deepseek41 : add cross-runtime correctness trace harness

[ajaxdude]

Overview

Add a deterministic, auditable DeepSeek V4.1 cross-runtime correctness trace harness for the unchanged published GGUF. The harness exports content-addressed exact-bit artifacts from llama.cpp, defines the pinned ds4 exporter contract, verifies prompt/token identity, compares routing, Engram, compressed-attention, prefill-logit, and multi-step decode data, and reports the first exact divergence.

This is stacked on corrected full-graph draft #7 at 081c549451b92c01fe832ffb0bdd9ad90370e21a. The frozen replacement head is c313eddf221ab35a085b915e88ff1d69facba8df; its parent is de8879f702a3cd1f53a97b761e6ec707336c5ac9, and its tree is dad3e01342d3007a840023a4f32690032e64e4bc. The base-to-head binary diff SHA-256 is 6afb931a8fac2194a868c3393d81fe0676b763a310d0e289cdc6fa1c795aacfe.

The rejected universal Linux host contract has been replaced with two strict runtime-specific lanes. The llama.cpp candidate must prove the actual selected ROCm0 PCI device maps through Linux KFD to gfx_target_version=110501 (gfx1151), use Linux local non-rotational NVMe, and carry the approved watchdog evidence. The ds4 oracle must truthfully prove macOS arm64, Apple Metal device identity, at least 128 GiB measured memory, zero swap, internal solid-state storage backed by NVMe or Apple Fabric, and runner/exporter ownership. Cross-runtime comparison does not require accelerator architecture, registry/PCI identity, or operating system equality; exact model, prompt, inference configuration, token, routing, Engram, attention, and complete-logit artifacts remain the comparison contract.

The replacement also makes the native exporter emit environment.command as a JSON-encoded argv string and flash_attention as JSON boolean true. The model-free native regression now writes the actual manifest consumed directly by TraceBundle; Python no longer copies native values into a handcrafted manifest. Every manifest and memory audit declares expert and KV caches as memory-resident with empty external cache/state path lists. Prompt-builder output is exact-schema validated and normalized into canonical provenance. The manifest audit envelope is exactly pre and post, and canonical watchdog leases require state=active plus millisecond UTC watchdog_start_time_utc.

The replacement also binds ds4 accelerator and host evidence into both content-addressed memory audits; binds every audit storage record to the corresponding manifest path; verifies model, prompt, output, repository, ds4 checkout, temporary directory, Python executable, runner script, and exporter storage; requires the runner script to belong to the attested harness repository; and hashes the Python executable, runner script, exporter, and command. APPROVED_EXPORTERS remains empty. The shared allowlist is checked before any exporter invocation, including device-only preflight, and again by standalone ds4 bundle validation and comparison so an unapproved handcrafted bundle cannot report TARGET PASS.

All manifest, event, provenance, audit, storage, accelerator, host, runner, and watchdog JSON uses duplicate-key rejection and exact schemas. Unknown or mixed runtime fields fail closed. The approved watchdog JSONL event schemas are validated exactly: procfs_error and signal_error permit producer-valid optional diagnostics, required-error and forbidden-error classifications remain distinct, secondary_errors is limited to a primary signal_error, and canonical sigkill_timeout is accepted. Canonical lease file identity fields and the live audit SHA-256 are strict required fields, and the live audit digest must equal the embedded content-addressed JSONL digest. Numeric identities reject JSON booleans. TMPDIR is mandatory and must be an absolute literal pathname; relative and expansion-changing forms such as ~/tmp are rejected before any filesystem or storage operation. The exact literal path must be an existing writable non-symlink directory and its unchanged identity must pass storage attestation. Linux rejects lexical and resolved /mnt/bigspace paths, tmpfs, network filesystems, rotational devices, unresolved devices, and symlink escapes. Apple resolves each path or nearest existing output parent with df -P, then proves the containing volume with diskutil info -plist; SATA, network, virtual, disk-image, external, and non-solid-state storage fails closed.

