nx_swarm_shardserve.nx source
↩ module page · 432 lines · 24875 B
1// nx_swarm_shardserve.nx -- SPLIT-MODEL SERVE PIPELINE (F838 keystone): run a stack of N sovereign no-float
2// transformer blocks SPLIT across a contiguous block-range per node (per the nx_swarm_gpu shard plan), passing
3// the hidden-state ACTIVATION between shards over a byte-exact wire format. THE CORRECTNESS INVARIANT proven
4// here = the sovereign EXCEED that exo/Petals/float-split-serve CANNOT offer: split(h0) == whole(h0) BIT-
5// IDENTICAL, regardless of how the stack is sharded, because every block is deterministic integer Q16.
6//
7// The block math (fxmul/relu/isqrt/sqrt_q16/exp_fx/dotp/layernorm/matvec/block) is COPIED byte-faithful from
8// nx_nofloat_transformer.nx (pre-norm block: h=x+SelfAttn(LN(x)); out=h+FFN(LN(h))) -- ⚠DRY debt: extract to
9// nx_nofloat_transformer_lib on next touch (rule 15; that organ carries a main() so it can't be imported =
10// double-main trap). The pipeline + transport + split-equals-whole gate are the NEW capability.
11//
12// nx_swarm_shardserve [gate] -- self-gate: whole==split(2-way,3-way) bit-identical + activation transport
13// byte-exact + LIAR-KILLERS (dropped-block differs, corrupt-transport differs)
14// + determinism. No args = gate.
15// license_tier: ORIGINAL Sovereign: nx_syscalls. expect_exit:0
16import "nx_syscalls.nx"
17import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc)
18
19const Q: i64 = 16
20const ONE: i64 = 65536
21const D: i64 = 4
22const T: i64 = 2
23const NBLK: i64 = 8 // stack depth (blocks 0..NBLK-1)
24const HID: i64 = 8 // T*D hidden-state size
25const LOG2E: i64 = 94548
26const C1: i64 = 45426
27const C2: i64 = 15743
28const EPS: i64 = 65
29
30func sp_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
31// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
32// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
33// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
34// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
35func sp_pn(v: i64) -> i64 { nxi_out(v); return 0 }
36
37// --- block math, byte-faithful copy of nx_nofloat_transformer.nx (DRY debt noted above) ---
38func fxmul(a: i64, b: i64) -> i64 { return (a*b)>>Q }
39func relu(x: i64) -> i64 { if x>0 { return x } return 0 }
40func iabs(v: i64) -> i64 { if v<0 { return 0-v } return v }
41func isqrt(n: i64) -> i64 { if n<2 { return n } var x: i64=n; var y: i64=(x+1)/2; while y<x { x=y; y=(x + n/x)/2 } return x }
42func sqrt_q16(y: i64) -> i64 { return isqrt(y*ONE) }
43func exp_fx(x: i64) -> i64 {
44 var xx: i64=x; if xx>0 { xx=0 }
45 let yabs: i64=fxmul(0-xx, LOG2E); let nabs: i64=yabs>>Q; let fabs: i64=yabs-(nabs<<Q)
46 let f2: i64=fxmul(fabs,fabs); let p: i64=ONE+fxmul(fabs,C1)+fxmul(f2,C2); let inv: i64=(ONE*ONE)/p
47 if nabs>=31 { return 0 } return inv>>nabs
48}
49func dotp(a: *i64, b: *i64, n: i64) -> i64 { var s: i64=0; var i: i64=0; while i<n { s=s+fxmul(a[i],b[i]); i=i+1 } return s }
50func layernorm(x: *i64, out: *i64) -> i64 {
51 var sum: i64=0; var i: i64=0; while i<D { sum=sum+x[i]; i=i+1 } let mean: i64=sum/D
52 var vs: i64=0; i=0; while i<D { let d: i64=x[i]-mean; vs=vs+fxmul(d,d); i=i+1 } let var_: i64=vs/D
