FastPLMs 1.0 repository and compliance upgrade

.dockerignore

@@ -1,18 +1,38 @@
-# Ignore everything by default
+# The build context is an explicit allowlist. Runtime stages never receive the
+# upstream parity oracles; reference stages copy only their selected checkout.
 *
 
-# Keep Python source files anywhere in the tree
-!**/*.py
+!.dockerignore
+!.gitmodules
+!pyproject.toml
+!uv.lock
+!kernels.lock
+!README.md
+!LICENSE
+!THIRD_PARTY_NOTICES.md
 
-# Keep dependency manifest used during build
-!requirements.txt
+!LICENSES/
+!LICENSES/**
+!src/
+!src/**
+!tests/
+!tests/**
+!benchmarks/
+!benchmarks/**
+!tools/
+!tools/**
+!docker/
+!docker/**
+!docs/
+!docs/**
+!model_cards/
+!model_cards/**
 
-# Keep official submodules (needed for pip install -e during build)
-!official/**
+!vendor/
+!vendor/README.md
 
-# Keep non-Python files needed by models
-!**/*.json
-!**/*.txt
-!**/*.md
-!Dockerfile
-!.dockerignore
+**/.git
+**/.git/**
+**/__pycache__
+**/*.py[cod]
+**/.pytest_cache

.gitattributes

@@ -0,0 +1,4 @@
+* text=auto eol=lf
+# Preserve byte-exact third-party legal text without treating its upstream
+# trailing spaces as project defects.
+LICENSES/ankh/LICENSE.md whitespace=-trailing-space

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 2

.github/workflows/cpu-contracts.yml

@@ -0,0 +1,122 @@
+name: CPU and package contracts
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pr-confidence-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CUDA_VISIBLE_DEVICES: ""
+  HF_DATASETS_OFFLINE: "1"
+  HF_HUB_OFFLINE: "1"
+  TRANSFORMERS_OFFLINE: "1"
+  HF_HOME: ${{ github.workspace }}/.ci-cache/huggingface
+  TORCH_HOME: ${{ github.workspace }}/.ci-cache/torch
+  XDG_CACHE_HOME: ${{ github.workspace }}/.ci-cache/xdg
+  PYTHONHASHSEED: "0"
+  OMP_NUM_THREADS: "1"
+  OPENBLAS_NUM_THREADS: "1"
+  MKL_NUM_THREADS: "1"
+  PYTEST_XDIST_AUTO_NUM_WORKERS: "4"
+  PYTHONNOUSERSITE: "1"
+  TOKENIZERS_PARALLELISM: "false"
+  UV_TORCH_BACKEND: cpu
+
+jobs:
+  cpu-contracts:
+    name: cpu-contracts (3.12)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+          submodules: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: "0.10.12"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - name: Install the locked CPU environment
+        run: |
+          uv lock --check
+          uv sync --frozen --python 3.12 --no-default-groups \
+            --group validation --extra cpu --extra dev --extra structure --extra train
+      - name: Run the hermetic CPU gate
+        env:
+          PYTHONPATH: ${{ github.workspace }}/tests/cpu/bootstrap:${{ github.workspace }}/src
+          FASTPLMS_CPU_TELEMETRY_PATH: ${{ github.workspace }}/artifacts/telemetry/cpu-contract.json
+        run: |
+          mkdir -p artifacts/junit artifacts/telemetry
+          .venv/bin/python -m pytest tests/cpu -m cpu_contract -n auto \
+            --dist=loadscope --durations=25 \
+            --junitxml=artifacts/junit/cpu-contract.xml
+
+  quality-package:
+    name: quality-package (3.12)
+    runs-on: ubuntu-latest
+    timeout-minutes: 8
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+          submodules: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: "0.10.12"
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+      - name: Install the locked quality environment
+        run: |
+          uv lock --check
+          uv sync --frozen --python 3.12 --no-default-groups \
+            --group validation --extra cpu --extra dev
+      - name: Check source, typing, generated docs, and release contracts
+        run: |
+          .venv/bin/ruff check src tests tools examples benchmarks
+          mapfile -t MYPY_TARGETS < tools/typing-critical-files.txt
+          .venv/bin/mypy --python-version 3.12 --ignore-missing-imports \
+            --explicit-package-bases --follow-imports=silent \
+            "${MYPY_TARGETS[@]}"
+          PYTHONPATH=src .venv/bin/python -m tools.artifacts.generate_docs --check
+          .venv/bin/python -m pytest \
+            tests/release/test_binder_example_contracts.py \
+            tests/release/test_documentation.py \
+            tests/release/test_dependency_contracts.py \
+            tests/release/test_flash_source_policy.py \
+            tests/release/test_manifest_readiness.py \
+            tests/release/test_model_card_licenses.py \
+            tests/release/test_optimized_mode_contracts.py \
+            tests/release/test_production_source_boundary.py \
+            tests/release/test_python_support_matrix.py \
+            tests/release/test_static_typing_scope.py \
+            tests/release/test_typing_no_regression_gate.py \
+            tests/release/test_workflow_declared_inputs.py \
+            -q
+      - name: Build and smoke one clean wheel
+        run: |
+          .venv/bin/python -m build --wheel
+          uv venv --python 3.12 .smoke-venv
+          uv pip install --python .smoke-venv/bin/python --torch-backend=cpu \
+            "torch==2.13.0" "transformers==5.13.0" dist/*.whl
+          .smoke-venv/bin/python -I tools/remote/python_support_smoke.py \
+            --expected-python 3.12 \
+            --source-root "$GITHUB_WORKSPACE/src"
+      - name: Check runtime import closure
+        run: |
+          .venv/bin/python tools/remote/runtime_import_closure.py \
+            --source-root src/fastplms \
+            --pyproject pyproject.toml \
+            --output artifacts/runtime-import-closure.json

