schema-1.3-r5: ROCm power/temperature telemetry sampler (mock-tested)

New since r4 — everything merged to main after 2026-10-16, bundled in this release:

• Engine identity block, token-count acceptance conditions, reference fake adapter (#26) — originally slated for a separate r6, shipped here together with the rest.
• AMD fallback: NVML-first cross-check for the hip-nvcc false positive, exit from the downgrade path (#28).
• ROCm power/temperature telemetry sampler (#31, thanks @amarjithkumar2007-wq): rocm-smi --showpower / --showtemp polling with lenient ROCm 5.x/6.x JSON parsing. Mock-tested only — not yet wired into the measurement flow; AMD GPUs remain reported as unavailable for energy.
• Docs & tooling: README badges/figure and ecosystem cross-links, CRLF fixes across shell scripts with a CI guard, release checklist in CONTRIBUTING, quickstart SHA256SUMS verification clarification.
• .zenodo.json + CITATION.cff: GitHub–Zenodo software DOI integration (this release is archived on Zenodo). Amarjith Sah is listed as co-author on the software record.

Byte-identical to r4 (see SHA256SUMS.all): quickstart.sh, schema/energy.schema.json, tools/validate.py — only the release URL changes for the pinned one-liner.

run-v2: one-liner wrapper (pinned, immutable) — LF line endings

Re-publishes the one-liner wrapper with LF line endings. run-v1's run.sh was CRLF, which kills bash on Linux ("set: pipefail: invalid option name") — found by an external reproducer, 2026-10-28. Release assets are immutable, so this is a new tag, not an edit.

Changes vs run-v1: line endings only (CRLF -> LF). No logic changes. The wrapper source now also lives in the repository (run.sh at the repo root), so the asset is reproducible from source, and CI now fails on any CRLF shell script.

Verify before running:

curl -fsSLO https://github.com/hongping-zh/ecocompute-mlcube/releases/download/run-v2/run.sh
sha256sum run.sh
# 06258dbc5dfefc959a02b726517ac4a8ef4aaec4b2f4b78bcce27b585f08ea40

The quantenergy.tech/run.sh stub has been updated to pin run-v2 and this checksum.

run-v1: one-liner wrapper (pinned, immutable)

[SUPERSEDED by run-v2, 2026-10-28] This release's run.sh was published with CRLF line
endings, which breaks bash run.sh on Linux — it dies on line 1 with
set: pipefail: invalid option name (found by an external reproducer). The live one-liner
at quantenergy.tech/run.sh now pins run-v2. The assets here are left as-published for
audit history — SHA256SUMS.run still matches these exact bytes, but they are CRLF and will
not run: do not use this release. Everything below is the original body, kept unchanged.

---

Pinned release for the quantenergy.tech/run.sh one-liner wrapper.

This release contains the exact version of run.sh that quantenergy.tech/run.sh downloads and executes. The release is immutable — once published, these assets cannot be changed.

Assets:

• run.sh — the one-liner wrapper (model mapping, checksum verification, quickstart.sh delegation)
• SHA256SUMS.run — SHA-256 checksum of run.sh

Verify before trusting:

curl -fsSLO https://github.com/hongping-zh/ecocompute-mlcube/releases/download/run-v1/run.sh
curl -fsSLO https://github.com/hongping-zh/ecocompute-mlcube/releases/download/run-v1/SHA256SUMS.run
sha256sum -c SHA256SUMS.run

Security model:

• quantenergy.tech/run.sh is a stub that downloads this pinned release, verifies its checksum, then executes it
• The actual logic is in this immutable release asset, not on the live site
• DNS hijack of quantenergy.tech cannot change what executes — the stub always downloads from this pinned GitHub release URL
• The stub itself is ~20 lines and auditable: https://github.com/hongping-zh/quant-energy/blob/main/run.sh

This is the same security model as quickstart.sh (pinned release + checksum), extended to the one-liner wrapper.

schema-1.3-r4: context_length effective, AMD GPU detection

What changed

PR #22 — context_length is now real. The prompt is tiled/truncated to exactly the recorded context_length value instead of always being ~20 tokens regardless of the parameter. This means runs at context_length ≠ 2048 are not directly comparable with dataset v1.1.0 (whose context_length was nominal). See the spec's comparability note.

