pinned [inspected src/models/d3/turbo.py, engine.py]

• Checkpoint identity: hard-coded MANIFEST_SHA256 = 54a65af0... (matches the body), REFERENCE_REPO = 'vllm-sr/d3-turbo', REFERENCE_REVISION = a0f3e9e5...; manifest schema and repo_id must match before anything loads. The manifest is the package contract (exact files_sha256 map).
• Verification before import: manifest SHA gate → verify_runtime_files (rejects __pycache__/, importable files/packages in the root, including any __init__+suffix variant) → per-file size/SHA checks with path-traversal rejection (absolute/..), unlisted-file rejection, and non-load artifacts (LICENSE, docs, assets/, LICENSES/) excluded from hashing but the file set still constrained.
• F-1 (P3, disclosed): default fast verify hash-checks only shards ≤ 64 MiB; larger weight shards (~52 GB package ⇒ all weight shards) are size-checked only in fast mode; full hashes everything. The docstring declares this ("Fast mode checks shard sizes and hashes shards up to 64 MiB; full mode also hashes every large shard"), and the body's "Neither mode permits skipping artifact identity" overstates fast mode slightly — size is not identity. Trigger: a corrupted/silently-modified large shard with identical size passes default verification. Consequence: weight-integrity in fast mode rests on the download channel, not hashes. Suggest documenting the operator-facing recommendation to use --verify full for first-time package admission.
• Runtime/wrapper import isolation (runtime_import_guard in engine.py, shared by legacy and turbo): one profile/package per process; rejects any pre-imported D3 module, its _<16-hex> hash-suffixed module variants, and any transformers_modules.* ancestor; sys.dont_write_bytecode during import; a failed selection poisons the process; turbo additionally swaps HF_MODULES_CACHE to a private TemporaryDirectory so a stale cached .pyc or same-size/mtime copied source cannot replace verified package code. The 781bae7 RED/GREEN regressions cover sourceless shadow packages and cached ancestors. Strong isolation work. [inspected]

Reference parity evidence — measured-then-declared [inspected + run; GPU = author-reported]

• Two oracle modes committed (state-once, full-row): shared turbo-preparation.json (887 lines) + turbo-inputs.npz (72,796 bytes, all 83 arrays, SHA pinned in the body) + two 257-line mode-response oracles; preparation pinned by SHA inside mode files; corrupt/unsafe references refuse to overwrite prior fixtures. Predeclared tolerance 1e-6 on numerical replay; everything else exact (code order, tensors, positions, answers, errors, usage).
• A800 qualification: 6 cases and 83 tensor arrays per mode passed at measured source 821d6f933; Public231 693/693 both deployments with max numeric delta 0 and zero flips; pooled p50/p95 233.83/930.21 ms vs official 236.63/927.31 ms, explicitly not claimed as acceleration (serial fixed-order runs, round-level variance disclosed). [author-reported; the public evidence release (SHA-pinned archive + SHA256SUMS + REVIEW.md) was not downloaded/audited in this pass]
• Byte-identity claim verified independently: git diff 821d6f93..7df2e338 touches only docs, tests, and ci.yml — no production Python/Rust changed after the measured head, so inheriting the A800 results at the final head is sound. The body's "GPU inference was not rerun for this storage-only change" is accurate and properly disclosed. [run]
• Production-target honesty: measured on A800/SM80; H200/SM90 target, Metal, native execution, full 32K, quantization, cross-request scheduling all declared unverified.

Profile registration — complete [inspected]

• docs/supported-models.md: D3 turbo row added with per-column status (contract/fixture tests; A800 reference; native unverified).
• recipe/d3/turbo.md (256 lines) registered in mkdocs.yml nav, recipe/README.md, and the root README.md model table.
• src/frontend/d3.py: explicit --profile {legacy,turbo}, legacy remains default; turbo path uses the typed turbo_protocol.parse_request/finish_response and maps runtime ValueError → 422 with a clear message.
• Legacy D3 executor keeps its own immutable package gate; the new guard is shared but preserves legacy semantics (same imports, bytecode-off behavior now inside the guard).
• CI: new step runs PYTHONPATH=src python -m pytest tests/d3 -q with pytest+pillow only — genuinely weight-free/Torch-free. [inspected ci.yml]

Fixture hygiene [inspected + run]

• Committed fixtures are maintained test data with generators (turbo_reference.py, turbo_fixture_storage.py) and integrity tests (test_turbo_fixture_storage.py): shared-NPZ reconstruction, SHA-chained mode→preparation→NPZ, conflict/rollback/corruption regressions. Raw campaign output stays outside Git. This is the correct maintained-fixture vs one-off-output distinction; the in-branch dedup (10,513 → 1,401 oracle lines) preserved all 8,708 scalar values per the body and is the committed final state.
• Warmup readiness: real system_one('warm-up', noul) inference with typed-answer validation before the worker reports ready; close() idempotent with module-cache cleanup. [inspected turbo.py]

Cross-PR hygiene [run]

• git merge-tree vs #196 and #197: no conflicts (disjoint file sets). Vs current main tip: no conflicts.

