pgw#1141 (§4.31 + §4.32): a boot-adopted cell materializes, arms and SERVES — the parity gate MOVES to the mint by PaulFidika · Pull Request #658 · cozy-creator/python-gen-worker

PaulFidika · 2026-08-11T19:45:16Z

Implements DESIGN-RULINGS §4.31 + §4.32 (both Paul, 2026-08-11).

The defect, measured twice

Two real pods (RTX 4000 Ada, gen-worker 0.106.0, hub 7ae35d54a2), identically:

boot_adopt :: hit :: 10 035 ms / 10 510 ms
cell_numerics :: checked :: axes=3/3  cos=1.00000 ret=1.0000 rel_l2=0.0000
serve_eager_posture :: target_applicability_incomplete   (functions=() …)
serve_eager_posture :: armed_target_unresolved           (armed=False targets_resolve=True)
serve_degrade :: armed_target_unresolved
self_mint_skipped :: boot_ended_uncompiled

The setup warmup scored the boot-adopted artifact unexercised, folded it into
unproven, wrote function_proofs[id]=set() and unwrapped it. The pod served
eager for life and published nothing — after verifying that same artifact at
cos=1.00000 seconds earlier.

The asymmetry was structural: a mint's warmup drives its own capture, so it
dispatches and proves; an adopt arms before setup, so by construction
nothing has dispatched when the gate runs.

The two rulings

§4.31 — serve first. "skip the warmup / arm check, so we can serve right
away … try to serve, if an error is encountered, and it's the cause of the cell,
de-arm the cell, and serve eager instead. If our cell is correct this adds zero
cost." An AOTI .pt2 is ahead-of-time machine code for this exact sm × toolchain:
the first call is full speed. The warm pass never made a cell faster — it only
checked it.

§4.32 — quality is proven at MINT and in author CI, never at adoption. Every
failure the numerics gate ever caught (a baked conv_out.bias, timestep dtype
scars) was an author defect in endpoint code or config. Re-measuring on every
adopter taxes the fleet forever for one author's one-time mistake. It is not the
consumer's job to catch the author's bugs.

What this does

	before	after
adoption	materialize → arm → numerics probe → warm-exercise → prove or disarm	materialize → arm → serve
the numerics gate	ran on every adopt, DEGRADED armed and shipped	runs only on the minting pod, before publish, strict: identical or refuse
`function_proofs`	decided which aliases an installed target may serve	telemetry; gates nothing on the exported lane
a bad cell	caught by re-measurement on every pod, forever	caught once at mint; at serve, by the in-request fallback

⚠️ Finding: the mint-side gate did not exist

§4.32 item 2 says the mint gate "exists — pgw#1058 admission". It did not.
pgw#1058 is the admission-contract identity check (an entry's generated input
guards against its declared manifest), which runs at mint and at arm. The only
eager-vs-compiled parity measurement in the tree was
models/provision.gate_cell_numerics, and its only caller was the adopt arm.

Deleting the adopt-side gate without moving it would have left the platform with
zero parity detection anywhere. So this PR makes the mint-side gate real:

it runs on exactly one path — fleet_cells.adopt_delegated_mint →
provision.arm_aot(verify_numerics=True) — which is the arm
publish_self_mint requires before it can ship anything, so a refusal
unwraps, serves eager, emits self_mint_abort to the hub and publishes
nothing;
it is strict: gate_cell_numerics(strict=True) refuses the gray band too,
because a DEGRADED cell is one an adopter can never re-check.

numerics_probe was built for this move — "measure_axis takes callables
rather than a pipeline precisely so the same measurement can run mint-side" —
so this is a call-site change, not a new mechanism.

