v0.10 Optimizers 0.2.22 consolidation review (not merge-ready)

.github/workflows/publish-craftax-eval-target.yml

@@ -66,15 +66,30 @@ jobs:
             'architectures=linux/amd64,linux/arm64' \
             'digest=${{ steps.publish.outputs.digest }}' | tee craftax-eval-target-receipt.txt
 
-      - name: Make the repository-linked target public
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh api --method PATCH \
-            /orgs/synth-laboratories/packages/container/workshop-craftax-eval-target \
-            -f visibility=public
-
       - uses: actions/upload-artifact@v4
         with:
           name: craftax-eval-target-receipt
           path: craftax-eval-target-receipt.txt
+
+      # GitHub has no REST route for package visibility: PATCH
+      # /orgs/{org}/packages/container/{name} is 404 for every token, which is
+      # what failed runs 32094428767 and 32098386835 after the push succeeded.
+      # Visibility is a one-time package-settings action by an org owner, so
+      # verify it here instead of pretending to set it. Once the package is
+      # public this step passes on every later run.
+      - name: Verify the target is anonymously pullable
+        env:
+          DIGEST: ${{ steps.publish.outputs.digest }}
+        run: |
+          set -euo pipefail
+          repo='synth-laboratories/workshop-craftax-eval-target'
+          token="$(curl -sS "https://ghcr.io/token?scope=repository:${repo}:pull" | jq -r '.token // empty')"
+          if [ -z "$token" ]; then
+            echo "::error::ghcr.io/${repo} is not anonymously pullable. The image ${DIGEST} was pushed and its receipt uploaded; an org owner must set the package public once at https://github.com/orgs/synth-laboratories/packages/container/workshop-craftax-eval-target/settings (Danger Zone -> Change visibility -> Public)."
+            exit 1
+          fi
+          curl -fsS -o /dev/null \
+            -H "Authorization: Bearer ${token}" \
+            -H 'Accept: application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json' \
+            "https://ghcr.io/v2/${repo}/manifests/${DIGEST}"
+          echo "anonymous pull verified for ${DIGEST}"

.github/workflows/publish-gsm8k-eval-target.yml

@@ -0,0 +1,108 @@
+name: Publish GSM8K eval target
+
+# Same shape as publish-craftax-eval-target.yml: an immutable build context from
+# pinned sources, a multi-arch push by digest, a receipt artifact. The dataset
+# pin (revision + split digests) is owned by containers' gsm8k_world.py; the
+# stage step refuses to build if the rows fetched at that revision do not
+# reproduce the recorded digests.
+
+on:
+  workflow_dispatch:
+    inputs:
+      containers_ref:
+        description: "containers commit to vendor gsm8k_world.py from (full SHA)"
+        required: true
+        default: "9916cd7479c1029d7dd9091db43f52af1cdf484e"
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out Optimizers producer
+        uses: actions/checkout@v4
+
+      - name: Check out pinned containers source
+        uses: actions/checkout@v4
+        with:
+          repository: synth-laboratories/containers
+          ref: ${{ inputs.containers_ref }}
+          path: containers-source
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Assemble immutable build context (pinned dataset, verified digests)
+        id: stage
+        run: |
+          set -euo pipefail
+          python -m pip install --quiet "huggingface_hub>=0.25" "pyarrow>=15"
+          python docker/gsm8k-eval-target/stage.py \
+            --containers-src containers-source/src \
+            --out "${RUNNER_TEMP}/gsm8k-eval-target"
+          revision="$(python -c 'import json,sys; print(json.load(open(sys.argv[1]))["revision"])' \
+            "${RUNNER_TEMP}/gsm8k-eval-target/stage-receipt.json")"
+          containers_sha="$(git -C containers-source rev-parse HEAD)"
+          echo "revision=${revision}" >> "$GITHUB_OUTPUT"
+          echo "containers_sha=${containers_sha}" >> "$GITHUB_OUTPUT"
+          echo "tag=v0.7-gsm8k-${revision:0:8}-containers-${containers_sha:0:8}" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and publish immutable multi-architecture target
+        id: publish
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ runner.temp }}/gsm8k-eval-target
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ghcr.io/synth-laboratories/workshop-gsm8k-eval-target:${{ steps.stage.outputs.tag }}
+          labels: |
+            org.opencontainers.image.source=https://github.com/synth-laboratories/optimizers
+            org.opencontainers.image.revision=${{ steps.stage.outputs.containers_sha }}
+            org.opencontainers.image.title=Workshop GSM8K eval target
+          build-args: |
+            GSM8K_REVISION=${{ steps.stage.outputs.revision }}
+            CONTAINERS_SOURCE_COMMIT=${{ steps.stage.outputs.containers_sha }}
+          provenance: mode=max
+          sbom: true
+
+      - name: Record immutable publication receipt
+        run: |
+          cp "${RUNNER_TEMP}/gsm8k-eval-target/stage-receipt.json" gsm8k-eval-target-stage-receipt.json
+          printf '%s\n' \
+            'image=ghcr.io/synth-laboratories/workshop-gsm8k-eval-target' \
+            'tag=${{ steps.stage.outputs.tag }}' \
+            'dataset_revision=${{ steps.stage.outputs.revision }}' \
+            'containers_source_commit=${{ steps.stage.outputs.containers_sha }}' \
+            'architectures=linux/amd64,linux/arm64' \
+            'digest=${{ steps.publish.outputs.digest }}' | tee gsm8k-eval-target-receipt.txt
+
+      # Known to 404 on this org (same step as the Craftax workflow); the image
+      # is pushed and its digest recorded regardless, and visibility can be
+      # fixed from the org's package settings.
+      - name: Make the repository-linked target public
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api --method PATCH \
+            /orgs/synth-laboratories/packages/container/workshop-gsm8k-eval-target \
+            -f visibility=public
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: gsm8k-eval-target-receipt
+          path: |
+            gsm8k-eval-target-receipt.txt
+            gsm8k-eval-target-stage-receipt.json

