[ws1]: WS1 Full Qwen3-8B Dense Train-Inference Closeout

.github/workflows/ci.yml

@@ -67,6 +67,7 @@ jobs:
         run: |
           python -m pytest rl_engine/tests/test_dispatch.py -v
           PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python -m pytest tests/test_attention_correctness.py -q -rs
+          python -m pytest tests/test_forward_invariance.py tests/test_tolerance_contract.py tests/test_ws1_workload.py tests/test_gradient_invariance.py tests/test_elementwise_inventory.py tests/test_four_judgment_matrix.py tests/test_op_checks.py tests/test_operator_inputs.py tests/test_profiler.py tests/test_kv_consistency.py tests/test_ws1_qwen3_dense.py tests/test_ws1_chain_integration.py -q
 
       - name: Run Attention Ground-Truth Tests (CPU-safe)
         run: |

.github/workflows/ws1-chain-gpu.yml

@@ -0,0 +1,106 @@
+# SPDX-License-Identifier: Apache-2.0
+# WS1 C10/C11 full Qwen3-8B Dense model-level gate (CUDA BF16 + Triton-on-CUDA BF16).
+# Required check: no skip / xfail / synthetic weights / silent fallback.
+# Security: do not use pull_request_target. Fork PRs never see RunPod secrets.
+# Fork commits require an explicit maintainer workflow_dispatch from a trusted branch.
+
+name: WS1-chain-GPU
+
+on:
+  pull_request:
+    branches: [ main, test ]
+  push:
+    branches: [ main, test ]
+  workflow_dispatch:
+    inputs:
+      source_repository:
+        description: "Public repository containing the reviewed commit (owner/name)"
+        required: true
+        default: "RL-Align/RL-Kernel"
+        type: string
+      source_sha:
+        description: "Exact reviewed 40-character commit SHA to execute on the GPU pod"
+        required: true
+        type: string
+
+concurrency:
+  group: ws1-chain-gpu-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  fork-pr-notice:
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - name: Report required trusted execution
+        run: |
+          echo "Fork code cannot receive RunPod credentials."
+          echo "A maintainer must dispatch this workflow from a trusted upstream branch."
+          echo "source_repository=${{ github.event.pull_request.head.repo.full_name }}"
+          echo "source_sha=${{ github.event.pull_request.head.sha }}"
+
+  ws1-chain:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { gpu_id: "NVIDIA H100 80GB HBM3", target_sm: "9.0", force_sm90: "1", name: "sm90-c10-c11" }
+    steps:
+      - name: Validate trusted dispatch target
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          SOURCE_REPOSITORY: ${{ inputs.source_repository }}
+          SOURCE_SHA: ${{ inputs.source_sha }}
+        run: |
+          [[ "$SOURCE_REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]
+          [[ "$SOURCE_SHA" =~ ^[0-9a-fA-F]{40}$ ]]
+
+      - name: Checkout trusted GPU orchestrator
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.sha || github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Install runpodctl
+        run: |
+          wget -qO runpodctl https://github.com/runpod/runpodctl/releases/latest/download/runpodctl-linux-amd64
+          chmod +x runpodctl
+          sudo mv runpodctl /usr/local/bin/runpodctl
+
+      - name: Configure runpodctl
+        run: runpodctl config --apiKey "${{ secrets.RUNPOD_API_KEY }}"
+
+      - name: Setup SSH key
+        run: |
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          printf '%s\n' "${{ secrets.RUNPOD_SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+
+      - name: Run WS1 full-model C10/C11 on RunPod H100/H20-class
+        env:
+          RUNPOD_API_KEY: ${{ secrets.RUNPOD_API_KEY }}
+          PR_REPO_URL: ${{ github.event_name == 'workflow_dispatch' && format('https://github.com/{0}.git', inputs.source_repository) || github.event.pull_request.head.repo.clone_url || github.event.repository.clone_url }}
+          PR_SHA: ${{ github.event_name == 'workflow_dispatch' && inputs.source_sha || github.event.pull_request.head.sha || github.sha }}
+          GPU_ID: ${{ matrix.gpu_id }}
+          GPU_COUNT: "1"
+          TARGET_SM: ${{ matrix.target_sm }}
+          KERNEL_ALIGN_FORCE_SM90: ${{ matrix.force_sm90 }}
+          TEST_SUITE: ws1-chain
+          WS1_WEIGHTS_PATH: ""
+        run: bash ci/run_gpu_ci.sh
+
+      - name: Upload C8/C10/C11 JSON
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ws1-closeout-${{ matrix.name }}
+          path: |
+            artifacts/ws1-c8-ci.json
+            artifacts/ws1-c10-*.json
+          if-no-files-found: error