Why adoption is safe without re-measuring

Not from checkpoint identity: cells never carry checkpoint hashes. A ck1
key is graph × envelope × sm × toolchain, deliberately checkpoint-free, so one
cell serves every checkpoint of the architecture — that is the point of reuse.
Safety comes from construction:

(a) the cell is compiled CODE; weights flow through it as data (call
inputs and arm-time-bound constants), so the mint-time parity proof proves the
function and transfers to any checkpoint that function accepts;
(b) the one way that breaks — a weight value baked into the artifact —
is structurally fenced fail-closed by the constant-folding fence (0.100.0),
not policed by measurement;
(c) a checkpoint that changes the computation (a config flag that
alters the traced graph, e.g. qwen's zero_cond_t) hashes to a different
graph → different key → no match. The graph axis protects there.

What carries the weight now

In-request fallback + sticky de-arm — a cell-attributable failure answers
that request eager, de-arms for the boot, and types the cause.
Honest attribution — a CUDA OOM is not the cell's fault (a sibling
load, a rotation): serve eager, stay armed. Condemning it would retire a
correct artifact on the first busy moment and re-mint it on the replacement pod.
The sticky de-arm reaches the install — a revoked artifact no longer gets a
compile target, so the wire can't say aot_cell on a pipeline whose every call
runs eager (the lie pgw#1082/#1093 spent two pods closing). The old disarm
sweep hid this case by unwrapping first; serve-first reaches it.
The dynamo lane keeps its ledger — a dynamo arm that does not serve its
cell recompiles: correct output, silently slower, no exception to catch and
no numerics gate on that lane. Its per-class cache-hit proof is the only
detector in existence there. Argued, not silently dropped.

Boot cost this deletes

A warm "class" is one full handler invocation (_invoke_warmup → the
endpoint's generate, step fields clamped to their floor), not a module forward.

family	full plan, per handler	after
sdxl	18 (9 aspect buckets × 2 guidance classes)	2 (collapsed eager plan)
micro-diffusion	1–2 (bucket-0 toy; 16 ms/request measured)	unchanged in practice
ltx-video-2.3	35 legal rows of 120, via a custom `warmup()`	unchanged — the plan does not own it

The pgw#654 / ie#546 canary priced this machinery at "~30-min first boots and a
~9-min tax on every juggle swap". The adopt-side probe it also removes measured
158 / 161 ms for 3 axes on the pods above.

Accepted residuals, on the record

An artifact pathological enough to corrupt the CUDA context is not recoverable
in-request (process restart).
Same-sm cards can differ in scheduling-dependent float ordering, so mint-pod
parity is not a mathematical guarantee on every adopter. The in-request
fallback and the eager-only command (§4.32 item 4, owned by a separate
lane) are the right-sized answer.

RED, all four directions, nothing stubbed

tests/test_adopted_cell_warm_proof_pgw1141.py:

A the mint gate ships a faithful cell, and refuses both a gray-band and
a below-floor one;
B an adoption arms a cell that same gate would have refused —
parametrized over both failing rungs, because the point is not that adoption is
lucky, it is that adoption does not ask — and emits no verdict row at all;
C through the real ensure_setup: an adopted cell is armed, its target
installed with its aliases, +compiled, no armed_target_unresolved; a
revoked artifact gets no target and says compiled_degraded;
D through the real wrapper: a failing cell answers eager + de-arms sticky +
revokes; a transient OOM does neither and serves compiled again after.

One captured log reproduces the pod's own line verbatim: _Pipe armed=False targets_resolve=True.

test_numerics_gate_pgw868.py keeps every row, now driving the mint arm, with
its gray-band row flipped to "confesses and refuses to publish".
test_aot_boot_proof_gap_pgw735.py rows 2–3 asserted the deleted barrier and are
rewritten with the supersession recorded. test_aot_local_mint_pgw1096.py's stub
asserts the adopt path does not ask for the gate rather than absorbing the new
keyword — a **kwargs shim would have gone on reading green if the tax came back.

Release

Not cut. Joins 8867baac (pgw#1132) and c7b0813f (pgw#1137) in the batched
0.110.0 per the pgw#1140 ledger.