The llama-side callback remains opt-in and captures only the reserved dsv41.trace.* producer contract. Unknown components, malformed suffixes, unexpected layers, zero-dimensional tensors, cache-slot expert IDs, incomplete logits, and missing per-chunk attention evidence fail closed. Trace payloads are streamed to content-addressed blobs without retaining unbounded tensor state. run_matrix.py is now an explicit --llama-only Strix capture tool; ds4 capture runs separately on the authorized Apple host and completed bundles are compared afterward.

Measurements

No performance measurements were run or claimed. Correctness must pass before any performance work.

Model-free correctness:

• Built llama-deepseek-v41-trace, llama-deepseek-v41-prompt-builder, and test-deepseek41-trace-host on macOS.
• Ran test-deepseek41-schema, test-deepseek41-engram, test-deepseek41-expert, test-deepseek41-memory, test-deepseek41-runtime, test-deepseek41-trace, and test-deepseek41-trace-host: 7/7 passed.
• Ran python3 tests/test-deepseek41-trace.py: 61/61 passed, including the exact approved watchdog serializer/atomic lease reader/audit embed pipeline, native-written manifest validation, canonical _kill_and_finish optional-error and sigkill_timeout outputs, strict secondary_errors, standalone ds4 exporter allowlist enforcement, and both full Python preflights rejecting relative, missing/../tmp, ordinary symlink, and literal ~/tmp ancestor-symlink paths while accepting the exact absolute path.
• Reconfigured and rebuilt at exact head c313eddf221ab35a085b915e88ff1d69facba8df; build-harness/bin/llama-deepseek-v41-trace --version reports commit c313eddf2. Its local macOS arm64 SHA-256 is 24a791c4bd01f603f1af9b8f3343a040b921b20d72fe8623774090896c5a2339; the prompt builder SHA-256 is 026ae552ea2110c4737697cc31d4781aa8b778db7855dfbf93febf458af877c4.
• Ran Python bytecode compilation, git diff --check, 125-character Python line scan, and ASCII-only scan: passed.

The model-free suite covers exact serialization and float bits, hashes, mismatch classification/reporting, truncated/corrupt artifacts, original expert ID versus cache-slot separation, empty variable-width attention payloads, valid Metal-vs-Strix bundle comparison, cross-kind and unknown-field rejection, duplicate keys, missing or spoofed accelerator evidence, audit/manifest path substitution, Apple host/storage/runner evidence, Linux NVMe/KFD evidence, forbidden-root symlink escapes, nearest-parent output behavior, strict watchdog event schemas, canonical watchdog file identity and audit digest binding, native producer-to-validator integration, boolean numeric identities, and exporter approval gates at execution, standalone validation, and comparison.

Contract SHA-256 values at this head:

• tools/deepseek-v41-trace/trace_format.py: e12e3a0ba4d6411f38ea019ef7a1a8b0ea60f2a13dbee2a7197a25ee40449eb4
• tools/deepseek-v41-trace/trace-components.h: fcd42211af3be02e753fb64a1bf3de27d1c7ef389cf86bd69d80d4ff1f2f681d
• tools/deepseek-v41-trace/host-attestation.h: fa0c9a7d2015204ec8da8b78a90ee3494ca935e6a7e55a81830bbf1628b2fe37
• tools/deepseek-v41-trace/preflight.py: fb2efc224ff80b4b154e34ae3c63a0954d1dd3a0f4b8c03d857b3799add0c93b
• tools/deepseek-v41-trace/run_ds4.py: e53b50edd1f9cd92b47e10da9a7c89b33eae1450c04c13c9e1c2de495cd49d02
• tools/deepseek-v41-trace/llama-trace.cpp: e48eaf08f2cc95fd8701aca55e9f12062c8f57ba34868fa30e97819ad638a859
• tests/test-deepseek41-trace.py: 5197c454fae7eaf4c846b3cfcef5e0b20fe2077ec5052c69665bec3c21a4188a
• tools/deepseek-v41-trace/README.md: 3c947251f1479a9cc2b192ec34470741be440917a1a7b51278d974ebc0081b23

The independently approved watchdog contract remains exactly revision 778db6f50eae04e6c232c69b9575bdbd0747962b, script SHA-256 d2781a25f978dd2bc14fc113079aa2dbf513aa157b44da9d0d51d750daa6c94f, lease/heartbeat version 2, 30 second grace, and 1 second sampling. Both approval maps contain only that exact pair. APPROVED_EXPORTERS is empty.