53 let std: i64=sqrt_q16(var_+EPS)
54 i=0; while i<D { out[i]=((x[i]-mean)*ONE)/std; i=i+1 } return mean
55}
56func matvec(W: *i64, v: *i64, out: *i64) -> i64 { var i: i64=0; while i<D { var s: i64=0; var j: i64=0; while j<D { s=s+fxmul(W[i*D+j], v[j]); j=j+1 } out[i]=s; i=i+1 } return 0 }
57func block(x: *i64, out: *i64, W1: *i64, W2: *i64) -> i64 {
58 let ln: *i64 = sys_mmap(T*D*8) as *i64
59 var t: i64=0; while t<T { let xi: *i64 = sys_mmap(D*8) as *i64; let oi: *i64 = sys_mmap(D*8) as *i64; var k: i64=0; while k<D { xi[k]=x[t*D+k]; k=k+1 } layernorm(xi, oi); k=0; while k<D { ln[t*D+k]=oi[k]; k=k+1 } t=t+1 }
60 let h: *i64 = sys_mmap(T*D*8) as *i64
61 var i: i64=0
62 while i<T {
63 let sc: *i64 = sys_mmap(T*8) as *i64; let a: *i64 = sys_mmap(T*8) as *i64; let lni: *i64 = sys_mmap(D*8) as *i64
64 var k: i64=0; while k<D { lni[k]=ln[i*D+k]; k=k+1 }
65 var j: i64=0; while j<T { let lnj: *i64=sys_mmap(D*8) as *i64; var m: i64=0; while m<D { lnj[m]=ln[j*D+m]; m=m+1 } sc[j]=dotp(lni,lnj,D); j=j+1 }
66 var mx: i64=sc[0]; j=1; while j<T { if sc[j]>mx { mx=sc[j] } j=j+1 }
67 var sume: i64=0; j=0; while j<T { a[j]=exp_fx(sc[j]-mx); sume=sume+a[j]; j=j+1 }
68 j=0; while j<T { a[j]=(a[j]*ONE)/sume; j=j+1 }
69 var d: i64=0; while d<D { var acc: i64=0; j=0; while j<T { acc=acc+fxmul(a[j], ln[j*D+d]); j=j+1 } h[i*D+d]=x[i*D+d]+acc; d=d+1 }
70 i=i+1
71 }
72 i=0
73 while i<T {
74 let hi: *i64=sys_mmap(D*8) as *i64; let lnh: *i64=sys_mmap(D*8) as *i64; var k: i64=0; while k<D { hi[k]=h[i*D+k]; k=k+1 }
75 layernorm(hi, lnh)
76 let m1: *i64=sys_mmap(D*8) as *i64; matvec(W1, lnh, m1); k=0; while k<D { m1[k]=relu(m1[k]); k=k+1 }
77 let m2: *i64=sys_mmap(D*8) as *i64; matvec(W2, m1, m2)
78 k=0; while k<D { out[i*D+k]=h[i*D+k]+m2[k]; k=k+1 }
79 i=i+1
80 }
81 return 0
82}
83
84// --- the NEW split-serve pipeline ---
85// per-block weight matrices, deterministic from block index (distinct per block so a wrong split is detectable,
86// small+bounded so the stack stays numerically sane). W1s[b], W2s[b] each D*D.
87func ss_weights(W1s: *i64, W2s: *i64) -> i64 {
88 var b: i64=0
89 while b < NBLK {
90 var j: i64=0
91 while j < D*D {
92 W1s[b*D*D + j] = ONE / (2 + ((b + j) % 3))
93 W2s[b*D*D + j] = ONE / (3 + ((b*2 + j) % 3))
94 j = j + 1
95 }
96 b = b + 1
97 }
98 return 0
99}
100// --- REAL WEIGHT LOADING (the VRAM saving that makes split-serve worthwhile): weights live in a FILE laid out
101// block-contiguous (block i at offset i*BLKBYTES = W1[D*D] then W2[D*D] i64). A shard node loads ONLY its block
102// range [a,b) via lseek+bounded-read -- it NEVER touches the other nodes' weights, so a model too big for one
103// node's VRAM fits when split (node A holds k blocks' weights, node B holds N-k). BLKBYTES = 2*D*D*8. ---
104func ss_write_all(fd: i64, buf: *u8, n: i64) -> i64 { var w: i64=0; while w<n { let r: i64=sys_write(fd, ((buf as i64)+w) as *u8, n-w); if r<=0 { return w } w=w+r } return w }
105func ss_read_all(fd: i64, buf: *u8, n: i64) -> i64 { var rd: i64=0; while rd<n { let r: i64=sys_read(fd, ((buf as i64)+rd) as *u8, n-rd); if r<=0 { return rd } rd=rd+r } return rd }
106// write the canonical NBLK-block weight file to <path>. Returns bytes written.
