64 lines
3.0 KiB
Markdown
64 lines
3.0 KiB
Markdown
# DGR-005 decomposition — 2026-07-14
|
|
|
|
## Verified starting point
|
|
|
|
- The mandated environment is present: project Python 3.14.6, CMake 4.4.0,
|
|
and protobuf 7.35.1.
|
|
- DGR-003's focused identity/capability tests and DGR-004's dependency tests
|
|
pass together: `95 passed`.
|
|
- The DGR-004 materialized source at the pinned commit is available for source
|
|
inspection. It contains only the DGR-004 CMake-marker patch.
|
|
|
|
## Why this chain cannot safely claim DGR-005 yet
|
|
|
|
At the locked llama.cpp revision, `llama_model_base::load_tensors()`:
|
|
|
|
1. sizes `layers` to `hparams.n_layer_all`;
|
|
2. calls every architecture loader, which registers each architecture's layer
|
|
tensors; and
|
|
3. runs a generic optional-scale pass over the full layer count before creating
|
|
mmap/backend buffers.
|
|
|
|
Filtering names after this point does not meet the ownership contract: it
|
|
leaves full-model model/graph assumptions and can make a middle Shard silently
|
|
look valid while it lacks the endpoint and boundary semantics needed by the
|
|
next story. A generic `blk.N.*` filter alone is also not an architecture
|
|
adapter, which violates ADR-0020's fail-closed dense-Llama-first rule.
|
|
|
|
## Required child slices
|
|
|
|
1. **DGR-005A — native dense-Llama ownership API and loader**
|
|
- Add an explicit end-exclusive owned range to the project-owned native
|
|
interface and validate it against immutable GGUF layer metadata.
|
|
- Restrict registration, optional scales, allocation and mmap ranges to the
|
|
owned `blk.N.*` tensors.
|
|
- Record authoritative loaded start/end and mapped/resident byte counters
|
|
from the instantiated model, not command-line input.
|
|
- Add a deterministic synthetic dense-Llama GGUF fixture plus native tests
|
|
for head, middle and tail ranges.
|
|
|
|
2. **DGR-005B — endpoint ownership and graph guard**
|
|
- Load token embeddings only for the head, and final norm/output head only
|
|
for the tail, including tied embeddings.
|
|
- Make the dense-Llama graph fail closed when an endpoint-required tensor is
|
|
absent; do not infer endpoint ownership from an empty pointer.
|
|
- Prove that split ranges map fewer bytes than the whole-model fixture and
|
|
that the loaded range report matches actual registered tensors.
|
|
|
|
3. **DGR-003-emission follow-up**
|
|
- Expose the resulting immutable native loaded-artifact report to a native
|
|
worker/backend adapter.
|
|
- Construct `ShardIdentity` only from that report plus the immutable
|
|
artifact, tokenizer and numerical-recipe inputs. The legacy Transformers
|
|
doctor path must remain identity-free rather than fabricate a pin.
|
|
- Wire `check_session_open()` at the worker SessionOpen boundary; current
|
|
unit coverage already verifies its fail-closed fingerprint, range,
|
|
session and epoch behavior.
|
|
|
|
## Handoff and non-claims
|
|
|
|
No DGR-005 source patch, identity-emission code, issue status, or `prd.json`
|
|
pass state was changed. No model was loaded, downloaded, benchmarked, or
|
|
certified. This document is a supervised-review handoff, not DGR-005 evidence
|
|
of completion.
|