Add dataflow grammar audit + PR comment workflow

.github/copilot-instructions.md

@@ -1,3 +1,8 @@
+---
+doc_revision: 1
+reader_reintern: "Reader-only: re-intern if doc_revision changed since you last read this doc."
+---
+
 # Copilot Instructions
 
 Follow `POLICY_SEED.md` as the authoritative control policy.
@@ -9,4 +14,4 @@ Key requirements:
 - For workflow changes, run `python scripts/policy_check.py --workflows`.
 - Use `mise exec -- python` for policy tooling to ensure dependencies resolve.
 
-If a request conflicts with `POLICY_SEED.md`, stop and ask for clarification.
+If a request conflicts with `POLICY_SEED.md`, stop and ask for clarification.

.github/workflows/ci-milestones.yml

@@ -23,6 +23,9 @@ permissions:
 
 env:
   PYTHON_VERSION: "3.14"
+  XLA_PYTHON_CLIENT_PREALLOCATE: "false"
+  XLA_PYTHON_CLIENT_ALLOCATOR: "platform"
+  PRISM_JAX_GPU_MEM_CAP_MB: "128"
 
 jobs:
   changes:
@@ -158,15 +161,95 @@ jobs:
         run: |
           scripts/check_agda.sh
 
+  preflight-smoke:
+    needs: [changes, policy-check, audit, smoke-exports, agda-check]
+    if: needs.changes.outputs.code_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      - name: Install dependencies (preflight)
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install pytest jax jaxlib
+      - name: Import smoke (ic_vm, prism_vm)
+        run: |
+          python -c "import ic_vm; import prism_vm"
+      - name: Collect-only harness import graph
+        run: |
+          mkdir -p artifacts
+          set -euo pipefail
+          pytest -c pytest.baseline.ini \
+            --collect-only tests/harness.py \
+            2>&1 | tee artifacts/pytest-preflight-collect.txt || true
+      - name: Run pytest smokes (preflight)
+        run: |
+          mkdir -p artifacts
+          set -euo pipefail
+          pytest -c pytest.baseline.ini -q \
+            tests/test_harness_jit_cfg_smoke.py \
+            tests/test_harness_cnf2_cfg_smoke.py \
+            tests/test_ic_guard_cfg_smoke.py \
+            --junitxml artifacts/pytest-preflight.xml \
+            2>&1 | tee artifacts/pytest-preflight.txt
+      - name: Upload preflight artifacts
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: pytest-preflight
+          path: artifacts/
+          if-no-files-found: ignore
+
+  baseline-tests:
+    needs: [changes, policy-check, audit, smoke-exports, agda-check, preflight-smoke]
+    if: needs.changes.outputs.code_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install pytest pytest-xdist jax jaxlib jaxtyping beartype
+      - name: Record telemetry metadata (baseline)
+        run: |
+          mkdir -p artifacts
+          python scripts/record_telemetry_metadata.py \
+            --out artifacts/telemetry_metadata_baseline.json \
+            --milestone baseline \
+            --label "pytest-baseline" \
+            --extra job=baseline-tests
+      - name: Run pytest (baseline)
+        run: |
+          mkdir -p artifacts
+          set -euo pipefail
+          pytest -c pytest.baseline.ini \
+            -n auto -vv -ra \
+            --junitxml artifacts/pytest-baseline.xml \
+            2>&1 | tee artifacts/pytest-baseline.txt
+      - name: Upload pytest artifact (baseline)
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: pytest-baseline
+          path: artifacts/
+          if-no-files-found: ignore
+
   tests:
-    needs: [changes, policy-check, audit, smoke-exports]
+    needs: [changes, policy-check, audit, smoke-exports, agda-check, preflight-smoke, baseline-tests]
     if: needs.changes.outputs.code_changed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
-        milestone: [m1, m2, m3, m4, m5]
+        suite: [m2, m3, m4, m5]
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
@@ -175,25 +258,26 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          python -m pip install pytest pytest-xdist jax jaxlib
-      - name: Record telemetry metadata
+          python -m pip install pytest pytest-xdist jax jaxlib jaxtyping beartype
+      - name: Record telemetry metadata (suite)
         run: |
           mkdir -p artifacts
           python scripts/record_telemetry_metadata.py \
-            --out artifacts/telemetry_metadata_${{ matrix.milestone }}.json \
-            --milestone ${{ matrix.milestone }} \
-            --label "pytest-${{ matrix.milestone }}" \
+            --out artifacts/telemetry_metadata_${{ matrix.suite }}.json \
+            --milestone ${{ matrix.suite }} \
+            --label "pytest-${{ matrix.suite }}" \
             --extra job=tests
-      - name: Run pytest (milestone)
+      - name: Run pytest (suite)
