v0.2.0 — verification hardening, DPO track, CI pipeline & fast vLLM eval

Highlights

• Verification hardening — the training/dataset gates now fail closed on the attack surface found in a whole-project audit: train-GPU corroboration reads signed NRAS hwmodel claims, not the miner-editable sidecar (#236); the manifest gpu_architecture is bound to the signed hwmodel (#238); attested eval samples are bound to their benchmark key so a passing sample can't be cross-mapped (#230); the canonical-pin grace window is honored on the scores path (#232); verified runs no longer drop benchmarks the frontier lacks (#234); the accepted-registry snapshot applies the mix's unexportable-row filter (#240); and malformed proof-bundle scores fail closed instead of crashing verify (#244).
• DPO training track (#268) — miners can submit an Axolotl rl: dpo recipe trained on a canonical preference dataset, verified and scored exactly like SFT (scoring is a held-out benchmark delta, independent of training method). The one "this is SFT" chokepoint is now track-aware and the reward-gate check_canonical_dataset_claim selects the preference pin for train_objective: "dpo" bundles (fail-closed without a pin) — SFT verification is byte-identical.
• CI pipeline (#247) — ruff / ruff format / pyright / pytest on every push & PR as a least-privilege pull_request job (no secrets to forks); all GitHub Actions SHA-pinned; Dependabot added; vendored tritonbench/ excluded from ruff.
• CoT recovery (#247) — when a teacher (GPT 5.6) returns encrypted/empty reasoning, Claude Fable 5 backfills a plaintext rationale so SFT rows keep a usable <think> trace (tagged metadata.cot_recovery); best-effort, never discards a generated trajectory.
• GPU-wheel vLLM serve stack (#247) — installs the official vllm==0.25.0+cu129 wheel + matching PyTorch (no CPU-only torch, no minutes of JIT at engine start) for fast TritonBench eval, and fixes a real _gpu_architecture UnboundLocalError on the auto-detect path (surfaced by the new pyright gate).
• Package version 0.2.0 (was 0.1.3).
• Dataset gate pinned to SparkProof v0.3.0 (#273).

DPO training track (new capability)

SparkDistill's training track verifies reproducibility + measured quality, not the training algorithm — so preference tuning drops in as a recipe type with no new scoring machinery.

• An SFT recipe (no rl key) keeps its exact prior behavior and must use the canonical SFT mix; a rl: dpo recipe must use the canonical preference path. The two tracks' accepted datasets/pins are disjoint (canonical_pref_sha256 beside canonical_sft_sha256), so a DPO submission can never satisfy the SFT pin or vice-versa.
• The reward-gate check is track-aware: a bundle declaring train_objective: "dpo" is verified against the canonical preference pin (pref_manifest.pref_sha256 / canonical_pref_hf_url) and fails closed if no preference pin is configured.
• The preference signal is GPU-attested, not human-labeled: pairs come from SparkProof's verified-vs-failed kernels (sparkproof-export-dpo --pair-type correctness), sha256-pinned and attested in the bundle manifest (SparkProof v0.3.0).

Still to come for end-to-end DPO submission: publishing the canonical preference dataset + pref_manifest pin, prepare_mining_dpo, the DPO-aware PR-body citation + grace window, and the dpo.yaml example recipe.

Pairs with SparkProof v0.3.0

The dataset registry gate now checks out SparkProof at the immutable v0.3.0 release commit (not the moving main), so every dataset submission is verified against exactly the released verifier — the one carrying the DPO correctness pairs and the attested preferences_sha256 bundle pin, plus the v0.3.0 dataset-quality + attestation hardening. Reproducible and auditable; bump deliberately to adopt a newer SparkProof release.

Also in this release

• Registry mix export routes through SparkProof's publish path (trajectory_to_messages_record), skipping empty/failed rows and preferring multi-turn episodes.
• Claim binding uses the signed NRAS eat_nonce, and TDX binding reads REPORTDATA from quote_b64 — never the editable JSON sidecars.
• Attested GSM8K regression samples can no longer forge a score by duplicating a problem_id.
• Training-track merges seed / raise runs/frontiers.json from verified non-REJECT scores.
• Two env-dependent tests made deterministic (fallback dedupe + a SparkProof skip-guard) so the suite is green with or without a sibling SparkProof checkout.

Full notes: see the CHANGELOG.