feat: add safe WebUI model library operations - #1872
Merged
Merged
Conversation
inureyes
added
status:review
inureyes
added a commit
that referenced
this pull request
Sep 12, 2026
21 tasks
inureyes
added a commit
that referenced
this pull request
Sep 14, 2026
inureyes
force-pushed
the
feature/issue-1841-safe-model-library
branch
from
September 14, 2026 03:20
034dfac to
3cb4817
Compare
inureyes
added a commit
that referenced
this pull request
Sep 14, 2026
inureyes
force-pushed
the
feature/issue-1841-safe-model-library
branch
from
September 14, 2026 04:27
857937c to
71552f8
Compare
inureyes
added a commit
that referenced
this pull request
Sep 14, 2026
…clean (#1889) ## Summary Restores the `OpenXLA feature compile` CI job, which has failed on `main` since 2026-09-12 16:12 and therefore fails on every open PR. No behavior changes on any feature set. ## Cause The job's second step is `cargo check --no-default-features --features xla-diagnostics --all-targets` under `RUSTFLAGS="-D warnings"`. Because `default = ["surgery", "webui"]`, that step builds with the WebUI off. The last success on `main` was `9ead2b7d` (2026-09-12 04:43) and the first failure `70386ac6` (2026-09-12 16:12). The only commits between them are the WebUI series: #1857, #1860, #1865, #1868, #1864. They registered their routes behind `#[cfg(feature = "webui")]` but left the handlers, validators, constants, request types and imports those routes use outside the gate. With `webui` off all of it is dead code, and `-D warnings` makes each an error. I checked before writing this that it was not already fixed elsewhere: current `origin/main` still carries the imports and its latest CI run still fails the job, `lablup/mlxcel-internal` was last pushed on 2026-09-10 and predates the breakage, and no merged or open PR fixes it. ## Change Every orphaned item is gated on `webui`, matching the gate its only callers already carry. - `src/server/router_server.rs`: 35 handlers, validators, constants and types, plus the `router_lifecycle`, `HeaderMap`, `Uri`, `AxumPath` and `RouterModelAction` imports only they use. - `src/server/app.rs`: six axum imports. - `src/models/mod.rs`: six detection re-exports used only by `server::webui`. `is_sequence_classification_architecture` stays ungated because `src/rerank/mod.rs` uses it. - `src/server/auth.rs`: `with_extra_key`, called only from the WebUI security setup in `startup.rs`. - `src/server/router_server_tests.rs`: `restore_env_var`, used only by a webui-gated test. Gating the first layer exposed a second layer of imports that only the gated items used, so this was iterated until the compiler reported nothing. The only deleted lines are import lists being split; no logic is touched. ## Verification Reproduced first on `main`: `cargo check --no-default-features --features cuda --lib --tests` reports 42 warnings in the `mlxcel` crate. After the change, every `cargo check` below reports zero warnings and zero errors in workspace crates: | features | targets | |---|---| | `--no-default-features --features cuda` | `--lib --tests` | | `--features cuda` (defaults on) | `--lib --tests` | | `--no-default-features --features cuda,webui` | `--lib --tests` | | `--no-default-features --features cuda,surgery` | `--lib --tests` | | `--no-default-features --features cuda` | `--all-targets` | | `--features cuda` (defaults on) | `--all-targets` | The `--all-targets` rows cover bins, benches and examples, where a gated item used by another target would have been a hard compile error rather than a warning. `cargo fmt --all -- --check` is clean. Not built locally: the `xla-iree` feature itself. The `OpenXLA feature compile` job on this PR is the check for it, and it is the job this PR exists to turn green. ## Follow-up for open PRs PR #1872 edits `src/server/router_server.rs` and carries the same imports, so it will need a rebase once this lands. A rebase request will be posted there.
Member
Author
Rebase needed onto
|
WebUI model downloads and managed-cache deletion now share the router lifecycle coordinator so browser and compatibility routes observe the same bounded operations, cancellation boundary, and terminal results. The implementation keeps WebUI Hub access anonymous, resolves downloads to immutable revisions before fd-relative staging, and confines deletion to managed cache snapshots through a private descriptor-anchored quarantine that preserves user model roots. Validation: cargo fmt --check; cargo clippy --lib --tests --features metal,accelerate -- -D warnings; focused cargo test filters for anonymous download transport, fd staging, queue/idempotency/cancel, WebUI routes, cache deletion races and rescan guards; make verify-webui-contract; make verify-llama-compat; make verify-versions; make verify-kernel-dtype-keys. Refs #1834; Closes #1841
Tighten WebUI-managed downloads so anonymous metadata asks HuggingFace for blob metadata, requires LFS SHA-256 for safetensors, preserves resolved-revision aliases, rejects idempotency payload drift before replay, keeps plan totals stable under throttled progress, and verifies same-size checksum/completeness failures before fd-relative publication. Harden managed-cache removal admission by rechecking idle/current state under the operation guard, failing closed on configured physical aliases from models-dir or presets, preserving busy entries during rescan, and keeping compatibility in-flight download cancellation from requiring a published snapshot path. Add whole-producer contract coverage for download operations and route accepted responses, plus hermetic fake HTTP and router tests for anonymous credentials, metadata status errors, offline rejection, disconnect truncation, checksum/completeness failures, duplicate/revision replay, queue saturation, cancellation linearization, and physical alias removal blocks.