.github/workflows/ws1-gtest-gpu.yml

@@ -0,0 +1,108 @@
+# SPDX-License-Identifier: Apache-2.0
+# WS1 single-op gtest + C8 four-judgment GPU gate (CUDA BF16 and Triton-on-CUDA BF16).
+# Uses the same RunPod orchestrator as gpu-ci.yml. Fails closed on C8 red cells
+# and on C3/C4 silent fallback. Hopper must have zero pending_hopper.
+#
+# Security: do not use pull_request_target. Fork PRs never see RunPod secrets.
+# Same-repo PRs, pushes to main, and maintainer workflow_dispatch are allowed.
+
+name: WS1-gtest-GPU
+
+on:
+  pull_request:
+    branches: [ main ]
+    paths:
+      - "rl_engine/kernels/gtest/**"
+      - "rl_engine/kernels/ops/**"
+      - "rl_engine/testing/**"
+      - "scripts/sweep_ws1_four_judgments.py"
+      - "scripts/check_forward_invariance.py"
+      - "scripts/check_gradient_invariance.py"
+      - "scripts/ws1_candidate_evidence.py"
+      - "tests/test_ws1_*.py"
+      - "tests/test_forward_invariance.py"
+      - "tests/test_gradient_invariance.py"
+      - "tests/test_four_judgment_matrix.py"
+      - "tests/test_triton_batch_invariant_attention.py"
+      - "ci/run_ws1_gtest.sh"
+      - "ci/run_gpu_ci.sh"
+      - ".github/workflows/ws1-gtest-gpu.yml"
+  push:
+    branches: [ main ]
+    paths:
+      - "rl_engine/kernels/gtest/**"
+      - "rl_engine/kernels/ops/**"
+      - "rl_engine/testing/**"
+      - "scripts/sweep_ws1_four_judgments.py"
+      - "scripts/check_forward_invariance.py"
+      - "scripts/check_gradient_invariance.py"
+      - "scripts/ws1_candidate_evidence.py"
+      - "tests/test_ws1_*.py"
+      - "tests/test_forward_invariance.py"
+      - "tests/test_gradient_invariance.py"
+      - "tests/test_four_judgment_matrix.py"
+      - "tests/test_triton_batch_invariant_attention.py"
+      - "ci/run_ws1_gtest.sh"
+      - "ci/run_gpu_ci.sh"
+      - ".github/workflows/ws1-gtest-gpu.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: ws1-gtest-gpu-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  ws1-gtest:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { gpu_id: "NVIDIA RTX A4000", target_sm: "8.6", name: "sm86-cuda-triton" }
+          - { gpu_id: "NVIDIA H100 80GB HBM3", target_sm: "9.0", force_sm90: "1", name: "sm90-c8-execute" }
+    steps:
+      - name: Checkout the commit under test
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Install runpodctl
+        run: |
+          wget -qO runpodctl https://github.com/runpod/runpodctl/releases/latest/download/runpodctl-linux-amd64
+          chmod +x runpodctl
+          sudo mv runpodctl /usr/local/bin/runpodctl
+
+      - name: Configure runpodctl
+        run: runpodctl config --apiKey "${{ secrets.RUNPOD_API_KEY }}"
+
+      - name: Setup SSH key
+        run: |
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          printf '%s\n' "${{ secrets.RUNPOD_SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+
+      - name: Run WS1 CUDA/Triton gtest + C8 on RunPod
+        env:
+          RUNPOD_API_KEY: ${{ secrets.RUNPOD_API_KEY }}
+          PR_REPO_URL: ${{ github.event.pull_request.head.repo.clone_url || github.event.repository.clone_url }}
+          PR_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          GPU_ID: ${{ matrix.gpu_id }}
+          GPU_COUNT: "1"
+          TARGET_SM: ${{ matrix.target_sm }}
+          KERNEL_ALIGN_FORCE_SM90: ${{ matrix.force_sm90 }}
+          TEST_SUITE: ws1-gtest
+        run: bash ci/run_gpu_ci.sh
+
+      - name: Upload C8 execute JSON
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ws1-c8-execute-${{ matrix.name }}
+          path: artifacts/ws1-c8-ci.json
+          if-no-files-found: error