.github/workflows/h100-validation.yml

@@ -0,0 +1,114 @@
+name: Hopper SM90 validation tiers
+
+on:
+  workflow_dispatch:
+    inputs:
+      revision:
+        description: Full 40-character PR or release commit SHA; dispatch this workflow on the same ref
+        required: true
+        type: string
+      tier:
+        description: Validation tier to execute on the configured remote Hopper/SM90 host
+        required: true
+        type: choice
+        default: golden-smoke
+        options:
+          - golden-smoke
+          - nightly
+          - release-candidate
+          - benchmark-capture
+permissions:
+  contents: read
+
+concurrency:
+  group: fastplms-h100-validation
+  cancel-in-progress: false
+
+jobs:
+  remote-h100:
+    name: hopper-sm90-${{ matrix.suite }}
+    runs-on: ubuntu-latest
+    environment: h100-validation
+    timeout-minutes: 360
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        suite: ${{ fromJSON(inputs.tier == 'release-candidate' && '["compliance","artifact","structure","benchmark"]' || inputs.tier == 'benchmark-capture' && '["benchmark-capture"]' || inputs.tier == 'nightly' && '["nightly"]' || '["gpu-golden-smoke"]') }}
+    env:
+      # Legacy secret names remain stable; release evidence is bound to the configured GH200.
+      FASTPLMS_H100_HOST: ${{ secrets.FASTPLMS_H100_HOST }}
+      FASTPLMS_H100_SSH_KEY: ${{ secrets.FASTPLMS_H100_SSH_KEY }}
+      FASTPLMS_H100_KNOWN_HOSTS: ${{ secrets.FASTPLMS_H100_KNOWN_HOSTS }}
+    steps:
+      - name: Bind a manual dispatch to its immutable workflow SHA
+        if: github.event_name == 'workflow_dispatch'
+        shell: bash
+        env:
+          REQUESTED_REVISION: ${{ inputs.revision }}
+          WORKFLOW_REVISION: ${{ github.sha }}
+        run: |
+          if [[ ! "$REQUESTED_REVISION" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error::revision must be a lowercase, full 40-character commit SHA"
+            exit 64
+          fi
+          if [[ "$REQUESTED_REVISION" != "$WORKFLOW_REVISION" ]]; then
+            echo "::error::Dispatch the workflow from the exact requested PR/release ref so its status is attached to that SHA"
+            exit 64
+          fi
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.revision || github.sha }}
+          submodules: false
+      - name: Verify the immutable checked-out revision
+        shell: bash
+        env:
+          EXPECTED_REVISION: ${{ github.event_name == 'workflow_dispatch' && inputs.revision || github.sha }}
+        run: |
+          ACTUAL_REVISION=$(git rev-parse HEAD)
+          if [[ "$ACTUAL_REVISION" != "$EXPECTED_REVISION" ]]; then
+            echo "::error::Checked-out HEAD $ACTUAL_REVISION differs from requested $EXPECTED_REVISION"
+            exit 65
+          fi