107func ss_write_weights(path: *u8) -> i64 {
108 let bb: i64 = 2*D*D*8
109 let W1s: *i64 = sys_mmap(NBLK*D*D*8) as *i64; let W2s: *i64 = sys_mmap(NBLK*D*D*8) as *i64; ss_weights(W1s, W2s)
110 let fd: i64 = sys_openat_wr(path, 0x1a4); if fd<0 { return 0-1 }
111 var b: i64=0
112 while b<NBLK {
113 ss_write_all(fd, ((W1s as i64)+b*D*D*8) as *u8, D*D*8)
114 ss_write_all(fd, ((W2s as i64)+b*D*D*8) as *u8, D*D*8)
115 b=b+1
116 }
117 sys_close(fd)
118 return NBLK*bb
119}
120// load ONLY blocks [a,b) from the weight file into W1s/W2s (indexed by absolute block). lseek past blocks < a =
121// the node never reads the other shards' weights. Returns BYTES READ (= (b-a)*BLKBYTES on success) = the proof
122// that this node loaded only its slice, not the whole model.
123func ss_load_range(path: *u8, a: i64, b: i64, W1s: *i64, W2s: *i64) -> i64 {
124 let bb: i64 = 2*D*D*8
125 let fd: i64 = sys_openat_rd(path); if fd<0 { return 0-1 }
126 sys_lseek(fd, a*bb, 0)
127 var got: i64=0
128 var blk: i64=a
129 while blk<b {
130 got = got + ss_read_all(fd, ((W1s as i64)+blk*D*D*8) as *u8, D*D*8)
131 got = got + ss_read_all(fd, ((W2s as i64)+blk*D*D*8) as *u8, D*D*8)
132 blk=blk+1
133 }
134 sys_close(fd)
135 return got
136}
137// run blocks [a,b) of the stack over hidden state h[HID] in place. This is what ONE shard node executes for its
138// assigned contiguous block range (per the nx_swarm_gpu shard plan). h is mutated to the post-range activation.
139func ss_range(h: *i64, W1s: *i64, W2s: *i64, a: i64, b: i64) -> i64 {
140 let tmp: *i64 = sys_mmap(HID*8) as *i64
141 var i: i64 = a
142 while i < b {
143 block(h, tmp, ((W1s as i64) + i*D*D*8) as *i64, ((W2s as i64) + i*D*D*8) as *i64)
144 var k: i64=0; while k<HID { h[k]=tmp[k]; k=k+1 }
145 i = i + 1
146 }
147 return 0
148}
149// ACTIVATION WIRE FORMAT: serialize the hidden state h[HID] (i64 each) to <buf> as HID*8 little-endian bytes =
150// exactly what moves between shard nodes over the fabric (binary-framed /api/rpc). Byte-exact both ways = the
151// transport-correctness half of split-transparency. Returns byte count.
152func ss_serialize(h: *i64, buf: *u8) -> i64 {
153 var i: i64=0
154 while i < HID {
155 var v: i64 = h[i]
156 var k: i64=0
157 while k < 8 { buf[i*8 + k] = (v & 255) as u8; v = v >> 8; k = k + 1 }
158 i = i + 1
159 }
160 return HID*8
161}
162func ss_deserialize(buf: *u8, h: *i64) -> i64 {
163 var i: i64=0
164 while i < HID {
165 var v: i64 = 0
166 var k: i64=7
167 while k >= 0 { v = (v << 8) | (buf[i*8 + k] as i64); k = k - 1 }
168 h[i] = v
169 i = i + 1
170 }
171 return 0
172}
173func ss_copy(src: *i64, dst: *i64) -> i64 { var i: i64=0; while i<HID { dst[i]=src[i]; i=i+1 } return 0 }
174func ss_eq(a: *i64, b: *i64) -> i64 { var i: i64=0; while i<HID { if a[i]!=b[i] { return 0 } i=i+1 } return 1 }
175// run the WHOLE stack [0,NBLK) on a copy of h0.
176func ss_whole(h0: *i64, out: *i64, W1s: *i64, W2s: *i64) -> i64 { ss_copy(h0, out); ss_range(out, W1s, W2s, 0, NBLK); return 0 }
177// run the stack SPLIT at boundaries, transporting the activation (serialize->deserialize) at each shard hop.
