fix(qwen38): the preflight asks whether the pin is ONE of an image's digests #92

Merged
dank merged 1 commits from fix/quant-pipeline-hardening into main 2026-10-30 16:30:07 -07:00
3 changed files with 24 additions and 9 deletions
Showing only changes of commit 44d72b9e78 - Show all commits

No files matched your search

+9 -6
View File
@@ -43,13 +43,16 @@ fi
# 2. image — resolve the REF to a digest. A stale local `:latest` is a different model of the world. # 2. image — resolve the REF to a digest. A stale local `:latest` is a different model of the world.
if command -v podman >/dev/null 2>&1; then if command -v podman >/dev/null 2>&1; then
got="$(podman image inspect -f '{{index .RepoDigests 0}}' "$IMAGE_REF" 2>/dev/null | sed 's/.*@//')" # An image carries EVERY digest it was pulled under (a tag plus the by-digest pull), so this
if [ -z "$got" ]; then # asks whether the pin is one of them — reading RepoDigests[0] reports a healthy image as wrong.
bad image "$IMAGE_REF is not present on this host (podman has no digest for it)" got="$(podman image inspect -f '{{range .RepoDigests}}{{println .}}{{end}}' "$IMAGE_REF" 2>/dev/null \
elif [ "$got" = "$WANT_DIGEST" ]; then | sed 's/.*@//' | grep -c "^${WANT_DIGEST}$")"
ok image "$IMAGE_REF resolves to ${got:0:19}…" if [ "${got:-0}" -ge 1 ]; then
ok image "$IMAGE_REF carries ${WANT_DIGEST:0:19}…"
elif podman image exists "$IMAGE_REF" 2>/dev/null; then
bad image "$IMAGE_REF is present but does not carry $WANT_DIGEST (a retagged or older pull)"
else else
bad image "$IMAGE_REF resolves to $got, expected $WANT_DIGEST" bad image "$IMAGE_REF is not present on this host"
fi fi
else else
skip image "podman not on PATH — cannot resolve $IMAGE_REF" skip image "podman not on PATH — cannot resolve $IMAGE_REF"
+10
View File
@@ -571,6 +571,16 @@ vllm-radiance era (this table opens on 09-26; the era page claims 10-10).
of falling through its health wait. All three exist because on 2026-10-29 the unguarded chain's of falling through its health wait. All three exist because on 2026-10-29 the unguarded chain's
rig boot died of an OOM, the health loop expired without failing, and the pusher fed four rounds rig boot died of an OOM, the health loop expired without failing, and the pusher fed four rounds
of 10M tokens into **restored production** — 86 minutes of live prefill that recorded nothing. of 10M tokens into **restored production** — 86 minutes of live prefill that recorded nothing.
- **A calibration step has an OPTIMUM, and it is not the widest step that boots.** The tap's cost is
expert re-reads per document (a 7,168-token document cut into four 2,048-token steps re-streams
each layer's routed expert union four times), which argues for the widest step — but the measured
curve turns over: at the 32,768 calibration window one 2-way prefill of the same document ran
**106 tok/s at an 8,192-token step and 76 tok/s at 16,384**, with the computed activation arena
growing 3.39 → 4.50 GiB, so the wider step pays more compute than it saves in reads. The
200,000-window `QSA score plane` refusal that made the wide step look impossible is an artifact of
serving the production window: the same 16,384-token step needs a 512 MiB plane at 32,768.
`Q38_CALIB_MNBT` is the only knob — the KL modes keep production's step, because their numbers are
only comparable at one shape.
- **A container that exists, a port that answers, and a `/health` 200 are three different claims — - **A container that exists, a port that answers, and a `/health` 200 are three different claims —
bind identity before believing any of them.** Measured 2026-10-30: `podman inspect` named the rig bind identity before believing any of them.** Measured 2026-10-30: `podman inspect` named the rig
while the port still belonged to the *dying* production process (`health ok waited=0s`, window dead while the port still belonged to the *dying* production process (`health ok waited=0s`, window dead
+5 -3
View File
@@ -851,7 +851,9 @@ preflight_fixture() {
cat > "$PF/bin/podman" <<'EOS' cat > "$PF/bin/podman" <<'EOS'
#!/usr/bin/env bash #!/usr/bin/env bash
case "$1" in case "$1" in
image) echo "${STUB_IMAGE_DIGEST:-sha256:69add58f7de1ed2bca2b1e20a4cc75717557df3f73569a178eca5aafe8c44093}" ;; image) # an image carries every digest it was pulled under; the pin is one of them
printf '%s\n' "docker.io/stilldeadcode/radiance@sha256:4beb81eea874e3e308fbffbe1a9402a2f845c19e68ea612ba949b43bd5cb7cb0"
printf '%s\n' "docker.io/stilldeadcode/radiance@${STUB_IMAGE_DIGEST:-sha256:69add58f7de1ed2bca2b1e20a4cc75717557df3f73569a178eca5aafe8c44093}" ;;
top) echo HPID; echo "${STUB_PROD_PIDS:-4242}" ;; top) echo HPID; echo "${STUB_PROD_PIDS:-4242}" ;;
esac esac
EOS EOS
@@ -881,7 +883,7 @@ run_preflight() {
run run_preflight run run_preflight
[ "$status" -eq 0 ] [ "$status" -eq 0 ]
[[ "$output" == *"PREFLIGHT PASSED"* ]] [[ "$output" == *"PREFLIGHT PASSED"* ]]
[[ "$output" == *"resolves to sha256:69add58f"* ]] [[ "$output" == *"carries sha256:69add58f"* ]]
} }
@test "preflight accepts the service's own process on the port, not just any answer" { @test "preflight accepts the service's own process on the port, not just any answer" {
@@ -897,7 +899,7 @@ run_preflight() {
export STUB_IMAGE_DIGEST="sha256:deadbeefdeadbeef" export STUB_IMAGE_DIGEST="sha256:deadbeefdeadbeef"
run run_preflight run run_preflight
[ "$status" -eq 2 ] [ "$status" -eq 2 ]
[[ "$output" == *"expected sha256:69add58f"* ]] [[ "$output" == *"does not carry sha256:69add58f"* ]]
} }
@test "preflight fails when :7770 belongs to a host pid the service does not own" { @test "preflight fails when :7770 belongs to a host pid the service does not own" {