Reject cache removals when configured models-dir or preset entries are descendants of the managed snapshot, and add bounded fake coverage for loopback read timeouts, simulated ENOSPC writer failures, and retry-after-failure downloads. Validation: cargo test --lib --profile test-fast --features metal,accelerate downloader::tests:: -- --nocapture; cargo test --lib --profile test-fast --features metal,accelerate server::router_models::router_models_tests:: -- --nocapture; cargo fmt --check; git diff --check; cargo clippy --lib --tests --features metal,accelerate -- -D warnings; make verify-webui-contract. Refs #1841.
Exercise interrupted running and queued downloads across owned CPU-only test processes using the shared router coordinator and descriptor-anchored staging. Verify session-local operation history, authenticated old-operation 404 responses, explicit retry, retained private partials and stable published catalog identity without loading a model. Document the non-destructive restart policy and distinguish this fake-writer regression from pending production CLI and real-checkpoint acceptance. Scoped restart tests, repeated process execution, clippy and 43 contract fixtures pass. Refs #1841; Refs #1834
Integrate the library routes with the merged secured startup path and derive bootstrap actions and feature flags from the same cache, offline and platform policy used by mutation admission. Preserve single-model read-only behavior and avoid filesystem or network probes during capability projection. Retain the upstream startup, Unicode and error fixtures alongside the library producer fixtures, and rebuild the deterministic bundle. Add whole-bootstrap, prefixed browser-security, no-cache admission and no-directory-creation regressions while retaining owned-process restart coverage. Refs #1841; Refs #1834
A revision-checked unload validated its caller token, advanced the revision in its own drain transition, then rejected the old token before worker shutdown. Capture the owned drain revision under the lifecycle mutex and use it for post-wait validation, preserving current-entry and external-change checks. Keep legacy callers without a revision precondition on identity-only cleanup semantics. The real acceptance failure is preserved. A loaded recording-worker regression reproduced expected3/current4 before repair; tests now cover request draining, observed worker exit, external revision and replacement rejection, shared revision allocation, and legacy failed-worker cleanup. The real harness remains unchanged for root acceptance. Refs #1841; Refs #1834
Record the ui-common rebase without changing the reviewed library and unload repair semantics. Preserve the latest Metal firmware-timeout full-gate failure separately from historical passing and CPU-only evidence, and keep actual library acceptance pending an owner-coordinated quiet window. Refs #1841; Refs #1834
Centralize the existing signed-device-to-u64 conversion in one narrowly documented helper, preserving Darwin representation without narrowing Linux metadata identity. Both anchored deletion checks use it; temporary-directory regressions reject changed device/inode and child replacement and cover Darwin signed values. Rebase onto latest main e9ee5f0, retaining upstream feature-disabled helper gates and the unchanged library/security contracts. Record the executed hosted failures separately from the historical runner outage; Linux hosted validation and root-owned full/real acceptance remain required. Refs #1841
inureyes
force-pushed
the
feature/issue-1841-safe-model-library
branch
from
September 14, 2026 12:34
71552f8 to
84f1aeb
Compare
Record root's full workspace, strict fresh-cache model lifecycle and actual hosted CI passes at source84f1aeb2. Preserve the earlier unload and Metal firmware failures without causal or reboot claims, and keep whole-implementation manual accessibility checks deferred. This report-only update changes no source or bundled assets. PR1872 remains in review for central merge. Refs #1841
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds authenticated WebUI downloads and managed-cache removal using the existing pool/coordinator: anonymous immutable-revision downloads, bounded admission/progress/cancellation, descriptor-anchored publication/deletion and shared bootstrap/admission policy. Single-model mode remains read-only; external/user-root/preset aliases and subtree overlaps are rejected. Includes the unload owned-drain revision fix and Linux device-identity portability repair.
Verified acceptance
Runtime source
84f1aeb2b4f5706bb0d63866b20ca48d74bf340ais based on maine9ee5f04; the final report commit changes no source or bundle.Evidence boundaries
The original
3cb4817dunload failure and857937cafirmware timeout remain preserved. Later success after user-confirmed GPU availability establishes neither their external cause nor a reboot. ENOSPC coverage is injected, not physical disk exhaustion. Safari/VoiceOver/native 200% checks remain user-deferred until the whole implementation is ready, not passed.Bilingual technical reports record architecture, reviews, failures and final evidence. PR remains in review pending central merge.
Refs #1834; Closes #1841