.github/workflows/publish-pypi.yml

@@ -12,6 +12,8 @@ on:
           - dev
           - official
   push:
+    branches:
+      - codex/v010-stable-packages
     tags:
       - "v*"
 
@@ -30,7 +32,7 @@ jobs:
       - id: release
         name: Enforce branch, tag, and version policy
         env:
-          REQUESTED_CHANNEL: ${{ github.event_name == 'push' && 'official' || inputs.channel }}
+          REQUESTED_CHANNEL: ${{ github.event_name == 'push' && (github.ref_type == 'tag' && 'official' || 'candidate') || inputs.channel }}
           RELEASE_REF: ${{ github.ref }}
           RELEASE_REF_NAME: ${{ github.ref_name }}
           RELEASE_REF_TYPE: ${{ github.ref_type }}
@@ -54,7 +56,12 @@ jobs:
           ref_name = os.environ["RELEASE_REF_NAME"]
           ref_type = os.environ["RELEASE_REF_TYPE"]
 
-          if channel == "dev":
+          if channel == "candidate":
+              if ref != "refs/heads/codex/v010-stable-packages":
+                  raise SystemExit("candidate checks require the release preparation branch")
+              if not re.fullmatch(r"\d+\.\d+\.\d+", version):
+                  raise SystemExit(f"candidate version is invalid: {version}")
+          elif channel == "dev":
               if ref != "refs/heads/dev":
                   raise SystemExit("development releases must be dispatched from the dev branch")
               if not re.fullmatch(r"\d+\.\d+\.\d+\.dev\d+", version):
@@ -73,30 +80,92 @@ jobs:
               output.write(f"version={version}\n")
           PY
 
-  build:
-    name: Build macOS arm64 wheel
+  # A package must not reach PyPI having never run its own suite. `cargo test`
+  # was absent here and had stopped compiling entirely before this release.
+  # `synth_optimizers_py` is excluded because linking the PyO3 extension as a
+  # test binary is a harness problem, not a source one.
+  test:
+    name: Test
     needs: validate
     runs-on: macos-14
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e
+        with:
+          enable-cache: true
+          python-version: "3.11"
+
+      - name: Rust suite
+        run: cargo test --workspace --exclude synth_optimizers_py
+
+      - name: Python production suite
+        run: uv run --locked --group dev pytest tests -q
+
+      - name: Static gates
+        run: |
+          cargo fmt --check
+          cargo clippy --workspace -- -D warnings
+          uv run --locked --project . --group dev ruff check src
+          python3 scripts/check-type-debt.py
+          git diff --check
+
+  build:
+    name: Build ${{ matrix.target }} wheel
+    needs:
+      - validate
+      - test
+    strategy:
+      matrix:
+        include:
+          - runner: macos-14
+            target: aarch64-apple-darwin
+          - runner: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+    runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Build wheel
         uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b
         with:
           command: build
-          target: aarch64-apple-darwin
+          target: ${{ matrix.target }}
           args: --release --out dist --find-interpreter
 
