release: 1.8.0 — per-site metrics, per-case predictions, warm-start guard, deploy test on real kits

[Ultimate-Storm]

Version bump and release paperwork for 1.8.0. No code changes.

• odelia_image.version → 1.8.0 (shared with DECADE; only the next build moves)
• CHANGELOG.md → the 1.8.0 section: per-site metrics (feat(metrics): publish per-site metrics with class support (#525, #441) #534), opt-in per-case predictions (feat(metrics): return per-case predictions, opt-in per site (#526, #527, #528) #556/feat: wire per-case prediction return end to end (#526, #527, #528) #557), warm-start provenance + structural guard (Label warm-start checkpoints and refuse another model's weights (#535) #545/fix: refuse wrong-architecture warm-start checkpoints structurally; cap DataLoader workers (#574) #575), loader-worker cap (fix: refuse wrong-architecture warm-start checkpoints structurally; cap DataLoader workers (#574) #575), strict exact-client runs (Make strict ODELIA swarm runs reliable and exact-client by default #514), the deliverable groundwork (feat(active-learning): sample-selection strategies for D3.2 (#527) #555/feat: MVPs for active learning (D3.2) and privacy accounting (T3.3 Phase 2) #563/feat(d3.4): robust aggregation rules and a poisoning simulation (#529) #566/fix(d3.2): retract the active-learning null result — it was computed on wrong-architecture predictions #568/feat(ms6): white-hat site-inference probe we can run without partner scheduling (#531) #571), deploy-test fixes (Make the 2-node deploy test able to run at all (ports, min_clients, gitignore) #544/fix(deploy-test): make the 2-node deploy test run on real kits (rename sites, decouple data folder, mirror hygiene, staged jobs) #573), weekly preflight (fix(ci): build startup kits before the weekly all-models preflight #552/539 run preflight check for all odelia models #559/fixed output of runIntegrationTests.sh #572), supply chain (Supply chain: digest-pin the base, keep apt unpinned, scan for CVEs (#395) #446)
• docs/SWARM_FAILURE_MODES.md → F11 (unlabelled wrong-architecture mirror) and F12 (pin-memory shm race), both found by the 1.8.0 deploy tests
• docs/RELEASE_RUNBOOK.md → the manual release procedure, verified step by step on 13 Sep: MEDISWARM_IMAGE_VERSION must be exported for a clean tag, :current is the only update channel sites have (it was never moved for 1.7.0 — Docker Hub has no 1.7.0 tag at all), provisioning the allsites project reuses the root CA in workspace/odelia_allsites/state so new kits are drop-in, and a published GitHub release fires the deploy test on the runners
• docs/EMAIL_release_1.8.0.md → announcement draft with per-site actions taken from the sites' own heartbeats (one restart for 1.6.0 kits; a kit or --image for the two 1.5.0 kits)

Evidence the release is ready

The four MVP deploy tests on real kits (server on dl3, clients dl0 + dl2, image 1.7.0-dev.260913.19f8613 = main + #573 + #575) — results recorded on this PR as they complete:

• test 1 — baseline: 20/20 rounds, 9 aggregations, no aborts, loader workers capped 16 -> 9, no pin-memory failure (mvp1_rc2_baseline_260913_0717, 3892 s). Metrics were published but the harness could not save them — see fix(deploy-test): make the 2-node deploy test run on real kits (rename sites, decouple data folder, mirror hygiene, staged jobs) #573's job-store fix.
• test 3a — warm-start accept: both clients provenance OK -- written by 'MST', structure OK -- 187/187 parameter names shared, warm-started in require mode, 20 rounds PASSED (mvp3_guard_accept_260913_0835, 3851 s); cross_val_results.json with both sites and per-class support recovered from the job store
• test 3b — warm-start refuse: with an unlabelled 722 MB 1DivideAndConquer mirror planted on TEST_B_1, that client logged carries no provenance and refused with WARM_START_MODEL_MISMATCH on all three NVFlare retries; TEST_A_1 accepted its labelled MST mirror (structure OK -- 187/187); the run aborted as it must (mvp3_guard_refuse_260913_1418, harness verdict FAILED: MST (training fail) = the expected outcome)
• test 2 — per-case predictions: with ODELIA_RETURN_PER_CASE=1 on both clients, cross_site_val/per_case_predictions/TEST_A_1.csv (10 rows) and TEST_B_1.csv (26 rows) came back — row_index,ground_truth,prob_class_0..2, no identifiers — matching each site's val/n in cross_val_results.json; 20 rounds PASSED (mvp2_percase_260913_1426, 3821 s)
• test 4 — weekly all-models validation dispatched on main 4625edc (fix(deploy-test): make the 2-node deploy test run on real kits (rename sites, decouple data folder, mirror hygiene, staged jobs) #573 + fix: refuse wrong-architecture warm-start checkpoints structurally; cap DataLoader workers (#574) #575 + ci: require both simulated clients to configure before the swarm starts (#576) #578): 34775138617 green, all six models' preflight plus simulation and two-client swarm — the first green weekly since 16 Aug (Nothing validates main after a merge, and the weekly check has been red for a month #554)

🤖 Generated with Claude Code