PR D: CPU, device and compute evidence infrastructure

[P-R-N-D]

Summary

PR D adds executable CPU/device evidence infrastructure after PR A #17, PR B #18 and PR C #19. Runtime installation, API/device discovery, access, execution, correctness, actual backend and fallback are separate facts. The hosted CPU lane computes a fixed reference result and validates its evidence using the existing v1 Profile/Result model.

Base: 74801fe0e78bef71182612408d6f8e4a95f69f56
Head: 0dd38027970de1345879bc5d740ec127f4a9b044
Tested merge: 2f2c161fbd67ccae2ad5bbbe2fb4d6c2271795bd

Scope comes from the owner's PR D instructions and subsequent Codex/2026-10-17 independent Claude review follow-ups. Keep this PR open and unmerged.

Changes

• Optional compute.probe_contract: device-v1 and typed probes extend schema version 1 without replacing the schema engine. Runtime/process, log/artifact, full run identity and stage requested/effective backend evidence must agree.
• Standard-library CPU reference multiplies fixed matrices and checks [[4,10],[8,-1]]; deliberate incorrect-result/execution-error inputs fail. CPU capabilities inferred from the running interpreter are labelled inferred. Install/initialize describe this interpreter/reference starting, not package installation or browser preparation.
• Native catalog covers CUDA, ROCm, oneAPI, Level Zero, OpenCL, Vulkan Compute, DirectCompute, DirectML, Metal, MPS, Core ML, MLX and QNN. These are capability contracts and hints, not implemented hardware kernels. All native accelerator operations remain not-run with unknown availability where unmeasured.
• Existing Playwright/Chromium probes WASM addition and WebGL/WebGPU/WebNN discovery. A bounded, sandboxed Chromium server listens on loopback only; an observation or cleanup timeout terminates its owned process tree. Controller PID and path-free paired/override binary source are explicit.
• device-tests.yml: one Ubuntu 24.04 hosted CPU job with an optional browser probe, strict missing-package/binary handling after setup, full paired Chromium without the unused shell download, a three-minute browser-step limit, strict validation, negative regressions and artifacts. CPU/evidence steps retain their existing failure conditions.
• Fifteen separately marked synthetic environment pairs cover VM/WSL2/rootless Podman, three distinct systemd roles, Kubernetes/K3s/OpenShift, device passthrough and CPU-only containers. They never claim executed stages. Tests assert the measured synthetic facts behind the five expected policy denials.

Existing ci.yml, compatibility.yml, python-abi.yml, 12 dev + 12 production E2E cases, product code and lockfiles are unchanged. No SDK/inference framework, deployment manifest, cluster/service setup, new Windows job, hardware/self-hosted runner, repository setting or privilege exception.

Review follow-ups

The four earlier Codex P2 findings were addressed in ed60c63. The owner's independent Claude review of 74801fe..ed60c63 identified no blockers/high findings and additional consistency/testing/documentation work. 0dd3802 addresses F1–F17 and the related improvements below.

Review items	Disposition
F1–F3	Exact finding code/path and guard-message regressions; unreferenced backend probes and genuine legacy branches; injectable browser lifecycle and actual CLI tests. Tests isolate provenance using the actual collected Node version.
F4, F6	Bare EPERM no longer means unavailable sandbox. Launch/observation/cleanup failures remain failed. Total observation deadline and owned-process kill are tested, including actual stopped Chromium; workflow step has an additional three-minute bound.
F5, F8, F18	Effective as well as requested accelerator claims are checked; known accelerator APIs cannot hide as CPU/other; passed probes name their own backend; measured software fallback cannot pass. Real stages share log/artifact execution evidence. Device profiles requiring workload execution cannot omit a CPU/accelerator binding.
F7, F9, F22, F23	Inherited producer-owned browser metadata is cleared; deep input errors return sanitized exit 2; exact bounded bytes are parsed and hashed once; browser status/reason appears in summary/stdout.
F10, F12–F17	Hosted browser nonexecution, strict installation detection, secret-check scope, review trigger paths, CPU stage meanings, controller PID, binary source and test totals are documented accurately.
F11	Full-range and per-commit secret-heuristic results corrected and rerun; exact results below.
F19–F21	Runtime coupling and negative-fact producer trust boundaries are explicit. Static CPU capability provenance is inferred; incomplete operations retain unknown fallback.
F25–F28	Fixture assertions check actual measured synthetic facts; profile-strengthened rootless policy, separate synthetic artifact file and optional-browser versus required-device status distinctions are documented.
F24	Deferred: output publication is not an atomic multi-file transaction. A write failure returns exit 2; an earlier output may remain. No all-or-nothing publication guarantee is made.

A forced GitHub Actions step timeout was not deliberately run. The code-level stalled-process tests execute in the regression suite, actual local Chromium SIGSTOP was tested, and the workflow has the additional step timeout. Those facts do not claim a separately observed Actions cancellation experiment.

Independent verification

GPT-6.1 Sol agents authored the changes. Two separate GPT-6 Astra agents independently reviewed code/security and performed adversarial rebuttal without repository edits. Both reported no remaining blocking or scoped-medium findings on the final diff. Review is evidence, not approval.

Independent runs from the repository root:

Command	Result
python -I scripts/ci/tests/test_compatibility_schema.py	95 tests, OK
python -I scripts/ci/tests/test_environment_probe.py	84 tests, OK
python -I scripts/ci/tests/test_python_abi_probe.py	35 tests, OK; 2 interpreter-dependent skips
python -I scripts/ci/tests/test_device_contract.py	58 tests, OK
python -I scripts/ci/tests/test_compute_probe.py	45 tests, OK
python -I scripts/ci/tests/test_device_environments.py	10 tests, OK
node --test frontend/scripts/probe-browser-compute.test.mjs	55 tests, 55 passed
git diff --check	Exit 0

The six Python suites comprise 327 tests, including the two stated skips. Author scratch checks killed 16 contract, 16 importer, 16 browser and 5 fixture mutants. Independent Astra checks reran all 16 contract and 16 browser mutants and constructed 8 importer guard mutants; all were killed. A separate measured→known provenance mutation failed both the same-value fixture and actual-Node CLI test.

