fix: bundle and validate CUDA 13 kernels for Linux bpy

[michaelgold]

Summary

• Use CUDA Toolkit 13.0 in Linux x86_64 and the real native ARM64/SBSA workflow.
• Explicitly enable Cycles CUDA device/binary builds and target only CUDA-13-supported architectures: sm_75, sm_80, sm_86, sm_89, sm_90, sm_100, sm_120, compute_120. No Maxwell/Pascal/Volta targets are retained.
• Validate every configured kernel in the final wheel before install/publication: correct versioned Cycles resource directory and loader format, nonempty payload, ZIP CRC, bounded declared zstd size, successful decompression without trailing data. Upstream packaging recursively includes the bpy tree; no packaging exclusion needed changing.
• Move x86_64 publication after runtime dependency resolution and import checks; respect each wheel's dependencies instead of forcing numpy<2. Add lightweight unit-test CI. Preserve native ARM64 validation-before-CI policy.

Verified

• Strict TDD for missing build directives, missing wheel/kernel gates, stale resource version, and malformed compressed kernels.
• Spark ARM64: 62 tests pass; CUDA validator 100% statement coverage; targeted Ruff, compileall, CLI help, YAML parsing and git diff --check pass.
• mghavn: fresh clone /home/mg/buildbpy-cuda13-validation, detached exact commit 2559a97b39d6b3c5b2adb03d8613d24e06c25d01; isolated test venv /home/mg/buildbpy-cuda13-test-venv; all 62 tests pass (100% validator coverage), targeted Ruff and CLI help pass. Tests also run outside repository cwd.
• Independent Codex review: initial findings fixed with regressions; final review reports no actionable correctness/security findings.
• Normal toolkit-present RTX 5090 render of the EXISTING custom bpy 5.2.1 reproduces nvcc fatal: Value 'sm_120' is not defined with CPU devices disabled. This is baseline evidence, not a successful rebuilt-wheel test.

Native validation / limitations

• Spark CUDA 13.0: all eight real Cycles kernels compiled; native incremental Blender v5.2.0 build/install completed against the preserved ARM64 source/dependency tree. Upstream wheel packaging completed, and the new final-archive validator accepted all eight kernels.
• Produced /home/mg/buildbpy-cuda13-native-dist/bpy-5.2.0-cp313-cp313-manylinux_2_39_aarch64.whl (428376997 bytes), SHA256 aebfc21818e79769f86b915bbb296fda469e1a670bc55c63d968b3ff57060136. Architecture/ABI tags checked; installed in fresh /home/mg/buildbpy-cuda13-native-venv; import/version 5.2.0 passed; all eight installed kernel files byte-match the wheel.
• Normal GB10 CUDA render passed with CPU devices disabled, producing a 32x32 PNG (1488 bytes). A second strace-instrumented render passed and shows the installed kernel_sm_120.cubin.zst opened; no nvcc exec was observed. Toolkit remained available. This is not the isolated no-toolkit test.
• GitHub unit-test CI is green: https://github.com/michaelgold/buildbpy/actions/runs/34482685560 . The initial CI dependency resolver backtracked through obsolete pytest-cov versions; pinning the locally/remotely tested coverage tooling fixed it.
• mghavn has nvcc 12.0 only. Its 595.58.03 driver advertises CUDA 13.2 compatibility, which is not a CUDA toolkit installation. A full CUDA-13 x86_64 rebuild and rebuilt-wheel GPU render there are blocked pending permission/provisioning for a CUDA13 toolkit. Existing consumer environment was not changed.
• Only the isolated no-toolkit GPU test is intentionally skipped. No clean/from-scratch Blender build or v5.2.1 rebuilt artifact was produced; the successful native artifact/render above is the incremental v5.2.0 ARM64 validation.

Reproduce target-host focused verification

ssh -i /home/mg/.ssh/hermes_depthmap_hetzner -o IdentitiesOnly=yes mg@mghavn
# Fresh clone was created with:
git clone https://github.com/michaelgold/buildbpy.git /home/mg/buildbpy-cuda13-validation
git -C /home/mg/buildbpy-cuda13-validation fetch origin fix/linux-cuda13-kernels
git -C /home/mg/buildbpy-cuda13-validation checkout --detach 2559a97b39d6b3c5b2adb03d8613d24e06c25d01
cd /home/mg/buildbpy-cuda13-validation
/home/mg/buildbpy-cuda13-test-venv/bin/python -m pytest tests --cov=buildbpy.cuda_wheel --cov-report=term-missing -q
/home/mg/buildbpy-cuda13-test-venv/bin/python -m ruff check src/buildbpy/cuda_wheel.py tests/test_cuda_wheel.py
/home/mg/buildbpy-cuda13-test-venv/bin/python -m buildbpy.main --help

• No publication-enabled build workflows dispatched; no ARM64 CI bypass, wheel publication, release, or merge performed.