178// bnds[0..nb) are the split points (e.g. [3,6] -> shards [0,3)[3,6)[6,NBLK)). Returns via out.
179func ss_split(h0: *i64, out: *i64, W1s: *i64, W2s: *i64, bnds: *i64, nb: i64) -> i64 {
180 let h: *i64 = sys_mmap(HID*8) as *i64
181 ss_copy(h0, h)
182 let wire: *u8 = sys_mmap(HID*8)
183 var prev: i64 = 0
184 var s: i64 = 0
185 while s <= nb {
186 var hi: i64 = NBLK
187 if s < nb { hi = bnds[s] }
188 ss_range(h, W1s, W2s, prev, hi)
189 // TRANSPORT the activation across the shard boundary (byte-exact wire) unless this was the last shard
190 if s < nb {
191 ss_serialize(h, wire)
192 ss_deserialize(wire, h)
193 }
194 prev = hi
195 s = s + 1
196 }
197 ss_copy(h, out)
198 return 0
199}
200
201func ck(name: *u8, c: i64) -> i64 { if c==1 { sp_puts(" PASS " as *u8) } else { sp_puts(" FAIL " as *u8) } sp_puts(name); sp_puts("\n" as *u8); return c }
202
203// --- distributed shard-executor: the `run` verb makes THIS node a real shard worker (a contiguous block-range
204// executor over a received activation), so split-serve runs across REAL machines: node A runs [0,k) -> hex
205// activation -> transported over the fabric (MCP tools/call) -> node B `run k N <hex>` -> whole. Bit-identical
206// to a single-node whole run = real cross-machine split-serve (CPU integer, no GPU needed for compute). ---
207func ss_atoi(s: *u8) -> i64 { var v: i64=0; var i: i64=0; if s[0]==(45 as u8) { i=1 } while s[i]!=(0 as u8) { let c: i64=s[i] as i64; if c<48 { return v } if c>57 { return v } v=v*10+(c-48); i=i+1 } if s[0]==(45 as u8) { return 0-v } return v }
208// encode HID i64 as HID*16 big-endian hex chars (unsigned 64-bit view), NUL-terminated. Returns char count.
209func ss_hex_encode(h: *i64, buf: *u8) -> i64 {
210 let dig: *u8 = "0123456789abcdef" as *u8
211 var i: i64=0; var o: i64=0
212 while i < HID {
213 var v: i64 = h[i]
214 var k: i64=60
215 while k >= 0 { buf[o] = dig[(v >> k) & 15]; o=o+1; k=k-4 }
216 i=i+1
217 }
218 buf[o]=0 as u8
219 return o
220}
221func ss_hexval(c: i64) -> i64 { if c>=48 { if c<=57 { return c-48 } } if c>=97 { if c<=102 { return c-87 } } if c>=65 { if c<=70 { return c-55 } } return 0 }
222func ss_hex_decode(s: *u8, h: *i64) -> i64 {
223 var i: i64=0
224 while i < HID {
225 var v: i64=0
226 var k: i64=0
227 while k < 16 { v = (v << 4) | ss_hexval(s[i*16 + k] as i64); k=k+1 }
228 h[i]=v
229 i=i+1
230 }
231 return 0
232}
233func ss_seth0(h0: *i64) -> i64 { h0[0]=ONE; h0[1]=2*ONE; h0[2]=0; h0[3]=ONE; h0[4]=3*ONE; h0[5]=0; h0[6]=ONE; h0[7]=2*ONE; return 0 }
234func sp_eqs(a: *u8, b: *u8) -> i64 { var i: i64=0; while a[i]!=(0 as u8) { if a[i]!=b[i] { return 0 } i=i+1 } if b[i]!=(0 as u8) { return 0 } return 1 }
235func ss_slen(p: *u8) -> i64 { var n: i64=0; while p[n]!=(0 as u8) { n=n+1 } return n }
236// PATH LAW for the weight-file arg (eats seq298): must end ".bin", contain no "..", and be a bare basename (in
237// CWD) OR live under /tmp/ -- a leaked cap cannot read/write arbitrary host paths via weights/runf BY CONSTRUCTION.
