From 4b0ffa11f248a74120e50c3c597f2d7ed6f4f4ab Mon Sep 17 00:00:00 2001 From: Jason McCartney Date: Tue, 13 Oct 2026 03:28:44 -0700 Subject: [PATCH 1/2] Pin the SparkGLM fabric and refusal-content maintenance image --- backends/atlas-sparkglm/README.md | 14 ++++++++------ backends/atlas-sparkglm/pins.json | 8 ++++---- docs/recipes.md | 8 ++++---- recipes/linux-nvidia-dgx-spark-2x-glm53-atlas.json | 8 ++++---- test/atlas-sparkglm-recipe.test.mjs | 12 ++++++------ 5 files changed, 26 insertions(+), 24 deletions(-) diff --git a/backends/atlas-sparkglm/README.md b/backends/atlas-sparkglm/README.md index 70c2697..c24d11f 100644 --- a/backends/atlas-sparkglm/README.md +++ b/backends/atlas-sparkglm/README.md @@ -3,10 +3,12 @@ LLooM-managed two-node Atlas SparkGLM candidate for a directly connected pair of NVIDIA DGX Spark systems. This directory is **MIT orchestration only**: no Atlas engine source is committed here. The engine image is built from immutable -revision `7a67d9bce4b5f408ad67f2a958ef1a8787136fdd` of `Enntity/sparkglm` by +revision `5063c13ea6f196046b76ce6e5c8b4d4200cccc9a` of `Enntity/sparkglm` by that repository's `install/build.sh`. The engine inside the image is AGPL-3.0-only; see [Credits and licenses](#credits-and-licenses). Live hardware -and full serving qualification remain pending. +and full serving qualification remain pending. This revision includes the +issue 172 fix that restores full blocking-refusal content and the existing +per-node fabric support. ## Layout @@ -26,7 +28,7 @@ and full serving qualification remain pending. install-tree label is a contents check, not an artifact identity. - `install.sh` — prepares the image. The normal path reuses an already verified local image, otherwise pulls the immutable manifest digest - `ghcr.io/enntity/atlas-sparkglm@sha256:78420594991e6e7e3914f84a6300ac1cf2f4e18b68e331f8ddc74fd7db905d3c` + `ghcr.io/enntity/atlas-sparkglm@sha256:5ec57d5522a95463b600a17471ce60712b315566e04c0a3bb6af1d84a1de0a4a` from GHCR. It never pulls the mutable tag, and a failed pinned digest pull is a hard failure with no silent source build. The explicit `--source-build` option instead clones `Enntity/sparkglm` at the pinned revision, checks that @@ -122,7 +124,7 @@ Inside the image: share one physical FP8-latent KV pool, split between the nodes by `SPARKGLM_KV_SHARD=1` (about 2.38M tokens at the recipe's 0.91 GPU memory utilization with the display carveout and the disk prefix cache, up to 1,048,576 per request with `SPARKGLM_PROFILE=4x1m`; it also holds the prefix cache, with 16 recurrent-state snapshot slots); it does not reserve four full windows. `disable-tool-grammar` is deliberately **not** set, so structured output and tool grammar stay functional. The engine is built from - Enntity/atlas `sparkglm/atlas-20261012-rc4.2-layered` @ `dfb9c26a` (recorded in the + Enntity/atlas `fix/sparkglm-rc4.2-refusal-content` @ `6f27e8fa` (recorded in the image's `/opt/atlas/source-manifest.json`); measured results are in Enntity/sparkglm `results/2026-09-30-decode-step/` (this engine) and `results/2026-09-30-nvme-tier/` (this image). @@ -235,9 +237,9 @@ is not part of LLooM: `ghcr.io/enntity/atlas-sparkglm`, alongside LLooM (an aggregate); no engine source or binary is included in LLooM. - **Corresponding source.