Promote validated Optimizers 0.2.22 staging to main

.github/workflows/publish-pypi.yml

@@ -12,6 +12,9 @@ on:
           - dev
           - official
   push:
+    branches:
+      - codex/v010-stable-packages
+      - codex/v010-optimizers-integrated
     tags:
       - "v*"
 
@@ -30,7 +33,7 @@ jobs:
       - id: release
         name: Enforce branch, tag, and version policy
         env:
-          REQUESTED_CHANNEL: ${{ github.event_name == 'push' && 'official' || inputs.channel }}
+          REQUESTED_CHANNEL: ${{ github.event_name == 'push' && (github.ref_type == 'tag' && 'official' || 'candidate') || inputs.channel }}
           RELEASE_REF: ${{ github.ref }}
           RELEASE_REF_NAME: ${{ github.ref_name }}
           RELEASE_REF_TYPE: ${{ github.ref_type }}
@@ -54,7 +57,12 @@ jobs:
           ref_name = os.environ["RELEASE_REF_NAME"]
           ref_type = os.environ["RELEASE_REF_TYPE"]
 
-          if channel == "dev":
+          if channel == "candidate":
+              if ref not in {"refs/heads/codex/v010-stable-packages", "refs/heads/codex/v010-optimizers-integrated"}:
+                  raise SystemExit("candidate checks require the release preparation branch")
+              if not re.fullmatch(r"\d+\.\d+\.\d+", version):
+                  raise SystemExit(f"candidate version is invalid: {version}")
+          elif channel == "dev":
               if ref != "refs/heads/dev":
                   raise SystemExit("development releases must be dispatched from the dev branch")
               if not re.fullmatch(r"\d+\.\d+\.\d+\.dev\d+", version):
@@ -73,30 +81,92 @@ jobs:
               output.write(f"version={version}\n")
           PY
 
-  build:
-    name: Build macOS arm64 wheel
+  # A package must not reach PyPI having never run its own suite. `cargo test`
+  # was absent here and had stopped compiling entirely before this release.
+  # `synth_optimizers_py` is excluded because linking the PyO3 extension as a
+  # test binary is a harness problem, not a source one.
+  test:
+    name: Test
     needs: validate
     runs-on: macos-14
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e
+        with:
+          enable-cache: true
+          python-version: "3.11"
+
+      - name: Rust suite
+        run: cargo test --workspace --exclude synth_optimizers_py
+
+      - name: Python production suite
+        run: uv run --locked --group dev pytest tests -q
+
+      - name: Static gates
+        run: |
+          cargo fmt --check
+          cargo clippy --workspace -- -D warnings
+          uv run --locked --project . --group dev ruff check src
+          python3 scripts/check-type-debt.py
+          git diff --check
+
+  build:
+    name: Build ${{ matrix.target }} wheel
+    needs:
+      - validate
+      - test
+    strategy:
+      matrix:
+        include:
+          - runner: macos-14
+            target: aarch64-apple-darwin
+          - runner: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+    runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
 
       - name: Build wheel
         uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b
         with:
           command: build
-          target: aarch64-apple-darwin
+          target: ${{ matrix.target }}
           args: --release --out dist --find-interpreter
 
+      - name: Verify production dependency metadata
+        run: python3 scripts/check-production-wheel.py dist/*.whl
+
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e
+        with:
+          python-version: "3.11"
+
+      - name: Fresh vendored dependency installation
+        run: |
+          uv venv .release-smoke --python 3.11
+          uv pip install --python .release-smoke/bin/python dist/*.whl vendor/synth-containers/synth_containers-0.4.3-py3-none-any.whl
+          .release-smoke/bin/python -c 'from importlib.metadata import distributions; import synth_optimizers._synth_optimizers; assert not any("tblite" in d.metadata["Name"].lower() for d in distributions())'
+          .release-smoke/bin/synth-optimizers --help
+
+      - name: Fresh public dependency installation
+        run: |
+          uv venv .public-release-smoke --python 3.11
+          uv pip install --python .public-release-smoke/bin/python --index-url https://pypi.org/simple dist/*.whl
+          .public-release-smoke/bin/python -c 'from importlib.metadata import distributions, version; import synth_optimizers._synth_optimizers; assert version("synth-containers") == "0.4.3"; assert not any("tblite" in d.metadata["Name"].lower() for d in distributions())'
+          .public-release-smoke/bin/synth-optimizers --help
+
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
-          name: optimizer-wheel
+          name: optimizer-wheel-${{ matrix.target }}
           path: dist/*.whl
           if-no-files-found: error
           retention-days: 7
 
   source:
     name: Build source distribution
-    needs: validate
+    needs:
+      - validate
+      - test
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
@@ -115,6 +185,8 @@ jobs:
           retention-days: 7
 
   publish:
+    # Candidate pushes exercise the real build gates but cannot publish.
+    if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
     name: Publish ${{ needs.validate.outputs.version }}
     needs:
       - validate