Actual supplemental system Chromium with sandbox enabled passed normally. Independently stopping its owned process during evaluation and close produced failed reports in about 2.5s/1.7s with shortened test budgets, removed the owned PID and allowed Node to exit. No root, installation or sandbox bypass was used. This is system-override evidence, not paired hosted-browser qualification.

Author self-assessment additionally validated all 25 real profiles (0 errors/warnings) and the Device YAML, runner, timeouts, permissions and action pins. Local missing isolation evidence remains a policy limitation; no local policy bypass is represented as compliance.

Secret-heuristic correction and current results

The exact Python script from SECURITY-REVIEW step 7 was independently extracted unchanged and run with python3 -I <step7.py> <base> <head>, plus each commit returned by git rev-list --no-merges <base>..<head>.

Committed scope	Exit	Keyword leads
Historical full 74801fe..ed60c63	1	7
Current full 74801fe..0dd3802	1	15
8be7f31^..8be7f31	1	7
b34b7b8^..b34b7b8	0	0
ed60c63^..ed60c63	0	0
0dd3802^..0dd3802	1	10

All leads were inspected as documentation, test names or test sentinels; no credential was identified. Exit 1 means leads required review, not a clean keyword scan. The earlier unqualified exit-0 statement did not describe the full PR range and is corrected here. Clean uncommitted mode returns exit 0 and is not evidence about committed history. This heuristic is not a dedicated secret scanner.

Latest-head Actions

All four workflows completed successfully on attempt 1: 31/31 jobs. These runs test head 0dd3802 through merge 2f2c161 against base 74801fe.

Workflow	Run	Result
Device Compute	39000607804	1/1 jobs successful
CI	39000607805	7/7 jobs successful
Compatibility	39000607785	11/11 jobs successful
Python ABI	39000607871	12/12 jobs successful

The Device artifact was downloaded and independently revalidated by GPT-6 Astra against the final checkout: 0 errors, 0 warnings with the default policy and device profile. CPU requested/effective backend is cpu; expected and actual matrix are [[4,10],[8,-1]] on CPython 3.12.15. All 168 Device regressions (58 + 45 + 10 Python, 55 Node) passed without skips.

Device artifact 12088369791 contains ten files; downloaded ZIP SHA-256: bd1420de3876ca9a8306c6b4b7592ba00b4370db5578251f3c4deb12aae2a7ea. Browser metadata records binary_source: paired; all four browser probes are not-run (chromium-sandbox-unavailable). The environment digest and run identity match. No hosted Chromium WASM execution or accelerator kernel is claimed. All fifteen fixture pairs remain synthetic.

The other Astra reviewer independently read all thirty jobs in the unchanged workflows. CI retained 12 dev + 12 production E2E passes, Django 23, pytest 23, Vitest 13, lock checks 49, and successful lint/type-check/build. Compatibility and ABI retain their existing explicit missing-wheel/lock/dependency blocks and skipped downstream checks. Installable ABI import/call checks passed; thread safety remains unverified. The seven existing Windows jobs retain their scoped administrator exception and policy-skipped warnings. Successful workflow conclusions do not promote these blocked lanes to supported.

Historical hosted Device runs 38239325381 and 38242667040 passed CPU validation while every browser probe was not-run (chromium-sandbox-unavailable). Neither executed browser WASM; Node unit tests exercised WASM separately. The latest artifact confirms the same hosted sandbox limitation.

Security and remaining limits

Rootless First remains: application non-root execution, minimal device access, no rootful/privileged fallback, contents-read token, no persisted checkout credentials, full SHA action pins, no secrets/OIDC or self-hosted selection. Validation applies the default policy plus the profile's stricter engine-rootless requirement.

Chromium retains its sandbox, PATH/LANG-only environment, service-worker blocking and fixed intercepted origin. Its temporary loopback connection is not exposed in reports. No device identifiers, hostnames, environment dumps or raw Chromium errors are published by the producers.

Only environment/Result documents receive existing secret-shape validation. Raw browser/compute reports, CPU/test logs and the separate synthetic bundle rely on reviewed producers; there is no artifact-wide secret scan. Hash/run checks establish consistency, not authenticity against a dishonest producer.

No hardware lane is promoted to Checked. The CPU profile is not-assessed; security/performance remain not-run and overall compatibility incomplete. CPU reference evidence does not establish LLM inference or accelerator performance. No GPU/NPU kernel or real WSL2/cluster/systemd verification ran.

The existing PR C Windows administrator exception remains confined to its jobs. Windows non-administrator/token verification remains a separate follow-up with the 2026-11-08 review deadline. Future hardware testing needs actual hardware, an approved driver/runtime and correctness kernel, minimum device permissions and an isolated trusted runner at an owner-reviewed immutable revision; public PR code must never automatically select it.

Merge recommendation: ready within the defined PR D scope, based on the successful latest-head workflows and independent code/security/rebuttal reviews, with the explicit limitations and F24 follow-up above. This is evidence for the owner's decision, not automatic approval. The PR remains open and unmerged; no merge was performed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T11:40:35.055004Z	ed60c63	Manual request
🔒 Security Review	✅ Completed 2026-10-12T10:56:28.364965Z	8be7f31	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b34b7b8a42

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".