.gitignore

@@ -9,6 +9,7 @@ __pycache__/
 # Distribution / packaging
 .Python
 build/
+build_jit/
 develop-eggs/
 dist/
 downloads/
@@ -209,3 +210,6 @@ __marimo__/
 
 # Local dev notes (not for upstream)
 _dev_notes/
+
+# Local C8 execute dumps; default output is under TMPDIR.
+ws1-c8-ci.json

benchmarks/benchmark_sampling.py

@@ -5,7 +5,6 @@
 import time
 
 import torch
-from tabulate import tabulate
 
 from rl_engine.kernels.sampling import SamplerBackend as RL_Sampler
 from rl_engine.platforms.device import device_ctx
@@ -91,6 +90,8 @@ def run_benchmark(args, return_data: bool = False):
     if return_data:
         return raw_metrics
 
+    from tabulate import tabulate
+
     headers = ["Batch Size (G)", "Native Latency", "RL-Kernel", "Speedup"]
     print("\n" + "=" * 80)
     print(f"RL-KERNEL SAMPLING BENCHMARK REPORT (TopK={args.top_k}, TopP={args.top_p})")

ci/run_gpu_ci.sh

@@ -17,7 +17,7 @@ TARGET_SM="${TARGET_SM:-}"
 KERNEL_ALIGN_FORCE_SM90="${KERNEL_ALIGN_FORCE_SM90:-}"
 
 CI_IMAGE="${CI_IMAGE:-runpod/pytorch:2.4.0-py3.11-cuda12.4.1-devel-ubuntu22.04}"
-DISK_GB=40
+DISK_GB="${DISK_GB:-60}"
 PR_SHA="${PR_SHA:-$(date +%s)}"
 POD_NAME="rl-kernel-ci-${PR_SHA:0:7}"
 READY_RETRIES=60
@@ -118,7 +118,16 @@ echo "[ci] Target Establish -> root@$SSH_IP:$SSH_PORT"
 
 SSH_OPTIONS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -p $SSH_PORT"
 
-if [ "${GPU_COUNT}" -gt 1 ]; then
+WS1_WORKFLOW_URL_VALUE="${WS1_WORKFLOW_URL:-}"
+if [ -z "$WS1_WORKFLOW_URL_VALUE" ] && [ -n "${GITHUB_SERVER_URL:-}" ] && [ -n "${GITHUB_REPOSITORY:-}" ] && [ -n "${GITHUB_RUN_ID:-}" ]; then
+  WS1_WORKFLOW_URL_VALUE="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+fi
+TEST_SUITE="${TEST_SUITE:-full}"
+if [ "$TEST_SUITE" = "ws1-gtest" ]; then
+  TEST_CMD='bash ci/run_ws1_gtest.sh'
+elif [ "$TEST_SUITE" = "ws1-chain" ]; then
+  TEST_CMD='bash ci/run_ws1_chain_gate.sh'
+elif [ "${GPU_COUNT}" -gt 1 ]; then
   TEST_CMD='"$PY" -m torch.distributed.run --nproc_per_node='"${GPU_COUNT}"' -m pytest tests/ -v'
 else
   TEST_CMD='"$PY" -m pytest tests/ -v'
@@ -134,9 +143,11 @@ if ! "$PY" -c "import torch" >/dev/null 2>&1; then
   done
 fi
 echo "[remote] Using interpreter: $PY"
+export WS1_WORKFLOW_URL="'"${WS1_WORKFLOW_URL_VALUE}"'"
 export FORCE_CUDA=1
 export MAX_JOBS=8
 export KERNEL_ALIGN_FORCE_SM90="'"${KERNEL_ALIGN_FORCE_SM90}"'"
+export WS1_TEST_SUITE="'"${TEST_SUITE}"'"
 