PR #20 — AMD GPU (ROCm) detection. On a ROCm host the run skips the doomed NVML attempt and reports measurement_source: "ecocompute-dataset (AMD GPU detected, NVML is NVIDIA-only)" with the card name, instead of an opaque NVML error. Use ECOCOMPUTE_IMAGE=ghcr.io/hongping-zh/ecocompute-mlcube:latest or pin this release once assets are uploaded.

PR #21 — Backend contributor guide. Added docs/backends.md, a guide for adding llama.cpp / vLLM / TensorRT-LLM as inference backends.

Pinned artifacts

Artifact	SHA-256
quickstart.sh	7deb212e88df780f40bf059345780044177e4f771766299e180e3f966cb668b5
schema/energy.schema.json	255ba06777d1da911eeb594fe8a0c2b8f959636e69033d733d10c65b048335a0
tools/validate.py	3dc166d2c2c0d7fbd6bbcb5a37a4cb2520feb04a432727a06e993f6d2310bee3 (unchanged from r2)

Image

• Digest: ghcr.io/hongping-zh/ecocompute-mlcube@sha256:5c4f5589534793883ba0a0a857a69fcdfbaf4901859ceba1050231dbf25dd81f
• Built by CI run 38979054443 at commit 73ec5a8 (PR #22 merge), including the non-root smoke test (energy_estimate --dry_run inside the published image, basis != measured asserted).
• Pin it: ECOCOMPUTE_IMAGE=ghcr.io/hongping-zh/ecocompute-mlcube@sha256:5c4f5589534793883ba0a0a857a69fcdfbaf4901859ceba1050231dbf25dd81f

Verify and run

curl -fsSLO https://github.com/hongping-zh/ecocompute-mlcube/releases/download/schema-1.3-r4/quickstart.sh
curl -fsSLO https://github.com/hongping-zh/ecocompute-mlcube/releases/download/schema-1.3-r4/SHA256SUMS
sha256sum -c SHA256SUMS && bash quickstart.sh

SHA256SUMS contains only quickstart.sh, so sha256sum -c needs no flags. SHA256SUMS.all covers the schema and the validator as well.

Comparability note

Runs at context_length ≠ 2048 are not directly comparable with dataset v1.1.0, whose context_length was nominal (~20 token input regardless of the recorded value). The v1.1.0 anchors remain valid at their original context_length; new runs at different context_length form a separate comparability class.

---

Assets re-published 2026-10-28: quickstart.sh now has LF line endings — the CRLF original killed bash quickstart.sh on Linux with syntax error near unexpected token $'do ' (found by an external reproducer). Checksums updated accordingly. While re-publishing, one pre-existing error was corrected: the SHA256SUMS.all entry for schema/energy.schema.json never matched the file at this tag (recorded 501dc1f3…, actual 255ba067…); tools/validate.py was already correct. No code changes beyond line endings, and the header's example URLs now point at schema-1.3-r4 instead of r3.

Assets re-published again 2026-10-28 (evening): quickstart.sh header now documents where to run sha256sum -c SHA256SUMS.all (from the root of a clone of this tag, not the download directory — its entries are repo-relative paths; feedback from an external reproducer). Checksums updated accordingly. No functional change.

schema-1.3-r3: verified-by-default quickstart, non-root image, --dry-run, SBOM

Supply-chain hardening: the quickstart is a verified release asset, the image runs non-root, and the whole plan is inspectable before anything executes.

