runD 1.0.4 Alpha

runD 1.0.4 Alpha

This release closes cold Pipeline preparation memory ownership and backend divergence while preserving deterministic execution across CPU, Metal, and Vulkan.

Release source: b2cb9270ce0fdd48f5266ec096bf855f071cc4b2

Exact preparation ownership and admission (#4)

• CPU preparation now materializes its typed layout in one sealed, page-aligned arena. Immutable Program storage is retained once, while occurrence-specific bindings and coordinates remain compact routes; Map, collective, primitive, worker, and tile scratch no longer create an allocator-owned forest or scale with the outer/inner route product.
• PipelinePlan::peak_bytes remains the exact runD-owned logical payload. arena_extent_bytes reports the exact CPU mapping span, and committed_peak_bytes reports the page-rounded Device admission charge without relabeling process RSS or adding a guessed margin.
• DevicePipelineMemoryLimit and Device::pipeline_memory() provide one Device-owned aggregate authority across live Pipelines. Local MemoryBudget admission happens first, Device reservation happens once before materialization, and rollback/release are deterministic.
• Whole-process RSS remains an operational envelope for allocator, runtime, thread-stack, and driver-private memory. Deployments requiring a literal cap should apply an OS process/container limit above the Device governor.

Frozen accelerator preparation and warm execution

• Primary and transactional-alternate streams share one immutable accelerator template registry. Equal templates are planned and charged once; every backend consumes the same frozen manifest instead of reconstructing a second planning authority.
• Metal calibrates its admitted ICB size classes from the selected device, records the command graph in chunks of at most 65,536 commands, and reduces warm host work to ceil(D / 65,536) compact 16-byte chunk records. It performs no per-command descriptor walk, rebinding, dynamic count readback, or warm allocation.
• Vulkan plans command, parameter, descriptor, pipeline, native-object, and source-materialization capacity before allocation. Oversized product shapes now return a deterministic PipelineCapacity result with stable step/template/outer/inner/phase coordinates and a native reason key instead of expanding until process termination.
• Linux/GCC builds without the Metal SDK now compile only the documented portable unavailable boundary; native Metal helpers cannot leak into that build graph.

Deterministic contract

Canonical outer/inner order, publication-before-later-read, zero and partial-tail behavior, first-failure priority, fixed-width status, reset behavior, binding identity, and raw output parity are unchanged. Memory pressure, allocator order, pointer values, and runtime scheduling do not enter graph identity or admission order.

Verification and platform boundary

• Debug repository contracts: 35/35 passed.
• Release package contracts: 25/25 passed.
• Darwin arm64 clean-source candidate: archive extraction, sealed identity, verifier, and installed SDK external-consumer rebuild passed; 84 consumer build targets completed.
• Linux x64: the tag-pinned Ubuntu 24.04 / GCC 13 candidate workflow passed the complete Release contract, source-identity seal, verified SDK candidate lifecycle, extracted installed consumer, and temporary artifact upload.

Linux remains a validated candidate rather than a supported release platform. Its temporary workflow artifact is intentionally not attached to this release; the published SDK asset is Darwin arm64 only.

Assets

• rund-sdk-1.0.4-darwin-arm64.tar.gz
• rund-sdk-1.0.4-darwin-arm64.sha256
• rund-verify

Darwin SDK SHA-256: b8706f61c75efdd020a3ba969afd71f583c90a9acc9dadd0a50f9bcf4b84c10f

runD 1.0.3 Alpha

runD 1.0.3 Alpha

This release closes the remaining append-only window publication semantics while preserving deterministic resident execution across CPU, Metal, and Vulkan.

Release source: ae4bfbe3a4e53980ed65cb638f5b14e8560036f3

Same-Pipeline append-only hand-off (#2)

• A step after a completed nested window may read the caller Buffer populated by write_window(...). Declaration order supplies the exact publication-to-read boundary; any later writer to those public bytes remains rejected.
• The read stays bound to the caller-owned full-capacity Buffer. The implementation adds no O(Max) shadow, duplicate terminal copy, host count readback, per-tick allocation, descriptor rebinding, or fallback path.
• Partial final tiles and complete active prefixes are observed identically on CPU, Metal, and Vulkan.

Exact zero-active recurrent seal

• Nested windows now record the leading Fold output prefix that actually carries recurrent state, independently of append-only publication outputs.
• When active count is zero, CPU seals only that recurrent prefix. Extra Fold outputs can no longer be mistaken for input banks or copied through an invalid shape.
• Admission, fingerprinting, asynchronous validation, CPU execution, and accelerator preparation all validate the same prefix contract and preserve deterministic failure ordering.