** [Enntity/sparkglm](https://github.com/Enntity/sparkglm) - at the pinned revision (`7a67d9bc`) plus the Enntity/atlas commit recorded + at the pinned revision (`5063c13e`) plus the Enntity/atlas commit recorded in the image's `/opt/atlas/source-manifest.json` - ([`dfb9c26a`](https://github.com/Enntity/atlas/tree/dfb9c26a95c96faa9f94c44e23343b0f2b4f9db6)). + ([`6f27e8fa`](https://github.com/Enntity/atlas/tree/6f27e8fa0afe65180a169e54361a77565787ae27)). SparkGLM's `NOTICE` and `docs/LICENSING.md` list everything else it fetches. - **Third-party notices in the image.** FlashKDA (MoonshotAI, MIT), FlashInfer including NVIDIA's sparse-MLA prefill source (Apache-2.0) and CUTLASS diff --git a/backends/atlas-sparkglm/pins.json b/backends/atlas-sparkglm/pins.json index a6069bc..aba0143 100644 --- a/backends/atlas-sparkglm/pins.json +++ b/backends/atlas-sparkglm/pins.json @@ -4,14 +4,14 @@ "note": "Single pin manifest for the Atlas SparkGLM candidate. Portable source, image, model and converter identities are final for this candidate; live hardware and serving qualification remains pending. The normal install path addresses image.reference, the immutable GHCR manifest digest. The tag is retained as source-build metadata (it derives from the git tree of install/ at the pinned revision) and as the local tag produced by an explicit --source-build; the install-tree label is a contents check. A tag or label alone is never the artifact identity.", "source": { "repo": "Enntity/sparkglm", - "revision": "7a67d9bce4b5f408ad67f2a958ef1a8787136fdd", - "installTree": "f95a9af14236a781bb13f57dcc9ea0342f339905", + "revision": "5063c13ea6f196046b76ce6e5c8b4d4200cccc9a", + "installTree": "ed7548dfe442949283b54c7160605429046cd46f", "cloneUrl": "https://github.com/Enntity/sparkglm.git", "buildScript": "install/build.sh" }, "image": { - "reference": "ghcr.io/enntity/atlas-sparkglm@sha256:78420594991e6e7e3914f84a6300ac1cf2f4e18b68e331f8ddc74fd7db905d3c", - "tag": "ghcr.io/enntity/atlas-sparkglm:f95a9af14236", + "reference": "ghcr.io/enntity/atlas-sparkglm@sha256:5ec57d5522a95463b600a17471ce60712b315566e04c0a3bb6af1d84a1de0a4a", + "tag": "ghcr.io/enntity/atlas-sparkglm:ed7548dfe442", "label": "io.enntity.sparkglm.install-tree", "entrypoint": "/opt/atlas/serve.py", "profilePath": "/opt/atlas/profiles/4x1m.json", diff --git a/docs/recipes.md b/docs/recipes.md index d947e6e..2bf6cc4 100644 --- a/docs/recipes.md +++ b/docs/recipes.md @@ -374,11 +374,11 @@ the git tree of its `install/` directory, the immutable image manifest reference (`image.reference`) with the tag kept as source-build metadata and the install-tree contents label, the `nvidia/GLM-5.3-Flash-NVFP4` and drafter revisions, and the conversion marker contract. The current source pin is product revision -`7a67d9bce4b5f408ad67f2a958ef1a8787136fdd` with install tree -`f95a9af14236a781bb13f57dcc9ea0342f339905`, so the normal install path +`5063c13ea6f196046b76ce6e5c8b4d4200cccc9a` with install tree +`ed7548dfe442949283b54c7160605429046cd46f`, so the normal install path addresses the immutable digest -`ghcr.io/enntity/atlas-sparkglm@sha256:78420594991e6e7e3914f84a6300ac1cf2f4e18b68e331f8ddc74fd7db905d3c`. -The tag `ghcr.io/enntity/atlas-sparkglm:f95a9af14236` is source-build metadata +`ghcr.io/enntity/atlas-sparkglm@sha256:5ec57d5522a95463b600a17471ce60712b315566e04c0a3bb6af1d84a1de0a4a`. +The tag `ghcr.io/enntity/atlas-sparkglm:ed7548dfe442` is source-build metadata (first 12 characters of the install tree) and is never pulled; a tag alone is not an immutable artifact identity. A later product revision is adopted by changing