… destroying evidence stronger than the evidence it demands Two real pods (RTX 4000 Ada, gen-worker 0.106.0, hub 7ae35d54a2) did this, identically: `boot_adopt=hit` -> materialize -> `cell_numerics cos=1.00000 ret=1.0000 rel_l2=0.0000` on 3/3 axes -> and then the setup warmup scored that same artifact `unexercised`, folded it into `unproven`, wrote `function_proofs[id]=set()` and called `aot_serve.unwrap` / `compile_cache.unwrap`. `functions=()` then made `_install_compile_targets` omit the target (`target_applicability_incomplete`), which `_assert_armed_targets_installed` correctly reported as `armed_target_unresolved` — pgw#1093's own token on its boot-adopt twin — and the pod served eager for life and published nothing. The SELF-MINT arm was healthy on the same wheel, card and release, and the asymmetry is structural: a mint's warmup DRIVES its own capture, so it dispatches; an adopt arms BEFORE setup, so by construction nothing has. Paul's ruling, verbatim: "skip the warmup / arm check, so we can serve right away … try to serve, if an error is encountered, and it's the cause of the cell, de-arm the cell, and serve eager instead. If our cell is correct this adds zero cost. If our cell is wrong we detect immediately and then fall back to working." So this is mostly a deletion. On the EXPORTED lane the warm ledger gates nothing: the arm stands, and `_install_compile_targets` permits the whole contract the cell advertises instead of whatever the warm plan happened to dispatch. An AOTI artifact is ahead-of-time machine code for this exact sm/toolchain — the first call is full speed, so the warm pass never made it faster, it only checked it. What keeps the teeth: * the pgw#868 numerics gate still REFUSES a cell that does not reproduce eager — the only detector for a cell that runs cleanly and returns a WRONG image, which try-serve cannot see; * a cell-attributable failure at serve time answers THAT request eager, revokes the arm stickily, and says so typed (the existing wrapper); * an out-of-envelope shape is refused by name, per request (pgw#844); * evidence AGAINST still disarms; only the ABSENCE of evidence stopped being a verdict; * publishing to the fleet stays evidence-gated — serving optimistically costs this pod one eager fallback, publishing an unverified cell costs every pod that adopts it. The DYNAMO lane keeps its ledger, and the reason is the failure MODE, not the vintage: a dynamo arm that does not serve its cell RECOMPILES — correct output, silently slower, no exception for try-serve to catch, and no numerics gate on that lane at all. Its per-class cache-hit proof is the only detector that exists, so deleting it would remove a detector with no replacement. Boot cost deleted with the barrier: `tracing` now means a capture is being DRIVEN (or a dynamo arm is live), not "something is armed", so a boot adopting an exported cell runs the collapsed EAGER warm plan instead of the full class cross-product. sdxl: 18 full generates per handler (9 aspect buckets x 2 guidance classes) -> 2. The pgw#654 / ie#546 canary priced this same machinery at ~30-minute first boots. Serve-time attribution is honest now: a CUDA OOM is a fact about the CARD at that instant (a sibling load, a rotation), so it serves the request eager and leaves the cell ARMED — condemning it would retire a correct artifact on the first busy moment and re-mint it on the replacement pod. Accepted tail risk, recorded rather than hidden: an artifact pathological enough to corrupt the CUDA context is not recoverable in-request (process restart). With key-matched, numerics-gated cells that residual is judged acceptable. RED both directions, nothing stubbed: `tests/test_adopted_cell_warm_proof_ pgw1141.py` drives the real `provision.arm_aot` (real packed artifact, real gate, real ladder), the real `ensure_setup` warmup proof, and the real serving wrapper. Six rows fail on origin/master — including one whose captured log is the pod's own line verbatim: `_Pipe armed=False targets_resolve=True`.