Verification and platform boundary

• Debug repository contracts: 35/35 passed.
• Release package contracts: 25/25 passed, including installed SDK consumers.
• Darwin arm64 clean-source candidate: 25/25 passed; archive extraction, sealed identity, verifier, and external consumer rebuild passed.
• Documentation site contract: 13 pages passed.
• Linux x64: the tag-pinned Ubuntu 24.04 / GCC 13 candidate workflow passed the complete Release contract, source-identity seal, verified SDK candidate lifecycle, extracted installed consumer, and temporary artifact upload.

Linux remains a validated candidate rather than a supported release platform. Its temporary workflow artifact is intentionally not attached to this release; the published SDK asset is Darwin arm64 only.

Assets

• rund-sdk-1.0.3-darwin-arm64.tar.gz
• rund-sdk-1.0.3-darwin-arm64.sha256
• rund-verify

Darwin SDK SHA-256: e37295e0fc849faef700c30bb81ecb68b8f727961bbd9ce230d16d7eedfef614

runD 1.0.2 Alpha

runD 1.0.2 Alpha

This release hard-cuts full-capacity tile recurrence and per-tick checkpoint costs while preserving one deterministic Pipeline authority across CPU, Metal, and Vulkan.

Release source: a3188ee5455cc4abe1c6e1d3a87a705b98a90074

Append-only tile outputs (#2)

• write_window(...) separates append-only tile publication from recurrent Fold state. The global destination remains O(Max), while each Fold's private publication bank and work are bounded by O(Tile) and total terminal publication is O(Max).
• tile_repeat<0>(seed, fold) expresses Seed-to-Fold recurrence without a dummy identity Action.
• CPU publishes the exact active slice directly. Metal uses the retained ICB warm path and Vulkan uses its retained command path; neither performs warm allocation, count readback, rebinding, or fallback.
• Zero count, partial tails, high-index writes, duplicate/conflicting targets, deterministic failure priority, and atomic poison/unpublication are covered across CPU, Metal, and Vulkan.

Controlled Max=16, Tile=4 CPU evidence: warm median 57,000 ns -> 39,708 ns (-30.34%), Pipeline-owned peak 744 B -> 56 B (-92.47%), and modeled terminal semantic traffic 576 B -> 64 B (-88.89%). These are fixture-specific measurements, not a whole-application speed claim.

Explicit checkpoint tiers (#3)

• latest_device_state() returns a copyable LatestDeviceState for live same-Device recovery without host payload, hashing, or checkpoint-path allocation.
• snapshot_storage([capacity]) and snapshot_into(storage) provide a move-only reusable, atomically published two-bank SnapshotStorage for portable host recovery. Existing immutable snapshot() behavior remains available.
• restore(latest) performs an O(1) selector hand-off when the target shares the publication authority; a disjoint compatible Pipeline performs an exact device-to-device payload copy. Portable restore retains the two-bank host contract.
• Ordinary run() performs no implicit checkpoint operation. Checkpoint allocation/transfer evidence is separated in checkpoint_stats().

For a 4 MiB state, LatestDeviceState acquisition recorded zero checkpoint allocation, payload transfer, and hash work on CPU, Metal, and Vulkan. Warm reusable host export recorded zero process allocation on CPU and Metal; immutable export allocated 3 owners / 4,194,440 B. MoltenVK's driver-inclusive Vulkan observations were 44 allocations / 11,168 B for reusable export versus 47 / 4,205,608 B for immutable export, and are reported without vendor filtering.

Verification and platform boundary

• Debug repository contracts: 35/35 passed.
• Release package contracts: 25/25 passed, including installed SDK consumers.
• Darwin arm64 clean-source candidate: 25/25 passed; archive extraction, identity, consumer rebuild, and SHA-256 verification passed.
• Documentation site contract: 13 pages passed.
• Linux x64: the tag-pinned Ubuntu 24.04 / GCC 13 candidate workflow passed the full release contract, source-identity sealing, SDK candidate packaging, extracted installed consumer, and temporary artifact upload.

Linux validation also closed two portability/verification gaps without weakening product contracts: the official parity example permits only exact AdapterUnavailable at device open on non-Darwin candidates, while Darwin still requires CPU, Metal, and Vulkan; and host-I/O queue verification now distinguishes deterministic FIFO effects from schedule-dependent physical pop retries after lane backpressure.

Linux remains a validated candidate rather than a supported release platform. Its temporary workflow artifact is intentionally not attached to this release; the published SDK asset is Darwin arm64 only.