the revision, the install tree, the derived tag and the pinned digest. diff --git a/recipes/linux-nvidia-dgx-spark-2x-glm53-atlas.json b/recipes/linux-nvidia-dgx-spark-2x-glm53-atlas.json index 3ca7bc0..5021b4f 100644 --- a/recipes/linux-nvidia-dgx-spark-2x-glm53-atlas.json +++ b/recipes/linux-nvidia-dgx-spark-2x-glm53-atlas.json @@ -14,7 +14,7 @@ "provenance": { "createdBy": "lloom", "generatedBy": "manual-curated", - "source": "Atlas SparkGLM candidate at product revision 7a67d9bce4b5f408ad67f2a958ef1a8787136fdd (engine Enntity/atlas sparkglm/atlas-20261012-rc4.2-layered @ dfb9c26a, AGPL-3.0-only, recorded in the image's /opt/atlas/source-manifest.json; corresponding source is Enntity/sparkglm at that revision plus that Enntity/atlas commit). The normal install path pulls the immutable GHCR manifest digest ghcr.io/enntity/atlas-sparkglm@sha256:78420594991e6e7e3914f84a6300ac1cf2f4e18b68e331f8ddc74fd7db905d3c; the tag ghcr.io/enntity/atlas-sparkglm:f95a9af14236 is source-build metadata and is never pulled. Each host verifies the pulled image's io.enntity.sparkglm.install-tree contents label equals install tree f95a9af14236a781bb13f57dcc9ea0342f339905 and the image is arm64; the label is a contents check, not an artifact identity. An explicit --source-build builds from Enntity/sparkglm install/ at that revision and produces a LOCAL tag for an explicitly overridden local recipe only, and does not satisfy the normal immutable recipe. Model nvidia/GLM-5.3-Flash-NVFP4 revision 423acf37583782c51c142d145aef733d72943d93 requires a once-per-node overlay conversion gated on conversion.complete.json plus verification; the DFlash2 drafter incoai/GLM-5.3-Flash-DFlash2 revision 7d74cdd881ed7e32c31175984a67823127b66cfe (CC BY-NC-ND 4.0, non-commercial) is served from its checkpoint. The engine argument vector ships inside the image as /opt/atlas/profiles/4x1m.json, selected with SPARKGLM_PROFILE=4x1m, not in this recipe. The profile carries 1048576-token contexts, four sequences sharing one physical KV pool (GLM latent in FP8 with per-128 scales, split between the two nodes by SPARKGLM_KV_SHARD=1, qualified at about 2.38M tokens at the recipe's 0.91 GPU memory utilization with the display carveout, which overrides the profile default of 0.88, and shared with the disk prefix cache; the 48 GiB disk prefix-cache tier is enabled beside the shard, split into 24 GiB KV and 24 GiB SSM tiers per node), FP32 SSM state with KDA record rollback, and DFlash2 (gamma 8) on the head rank; disable-tool-grammar is deliberately not set so structured output and tools stay functional." + "source": "Atlas SparkGLM candidate at product revision 5063c13ea6f196046b76ce6e5c8b4d4200cccc9a (engine Enntity/atlas fix/sparkglm-rc4.2-refusal-content @ 6f27e8fa, AGPL-3.0-only, recorded in the image's /opt/atlas/source-manifest.json; corresponding source is Enntity/sparkglm at that revision plus that Enntity/atlas commit). The normal install path pulls the immutable GHCR manifest digest ghcr.io/enntity/atlas-sparkglm@sha256:5ec57d5522a95463b600a17471ce60712b315566e04c0a3bb6af1d84a1de0a4a; the tag ghcr.io/enntity/atlas-sparkglm:ed7548dfe442 is source-build metadata and is never pulled. Each host verifies the pulled image's io.enntity.sparkglm.install-tree contents label equals install tree ed7548dfe442949283b54c7160605429046cd46f and the image is arm64; the label is a contents check, not an artifact identity. An explicit --source-build builds