ACCEPTANCE.md

@@ -2,6 +2,31 @@
 
 Date: 2026-05-20
 
+> **Historical record — do not run the paths in this document.** This audit was
+> written on 2026-05-20 against the then-current monorepo layout and is preserved
+> unedited as evidence. Rewriting its paths would falsify what was actually run,
+> so read it as a record, not as instructions:
+>
+> - Source paths carry the `packages/synth-optimizers/` and
+>   `packages/synth-containers/` monorepo prefixes (26 and 5 occurrences). This
+>   repository is now a standalone checkout: drop the
+>   `packages/synth-optimizers/` prefix, and Containers lives in its own
+>   repository.
+> - Cookbook paths (`cookbooks/optimizers/gepa/…`) are **not in this
+>   repository**. They live in the separate public repo
+>   [`synth-laboratories/synth-cookbooks-public`](https://github.com/synth-laboratories/synth-cookbooks-public);
+>   see `RELEASE.md` for how they are invoked now.
+> - `code_review_container` exists on no ref of that public repo, so every
+>   `code-review` row below is unreproducible by an outside reader. The public
+>   GEPA cookbooks on `main` today are `banking77_container`,
+>   `hotpotqa_container`, `minigrid_container`, `crafter_container`,
+>   `tblite_container`, and `healthbench_groq`.
+> - Evidence roots under `/tmp/…` and `/var/folders/…` were ephemeral workspaces
+>   on the machine that ran the audit. They are cited as run identifiers, not as
+>   artifacts anyone can open.
+>
+> For the current release acceptance, see `RELEASE.md`.
+
 Scope: public `synth-optimizers` GEPA v1 vertical slice in
 `synth-cookbooks-public`, including Banking77 plus public-safe TBLite,
 code-review, and Crafter fixtures. This document records validation evidence;
@@ -81,7 +106,7 @@ package, `synth-containers` contract additions, and GEPA cookbooks under
 | Fresh readwrite run writes required artifacts. | PROVED | Current Banking77, TBLite, code-review, and Crafter fresh directories under `/tmp/synth-gepa-status-20260520` each contain `result_manifest.json`, `events.jsonl`, `events.normalized.jsonl`, `cache_profile.json`, `best_candidate.json`, `candidate_registry.json`, `frontier.json`, and `workspace.sqlite` |
 | Immediate cached rerun makes no new policy/proposer/rollout external cache writes. | PROVED | Final cached cache profiles: Banking77 `45 hits, 0 misses, 0 writes`; TBLite `15 hits, 0 misses, 0 writes`; code-review `18 hits, 0 misses, 0 writes`; Crafter `18 hits, 0 misses, 0 writes` |
 | Readonly replay succeeds when fully cached. | PROVED | Final readonly cache profiles: Banking77 `45 hits, 0 misses, 0 writes`; TBLite `15 hits, 0 misses, 0 writes`; code-review `18 hits, 0 misses, 0 writes`; Crafter `18 hits, 0 misses, 0 writes` |
-| `events compare` reports normalized parity between original, cached, and readonly runs. | PROVED | Banking77, TBLite, code-review, and Crafter fresh-vs-cached and fresh-vs-readonly compare commands returned `normalized event feeds match` |
+| `events compare` reports normalized parity between original, cached, and readonly runs. | **SUPERSEDED — do not carry forward** | Historical: Banking77, TBLite, code-review, and Crafter compare commands returned `normalized event feeds match`. This row predates the worker pool, budget forecasts, and child resource refs, and the claim no longer holds as stated: `events compare` is byte equality, and a replay legitimately emits 28 fewer `partial: true` worker-pool progress records because it executes no rollout (240 fresh vs 211 cached/readonly at `c21d6fe`). See `RELEASE.md` for the property that actually holds — byte-identical 199-event feeds once runtime telemetry is excluded. |
 | Optimizer state machine records run lifecycle from created to terminal state. | PROVED | Current `workspace.sqlite` files under `/tmp/synth-gepa-status-20260520` have `optimizer_state_history` rows: Banking77 40, TBLite 19, code-review 19, Crafter 19; manifests end in `completed` |
 | Rollout observations are captured as sensor frames. | PROVED | Current `workspace.sqlite` files under `/tmp/synth-gepa-status-20260520` have `sensor_frames` rows: Banking77 40, TBLite 11, code-review 14, Crafter 14, with rollout jobs persisted 1:1 |
 | Candidate payloads, candidate deltas, acceptance decisions, frontier cells, and plan links are first-class workspace rows. | PROVED | Final current-schema rerun under `/tmp/synth-gepa-final-current-20260520` completed Banking77, TBLite, code-review, and Crafter fresh/cached/readonly runs. Fresh workspaces contain candidate graph rows: Banking77 `candidate_payloads=5`, `candidate_deltas=4`, `acceptance_decisions=5`, `frontier_cells=5`, `plan_links=63`; TBLite `2/1/2/1/18`; code-review `2/1/2/1/21`; Crafter `2/1/2/1/21`. Each fresh run returned `projection_status_counts={fresh: 21}`, `invariant_status_counts={pass: 2}`, zero invariant violations, cached writes `0`, readonly writes `0`, and normalized event comparisons true. |

