perf: defer runtime inspection until model evidence

scripts/run_content_matrix.py

@@ -93,17 +93,17 @@ def main() -> int:
                 finally:
                     stop(process)
                     stop(canary)
+        results["latency_ms"] = {
+            "process_start_to_first_stop_p95": percentile(starts, 95),
+            "qualification_to_first_stop_p95": percentile(qualification, 95),
+            "trigger_to_empty_p95": percentile(empties, 95),
+        }
         if (
             percentile(starts, 95) >= 1000
             or percentile(qualification, 95) >= 100
             or percentile(empties, 95) >= 500
         ):
             raise RuntimeError("content latency gate failed")
-        results["latency_ms"] = {
-            "process_start_to_first_stop_p95": percentile(starts, 95),
-            "qualification_to_first_stop_p95": percentile(qualification, 95),
-            "trigger_to_empty_p95": percentile(empties, 95),
-        }
         results["result"] = "PASS"
         args.output.write_text(json.dumps(results, sort_keys=True) + "\n", encoding="utf-8")
         return 0

src/lumi_eggcracker/artifacts.py

@@ -111,6 +111,22 @@ def validate_path(path: Path) -> ArtifactEvidence | None:
         os.close(descriptor)
 
 
+def _looks_like_gguf(path: Path) -> bool:
+    """Use only a four-byte bounded probe before full artifact validation."""
+    flags = os.O_RDONLY | getattr(os, "O_CLOEXEC", 0) | getattr(os, "O_NOFOLLOW", 0)
+    try:
+        descriptor = os.open(path, flags)
+    except OSError:
+        return False
+    try:
+        metadata = os.fstat(descriptor)
+        return stat.S_ISREG(metadata.st_mode) and os.read(descriptor, 4) == b"GGUF"
+    except OSError:
+        return False
+    finally:
+        os.close(descriptor)
+
+
 def from_process_fds(
     snapshot: object, *, proc: Path = Path("/proc")
 ) -> tuple[ArtifactEvidence, ...]:
@@ -152,10 +168,13 @@ def from_process_fds(
 def from_snapshot(snapshot: object, *, proc: Path = Path("/proc")) -> tuple[ArtifactEvidence, ...]:
     """Collect bounded GGUF evidence from open descriptors and mapped files."""
     result = list(from_process_fds(snapshot, proc=proc))
-    for raw in tuple(getattr(snapshot, "map_paths", ()))[:MAX_ARTIFACTS]:
+    for raw in tuple(getattr(snapshot, "map_paths", ())):
         if not isinstance(raw, str) or not raw.startswith("/"):
             continue
-        evidence = validate_path(Path(raw))
+        path = Path(raw)
+        evidence = validate_path(path) if _looks_like_gguf(path) else None
         if evidence is not None and evidence not in result:
             result.append(evidence)
+            if len(result) >= MAX_ARTIFACTS:
+                break
     return tuple(result[:MAX_ARTIFACTS])

src/lumi_eggcracker/supervisor.py

@@ -486,7 +486,7 @@ class Supervisor:
             first_seen_ns = time.monotonic_ns()
             if detected is None:
                 content = artifacts_from_snapshot(snapshot)
-                runtimes = runtime_from_snapshot(snapshot)
+                runtimes = runtime_from_snapshot(snapshot) if content else ()
                 supplied = {
                     "MODEL_CONTENT": {item.evidence_id for item in content},
                     "INFERENCE_RUNTIME": {item.evidence_id for item in runtimes},

tests/test_artifacts.py

@@ -34,6 +34,12 @@ class ArtifactTests(unittest.TestCase):
                 path.write_bytes(body)
                 self.assertIsNone(validate_path(path))
 
+    def test_ai_looking_filename_is_not_content_evidence(self) -> None:
+        with tempfile.TemporaryDirectory() as raw:
+            path = Path(raw) / "model.gguf"
+            path.write_bytes(b"not a model")
+            self.assertIsNone(validate_path(path))
+
     def test_symlink_and_non_regular_files_do_not_qualify(self) -> None:
         with tempfile.TemporaryDirectory() as raw:
             root = Path(raw)