What changed

• curl | bash is no longer the documented way in. The documented entry point is now download-from-release → sha256sum -c → bash, on every page that used to teach the one-liner (quickstart header, README, quantenergy.tech). What you execute is an immutable, checksummed version of the script — not whatever main holds at the moment you type the command.
• --dry-run (also --dry_run): prints the resolved plan — the mode it would pick, every directory it would touch on your host, the exact commands with all expansions, and the environment variables it reads — and exits before any side effect. --help prints the full usage header, including what the script changes on the host and what it never touches (your shell profile, system packages, GPU drivers).
• Non-root container. The image's default user is now the unprivileged ecocompute (uid 1000). quickstart.sh has always passed --user $(id -u):$(id -g); runtime-writable paths are 0777 so any --user keeps working. The CI smoke tests run the same way.
• ECOCOMPUTE_READONLY=1 (opt-in): docker run gains --read-only and a tmpfs /tmp, leaving only the two bind mounts ($ECOCOMPUTE_OUT, $ECOCOMPUTE_CACHE) writable. Opt-in because library write locations vary across hosts — if it fails on yours, please open an issue.
• SBOM: sbom.cdx.json (CycloneDX 1.6, 48 library components) generated from the pinned requirements.lock.txt at this commit. The OS layer of the base image (nvidia/cuda:12.1.1-cudnn8-runtime-ubuntu22.04) is identified by digest in the image reference, not re-declared here.

Verify and run

curl -fsSLO https://github.com/hongping-zh/ecocompute-mlcube/releases/download/schema-1.3-r3/quickstart.sh
curl -fsSLO https://github.com/hongping-zh/ecocompute-mlcube/releases/download/schema-1.3-r3/SHA256SUMS
sha256sum -c SHA256SUMS && bash quickstart.sh

SHA256SUMS contains only quickstart.sh, so sha256sum -c needs no flags. SHA256SUMS.all covers the schema, the validator and the SBOM as well.

Pinned artifacts

Artifact	SHA-256
quickstart.sh	491e8c381dfdb826b5093a0dc6b77c8544d0f3463d6bc9b14d0ec5df0382ba24
schema/energy.schema.json	255ba06777d1da911eeb594fe8a0c2b8f959636e69033d733d10c65b048335a0
tools/validate.py	3dc166d2c2c0d7fbd6bbcb5a37a4cb2520feb04a432727a06e993f6d2310bee3 (unchanged from schema-1.3-r2)
sbom.cdx.json	4bdcb3a5d35daf2b5f726c5ccdc158f302f96dce6e5779e1715d6019cf9bd740

Image

• Digest: ghcr.io/hongping-zh/ecocompute-mlcube@sha256:5c812e66c34fcdab436bdcf4c1135dc91a6a86b1f94d3efb6118947a7492e275
• Built by CI run 38108843031 at commit 8afc0bf, including the non-root smoke test (energy_estimate --dry_run inside the published image, basis != measured asserted).
• Pin it: ECOCOMPUTE_IMAGE=ghcr.io/hongping-zh/ecocompute-mlcube@sha256:5c812e66c34fcdab436bdcf4c1135dc91a6a86b1f94d3efb6118947a7492e275

No measurement, protocol or schema semantics changed in this release: schema 1.3, the validator, and the pinned dependency set are byte-identical to schema-1.3-r2.

schema-1.3-r2: validator hardening

The semantic validator (tools/validate.py) no longer waves through reports that omit protocol facts.

A negative probe (non-NVML method, iterations=1, no window statement, no decoding record, no arm order, thermal block with mode+basis only) previously returned 'protocol violations: 0 / protocol-conformant'. Now every Protocol v1.1 MUST that is machine-checkable is enforced: NVML method (4.1.1), achieved rate >= 10 Hz (4.1.2), FP16 baseline for every non-FP16 precision (4.2.1), 256 tokens / 10 iterations / greedy decoding (4.3.2), generation window stated (4.4.1), conformance floor at schema 1.2+ (4.5.2), full temperature + cooldown records for measured thermal blocks (4.6.1), and arm order recorded or deviation disclosed (4.6.2). A report that does not record a required fact is schema-valid, never protocol-conformant.