238func ss_path_ok(p: *u8) -> i64 {
239 let n: i64 = ss_slen(p)
240 if n < 5 { return 0 }
241 var i: i64 = 0
242 while i+1 < n { if (p[i] as i64)==46 { if (p[i+1] as i64)==46 { return 0 } } i=i+1 }
243 if (p[n-4] as i64)!=46 { return 0 }
244 if (p[n-3] as i64)!=98 { return 0 }
245 if (p[n-2] as i64)!=105 { return 0 }
246 if (p[n-1] as i64)!=110 { return 0 }
247 var slash: i64=0; i=0; while i<n { if (p[i] as i64)==47 { slash=1 } i=i+1 }
248 if slash==0 { return 1 }
249 if n<6 { return 0 }
250 if (p[0] as i64)!=47 { return 0 }
251 if (p[1] as i64)!=116 { return 0 }
252 if (p[2] as i64)!=109 { return 0 }
253 if (p[3] as i64)!=112 { return 0 }
254 if (p[4] as i64)!=47 { return 0 }
255 return 1
256}
257func ss_mkmsg(buf: *u8, pfx: *u8, v: i64) -> i64 {
258 var o: i64=0; var i: i64=0; while pfx[i]!=(0 as u8) { buf[o]=pfx[i]; o=o+1; i=i+1 }
259 if v==0 { buf[o]=48 as u8; o=o+1 } else { var d: i64=0; var y: i64=v; while y>0 { d=d+1; y=y/10 } var p: i64=o+d-1; y=v; while y>0 { buf[p]=(48+(y%10)) as u8; y=y/10; p=p-1 } o=o+d }
260 buf[o]=10 as u8; o=o+1
261 return o
262}
263
264func main(argc: i64, argv: *i64) -> i64 {
265 if argc >= 2 {
266 let verb: *u8 = argv[1] as *u8
267 // h0: print the canonical demo input activation as hex (the driver's starting point)
268 if sp_eqs(verb, "h0" as *u8) == 1 {
269 let h0: *i64 = sys_mmap(HID*8) as *i64; ss_seth0(h0)
270 let buf: *u8 = sys_mmap(HID*16 + 8); ss_hex_encode(h0, buf)
271 sys_write(1, buf, HID*16); sp_puts("\n" as *u8); return 0
272 }
273 // run <a> <b> <hex-activation>: run blocks [a,b) of the stack on the input activation, print output hex.
274 // THIS is the shard-worker primitive -- one node's contribution to a distributed split-serve pipeline.
275 if sp_eqs(verb, "run" as *u8) == 1 {
276 if argc < 5 { sp_puts("usage: nx_swarm_shardserve run <a> <b> <hex-activation>\n" as *u8); return 2 }
277 let a: i64 = ss_atoi(argv[2] as *u8)
278 let b: i64 = ss_atoi(argv[3] as *u8)
279 if a < 0 { return 2 }
280 if b > NBLK { return 2 }
281 if a > b { return 2 }
282 let W1s: *i64 = sys_mmap(NBLK*D*D*8) as *i64; let W2s: *i64 = sys_mmap(NBLK*D*D*8) as *i64; ss_weights(W1s, W2s)
283 let h: *i64 = sys_mmap(HID*8) as *i64; ss_hex_decode(argv[4] as *u8, h)
284 ss_range(h, W1s, W2s, a, b)
285 let buf: *u8 = sys_mmap(HID*16 + 8); ss_hex_encode(h, buf)
286 sys_write(1, buf, HID*16); sp_puts("\n" as *u8); return 0
287 }
288 // weights <file>: write the canonical NBLK-block weight file (a shared model on-disk).
289 if sp_eqs(verb, "weights" as *u8) == 1 {
290 if argc < 3 { sp_puts("usage: nx_swarm_shardserve weights <file>\n" as *u8); return 2 }
291 if ss_path_ok(argv[2] as *u8) == 0 { sp_puts("WEIGHTS REFUSED (path law: end .bin, bare basename or /tmp/)\n" as *u8); return 3 }
292 let n: i64 = ss_write_weights(argv[2] as *u8)
293 if n < 0 { sp_puts("WEIGHTS write-fail\n" as *u8); return 4 }
294 sp_puts("WEIGHTS-WRITTEN bytes="); sp_pn(n); sp_puts(" blocks="); sp_pn(NBLK); sp_puts("\n" as *u8); return 0
295 }
296 // runf <a> <b> <hex> <weightfile>: shard executor loading ONLY blocks [a,b)'s weights from <weightfile>
297 // (the VRAM saving). Emits the output activation hex; a LOADED= marker on stderr proves the partial read.