[Copilot]

🟡 Changes recommended

The Linux workflows may not actually install wheel runtime dependencies after buildbpy’s --install (which uses pip --no-deps), because pip install <wheel> can no-op when the wheel is already installed.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the Linux build/release pipeline to use CUDA Toolkit 13.0, explicitly build/bundle the supported Cycles CUDA kernels, and validate kernel presence/format directly from the produced wheel before installation/publication.

Changes:

• Add a Linux CUDA wheel validator (validate_cuda_wheel) and enforce it during Linux wheel build management.
• Update Linux (x86_64 + native ARM64/SBSA) workflows to install CUDA 13.0 and publish only after import/dependency checks.
• Add unit tests/CI to cover CUDA wheel validation, Linux workflow CUDA setup ordering, and CUDA CMake directives.

File summaries

File	Description
tests/test_cuda_wheel.py	Adds unit tests for wheel kernel validation and workflow/CMake assertions.
tests/test_arm64_deps_bundle.py	Updates a builder test double to include os_strategy required by new validation path.
src/buildbpy/main.py	Enables Cycles CUDA directives on Linux and validates CUDA kernels in the final built wheel.
src/buildbpy/cuda_wheel.py	Introduces CUDA arch policy + wheel kernel validation logic (CRC, zstd framing, decompression).
requirements.txt	Adds zstandard dependency.
README.md	Documents Linux CUDA kernel policy, build/runtime expectations, and validation behavior.
pyproject.toml	Adds zstandard dependency to project metadata.
.github/workflows/tests.yml	Adds a lightweight unit-test workflow (pytest + coverage for CUDA validator).
.github/workflows/build_linux.yml	Switches to CUDA 13.0, defers publishing, and installs wheel runtime dependencies.
.github/workflows/build_linux_arm64.yml	Adds native ARM64 CUDA 13 setup and installs wheel runtime dependencies.

Review details

• Files reviewed: 9/10 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[michaelgold]

Update: x86_64 validation now PASSES on mghavn at exact PR head 2559a97. The earlier toolkit blocker is resolved: CUDA 13.0.88 installed by user; isolated GCC 14.2 and X11 development dependencies supplied for the build. Full Blender v5.2.1 build and wheel packaging completed. Final CUDA wheel validator passed. Wheel installed with dependencies in separate /home/mg/buildbpy-cuda13-x86-render-venv; import reports 5.2.1 LTS. Normal toolkit-present Cycles CUDA render PASSED on NVIDIA GeForce RTX 5090, CPU explicitly disabled, output /home/mg/buildbpy-cuda13-x86-render.png. Log: /home/mg/buildbpy-cuda13-x86-verify.log. Wheel: /home/mg/buildbpy-cuda13-x86/build_linux_bpy/bin/bpy-5.2.1-cp313-cp313-manylinux_2_39_x86_64.whl. SHA256: 157304269716ccfbddcaa983b3a6075893dfc815cd18ff6719c84f79c28d37aa. Existing consumer venv unchanged. Isolated no-toolkit GPU test remains intentionally skipped. No merge, release, or publication. This supersedes the earlier x86_64 validation blocker.

[michaelgold]

Consumer integration verified: with user approval, backed up complete mghavn enhanced-MCP .venv to /home/mg/buildbpy-consumer-rollback-cuda13/venv.tar, then replaced only bpy with the verified 5.2.1 CUDA13 wheel (--no-deps). pip check passes. Installed provenance matches SHA256 157304269716ccfbddcaa983b3a6075893dfc815cd18ff6719c84f79c28d37aa; all eight installed kernels byte-match wheel. Actual MCP stdio initialize/list_tools/call_tool path passed using execute_blender_code_for_cli and standalone bpy in /home/mg/blenderbench-direct/enhanced-mcp/mcp/.venv/bin/python. RTX 5090 CUDA enabled, CPU disabled, 128x128 render produced. All four requested tools are exposed. MCP result isError=false. Consumer lacks Pillow, so the smoke script final image-decoding step failed locally; PNG was independently transferred and fully decoded/size-checked on Spark, passing without adding consumer dependencies. Evidence: /home/mg/buildbpy-consumer-mcp-smoke.log and /home/mg/buildbpy-consumer-cuda13-smoke/mcp-result.json. No merge or publication.