mirror kernels/ so the kept code is self-contained

kernels/p7_probe_publish_source.py

@@ -0,0 +1,103 @@
+"""Does `--ckpt-repo` actually choose the repo the publisher reads its weights from?
+
+Hard-coding `Cion-lab/ounce100m-ckpt` as the only source was harmless while that repo existed and there was one
+model. It is not harmless now: a second run publishing to its own repo would still resolve `latest.json` from
+the first run's -- i.e. publish one model's weights under another model's card -- and since that repo has been
+deleted the failure arrives as a confusing 404 instead of a wrong answer.
+
+Why a 404 cannot be the test. A traceback prints the failing *source line*, which contains the literal
+`{a.ckpt_repo}`, not the URL it resolved to. "It died" therefore says nothing about which repo it asked for,
+and a probe asserting on that text would pass whether or not the fix works. So the decisive read is the
+publisher's own `ckpt latest.json -> {...}` print, which names the repo it fetched -- that needs a repo that
+answers. The kernel therefore creates a throwaway **private** dataset repo containing nothing but
+`latest.json = {"step": 0, "path_in_repo": "final"}`, reads that dict back out of the publisher's stdout, and
+deletes the repo in a `finally`. If the constant still won, the print would name `ounce100m-ckpt` and the fetch
+would 404, and the assertion fails for the right reason.
+
+Four cases, free CPU, nothing published:
+  1  static  -- the fetch is built from the argument; no fetch is built from the constant.
+  2  help    -- `--help` lists `--ckpt-repo`.
+  3  positive-- the new file, told to read the temp repo, prints that repo's name and step 0.
+  4  contrast-- the old file at REV `55f23ef5` rejects `--ckpt-repo` outright (rc 2, argparse), so case 3 is
+                evidence about the change and not about something that was always true.
+"""
+import hashlib
+import io
+import json
+import os
+import subprocess
+import sys
+import urllib.request
+
+CODE = "Cion-lab/ounce100m-code"
+NEW_REV = "dd1b6b94cc90ae6deff94e0990d58da64c6637f1"
+NEW_SHA = "d1f3c4eb2b80cd4bff35c1b1b90a67ec6204dd753e09f354673d0812cc231e01"
+OLD_REV = "55f23ef5d0e8e6a60adad23bf8a2ffffc6bc7580"
+TMP = "Cion-lab/ounce100m-p7-probe-tmp"
+
+
+def fetch(rev):
+    url = f"https://huggingface.co/{CODE}/resolve/{rev}/build/publish_model.py"
+    return urllib.request.urlopen(url, timeout=120).read()
+
+
+def report(R, why=""):
+    print("PROBE_JSON_BEGIN\n" + json.dumps(R, indent=1) + "\nPROBE_JSON_END", flush=True)
+    ok = all(v for k, v in R.items() if k.startswith("case"))
+    print(f"VERDICT PUBLISH_SOURCE {'PASS' if ok else 'FAIL'} {why}", flush=True)
+    return ok
+
+
+R = {}
+try:
+    sys.path.insert(0, "/kaggle/working/lib")
+    import ounce100m_credentials
+    ounce100m_credentials.install(verify=True)
+    from huggingface_hub import HfApi
+    api = HfApi()
+
+    os.makedirs("/kaggle/working/lib", exist_ok=True)
+    newp, oldp = "/kaggle/working/pub_new.py", "/kaggle/working/pub_old.py"
+    nb = fetch(NEW_REV)
+    open(newp, "wb").write(nb)
+    got = hashlib.sha256(nb).hexdigest()
+    R["fetched"] = f"{NEW_REV[:10]} sha_ok={got == NEW_SHA}"
+    assert got == NEW_SHA, "the pinned publisher bytes are not what this probe was written against"
+    open(oldp, "wb").write(fetch(OLD_REV))
+
+    src = nb.decode("utf-8")
+    R["case1_static_arg_wired"] = "datasets/{a.ckpt_repo}/resolve/main/latest.json" in src
+    R["case1_static_no_constant_fetch"] = ("datasets/{CKPT}/resolve" not in src
+                                           and "snapshot_download(CKPT" not in src)
+    R["case2_help_lists_flag"] = "--ckpt-repo" in subprocess.run(
+        [sys.executable, newp, "--help"], capture_output=True, text=True).stdout
+
+    api.create_repo(repo_id=TMP, repo_type="dataset", private=True, exist_ok=True,
+                    token=os.environ["HF_TOKEN"])
+    api.upload_file(path_or_fileobj=io.BytesIO(json.dumps({"step": 0, "path_in_repo": "final"}).encode()),
+                    path_in_repo="latest.json", repo_id=TMP, repo_type="dataset", token=os.environ["HF_TOKEN"])
+    made = True
+
+    r = subprocess.run([sys.executable, newp, "--dry-run", "--ckpt-repo", TMP],
+                       capture_output=True, text=True)
+    out = r.stdout + r.stderr
+    R["case3_names_the_repo_it_was_given"] = f"'repo': '{TMP}'" in out
+    R["case3_read_the_pointer"] = "'step': 0" in out and "path_in_repo" in out
+    # It then looks for `final/`, which the temp repo does not have: stopping there is the expected outcome,
+    # and it is what proves no upload was attempted.
+    R["case3_stopped_before_upload"] = r.returncode != 0 and "upload" not in out.lower()
+
+    ro = subprocess.run([sys.executable, oldp, "--dry-run", "--ckpt-repo", TMP],
+                        capture_output=True, text=True)
+    R["case4_old_file_rejects_the_flag"] = ro.returncode == 2 and "unrecognized arguments" in ro.stderr
+except Exception as e:
+    R["aborted"] = f"{type(e).__name__}: {str(e)[:200]}"
+finally:
+    if locals().get("made"):
+        try:
+            api.delete_repo(repo_id=TMP, repo_type="dataset")
+            R["temp_repo_deleted"] = True
+        except Exception as e:
+            R["temp_repo_deleted"] = f"FAILED {type(e).__name__} -- remove {TMP} by hand"
+
+sys.exit(0 if report(R, R.get("aborted", "")) else 1)

kernels/phase4_bootstrap.py

@@ -10,7 +10,7 @@ sys.path.insert(0, "/kaggle/working")
 REV = "c237b478076f68da43dabd3403daa5639286899e"
 LAUNCHER_SHA = "5fb14bc3597d999a21772a66b6f409f01f722019dc78da313feddb2f9c769c48"
 os.environ["OUNCE100M_REV"] = REV
-os.environ["QUOTA_LEFT_HOURS"] = "24.9"      # live read 2026-09-20T11:10Z: 18,137 s of 108,000 used
+os.environ["QUOTA_LEFT_HOURS"] = "7.0"       # live read 2026-09-21T08:29Z: 82,755.0 s of 108,000 used
 
 url = f"https://huggingface.co/Cion-lab/ounce100m-code/resolve/{REV}/kernels/phase4_session.py"
 rc = subprocess.run(["curl", "-sfL", url, "-o", "phase4_session.py"]).returncode