+      - name: Initialize pinned official references
+        if: >-
+          matrix.suite == 'compliance' ||
+          matrix.suite == 'structure' ||
+          matrix.suite == 'artifact' ||
+          matrix.suite == 'benchmark' ||
+          matrix.suite == 'benchmark-capture' ||
+          matrix.suite == 'nightly'
+        run: git submodule update --init --recursive
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.12"
+      - name: Require an explicitly configured remote Hopper/SM90 host
+        shell: bash
+        run: |
+          if [[ -z "$FASTPLMS_H100_HOST" || -z "$FASTPLMS_H100_SSH_KEY" || -z "$FASTPLMS_H100_KNOWN_HOSTS" ]]; then
+            echo "::error::Configure legacy FASTPLMS_H100_HOST, FASTPLMS_H100_SSH_KEY, and FASTPLMS_H100_KNOWN_HOSTS secrets for the exact GH200/aarch64 validation host. This workflow never reports an unconfigured Hopper/SM90 tier as green."
+            exit 64
+          fi
+          install -d -m 700 "$HOME/.ssh"
+          printf '%s\n' "$FASTPLMS_H100_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
+          chmod 600 "$HOME/.ssh/known_hosts"
+          printf '%s\n' "$FASTPLMS_H100_SSH_KEY" > "$RUNNER_TEMP/fastplms-h100-key"
+          chmod 600 "$RUNNER_TEMP/fastplms-h100-key"
+      - name: Execute exact-head remote validation
+        run: |
+          python -m tools.remote \
+            --host "$FASTPLMS_H100_HOST" \
+            --identity "$RUNNER_TEMP/fastplms-h100-key" \
+            --suite "${{ matrix.suite }}" \
+            --artifacts artifacts/remote
+      - name: Remove the ephemeral SSH identity
+        if: always()
+        run: rm -f "$RUNNER_TEMP/fastplms-h100-key"
+      - name: Upload immutable remote reports
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: h100-${{ matrix.suite }}-${{ github.sha }}
+          path: artifacts/remote
+          if-no-files-found: error

.gitignore

@@ -1,27 +1,54 @@
+# Python
+__pycache__/
+*.py[cod]
+*.so
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+.venv/
+*.egg-info/
 
-*.pyc
-*.png
-!docs/assets/*.png
-*.pth
-*.pt
-*.safetensors
-*.json
-!e1_fastplms/*.json
-*.bin
-.qodo
+# Build and run outputs
+build/
+dist/
+/artifacts/
+results/
+.cache/
 *.db
+*.db-shm
+*.db-wal
 *.nbc
 *.nbi
+
+# Checkpoint and tensor payloads
+*.bin
 *.ckpt
-/results_classification_lora
-/results_regression_lora
-/testing/results
+*.pth
+*.pt
+*.safetensors
+!tests/goldens/**/*.safetensors
+
+# Local credentials and workstation state
+.env
+.env.*
+!.env.example
+*.key
+*.pem
+*.p12
+*.pfx
+.qodo/
+
+# Local planning and scratch material
 draft.md
-/dplm
-/E1
-/.cache
-/esm
-/testing/__pycache__
-/github_issues
-/internal
-/marketing
+github_issues/
+internal/
+marketing/
+/.codex-*
+/.codex_*
+/.claude
+/tmp
+/output
+*.log
+.secrets.env