Assets

• rund-sdk-1.0.2-darwin-arm64.tar.gz
• rund-sdk-1.0.2-darwin-arm64.sha256
• rund-verify

Darwin SDK SHA-256: 8ad23657f437f9afd7e3a74c2190f864027232f5d5314bbba6a2305f8254f6a4

runD 1.0.1 Alpha

runD 1.0.1 Alpha

This alpha restructures repeated Compute execution around a compact,
tile-local nested plan. It removes the intermediate repeated-descriptor memory
layer and keeps execution, replay, and installed-SDK behavior tied to one
canonical plan identity.

Highlights

• Added tile_repeat<N> for bounded nested repetition without materializing a
  descriptor per repeated invocation.
• Reworked nested-plan lowering and execution so plan memory is proportional
  to the tile structure rather than the expanded repeat count.
• Added checked count, offset, and identity arithmetic with deterministic
  overflow and capacity failure behavior.
• Kept CPU, Metal, and Vulkan on the same public nested-plan contract, with
  backend-specific verification and parity coverage.
• Updated the installed SDK, exact-version CMake consumers, performance
  measurement routes, and API/ABI documentation for version 1.0.1.

Darwin ARM64 SDK

The three attached files form one release:

• rund-sdk-1.0.1-darwin-arm64.tar.gz
• rund-sdk-1.0.1-darwin-arm64.sha256
• rund-verify

Keep them together and verify the sealed producer and host tuple before use:

chmod +x ./rund-verify
sh ./rund-verify \
  ./rund-sdk-1.0.1-darwin-arm64.tar.gz \
  ./rund-sdk-1.0.1-darwin-arm64.sha256 \
  "$PWD"

The archive SHA-256 is:

ed7b59b2a92fce04982306ce84bf979c0558f6284b71b4d7db69cdc718aadc32

Verification

• Clean Release build: 1,947 / 1,947 targets.
• Release and installed-SDK contracts: 25 / 25 passed.
• Exact extracted archive, 337-header closure, package identity, documentation
  examples, CPU, Metal, and Vulkan consumer routes passed.
• Source commit: 389c036c702458668d0e1b89e06477f1b1d6c3aa.

Alpha scope

• Darwin ARM64 is the supported binary SDK tuple.
• The Linux x64 source-candidate workflow for this tag stopped during the
  build because GCC 13 promoted an aggressive-loop-optimization diagnostic in
  pre-existing arena.cpp code to an error. No Linux artifact is attached;
  see workflow run 30624371425.
• Windows x64 is not supported.
• Exact package identity 1.0.1 is intentionally not ABI-compatible with
  1.0.0 because the alpha public by-value plan representation changed.
• The Metal warm path still walks frozen descriptors on the host; eliminating
  that remaining host loop stays open in issue #1.

runD 1.0.0 Alpha

runD 1.0.0 Alpha

This is the first public alpha of runD, a C++20 SDK for deterministic Compute,
replay, bounded runtime work, networking, telemetry, and optional cluster
placement.

Highlights

• Explicit CPU, Metal, and Vulkan execution without implicit backend fallback.
• Typed Flow, Program, Job, Batch, and dependent Pipeline execution.
• Canonical Live, Record, Replay, and Scenario input boundaries.
• Bounded memory, compilation, queue, retention, and failure contracts.
• Fixed-width math, deterministic scheduling, telemetry, networking, and
  installed CMake package consumers.
• Source code and documentation released under the MIT License.

Darwin ARM64 SDK

The three attached files form one release:

• rund-sdk-1.0.0-darwin-arm64.tar.gz
• rund-sdk-1.0.0-darwin-arm64.sha256
• rund-verify

Keep them together and verify the sealed producer and host tuple before use:

chmod +x ./rund-verify
sh ./rund-verify \
  ./rund-sdk-1.0.0-darwin-arm64.tar.gz \
  ./rund-sdk-1.0.0-darwin-arm64.sha256 \
  "$PWD"

The archive SHA-256 is:

e4678eeb830d5e434de308856f58ee8699b6053efc6f02a994a095095f734f55

Verification

• Clean Release build: 1,945 / 1,945 targets.
• Release and installed-SDK contracts: 25 / 25 passed.
• Exact extracted archive, 335-header closure, package identity, documentation
  examples, CPU, Metal, and Vulkan consumer routes passed.
• Source commit: 63cd70590255ef777d9c21549faa1d21344bf402.

Alpha scope

• Darwin ARM64 is the supported binary SDK tuple.
• Linux x64 is a validated source candidate; no Linux release binary is
  published here.
• Windows x64 is not supported.
• The SDK uses exact-version package discovery and may make compatibility
  changes before a stable release.
• Very large accelerator workloads must be tested against real device and
  driver memory headroom; successful graph compilation or preparation alone
  is not a production-capacity guarantee.