…opt-side gate moves to the minting pod and turns strict Paul refined §4.31 after the first commit here. Every numerics failure this platform ever caught (a baked `conv_out.bias`, timestep dtype scars) was an AUTHOR defect in endpoint code or config, so the check belongs to the author, not to every pod that adopts the result: re-measuring per boot taxes the fleet forever for one author's one-time mistake. * **Adoption runs no quality gate.** `provision.arm_aot` gains `verify_numerics`, defaulting to FALSE — materialize, arm, serve. The three adopt routes through `_arm_exported_cell` (hub-ordered/boot-adopt, the local store, an in-process finalized cell) all take the default. * **The mint-time gate is REAL and STRICT, and this commit is what makes it either.** It runs on exactly one path — `fleet_cells.adopt_delegated_mint` -> `arm_aot(verify_numerics=True)` — which is the arm `publish_self_mint` requires before it can ship anything, so a refusal there unwraps, serves eager, emits `self_mint_abort` to the hub and publishes nothing. §4.32 wants identical-or-refuse, so `gate_cell_numerics(strict=True)` now refuses the gray band too: a DEGRADED cell is one an adopter can never re-check. FINDING, reported rather than assumed: §4.32 says this gate "exists — pgw#1058 admission". It did not. pgw#1058 is the admission-CONTRACT identity check (an entry's generated input guards against its declared manifest), at mint and at arm; the only eager-vs-compiled parity measurement in the tree was `models/provision.gate_cell_numerics`, and its only caller was the ADOPT arm. Deleting it without moving it would have left the platform with zero parity detection anywhere. `numerics_probe` was built for exactly this move ("`measure_axis` takes callables rather than a pipeline precisely so the same measurement can run mint-side"), so it is a call-site change, not a new mechanism. * **The superseded ledger is gone.** `aot_serve.NumericsProof` / `record_numerics_proof` / `numerics_proof` / `numerics_measured` were built for the previous design (bank the adopt verdict so the warm gate could read it). With adoption measuring nothing they have no job, so they are deleted rather than left as a surface a future lane would wire back up. * **The sticky de-arm now reaches the INSTALL.** A revoked exported artifact no longer gets a compile target installed — otherwise the wire would say `serving_mode=aot_cell` on a pipeline whose every call runs eager, which is the class of lie pgw#1082/#1093 spent two pods closing. The old disarm sweep hid this case by unwrapping first; serve-first reaches it, so it is named. Safety without re-measurement, stated correctly (an earlier draft of this argument was wrong and Paul caught it — cells NEVER carry checkpoint hashes; a ck1 key is graph x envelope x sm x toolchain and one cell serves every checkpoint of the architecture, which is the point of reuse): (a) the cell is compiled CODE and weights flow through it as data (call inputs and arm-time-bound constants), so a mint-time parity proof proves the FUNCTION and transfers to any checkpoint that function accepts; (b) the one way that breaks — a weight VALUE baked into the artifact — is structurally fenced fail-closed by the constant-folding fence (0.100.0), not policed by measurement; (c) a checkpoint that changes the COMPUTATION (a config flag that alters the traced graph) hashes to a different graph, hence a different key, hence no match at all. Tests: `test_adopted_cell_warm_proof_pgw1141.py` is restructured into the four things that now have to be true — the mint gate ships or refuses (strict), an ADOPTION arms a cell that same gate would have refused and emits no verdict at all (parametrized over both failing rungs, deliberately: the point is not that adoption is lucky, it is that adoption does not ASK), the setup warmup keeps an undispatched arm and its aliases, and try-serve de-arms on the cell's fault while a transient OOM does neither. `test_numerics_gate_pgw868.py` keeps every row it had, now driving the MINT arm, with its gray-band row flipped to "confesses AND refuses to publish". `test_aot_local_mint_pgw1096.py`'s stub asserts the adopt path does NOT ask for the gate rather than absorbing the new keyword — a `**kwargs` shim there would have gone on reading green if the tax came back.