         run: |
           mkdir -p artifacts
           set -euo pipefail
-          pytest -c pytest.${{ matrix.milestone }}.ini \
+          config="pytest.${{ matrix.suite }}.ini"
+          pytest -c "$config" \
             -n auto \
-            --junitxml artifacts/pytest-${{ matrix.milestone }}.xml \
-            2>&1 | tee artifacts/pytest-${{ matrix.milestone }}.txt
+            --junitxml artifacts/pytest-${{ matrix.suite }}.xml \
+            2>&1 | tee artifacts/pytest-${{ matrix.suite }}.txt
       - name: Run damage metrics fixture (arena)
-        if: matrix.milestone == 'm4'
+        if: matrix.suite == 'm4'
         run: |
           mkdir -p artifacts
           set -euo pipefail
@@ -210,7 +294,7 @@ jobs:
             --inputs artifacts/damage_metrics.txt artifacts/damage_metrics_tile32.txt \
             --out artifacts/damage_metrics_delta.txt
       - name: Capture host performance baselines
-        if: matrix.milestone == 'm4'
+        if: matrix.suite == 'm4'
         run: |
           mkdir -p artifacts
           python scripts/audit_host_performance.py \
@@ -226,7 +310,7 @@ jobs:
             --engine cnf2 --iterations 5 --warmup 1 \
             --json-out artifacts/host_memory_cnf2.json
       - name: Capture CPU trace baselines
-        if: matrix.milestone == 'm4'
+        if: matrix.suite == 'm4'
         run: |
           mkdir -p artifacts
           python scripts/capture_trace.py \
@@ -235,7 +319,7 @@ jobs:
           python scripts/trace_analyze.py \
             --report-only --json-out artifacts/trace_cpu_report.json
       - name: Capture m5 servo trace baselines
-        if: matrix.milestone == 'm5'
+        if: matrix.suite == 'm5'
         run: |
           mkdir -p artifacts
           rm -rf /tmp/jax-trace
@@ -266,12 +350,76 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
-          name: pytest-${{ matrix.milestone }}
+          name: pytest-${{ matrix.suite }}
+          path: artifacts/
+          if-no-files-found: ignore
+
+  baseline-tests-gpu:
+    needs: [changes, policy-check, audit, smoke-exports, agda-check, preflight-smoke, baseline-tests]
+    if: needs.changes.outputs.code_changed == 'true' && github.actor == github.repository_owner && needs.policy-check.result == 'success' && needs.audit.result == 'success'
+    runs-on: [self-hosted, cassian, gpu, local]
+    timeout-minutes: 30
+    env:
+      XLA_FLAGS: "--xla_gpu_enable_command_buffer="
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - name: Ensure mise Python is installed (self-hosted)
+        run: |
+          if ! command -v mise >/dev/null 2>&1; then
+            echo "mise is required on the self-hosted runner" >&2
+            exit 1
+          fi
+          mise install
+      - name: Verify python version (self-hosted)
+        run: |
+          mise exec -- python - <<'PY'
+          import os
+          import sys
+          want = os.environ["PYTHON_VERSION"]
+          version = sys.version.split()[0]
+          if not version.startswith(want):
+              raise SystemExit(f"Expected Python {want}, found {version}")
+          print("Python version:", version)
+          PY
+      - name: Install test dependencies (GPU)
+        run: |
+          mise exec -- python -m pip install --upgrade pip
+          mise exec -- python -m pip install pytest nvidia-ml-py jaxtyping beartype "jax[cuda12]" -f https://storage.googleapis.com/jax-releases/jax_cuda_releases.html
+      - name: Verify GPU backend
+        run: |
+          mise exec -- python - <<'PY'
+          import jax
+          gpus = jax.devices("gpu")
+          if not gpus:
+              raise SystemExit("GPU backend required but not available")
+          print("GPU devices:", gpus)
+          PY
+      - name: Record telemetry metadata (gpu baseline)
+        run: |
+          mkdir -p artifacts
+          mise exec -- python scripts/record_telemetry_metadata.py \
+            --out artifacts/telemetry_metadata_gpu_baseline.json \
+            --milestone baseline \
+            --backend gpu \
+            --label "pytest-gpu-baseline" \
+            --extra job=baseline-tests-gpu
+      - name: Run pytest (baseline, gpu)
+        run: |
+          mkdir -p artifacts
+          set -euo pipefail
+          mise exec -- python -m pytest -c pytest.baseline.ini \
+            --junitxml artifacts/pytest-gpu-baseline.xml \
+            2>&1 | tee artifacts/pytest-gpu-baseline.txt
+      - name: Upload pytest artifact (gpu baseline)
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: pytest-gpu-baseline
           path: artifacts/
           if-no-files-found: ignore
 