298 if sp_eqs(verb, "runf" as *u8) == 1 {
299 if argc < 6 { sp_puts("usage: nx_swarm_shardserve runf <a> <b> <hex> <weightfile>\n" as *u8); return 2 }
300 let a: i64 = ss_atoi(argv[2] as *u8); let b: i64 = ss_atoi(argv[3] as *u8)
301 if a < 0 { return 2 }
302 if b > NBLK { return 2 }
303 if a > b { return 2 }
304 if ss_path_ok(argv[5] as *u8) == 0 { sp_puts("runf REFUSED (path law: end .bin, bare basename or /tmp/)\n" as *u8); return 3 }
305 let W1s: *i64 = sys_mmap(NBLK*D*D*8) as *i64; let W2s: *i64 = sys_mmap(NBLK*D*D*8) as *i64
306 let got: i64 = ss_load_range(argv[5] as *u8, a, b, W1s, W2s)
307 if got < 0 { sp_puts("runf weight-load-fail\n" as *u8); return 4 }
308 let em: *u8 = sys_mmap(64); let eo: i64 = ss_mkmsg(em, "LOADED=" as *u8, got); sys_write(2, em, eo)
309 let h: *i64 = sys_mmap(HID*8) as *i64; ss_hex_decode(argv[4] as *u8, h)
310 ss_range(h, W1s, W2s, a, b)
311 let buf: *u8 = sys_mmap(HID*16 + 8); ss_hex_encode(h, buf)
312 sys_write(1, buf, HID*16); sp_puts("\n" as *u8); return 0
313 }
314 }
315 return ss_gate()
316}
317
318func ss_gate() -> i64 {
319 sp_puts("nx_swarm_shardserve (SPLIT-MODEL SERVE PIPELINE -- N no-float transformer blocks sharded across nodes, activation transported byte-exact, split==whole bit-identical)\n" as *u8)
320 var pass: i64=0; var total: i64=0
321
322 let W1s: *i64 = sys_mmap(NBLK*D*D*8) as *i64
323 let W2s: *i64 = sys_mmap(NBLK*D*D*8) as *i64
324 ss_weights(W1s, W2s)
325 let h0: *i64 = sys_mmap(HID*8) as *i64
326 h0[0]=ONE; h0[1]=2*ONE; h0[2]=0; h0[3]=ONE; h0[4]=3*ONE; h0[5]=0; h0[6]=ONE; h0[7]=2*ONE
327
328 let whole: *i64 = sys_mmap(HID*8) as *i64
329 ss_whole(h0, whole, W1s, W2s)
330 sp_puts(" whole stack ["); sp_pn(NBLK); sp_puts(" blocks] out[0..2]=["); sp_pn(whole[0]); sp_puts(","); sp_pn(whole[1]); sp_puts(","); sp_pn(whole[2]); sp_puts("]\n" as *u8)
331
332 // T1 2-way split [0,4)[4,8) transported == whole, BIT-IDENTICAL
333 total=total+1
334 let b1: *i64=sys_mmap(8) as *i64; b1[0]=4
335 let sp1: *i64=sys_mmap(HID*8) as *i64; ss_split(h0, sp1, W1s, W2s, b1, 1)
336 pass=pass+ck("T1 2-way split [0,4)[4,8) w/ activation transport == whole, BIT-IDENTICAL" as *u8, ss_eq(whole, sp1))
337
338 // T2 3-way split [0,3)[3,6)[6,8) == whole
339 total=total+1
340 let b2: *i64=sys_mmap(16) as *i64; b2[0]=3; b2[1]=6
341 let sp2: *i64=sys_mmap(HID*8) as *i64; ss_split(h0, sp2, W1s, W2s, b2, 2)
342 pass=pass+ck("T2 3-way split [0,3)[3,6)[6,8) == whole, BIT-IDENTICAL (shard boundaries are transparent)" as *u8, ss_eq(whole, sp2))
343
344 // T3 uneven split [0,1)[1,7)[7,8) == whole (any contiguous partition is transparent)
345 total=total+1
346 let b3: *i64=sys_mmap(16) as *i64; b3[0]=1; b3[1]=7
347 let sp3: *i64=sys_mmap(HID*8) as *i64; ss_split(h0, sp3, W1s, W2s, b3, 2)
348 pass=pass+ck("T3 uneven split [0,1)[1,7)[7,8) == whole (VRAM-proportional shards are transparent)" as *u8, ss_eq(whole, sp3))