…sed by the pod that minted it, end to end The survey that corrected my brief is right that this is a MOVE and not a delete, and $4.32's sequencing rule (at no commit may zero parity gates exist) deserves a test rather than an argument. `test_a_DIVERGENT_cell_is_not_ published_by_the_pod_that_minted_it` drives the REAL `adopt_delegated_mint` — the arm `publish_self_mint` requires — over a REAL packed cell with the REAL gate underneath, and asserts nothing ships plus the two typed rows (the ladder's `cell_numerics phase=refused` and the mint's `self_mint_abort phase=numerics_refused`). It is GREEN on master too, and the docstring says so. Master satisfied the invariant by ACCIDENT of placement: the gate lived in `arm_aot`, and a mint arms, so the mint path inherited a check aimed at adopters. This commit satisfies it on PURPOSE — aimed at the mint, with nothing left on the adopt path. The rows that separate those two worlds are the ones that go red: the gray band (master ships a degraded cell) and every adoption row.

…ed it, and the collapse is not free CI found the price. Making `tracing` mean "a capture is being driven" collapsed an exported adopt to the eager warm plan (sdxl: 18 full generates per handler -> 2, against a pgw#654/ie#546 canary that priced the machinery at ~30-minute first boots) — but that same plan is what produces pgw#844's BOOT-TIME coverage census (`compiled_shape_coverage`, which names the declared classes a cell does not carry before any tenant meets one) and what feeds the dynamo lane's per-class cache-hit ledger, its only detector of a silent recompile. `test_partial_shape_coverage_pgw844` went red on exactly that. §4.31 deletes the warm plan as a PREREQUISITE TO ARMING, which is this issue and is untouched by the revert: the arm stands, the target installs, the cell serves. The per-class COST is a separate saving that needs its own answer for the census and its own red tests, so it is filed rather than ridden in on a P0 arm fix. The omission is written into the code at the decision point. Also fixes the three stub signatures CI caught (`test_abandoned_mint_telemetry_ pgw848`, `test_local_serve_no_publisher_pgw1127`, `test_boot_adopt_local_first_ pgw1127`): each now ASSERTS the adopt path does not ask for the mint-time gate rather than absorbing the keyword through `**kwargs` — a shim there would keep those files green if the per-adopter tax came back.

PaulFidika added 2 commits August 11, 2026 13:48

PaulFidika force-pushed the 1141-warmup-disarm branch from 0eb822b to 30af52a Compare August 11, 2026 20:03

PaulFidika changed the title ~~pgw#1141: a boot-adopted cell SERVES — delete the warmup proof barrier, keep every detector that can actually see a fault~~ pgw#1141 (§4.31 + §4.32): a boot-adopted cell materializes, arms and SERVES — the parity gate MOVES to the mint Aug 11, 2026

PaulFidika merged commit 0dbf68e into master Aug 11, 2026
2 checks passed

PaulFidika deleted the 1141-warmup-disarm branch August 11, 2026 20:50

PaulFidika mentioned this pull request Aug 11, 2026

pgw#1141 (REOPENED by POD PROOF #4): a boot-adopted cell is on the EXPORTED lane — read it off the OBJECT, not off a registry nobody fed #669

Open

Navigation Menu

Uh oh!

pgw#1141 (§4.31 + §4.32): a boot-adopted cell materializes, arms and SERVES — the parity gate MOVES to the mint - #658

pgw#1141 (§4.31 + §4.32): a boot-adopted cell materializes, arms and SERVES — the parity gate MOVES to the mint#658
PaulFidika merged 4 commits into
masterfrom
1141-warmup-disarm

PaulFidika commented Aug 11, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

PaulFidika commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

The defect, measured twice

The two rulings

What this does

⚠️ Finding: the mint-side gate did not exist

Why adoption is safe without re-measuring

What carries the weight now

Boot cost this deletes

Accepted residuals, on the record

RED, all four directions, nothing stubbed

Release

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

PaulFidika commented Aug 11, 2026 •

edited

Loading