   tests-gpu:
-    needs: [changes, policy-check, audit, smoke-exports]
+    needs: [changes, policy-check, audit, smoke-exports, agda-check, preflight-smoke, baseline-tests, baseline-tests-gpu]
     if: needs.changes.outputs.code_changed == 'true' && github.actor == github.repository_owner && needs.policy-check.result == 'success' && needs.audit.result == 'success'
     runs-on: [self-hosted, cassian, gpu, local]
     timeout-minutes: 30
@@ -304,7 +452,7 @@ jobs:
       - name: Install test dependencies (GPU)
         run: |
           mise exec -- python -m pip install --upgrade pip
-          mise exec -- python -m pip install pytest nvidia-ml-py "jax[cuda12]" -f https://storage.googleapis.com/jax-releases/jax_cuda_releases.html
+          mise exec -- python -m pip install pytest nvidia-ml-py jaxtyping beartype "jax[cuda12]" -f https://storage.googleapis.com/jax-releases/jax_cuda_releases.html
       - name: Verify GPU backend
         run: |
           mise exec -- python - <<'PY'
@@ -356,7 +504,7 @@ jobs:
 
   collect-report:
     runs-on: ubuntu-latest
-    needs: [changes, policy-check, audit, smoke-exports, agda-check, tests, tests-gpu]
+    needs: [changes, policy-check, audit, smoke-exports, agda-check, preflight-smoke, baseline-tests, baseline-tests-gpu, tests, tests-gpu]
     if: always() && needs.policy-check.result == 'success' && needs.audit.result == 'success'
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5

.github/workflows/pr-dataflow-grammar.yml

@@ -0,0 +1,78 @@
+name: pr-dataflow-grammar
+
+on:
+  pull_request:
+    paths:
+      - "scripts/**"
+      - "src/**"
+      - ".github/workflows/pr-dataflow-grammar.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  dataflow-grammar:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.14"
+      - name: Install graphviz
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y graphviz
+      - name: Render dataflow grammar graph
+        run: |
+          ./scripts/render_dataflow_grammar.sh src artifacts/dataflow_grammar
+      - name: Upload dataflow artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: dataflow-grammar
+          path: artifacts/dataflow_grammar
+      - name: Comment on PR with artifact link
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+          RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          python - <<'PY'
+          import json
+          import os
+          import pathlib
+          import urllib.request
+
+          token = os.environ["GITHUB_TOKEN"]
+          repo = os.environ["REPO"]
+          issue = os.environ["PR_NUMBER"]
+          run_url = os.environ["RUN_URL"]
+          report_path = pathlib.Path("artifacts/dataflow_grammar/report.md")
+          if report_path.exists():
+              report = report_path.read_text()
+          else:
+              report = "<!-- dataflow-grammar -->\nDataflow grammar graph generated.\n"
+          footer = f"\n\n- Artifact: dataflow-grammar\n- Download: {run_url}\n"
+          body = report + footer
+          if len(body) > 60000:
+              body = body[:60000] + "\n\n(truncated)\n" + footer
+
+          url = f"https://api.github.com/repos/{repo}/issues/{issue}/comments"
+          req = urllib.request.Request(
+              url,
+              data=json.dumps({"body": body}).encode("utf-8"),
+              headers={
+                  "Authorization": f"Bearer {token}",
+                  "Accept": "application/vnd.github+json",
+                  "Content-Type": "application/json",
+              },
+              method="POST",
+          )
+          with urllib.request.urlopen(req) as resp:
+              resp.read()
+          PY

AGENTS.md

@@ -1,3 +1,8 @@
+---
+doc_revision: 1
+reader_reintern: "Reader-only: re-intern if doc_revision changed since you last read this doc."
+---
+
 # AGENTS.md
 
 This repository is governed by `POLICY_SEED.md`. Treat it as authoritative.
@@ -13,4 +18,4 @@ This repository is governed by `POLICY_SEED.md`. Treat it as authoritative.
 - Hooks are advisory; CI policy checks are authoritative.
 - Use `mise exec -- python` for policy tooling so dependencies resolve as expected.
 
-If any request conflicts with `POLICY_SEED.md`, stop and ask for guidance.
+If any request conflicts with `POLICY_SEED.md`, stop and ask for guidance.