[bong-water-water-bong]

Stacked on #477 (base 1bit/pin-set-rows-q8). GitHub retargets it to main once #477 merges.

The gate built llama.cpp without the gpu-kernels add-on, so it passed main 1834ceb, whose llama.cpp and gpu-kernels pins do not compile together (dispatch-hip-set-rows-q8.cpp:39, HipSetRowsArgs). Its build phase now does what cmake/hrx.cmake (ONEBIT_GPU_PRIVATE) and scripts/weekly.sh do:

• It fetches the add-on at the commit config/gpu-kernels.config pins, with scripts/fetch-private.sh and the runner box's gh login, and passes GGML_HRX_HIP_ADDON_DIR. It also checks that llama.cpp has the hook.
• The build tree is keyed by the add-on choice, and the gate reconfigures when the gpu-kernels pin moves, so new kernel files are seen.
• The build fails when libggml-hrx.so does not export ggml_hrx_hip_addon_register.
• On a failed build, the job log shows only the compiler's error lines. The log is public and the add-on's sources are not.
• A box that cannot read gpu-kernels stops with exit 2. HW_GATE_PRIVATE=0 gates the public plumbing only.

docs/hw-gate.md is updated, and its "Private kernels" limitation is removed.

Proof on ryzen (--phases build, ROCR_VISIBLE_DEVICES=-1, nice 19, -j8, TheRock copy):

• llama.cpp b14a28362 (main's pin): build FAIL in 61 s, printing only .../dispatch-hip-set-rows-q8.cpp:39:28: error: unknown type name 'HipSetRowsArgs'.
• llama.cpp 8792923f8 (Pin llama.cpp 8792923f: the SET_ROWS hook the private kernels need (fixes the main build) #477): build PASS. libggml-hrx.so exports the add-on and has 40 code objects.

Not verified: that the self-hosted runner's gh login can read 1bit-MONSTER/gpu-kernels. The workflow sets no GH_TOKEN for this step, so fetch-private.sh uses the runner user's own login. If the gate run on this PR ends with "cannot fetch the private gpu-kernels add-on", that login needs read access.

🤖 Generated with Claude Code

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit 63b7727)

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 477 - Partially compliant Compliant requirements: Pin llama.cpp to commit 8792923f8 Fetch and compile the private HIP kernels add-on Fail build when private kernels are missing from libggml-hrx.so Update docs/hw-gate.md to reflect new behavior Non-compliant requirements: None Requires further human verification: None

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Build tree keying logic The build tree keying logic uses a SHA1 hash of the source path and PRIVATE flag to determine if a build should be reused. This approach may not be robust enough to detect changes in the private kernel add-on pin, potentially leading to stale builds if the add-on changes but the key remains the same. The key should also include the add-on pin to ensure proper rebuilds when the add-on changes. # one persistent build tree per source path (and per add-on choice), so the runner's checkout # rebuilds incrementally key=$(printf '%s|private=%s' "$src" "$PRIVATE" | sha1sum | cut -c1-10) Error message clarity The error message when fetching the private gpu-kernels add-on fails does not provide enough context about why the fetch might have failed. It only shows the last line of the log, which may not be sufficient to diagnose issues with authentication or network problems. The error message should be more informative to help with debugging. if ! addon=$("$ROOT/scripts/fetch-private.sh" "$ROOT/config/gpu-kernels.config" "$STORE/gpu-kernels" 2> "$OUT/private.log"); then note "::error::cannot fetch the private gpu-kernels add-on at ${addon_pin:0:12} (gh login with read access on this box?): $(tail -n 1 "$OUT/private.log")" note " (HW_GATE_PRIVATE=0 gates the public plumbing only)" exit 2

---

⚠️ Review coverage: The following files were not included in this review because of the token budget:

• tests/golden/hw-gate/kat-qwen3-0.6b.json
• tests/golden/hw-gate/kat-qwen3-coder-30b-a3b.json
• tests/golden/hw-gate/kat-qwen3-4b-iq4xs.json
• tests/golden/hw-gate/manifest.json

[github-actions]

Persistent review updated to latest commit 63b7727