Skip to content

fix(split-mtp): commit outputs from private staging - #2277

Merged
inureyes merged 4 commits into
mainfrom
fix/issue-1784-atomic-split-output
Oct 12, 2026
Merged

inureyes merged 4 commits into
mainfrom
fix/issue-1784-atomic-split-output

Conversation

@inureyes

@inureyes inureyes commented Oct 12, 2026 •

Copy link
Copy Markdown
Member

Summary

split-mtp now writes every artifact into a private sibling staging directory and publishes a new or empty output with one directory rename. Non-empty outputs require --force; foreign weights, symlinked destinations, source aliases, and path-resolution changes remain protected.

The exclusive streaming safetensors writer preserves the canonical byte layout without allocating a second multi-gigabyte serialization buffer.

Related issues

Closes #1784

Type of change

  • feat — new user-visible feature
  • fix — bug fix
  • perf — performance improvement (include before/after numbers in the PR body)
  • refactor — internal restructuring without behavior change
  • chore — build, CI, dependencies, release infrastructure
  • docs — documentation only
  • test — tests only

Test plan

  • cargo fmt --all -- --check
  • cargo clippy --bin mlxcel --profile test-fast --features cuda -j2 -- -D warnings
  • cargo test -p mlxcel-surgery --lib --profile test-fast -j2 --no-run split_mtp; focused binary: 26 passed
  • cargo test --bin mlxcel --profile test-fast --features cuda -j2 split_mtp: 10 passed
  • Issue contract checks for versions, dtype, dispatch, compatibility, ROCm overlay, Python, and WebUI
  • Real checkpoint: zai-org/GLM-4.7-Flash revision 7dd20894a642a0aa287e9827cb1a1f7f91386b67, --q-bits 4, 54 tensors and 15 quantized tensors. Baseline and candidate outputs match byte for byte: weights 84018ae89ff88bf727f2552523748a21acb4e824d7f22bcf77d8a439d5f4dd61, config 7218072d09e5bb06e3eb005b2481ea0b1da08e7e7cd9ad59c69dbd132a754c24.

Notes for reviewers

Fresh and empty outputs use one atomic directory rename. Forced replacement validates the destination again, then renames only the known drafter files individually, as specified by the issue. Staging directories use mode 0700 on Unix and clean themselves up after every error.

The focused serializer regression compares mixed dtypes and multiple tensor names byte for byte against safetensors::serialize_to_file. Path regressions cover ., .., Unix non-UTF-8 names, dangling links, concurrent winners, ancestor-symlink retargeting, and unresolved source aliases.

CI note: cargo-deny reports the existing main-branch unsafe-libyaml 0.2.11 maintenance advisory (RUSTSEC-2024-0449) through serde_yaml. This PR changes no dependency or advisory policy and adds no ignore.

Checklist

  • PR title uses a Conventional Commits prefix (feat:, fix:, etc.)
  • One logical change per PR (split unrelated changes)
  • Updated CLI help and technical reports for the behavior change
  • Updated // Used by: ... comments on shared functions modified here
  • No secrets, credentials, or .env files committed

Write every generated artifact into a private sibling staging directory with exclusive file creation, then atomically publish new output directories or replace only validated drafter files under --force. Refuse non-empty destinations by default, protect foreign weights and symlinked targets, and stream safetensors with byte-equivalent ordering. Add concurrency, symlink, permissions, serializer, and CLI regression coverage.

Refs #1784
@inureyes inureyes added area:cli Command-line interface / CLI flags area:surgery Model surgery operations (merge, interpolate, replace, etc.) priority:low Low priority status:review Under review type:security Security vulnerability or fix labels Oct 12, 2026
Document the atomic output design, path security review, focused regressions, and pinned GLM byte-identity acceptance in English and Korean.

Refs #1784
Merge main at fc45284 so PR #2277 uses the maintained safe-Rust YAML parser and no longer inherits the RUSTSEC-2024-0449 cargo-deny failure. The split-mtp source remains unchanged.

Validation: configured version, kernel, Llama, ROCm, Python, and WebUI contracts pass; cargo deny check, formatting, and diff checks pass.

Refs #1784, #2279
Merge origin/main at 2cb4e20 after the portable A/B output directory fix landed.

This incorporates the #2209 and #2276 prerequisite changes while leaving the split-MTP implementation and regression-test paths unchanged.

Validation:
- configured repository contracts
- cargo deny check
- cargo fmt --all -- --check
- staged and unstaged whitespace checks
@inureyes inureyes added status:done Completed and removed status:review Under review labels Oct 12, 2026
@inureyes
inureyes merged commit c55e180 into main Oct 12, 2026
27 checks passed
@inureyes
inureyes deleted the fix/issue-1784-atomic-split-output branch October 12, 2026 16:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:cli Command-line interface / CLI flags area:surgery Model surgery operations (merge, interpolate, replace, etc.) priority:low Low priority status:done Completed type:security Security vulnerability or fix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(split-mtp): write the drafter atomically, refuse symlinked outputs

1 participant