[bong-water-water-bong]

Gantt: "Install path on Ubuntu 26.04: PPA lemond + one engine package".

The Lemonade PPA's lemond (2026.42.1~26.04) has no onebit recipe. The fork's Debian 13 .deb cannot install on 26.04 because it depends on libcpp-httplib0.41. This PR uses the stock lemond's HRX recipe (llamacpp-hrx) instead, with no Lemonade patch. lemond takes that recipe's llama-server from LEMONADE_HRX_HRX_BIN, or from hrx.hrx_bin in config.json, and when that is a path it skips its own HRX download (Lemonade v2026.42.1 BackendUtils::find_external_backend_binary). It forks and execs the backend with its own environment plus GGML_DISABLE_VULKAN=1, so variables set on the service reach llama-server.

What's added

• config/lemonade/1bit-hrx.conf: a systemd drop-in for lemond.service that sets LEMONADE_HRX_HRX_BIN=/opt/1bit/lemonade-hrx.
• scripts/lemonade-hrx: runs the package's HRX llama-server, with our HIP kernels, on Lemonade's argv unchanged. It gets the environment from 1bit serve --print-backend-env, which also makes serve's architecture and memory checks: GGML_HRX_STRICT=1, TheRock libhsa, CWSR placement and ternary decode. Where Lemonade's argv leaves them out, it adds -ngl 99, --cache-reuse 256, and -kvu when --parallel is above 1. A value already set in lemond's environment wins.
• 1bit serve --print-backend-env: the --print-backend env as NAME=VALUE lines.
• scripts/install-lemonade-ppa.sh: post-install step for the engine tarball. It copies the package to /opt/1bit, writes the drop-in to /etc/systemd/system/lemond.service.d/, then runs daemon-reload and restarts lemond.
• scripts/check-ubuntu-2604-lemond.sh: runs the whole path in a clean ubuntu:26.04 container. It installs the PPA and the package, registers a model with llamacpp-hrx, then loads it and runs a chat. It passes only if lemond did not install its own HRX build and the running llama-server has GGML_HRX_STRICT=1.
• scripts/package-linux.sh packs the three files. New ctest lemonade_hrx; print_backend covers the new flag.
• Docs: docs/lemonade.md "Ubuntu 26.04: the PPA's lemond", and docs/serve.md.

Packaging fix found on the way (scripts/weekly.sh). The lemonade-onebit tarball's tar --transform "s,^,lemonade-onebit-$tag/," also rewrites symlink targets. In the tosreh2 rehearsal package, every libggml*.so.0 / libllama*.so.0 / libmtmd*.so.0 link in 1bit/hrx/llama/bin points to lemonade-onebit-rehearsal-tosreh2/..., so the packaged HRX llama-server cannot load its libraries. With the S flag only member names change.

Verified (ryzen, no GPU, ROCR_VISIBLE_DEVICES=-1)

• ctest -R "print_backend|lemonade_hrx": 2/2 pass. tools/copyright.py --check is clean.
• scripts/check-ubuntu-2604-lemond.sh <package> Qwen3-0.6B-Q4_K_M.gguf: PASS, with lemond 2026.42.1~26.04 from the PPA. The model is listed as llamacpp-hrx, load succeeds, and the chat replies "2 + 3 = 5". lemond ran /opt/1bit/lemonade-hrx with -m … --ctx-size 4096 --device HRX0 --port 8001 --jinja --metrics --parallel 1 -ngl 99 --cache-reuse 256 and env GGML_HRX_STRICT=1 GGML_HRX_REPORT=1. A CPU stand-in replaced llama-server here.
• Control run, same container without the drop-in: lemond installs hrx-b99 from ROCm/ggml-staging-automation into cache/bin/llamacpp-hrx.

Still to run on Strix Halo (needs gfx1151), with a package built from main (libomp packed since #472):

scripts/check-ubuntu-2604-lemond.sh out/1bit-<version>-linux-x86_64.tar.zst ~/models/Qwen3-0.6B-Q4_K_M.gguf --gpu

Not merged; the Strix Halo run comes first.

🤖 Generated with Claude Code

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit facb331)

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 472 - Partially compliant Compliant requirements: A: weekly.sh package checks use tee >(cat >&2); tee /dev/stderr reopened and truncated package-checks.log - log has 0 NUL bytes and all 5 check lines (before: lines lost, NUL-filled) B: new scripts/pack-elf.sh (package-linux.sh's former fix() + strip, RPATH-leak and missing-library checks), used by package-linux.sh and make-binary-drop.sh --build - make-binary-drop.sh --build passes (before: 11 RPATH failures) C: libomp.so (LLVM OpenMP, Apache-2.0 WITH LLVM-exception, credited in NOTICE-BINARY) packed beside the libraries that load it, RUNPATH $ORIGIN; package and drop checks fail if ldd finds anything missing beyond TheRock's documented runtime - clean clone with libomp nowhere on the system, built from the --build drop: ctest 37/37 incl. serve_e2e_cpu (before: fails, libomp.so not found) D: serve_e2e_hrx exits 77 (skip) without a gfx1151 (scripts/gpu-targets.sh, sysfs only, opens no GPU; ONEBIT_HRX_E2E_TARGETS); held-bump reason names the host and its GPUs - ryzen ctest 38/38 with the skip E: SHA256SUMS rewritten after changes.json - sha256sum -c passes for all 4 files F: 1bit OS: /etc/profile for SSH login shells (Dropbear's own PATH) and lemonade/lemond linked into /usr/bin - VMTEST PASS incl. new "lemonade CLI over SSH" check G: release stage writes [] when bumps.json is missing (running the stage alone crashed) - release stage alone passes Non-compliant requirements: None Requires further human verification: None

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Environment Variable Handling The script scripts/lemonade-hrx reads environment variables from 1bit serve --print-backend-env and exports them. However, it does not validate or sanitize the input from --print-backend-env, which could lead to unexpected behavior if the environment contains malformed or malicious entries. This could be a security concern if the environment is not fully trusted. while IFS= read -r kv; do case $kv in [A-Za-z_]*=*) export "${kv?}" ;; esac done <<<"$env_lines" Path Validation The script scripts/install-lemonade-ppa.sh checks if the prefix is an absolute path but does not ensure that the prefix is not a subdirectory of /home or /root. This could lead to unintended behavior or security issues if the prefix is set to a location that is not allowed due to systemd's ProtectHome=yes setting. case $prefix in /home/* | /root/*) echo "install-lemonade-ppa.sh: lemond runs with ProtectHome=yes; pick a prefix outside /home" >&2; exit 1 ;; esac

[github-actions]

Persistent review updated to latest commit facb331