From 7de372c25a1c9c3bfc6ece03bde9816b0aa18a4e Mon Sep 17 00:00:00 2001
From: echobt <154886644+echobt@users.noreply.github.com>
Date: Sun, 25 Oct 2026 11:24:49 +0000
Subject: [PATCH] ci(check-proof): run the bitwise proof gate as an
 informational job

The test shards already run the golden replay suites, but a leaf root
outside GOLDEN is only an xfail there, so a CPU-class mismatch never
turns PR CI red. scripts/check-proof.sh fails on that xfail and on any
unexpected skip; nothing ran it in CI.

The job is continue-on-error: GOLDEN holds roots from the AMD dev host
and the GitHub ubuntu-24.04 runner only, none from Blacksmith, and a
GitHub-hosted run of one commit has already given two outcomes (see
730d248). Until the roots are shown to reproduce on this runner pool, a
red gate must not fail ci or the images publish that calls it.

It runs on blacksmith-8vcpu-ubuntu-2404 like the test job (founder
choice over ubuntu-24.04), with the same setup steps and Runner CPU
summary line, and uploads the tee'd output with the upload-artifact SHA
already pinned in gpu-vast.yml and miner-flow.yml. Upload stays on
failure() only: an upload on cancel would also fire on every superseded
PR run, and the script bounds itself at its 600 s budget.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 44 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b77c5b..18f30e3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -128,3 +128,47 @@ jobs:
           cache-dependency-glob: "uv.lock"
       - run: uv sync --locked --all-extras --group dev
       - run: uv run --frozen pytest -q --durations=25 -m "not od" tests/${{ matrix.suite }}
+
+  # Bitwise proof gate (scripts/check-proof.sh). The shards report a golden leaf root
+  # outside GOLDEN as an xfail; this gate fails it. Informational: GOLDEN holds no root
+  # from a Blacksmith runner yet, so a red gate fails neither ci nor the images publish
+  # that calls it.
+  check-proof:
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 15
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: "0.12.17"
+          python-version: "3.12"
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+      - run: uv sync --locked --all-extras --group dev
+      # Golden leaf roots are per CPU class; record which CPU ran the gate.
+      - name: Runner CPU
+        shell: bash
+        run: |
+          set -euo pipefail
+          MODEL=$(lscpu | sed -n 's/^Model name: *//p' | head -n1)
+          VENDOR=$(lscpu | sed -n 's/^Vendor ID: *//p' | head -n1)
+          if lscpu | grep -E '^Flags:' | grep -qw avx512f; then AVX512F=yes; else AVX512F=no; fi
+          TORCH=$(uv run --frozen python -c "import torch;print(torch.__version__, torch.get_num_threads())")
+          LINE="cpu: ${MODEL} | vendor: ${VENDOR} | avx512f: ${AVX512F} | torch, threads: ${TORCH}"
+          echo "$LINE"
+          echo "check-proof $LINE" >> "$GITHUB_STEP_SUMMARY"
+      - name: Bitwise proof gate
+        shell: bash
+        run: |
+          set -euo pipefail
+          bash scripts/check-proof.sh 2>&1 | tee "$RUNNER_TEMP/check-proof.log"
+      - name: Upload check-proof output
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: check-proof-output
+          path: ${{ runner.temp }}/check-proof.log
+          if-no-files-found: warn