Pinned: tools/validate.py SHA-256 3dc166d2c2c0d7fbd6bbcb5a37a4cb2520feb04a432727a06e993f6d2310bee3 (commit 8778c42). The schema itself is unchanged from schema-1.3-r1 (SHA 501dc1f3...); only the validator and its tests changed. The container image is unchanged.

schema-1.3-r1 — tightened schema, semantic validator, pinned installs

Revision 1 of the ecocompute-energy/1.3 report schema, plus the tools that close the spec<->schema loop.

What changed

• Schema tightened (no existing valid report breaks): schema_version/benchmark fixed values; sample_rate_hz minimum 10 (measurement + power_trace); at schema 1.3 the workload/measurement/software MUST-fields (tokens_per_run, iterations, warmup, context_length, software) become required; the thermal block is formally defined with honest-failure-state semantics.
• Semantic validator: ecocompute validate --profile v1.1-core (tools/validate.py) checks every machine-checkable Protocol v1.1 MUST with clause-numbered violations; three verdicts: schema-valid / protocol-conformant / dataset-eligible; CI exit codes 0/1/2.
• Pinned installs: ECOCOMPUTE_REF selects the git ref in quickstart.sh; this release asset is checksummed below.

Pins (verify before use)

• release commit: 05a3ffd (schema/entrypoint content identical to e52f878, whose image digest is listed below)
• quickstart.sh SHA-256: 5664b5a131de9458f8dadda6389de44cfc24e9cc51dbac5128d02023482ac1a7
• schema/energy.schema.json SHA-256: 501dc1f328270f0bd3221e1ec5c81d740308bdd87090b93f54758ea79b6efb04
• tools/validate.py SHA-256: c5ca27907ffc68c91b6f28702515788210cc670e6d0330e9328788f5dd815205
• container image (e52f878 build): ghcr.io/hongping-zh/ecocompute-mlcube@sha256:595e6ddf9658237fdfe222a9929cada024ea2d4dd1c5ae41195d024082247568

Pinned run

curl -fsSL -o quickstart.sh https://github.com/hongping-zh/ecocompute-mlcube/releases/download/schema-1.3-r1/quickstart.sh
sha256sum quickstart.sh   # expect 5664b5a1...ac1a7
ECOCOMPUTE_REF=schema-1.3-r1 bash quickstart.sh

---

Correction (2026-10-11)

Two defects in the pins above, found while cutting schema-1.3-r3 — both caused by
hashing and uploading Windows working-tree bytes (CRLF) instead of the
repository blobs (LF):

1. The schema pin does not verify. 501dc1f3… is the SHA-256 of the CRLF
   working-tree copy of schema/energy.schema.json. The canonical LF blob —
   what raw.githubusercontent.com and any checkout actually serve, and the
   content in every commit from e52f878 through today — hashes to
   255ba06777d1da911eeb594fe8a0c2b8f959636e69033d733d10c65b048335a0.
   Schema content is unchanged; only the published hash was computed over the
   wrong byte representation.
2. The quickstart.sh asset of this release carries CRLF line endings. On
   Linux, bash quickstart.sh stops at set -euo pipefail\r (invalid option).
   It works under MSYS/Git-Bash-style translation only. The hash 5664b5a1…
   matches the CRLF asset, so the checksum "verifies" — the failure appears one
   step later, at execution.

Use schema-1.3-r3 instead: its asset is the LF blob, its SHA256SUMS
verifies it, and --dry-run proves it parses before anything runs. The
validator and schema content of r3 are byte-identical to this release's (r1
validator: c5ca2790…, superseded by the hardened 3dc166d2… in r2).