from Enntity/sparkglm install/ at that revision and produces a LOCAL tag for an explicitly overridden local recipe only, and does not satisfy the normal immutable recipe. Model nvidia/GLM-5.3-Flash-NVFP4 revision 423acf37583782c51c142d145aef733d72943d93 requires a once-per-node overlay conversion gated on conversion.complete.json plus verification; the DFlash2 drafter incoai/GLM-5.3-Flash-DFlash2 revision 7d74cdd881ed7e32c31175984a67823127b66cfe (CC BY-NC-ND 4.0, non-commercial) is served from its checkpoint. The engine argument vector ships inside the image as /opt/atlas/profiles/4x1m.json, selected with SPARKGLM_PROFILE=4x1m, not in this recipe. The profile carries 1048576-token contexts, four sequences sharing one physical KV pool (GLM latent in FP8 with per-128 scales, split between the two nodes by SPARKGLM_KV_SHARD=1, qualified at about 2.38M tokens at the recipe's 0.91 GPU memory utilization with the display carveout, which overrides the profile default of 0.88, and shared with the disk prefix cache; the 48 GiB disk prefix-cache tier is enabled beside the shard, split into 24 GiB KV and 24 GiB SSM tiers per node), FP32 SSM state with KDA record rollback, and DFlash2 (gamma 8) on the head rank; disable-tool-grammar is deliberately not set so structured output and tools stay functional." }, "links": [ { @@ -23,7 +23,7 @@ }, { "rel": "engine", - "href": "https://github.com/Enntity/atlas/tree/dfb9c26a95c96faa9f94c44e23343b0f2b4f9db6" + "href": "https://github.com/Enntity/atlas/tree/6f27e8fa0afe65180a169e54361a77565787ae27" }, { "rel": "engine-upstream", @@ -284,7 +284,7 @@ "warmup": false, "bootstrap": { "adapter": "docker", - "image": "ghcr.io/enntity/atlas-sparkglm@sha256:78420594991e6e7e3914f84a6300ac1cf2f4e18b68e331f8ddc74fd7db905d3c", + "image": "ghcr.io/enntity/atlas-sparkglm@sha256:5ec57d5522a95463b600a17471ce60712b315566e04c0a3bb6af1d84a1de0a4a", "pull": false, "pullTimeoutMs": 3600000, "createArgs": [ @@ -443,7 +443,7 @@ }, "bootstrap": { "adapter": "docker", - "image": "ghcr.io/enntity/atlas-sparkglm@sha256:78420594991e6e7e3914f84a6300ac1cf2f4e18b68e331f8ddc74fd7db905d3c", + "image": "ghcr.io/enntity/atlas-sparkglm@sha256:5ec57d5522a95463b600a17471ce60712b315566e04c0a3bb6af1d84a1de0a4a", "pull": false, "pullTimeoutMs": 3600000, "createArgs": [ diff --git a/test/atlas-sparkglm-recipe.test.mjs b/test/atlas-sparkglm-recipe.test.mjs index 4d74e91..bd03e63 100644 --- a/test/atlas-sparkglm-recipe.test.mjs +++ b/test/atlas-sparkglm-recipe.test.mjs @@ -528,18 +528,18 @@ assert.equal(pins.model.revision, '423acf37583782c51c142d145aef733d72943d93'); assert.equal(pins.model.repo, 'nvidia/GLM-5.3-Flash-NVFP4'); assert.equal(pins.source.repo, 'Enntity/sparkglm'); assert.equal(pins.status, 'final'); -assert.equal(pins.source.revision, '7a67d9bce4b5f408ad67f2a958ef1a8787136fdd'); -assert.equal(pins.source.installTree, 'f95a9af14236a781bb13f57dcc9ea0342f339905'); +assert.equal(pins.source.revision, '5063c13ea6f196046b76ce6e5c8b4d4200cccc9a'); +assert.equal(pins.source.installTree, 'ed7548dfe442949283b54c7160605429046cd46f'); assert.equal(pins.source.buildScript, 'install/build.sh'); // The normal install path addresses the immutable registry digest, not the // mutable tag. The tag stays as source-build metadata only. assert.equal( pins.image.reference, - 'ghcr.io/enntity/atlas-sparkglm@sha256:78420594991e6e7e3914f84a6300ac1cf2f4e18b68e331f8ddc74fd7db905d3c' + 