Cargo.toml

@@ -9,11 +9,11 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.2.16"
+version = "0.2.22"
 edition = "2021"
 license = "Apache-2.0"
 authors = ["Synth Laboratories <josh@usesynth.ai>"]
-repository = "https://github.com/synth-laboratories/synth-cookbooks-public"
+repository = "https://github.com/synth-laboratories/optimizers"
 
 [workspace.dependencies]
 anyhow = "1.0"
@@ -32,3 +32,11 @@ thiserror = "1.0"
 time = { version = "0.3", features = ["formatting", "macros", "parsing"] }
 toml = "0.8"
 uuid = { version = "1.10", features = ["v4"] }
+
+# Several constructors and snapshot builders take eight or more distinct domain
+# values. Bundling them into parameter structs would only move the arity into a
+# literal at every call site, and the alternative -- an attribute per function --
+# grows source files that the file-size ratchet in
+# `synth_optimizer_platform/tests/file_size_cap.rs` allows only to shrink.
+[workspace.lints.clippy]
+too_many_arguments = "allow"

EXECUTION.md

@@ -1,7 +1,18 @@
 # Lane: local MLX RL — optimizers side
 
+> **Internal engineering lane journal, not stranger-facing documentation.** It
+> records an in-progress work plan dated 2026-08-18 and deliberately cites
+> material outside this repository. The authority doc below is an unpublished
+> local file that is not present at that path today. `scripts/real_mlx_smoke.sh`
+> belongs to the sibling `synth-mlx-rl` repository, and `runtimes/banking77.py`
+> to the sibling Containers repository as it stood in August 2026 — neither is in
+> this repository, and neither path is guaranteed to still resolve in its own
+> repository. The paths are left as written because rewriting them would falsify
+> the record. An outside reader should start from `README.md` and `RELEASE.md`;
+> nothing here is a supported public entry point.
+
 Branch `agent/mlx-local-rl-20260818`, cut from `origin/main` @ `1c89092`.
-Authority doc (read it before touching anything):
+Authority doc (unpublished; not in this repo):
 `~/Documents/Codex/2026-08-18/synth-mlx-rl-dev/outputs/implementation-plan-final.md`
 
 `origin/main` was chosen over `origin/dev` deliberately: dev is 11 commits behind with
@@ -23,7 +34,12 @@ Use `uv run python -m pytest`, never `uv run pytest`.
 ## Cross-repo coupling to watch
 
 `pyproject.toml` pins `synth-containers==0.4.1.dev20260814` via
-`[tool.uv.sources] rev = "e76f8e4ba3edae10dec24bf9e71ec1a7fb332bed"`. Every containers
+`[tool.uv.sources] rev = "e76f8e4ba3edae10dec24bf9e71ec1a7fb332bed"`.
+(Stale as of the `0.2.22` candidate: `pyproject.toml` now pins
+`synth-containers==0.4.2`, and `[tool.uv.sources]` resolves it from the vendored
+wheel under `vendor/synth-containers/` rather than a git rev. Containers `0.4.2`
+is also published on PyPI as of 2026-09-09, so the rev-bump ritual below no
+longer applies.) Every containers
 change in this campaign (provider admission, `/compatibility` on the platform app,
 `TokenCaptureV5` extension) requires bumping that rev here. The containers work is a
 separate lane; this lane must not vendor around the pin.
@@ -133,14 +149,13 @@ cannot reach the host proxy) and `required_artifacts = ["trace"]`.
 
 ### O6 — local SFT backend
 
-`src/synth_optimizers/sft.py`. `SftConfig.from_mapping` currently raises
-`"backend must be fixture or tinker"`. Add the local MLX value plus an executor
-implementing the `SftExecutor` protocol at `sft.py:44`.
+`src/synth_optimizers/sft.py` and `src/synth_optimizers/sft_executor.py`.
+`SftConfig.from_mapping` accepts `fixture` or `tinker`. The in-process
+`TinkerSftExecutor` implements estimate/submit/status/cancel/resume.
 
-Mirror the hosted contract in optimizers-beta `crates/synth_sft/src/config.rs:39`, whose
-comments record two already-paid-for lessons: `checkpoint_steps` silently setting
-training length, and `max_seq_len` silently deciding which rows train at all. Carry
-`dataset_digest`, `training_steps`, `max_seq_len`, and `max_dropped_fraction`.
+Carry `dataset_digest`, `training_steps`, `max_seq_len`, and `max_dropped_fraction`.
+Do not silently let `checkpoint_steps` set training length or `max_seq_len` drop
+rows without recording them.
 
 ### O7 — local `grpo` / `cispo_minimax` algorithms