 # normalize_sm: compact (90) or dotted (9.0) compute cap -> torch dotted form, keeping +PTX.
 normalize_sm() {
@@ -186,17 +197,54 @@ TORCH_INDEX_URL="${TORCH_INDEX_URL:-https://download.pytorch.org/whl/cu124}"
 # --no-build-isolation: torch must be visible to setup.py, else the extension is silently skipped.
 # --no-deps: keep the pinned torch; do not let the editable install re-resolve it.
 "$PY" -m pip install --no-build-isolation --no-deps -e .
-"$PY" -m pip install --no-cache-dir numpy tabulate accelerate "transformers==5.13.1" pytest
+"$PY" -m pip install --no-cache-dir numpy tabulate accelerate "transformers==5.13.1" pytest triton
 nvidia-smi
 # Fail fast if _C did not build or cannot launch, instead of silently using native fallbacks.
 "$PY" scripts/ci_smoke.py
 # Enforce _C in the pytest suite too (test_extension_smoke.py skips unless this is set).
 export RL_KERNEL_REQUIRE_EXT=1
+export WS1_C8_JSON=/tmp/ws1-c8-ci.json
+export WS1_WEIGHTS_PATH="'"${WS1_WEIGHTS_PATH:-}"'"
+if [ "$WS1_TEST_SUITE" = "ws1-chain" ]; then
+  if [ -n "$WS1_WEIGHTS_PATH" ] && [ -d "$WS1_WEIGHTS_PATH" ]; then
+    "$PY" scripts/prepare_ws1_weights.py \
+      --output "$WS1_WEIGHTS_PATH" --verify-only
+  else
+    export WS1_WEIGHTS_PATH=/workspace/models/Qwen3-8B
+    "$PY" scripts/prepare_ws1_weights.py --output "$WS1_WEIGHTS_PATH"
+  fi
+fi
 '"${TEST_CMD}"
 
-echo "[ci] Launching remote test suite on GPU pod (Distributed Execution Mode: TP=${GPU_COUNT})..."
+echo "[ci] Launching remote test suite on GPU pod (Distributed Execution Mode: TP=${GPU_COUNT}, suite=${TEST_SUITE})..."
 ssh $SSH_OPTIONS root@"$SSH_IP" "bash -lc '$REMOTE_CMD'"
 TEST_EXIT=$?
 
+if [ "$TEST_SUITE" = "ws1-gtest" ]; then
+  if [ "$TEST_EXIT" -ne 0 ]; then
+    echo "[ci] Remote WS1 gtest failed with exit code = $TEST_EXIT"
+    exit "$TEST_EXIT"
+  fi
+  echo "[ci] Fetching C8 execute artifact from the pod"
+  mkdir -p artifacts
+  scp $SSH_OPTIONS root@"$SSH_IP":/tmp/ws1-c8-ci.json artifacts/ws1-c8-ci.json
+  test -s artifacts/ws1-c8-ci.json
+fi
+
+if [ "$TEST_SUITE" = "ws1-chain" ]; then
+  if [ "$TEST_EXIT" -ne 0 ]; then
+    echo "[ci] Remote WS1 chain gate failed with exit code = $TEST_EXIT"
+    exit "$TEST_EXIT"
+  fi
+  echo "[ci] Fetching C8/C10/C11 artifacts from the pod"
+  mkdir -p artifacts
+  scp $SSH_OPTIONS root@"$SSH_IP":/tmp/ws1-c8-ci.json artifacts/ws1-c8-ci.json
+  scp $SSH_OPTIONS root@"$SSH_IP":/tmp/ws1-c10-cuda_bf16.json artifacts/ws1-c10-cuda_bf16.json
+  scp $SSH_OPTIONS root@"$SSH_IP":/tmp/ws1-c10-triton_cuda_bf16.json artifacts/ws1-c10-triton_cuda_bf16.json
+  test -s artifacts/ws1-c8-ci.json
+  test -s artifacts/ws1-c10-cuda_bf16.json
+  test -s artifacts/ws1-c10-triton_cuda_bf16.json
+fi
+
 echo "[ci] Remote execution finished with exit code = $TEST_EXIT"
 exit $TEST_EXIT