'ghcr.io/enntity/atlas-sparkglm@sha256:5ec57d5522a95463b600a17471ce60712b315566e04c0a3bb6af1d84a1de0a4a' ); assert.match(pins.image.reference, IMAGE_REFERENCE_PATTERN); assert.equal(pins.image.reference.split('@')[0], IMAGE_REPOSITORY); -assert.equal(pins.image.tag, 'ghcr.io/enntity/atlas-sparkglm:f95a9af14236'); +assert.equal(pins.image.tag, 'ghcr.io/enntity/atlas-sparkglm:ed7548dfe442'); assert.equal(pins.image.label, 'io.enntity.sparkglm.install-tree'); assert.equal(pins.image.architecture, 'arm64'); assert.equal(pins.image.entrypoint, '/opt/atlas/serve.py'); @@ -547,7 +547,7 @@ assert.equal(pins.image.entrypoint, '/opt/atlas/serve.py'); assert(!Object.hasOwn(pins, 'installer')); assert(!Object.hasOwn(pins.image, 'tagPrefix')); assert.notEqual(pins.image.reference, pins.image.tag, 'the digest must not be the mutable tag'); -assert(!pins.image.reference.includes(':f95a9af14236'), 'the tag must never appear as the pulled reference'); +assert(!pins.image.reference.includes(':ed7548dfe442'), 'the tag must never appear as the pulled reference'); assert(pins.overlay.marker.includes('conversion.complete.json')); assert.deepEqual(verifyPins(pins), []); @@ -839,7 +839,7 @@ assert.match(missingImageContract.stderr, /missing the Atlas entrypoint\/profile for (const identity of [`arm64 ${'f'.repeat(40)}`, `amd64 ${pins.source.installTree}`, 'arm64 ']) { const mismatched = runInstaller({ ...fakeEnv, ATLAS_TEST_IDENTITY: identity }, ['--check-only']); assert.notEqual(mismatched.status, 0, `--check-only must reject image identity ${identity}`); - assert.match(mismatched.stderr, /expected 'arm64 f95a9af14236a781bb13f57dcc9ea0342f339905'/); + assert.match(mismatched.stderr, /expected 'arm64 ed7548dfe442949283b54c7160605429046cd46f'/); } const noImageDir = fs.mkdtempSync(path.join(converterRoot, 'no-image-')); const checkedMissingImage = runInstaller({ ...fakeEnv, ATLAS_TEST_IMAGE_DIR: noImageDir }, ['--check-only']); From a569369cbf3c73ef6ba3068949428032450376ac Mon Sep 17 00:00:00 2001 From: Jason McCartney Date: Tue, 13 Oct 2026 03:31:40 -0700 Subject: [PATCH 2/2] Align SparkGLM corresponding-source notices with the image pin --- THIRD_PARTY_NOTICES.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md index 55d48e3..a5f8755 100644 --- a/THIRD_PARTY_NOTICES.md +++ b/THIRD_PARTY_NOTICES.md @@ -158,14 +158,14 @@ The optional Atlas SparkGLM lane in `backends/atlas-sparkglm` and `recipes/linux-nvidia-dgx-spark-2x-glm53-atlas.json` pulls or builds the container image `ghcr.io/enntity/atlas-sparkglm` from [Enntity/sparkglm](https://github.com/Enntity/sparkglm) at -`3c7d67146929f350ed75fcdfd5e5349db843b483`. LLooM starts that image as a +`5063c13ea6f196046b76ce6e5c8b4d4200cccc9a`. LLooM starts that image as a separate program; no engine source or binary is included in the LLooM npm package, and LLooM's files for the lane remain MIT. - Engine: [Atlas](https://github.com/Atlas-Inf/atlas) (Atlas-Inf) with SparkGLM's GLM-5.3 Flash work on the [Enntity/atlas](https://github.com/Enntity/atlas) fork, at - [`dfb9c26a95c96faa9f94c44e23343b0f2b4f9db6`](https://github.com/Enntity/atlas/tree/dfb9c26a95c96faa9f94c44e23343b0f2b4f9db6) + [`6f27e8fa0afe65180a169e54361a77565787ae27`](https://github.com/Enntity/atlas/tree/6f27e8fa0afe65180a169e54361a77565787ae27) (recorded in the image's `/opt/atlas/source-manifest.json`) - License: AGPL-3.0-only. The corresponding source is Enntity/sparkglm at the revision above plus that Enntity/atlas commit; SparkGLM's `NOTICE` and