+      - name: Verify production dependency metadata
+        run: python3 scripts/check-production-wheel.py dist/*.whl
+
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e
+        with:
+          python-version: "3.11"
+
+      - name: Fresh vendored dependency installation
+        run: |
+          uv venv .release-smoke --python 3.11
+          uv pip install --python .release-smoke/bin/python dist/*.whl vendor/synth-containers/synth_containers-0.4.2-py3-none-any.whl
+          .release-smoke/bin/python -c 'from importlib.metadata import distributions; import synth_optimizers._synth_optimizers; assert not any("tblite" in d.metadata["Name"].lower() for d in distributions())'
+          .release-smoke/bin/synth-optimizers --help
+
+      - name: Fresh public dependency installation
+        run: |
+          uv venv .public-release-smoke --python 3.11
+          uv pip install --python .public-release-smoke/bin/python --index-url https://pypi.org/simple dist/*.whl
+          .public-release-smoke/bin/python -c 'from importlib.metadata import distributions, version; import synth_optimizers._synth_optimizers; assert version("synth-containers") == "0.4.2"; assert not any("tblite" in d.metadata["Name"].lower() for d in distributions())'
+          .public-release-smoke/bin/synth-optimizers --help
+
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
-          name: optimizer-wheel
+          name: optimizer-wheel-${{ matrix.target }}
           path: dist/*.whl
           if-no-files-found: error
           retention-days: 7
 
   source:
     name: Build source distribution
-    needs: validate
+    needs:
+      - validate
+      - test
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
@@ -115,6 +184,8 @@ jobs:
           retention-days: 7
 
   publish:
+    # Candidate pushes exercise the real build gates but cannot publish.
+    if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
     name: Publish ${{ needs.validate.outputs.version }}
     needs:
       - validate