349
350 // T4 EXCEED determinism: re-run the 3-way split == itself bit-identical
351 total=total+1
352 let sp2b: *i64=sys_mmap(HID*8) as *i64; ss_split(h0, sp2b, W1s, W2s, b2, 2)
353 pass=pass+ck("T4 (EXCEED) DETERMINISTIC: re-run split is BIT-IDENTICAL (float split-serve cannot guarantee across heterogeneous GPUs)" as *u8, ss_eq(sp2, sp2b))
354
355 // T5 activation transport byte-exact: serialize->deserialize->re-serialize == original bytes
356 total=total+1
357 let wa: *u8=sys_mmap(HID*8); ss_serialize(whole, wa)
358 let hb: *i64=sys_mmap(HID*8) as *i64; ss_deserialize(wa, hb)
359 let wb: *u8=sys_mmap(HID*8); ss_serialize(hb, wb)
360 var tbytes: i64=1; var bi: i64=0; while bi<HID*8 { if wa[bi]!=wb[bi] { tbytes=0 } bi=bi+1 }
361 if ss_eq(whole, hb)==0 { tbytes=0 }
362 pass=pass+ck("T5 activation wire byte-exact (serialize->deserialize->reserialize identical + value round-trips)" as *u8, tbytes)
363
364 // T6 LIAR-KILLER dropped-block: a split that SKIPS block 4 ([0,4)[5,8)) MUST differ from whole (the split is
365 // FAITHFUL, not trivially equal -- a mis-assigned block range is DETECTED).
366 total=total+1
367 let hbad: *i64=sys_mmap(HID*8) as *i64; ss_copy(h0, hbad)
368 ss_range(hbad, W1s, W2s, 0, 4)
369 let wbad: *u8=sys_mmap(HID*8); ss_serialize(hbad, wbad); ss_deserialize(wbad, hbad)
370 ss_range(hbad, W1s, W2s, 5, 8) // SKIPS block 4
371 pass=pass+ck("T6 LIAR-KILLER dropped-block split ([0,4)+[5,8)) DIFFERS from whole (faithful, not trivially equal)" as *u8, 1 - ss_eq(whole, hbad))
372
373 // T7 LIAR-KILLER corrupt-transport: flip one byte of the transported activation -> output MUST differ
374 // (proves the transport is load-bearing; a wire corruption is not silently absorbed).
375 total=total+1
376 let hc: *i64=sys_mmap(HID*8) as *i64; ss_copy(h0, hc)
377 ss_range(hc, W1s, W2s, 0, 4)
378 let wc: *u8=sys_mmap(HID*8); ss_serialize(hc, wc)
379 wc[0] = (wc[0] + 1) as u8 // corrupt 1 byte on the wire
380 ss_deserialize(wc, hc)
381 ss_range(hc, W1s, W2s, 4, 8)
382 pass=pass+ck("T7 LIAR-KILLER corrupt-transport (1 byte flipped on the wire) DIFFERS from whole (transport is load-bearing)" as *u8, 1 - ss_eq(whole, hc))
383
384 // --- REAL WEIGHT LOADING: prove the VRAM saving (each shard loads ONLY its block range's weights from a file) ---
385 let bb: i64 = 2*D*D*8
386 let wpath: *u8 = "/tmp/sgp_wt.bin" as *u8
387 ss_write_weights(wpath)
388 // T8 file-loaded weights reproduce the generated stack (whole-from-file == whole)
389 total=total+1
390 let fW1: *i64=sys_mmap(NBLK*D*D*8) as *i64; let fW2: *i64=sys_mmap(NBLK*D*D*8) as *i64
391 ss_load_range(wpath, 0, NBLK, fW1, fW2)
392 let wf: *i64=sys_mmap(HID*8) as *i64; ss_copy(h0, wf); ss_range(wf, fW1, fW2, 0, NBLK)
393 pass=pass+ck("T8 file-loaded weights == generated (whole-from-file == whole)" as *u8, ss_eq(whole, wf))