Additional information

The trace format remains version 2 because the rejected contract was not accepted and no authorized oracle artifacts exist. The format is versioned JSONL plus canonical little-endian content-addressed blobs. Routing, Engram rows, token IDs, attention sources/candidates, and candidate blocks are hard failures on any mismatch. Complete prefill and decode logits require byte identity; there is no tolerance mode.

The ds4 source tree is not modified. Pinned ds4gguf@e13893ffcb33e90c8852929303e188102df7a8f5 is provenance only. The executable fixtures and verifier remain in this repository. The external ds4 exporter is not present in the pinned antirez/ds4@bd66c402070042bf0a79ad6ece8242de4c93680c checkout. Cross-runtime TARGET PASS remains blocked until the separately built exporter is independently approved, its exact executable SHA-256 is pinned, and an authorized 128 GiB or larger Apple Metal oracle host executes it.

The first real 32K oracle run remains unrun. It requires a clean final integration commit containing the approved watchdog, expert execution, full graph, and this replacement harness; an approved exporter; the unchanged published GGUF; exact prompt provenance for all four repository corpora; eight deterministic decode steps; complete component coverage; and byte-identical complete logits. The Strix candidate run additionally requires actual gfx1151, zero configured swap, no unrelated active workload, a live canonical watchdog lease/heartbeat/audit, and NVMe-only I/O. Do not expand to 65536, 98304, or 131072 and do not benchmark performance until 32768 passes.

Trailer audit disclosure: all 16 non-merge commits between the stacked base and this head carry both required trailers. Mechanical ancestry-only merge commits b1ffc5f9713eb85fd1b6e2ca71c3c11410d35bec and 61e9ea511b3969333df70a7cea669694096690ba lack the Assisted-by and Copilot co-author trailers. They were created during agent-coordinated stack propagation and contain no independent semantic change. History is preserved without rewrite or force-push.

Requirements

• I have read and agree with the contributing guidelines
• This change is Strix Halo specific, or justified by measurements on Strix Halo. General llama.cpp improvements belong in halo-box/llama.cpp instead
• AI usage disclosure: AGENT-AUTHORED by GPT-5.6 Sol under human direction and review coordination.
• What was NOT verified: no published DeepSeek V4.1 GGUF was executed; no Strix Halo model run, Apple Metal ds4 oracle export, live watchdog process or Linux validation-host execution, ROCm/Vulkan backend validation, 32K corpus matrix, long-context expansion, or performance benchmark was performed. The local build used macOS CPU-only focused targets with OpenMP unavailable.

[ajaxdude]

The current head 5dc4dc74ebdfba34a74afe9e743baf7b70f078d2 is superseded for real-host execution pending two fail-closed corrections found while preparing the exact runbook:

• the documented matrix configuration uses ubatch=512, 8 expert slots, and 4096 MiB, but final admission requires min(384, 6*n_ubatch) resident expert slots. That configuration requires 384 slots and more than 142 GiB for cache alone; it cannot execute under the host ceiling. A valid initial configuration must use the admitted DeepSeek41 ubatch (normally 32), require at least 192 slots, and derive the cache byte budget from metadata/admission rather than a fixed 4096 MiB example;
• the prepared lease procedure binds to an arbitrary heartbeat helper rather than the canonical strix_memory_watchdog.py, so current audit checks can be satisfied without any process enforcing the 116/118 GiB thresholds. The committed harness and docs must bind execution to the actual watchdog process group, thresholds, audit stream, and child workload, with a negative regression rejecting a synthetic heartbeat-only lease.

No Strix execution used this configuration. The owner is auditing committed scripts/docs and will publish a replacement head with focused tests before integration resumes.