ACCEPTANCE.md

@@ -2,6 +2,31 @@
 
 Date: 2026-05-20
 
+> **Historical record — do not run the paths in this document.** This audit was
+> written on 2026-05-20 against the then-current monorepo layout and is preserved
+> unedited as evidence. Rewriting its paths would falsify what was actually run,
+> so read it as a record, not as instructions:
+>
+> - Source paths carry the `packages/synth-optimizers/` and
+>   `packages/synth-containers/` monorepo prefixes (26 and 5 occurrences). This
+>   repository is now a standalone checkout: drop the
+>   `packages/synth-optimizers/` prefix, and Containers lives in its own
+>   repository.
+> - Cookbook paths (`cookbooks/optimizers/gepa/…`) are **not in this
+>   repository**. They live in the separate public repo
+>   [`synth-laboratories/synth-cookbooks-public`](https://github.com/synth-laboratories/synth-cookbooks-public);
+>   see `RELEASE.md` for how they are invoked now.
+> - `code_review_container` exists on no ref of that public repo, so every
+>   `code-review` row below is unreproducible by an outside reader. The public
+>   GEPA cookbooks on `main` today are `banking77_container`,
+>   `hotpotqa_container`, `minigrid_container`, `crafter_container`,
+>   `tblite_container`, and `healthbench_groq`.
+> - Evidence roots under `/tmp/…` and `/var/folders/…` were ephemeral workspaces
+>   on the machine that ran the audit. They are cited as run identifiers, not as
+>   artifacts anyone can open.
+>
+> For the current release acceptance, see `RELEASE.md`.
+
 Scope: public `synth-optimizers` GEPA v1 vertical slice in
 `synth-cookbooks-public`, including Banking77 plus public-safe TBLite,
 code-review, and Crafter fixtures. This document records validation evidence;
@@ -81,7 +106,7 @@ package, `synth-containers` contract additions, and GEPA cookbooks under
 | Fresh readwrite run writes required artifacts. | PROVED | Current Banking77, TBLite, code-review, and Crafter fresh directories under `/tmp/synth-gepa-status-20260520` each contain `result_manifest.json`, `events.jsonl`, `events.normalized.jsonl`, `cache_profile.json`, `best_candidate.json`, `candidate_registry.json`, `frontier.json`, and `workspace.sqlite` |
 | Immediate cached rerun makes no new policy/proposer/rollout external cache writes. | PROVED | Final cached cache profiles: Banking77 `45 hits, 0 misses, 0 writes`; TBLite `15 hits, 0 misses, 0 writes`; code-review `18 hits, 0 misses, 0 writes`; Crafter `18 hits, 0 misses, 0 writes` |
 | Readonly replay succeeds when fully cached. | PROVED | Final readonly cache profiles: Banking77 `45 hits, 0 misses, 0 writes`; TBLite `15 hits, 0 misses, 0 writes`; code-review `18 hits, 0 misses, 0 writes`; Crafter `18 hits, 0 misses, 0 writes` |
-| `events compare` reports normalized parity between original, cached, and readonly runs. | PROVED | Banking77, TBLite, code-review, and Crafter fresh-vs-cached and fresh-vs-readonly compare commands returned `normalized event feeds match` |
+| `events compare` reports normalized parity between original, cached, and readonly runs. | **SUPERSEDED — do not carry forward** | Historical: Banking77, TBLite, code-review, and Crafter compare commands returned `normalized event feeds match`. This row predates the worker pool, budget forecasts, and child resource refs, and the claim no longer holds as stated: `events compare` is byte equality, and a replay legitimately emits 28 fewer `partial: true` worker-pool progress records because it executes no rollout (240 fresh vs 211 cached/readonly at `c21d6fe`). See `RELEASE.md` for the property that actually holds — byte-identical 199-event feeds once runtime telemetry is excluded. |
 | Optimizer state machine records run lifecycle from created to terminal state. | PROVED | Current `workspace.sqlite` files under `/tmp/synth-gepa-status-20260520` have `optimizer_state_history` rows: Banking77 40, TBLite 19, code-review 19, Crafter 19; manifests end in `completed` |
 | Rollout observations are captured as sensor frames. | PROVED | Current `workspace.sqlite` files under `/tmp/synth-gepa-status-20260520` have `sensor_frames` rows: Banking77 40, TBLite 11, code-review 14, Crafter 14, with rollout jobs persisted 1:1 |
 | Candidate payloads, candidate deltas, acceptance decisions, frontier cells, and plan links are first-class workspace rows. | PROVED | Final current-schema rerun under `/tmp/synth-gepa-final-current-20260520` completed Banking77, TBLite, code-review, and Crafter fresh/cached/readonly runs. Fresh workspaces contain candidate graph rows: Banking77 `candidate_payloads=5`, `candidate_deltas=4`, `acceptance_decisions=5`, `frontier_cells=5`, `plan_links=63`; TBLite `2/1/2/1/18`; code-review `2/1/2/1/21`; Crafter `2/1/2/1/21`. Each fresh run returned `projection_status_counts={fresh: 21}`, `invariant_status_counts={pass: 2}`, zero invariant violations, cached writes `0`, readonly writes `0`, and normalized event comparisons true. |

Cargo.toml

@@ -9,11 +9,11 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.2.14"
+version = "0.2.22"
 edition = "2021"
 license = "Apache-2.0"
 authors = ["Synth Laboratories <josh@usesynth.ai>"]
-repository = "https://github.com/synth-laboratories/synth-cookbooks-public"
+repository = "https://github.com/synth-laboratories/optimizers"
 
 [workspace.dependencies]
 anyhow = "1.0"
@@ -32,3 +32,11 @@ thiserror = "1.0"
 time = { version = "0.3", features = ["formatting", "macros", "parsing"] }
 toml = "0.8"
 uuid = { version = "1.10", features = ["v4"] }
+
+# Several constructors and snapshot builders take eight or more distinct domain
+# values. Bundling them into parameter structs would only move the arity into a
+# literal at every call site, and the alternative -- an attribute per function --
+# grows source files that the file-size ratchet in
+# `synth_optimizer_platform/tests/file_size_cap.rs` allows only to shrink.
+[workspace.lints.clippy]
+too_many_arguments = "allow"