394 // T9 split loading ONLY each shard's weight slice == whole (the real distributed VRAM-split serve)
395 total=total+1
396 let aW1: *i64=sys_mmap(NBLK*D*D*8) as *i64; let aW2: *i64=sys_mmap(NBLK*D*D*8) as *i64
397 ss_load_range(wpath, 0, 4, aW1, aW2) // shard A loads ONLY blocks 0-3
398 let hf: *i64=sys_mmap(HID*8) as *i64; ss_copy(h0, hf); ss_range(hf, aW1, aW2, 0, 4)
399 let w2b: *u8=sys_mmap(HID*8); ss_serialize(hf, w2b); ss_deserialize(w2b, hf)
400 let bW1: *i64=sys_mmap(NBLK*D*D*8) as *i64; let bW2: *i64=sys_mmap(NBLK*D*D*8) as *i64
401 ss_load_range(wpath, 4, 8, bW1, bW2) // shard B loads ONLY blocks 4-7
402 ss_range(hf, bW1, bW2, 4, 8)
403 pass=pass+ck("T9 split-from-file (each shard loads ONLY its weight slice) == whole (distributed VRAM-split serve)" as *u8, ss_eq(whole, hf))
404 // T10 THE VRAM SAVING quantified: shard [4,8) loaded exactly its 4 blocks' bytes, NOT the whole model
405 total=total+1
406 let cW1: *i64=sys_mmap(NBLK*D*D*8) as *i64; let cW2: *i64=sys_mmap(NBLK*D*D*8) as *i64
407 let loaded48: i64 = ss_load_range(wpath, 4, 8, cW1, cW2)
408 var t10: i64=0; if loaded48 == 4*bb { if loaded48 < NBLK*bb { t10=1 } }
409 sp_puts(" shard [4,8) loaded "); sp_pn(loaded48); sp_puts(" bytes of the "); sp_pn(NBLK*bb); sp_puts("-byte model (half) = the VRAM saving\n" as *u8)
410 pass=pass+ck("T10 VRAM-SAVING: a shard loads ONLY its range's weights (4/8 blocks), never the whole model" as *u8, t10)
411
412 // T11 PATH LAW on the weight-file arg (seq298): traversal/non-tmp-absolute/wrong-ext refused; legit accepted
413 total=total+1
414 var p11: i64=1
415 if ss_path_ok("../x.bin" as *u8) != 0 { p11=0 }
416 if ss_path_ok("/etc/x.bin" as *u8) != 0 { p11=0 }
417 if ss_path_ok("/tmp/evil.elf" as *u8) != 0 { p11=0 }
418 if ss_path_ok("model.bin" as *u8) != 1 { p11=0 }
419 if ss_path_ok("/tmp/m.bin" as *u8) != 1 { p11=0 }
420 pass=pass+ck("T11 weight-file path law (traversal/non-tmp/wrong-ext refused, bare+/tmp accepted) -- eats seq298" as *u8, p11)
421
422 var okall: i64=0; if pass==total { okall=1 }
423 sp_puts("---- nx_swarm_shardserve: passed "); sp_pn(pass); sp_puts(" / "); sp_pn(total); sp_puts(" ----\n" as *u8)
424 if okall==1 {
425 let logf: i64=sys_openat_append("knowledge/status/shardserve_gate.log" as *u8, 420)
426 if logf>=0 { sys_write(logf,"SWARMSHARDSERVE GREEN: N no-float transformer blocks split across shards + activation transported byte-exact == whole BIT-IDENTICAL; split-model serve is transparent by construction (the sovereign determinism exceed)\n" as *u8, 202); sys_close(logf) }
427 sp_puts("SWARMSHARDSERVEGATE "); sp_pn(pass); sp_puts("/"); sp_pn(total); sp_puts(" verdict=GREEN -- split-model serve is BIT-TRANSPARENT on the real no-float transformer (F838 keystone)\n" as *u8)
428 sys_exit(0); return 0
429 }
430 sp_puts("SWARMSHARDSERVEGATE "); sp_pn(pass); sp_puts("/"); sp_pn(total); sp_puts(" verdict=RED\n" as *u8)
431 sys_exit(1); return 1
432}