CI (observed) [CI]

Actions API filtered to exact head 7df2e3384..., event pull_request:

• ThinkFlowLab/system1-omni: CI run 40695255073 success and Docs run 40695254703 success — the exact run IDs the body cites.
• Levius-Fubuki/system1-omni (fork): no workflow runs recorded at this SHA (empty result). Runs live on the upstream/mirror; recorded as observed.

Locally executed [run]

Environment: macOS arm64, no cargo/GPU/torch; Python 3.12.8, pytest 8.4.1, pillow 11.3.0, mkdocs 1.6.1. Worktree at 7df2e3384, removed after.

• PYTHONPATH=. python -m pytest tests/benchmarks -q → 133 passed (matches the body).
• PYTHONPATH=src python -m pytest tests/d3 -q → 147 passed, no Torch/Transformers required (matches the body's claim exactly).
• mkdocs build --strict → exit 0.

Material unverified checks

• All A800 GPU results (both oracle modes, Public231 693/693 exact-parity campaign, first/repeated-request, rejection-recovery, shutdowns) are author-reported; the public evidence release was not downloaded or recomputed here.
• The package gate's behavior against the real ~52 GB vllm-sr/d3-turbo package was not exercised locally (weights absent by design).
• Legacy GPU checkpoint inference was not rerun at this head (disclosed; legacy CPU/transport/media regressions pass locally/CI).

[MrDongsls]

Verified at 4b9c0b8. The profile isolation is fail closed at every boundary checked, the pinned manifest chain verifies before import, the fixture integrity mechanism is well designed, and CI is green at this head. Two small findings.

P3 in src/models/d3/turbo_protocol.py:14 the recursive media scan overflows on deeply nested JSON, json.loads accepts a body nested around 1500 levels deep but the pure Python recursion raises RecursionError which the turbo path maps to 500 instead of 4xx, while legacy parse_body at src/models/d3/protocol.py:89 already maps RecursionError to 400, catching it and returning a 400 or rewriting the scan with an explicit stack keeps the error policy consistent.

P3 in src/models/d3/turbo.py:61 the unlisted file scan covers the package root only, an unlisted file inside assets or another subdirectory passes verify_package even in full mode, and with the package root first on sys.path such a subdirectory imports as a namespace package, extending the scan to walk subdirectories or documenting the root level scope closes the gap.

Both are defense in depth items and do not block the draft.

[psv666]

The ae54a529 admission/inventory follow-up closes the two reported issues in the inspected paths.

Turbo admission now maps RecursionError to HTTP400 before decoding/execution, and the HTTP regressions check a subsequent successful request. The package inventory walks visible nested directories, rejects unlisted files and directory symlinks, while preserving the documented root metadata exemption and listed file-symlink behavior. 160 D3 CPU tests and strict MkDocs passed in this review.

No additional actionable source finding in the inspected turbo admission, verifier, dispatch and fixture paths. Current-head CI is now green; the body's last “new-head CI is pending” line can be refreshed. The later admission/verifier code changes mean the A800 campaign remains historical evidence, as correctly disclosed. I did not rerun checkpoint loading or inference. Keep the current draft boundary and rerun affected checks after any base integration.

Review scope and provenance

Head ae54a529f873db53aab3f1bbc4e6655f1a63172c; PR API base 22b7717c9710de5ac5c6ccba51a6d6686dae90d9; diff merge-base 22b7717c9710de5ac5c6ccba51a6d6686dae90d9. Inspected scope: turbo admission/verification and serving/fixture contract, with focused verification of the latest two fixes. Complete changed-file inventory: 24 files, 1,687 changed authored-code lines / 4,104 total text lines (binary fixtures counted as files, not text lines).

Loaded trusted InferMatrixLab/system1-omni@5fa5179d57f9267bb0d20162004d8ce26352aa9d:.agents/skills/system1-omni-review/SKILL.md, SHA256 3a4b876162da14eee8db56af86664576aa5755b8f3e80b3072e944018647c3bc, plus architecture, repository contracts, CONTRIBUTING, self-review artifact requirements and CI/Docs workflows. Personally executed checks are distinguished above from author-reported GPU evidence. No GPU inference was run in this review; no approval or readiness transition is implied.