[bong-water-water-bong]

Make the NPU engine shippable with the runtime and kernels closed, compiled binaries only.

What this adds (public, neutral)

• scripts/hw-gate.sh — a npu phase. Not in the default phases (--phases npu). Auto-skips when there is no NPU (/dev/accel/accel0) or no checker configured. Otherwise it runs a private checker ($HW_GATE_NPU_CHECK) inside the gate's GPU claim and under ~/npu.lock (NPU through the fair queue; not wrapped in thermal-run, whose freeze can abort an NPU dispatch), reads its neutral result lines — oracle (dense Qwen3-0.6B decode vs an fp64 reference), greedy64, prefill, reproducible — and applies a tok/s floor (HW_GATE_NPU_FLOOR). The checker and the kernels are private; this script carries no method.
• config/npu-kernels.config — the private NPU-kernels pin the release fetches (ONEBIT_NPU_PRIVATE), same shape as config/gpu-kernels.config.
• docs/npu.md, docs/releases.md — the NPU kernels ship as compiled, encrypted artifacts that 1bit verifies and decrypts in memory at load (fails cleanly on a wrong key, no network callback of any kind; a lifted kernel file is ciphertext and does not run). No source or method is public.

Proven on Strix Halo

The private delivery mechanism (sealed kernel container, in 1bit-MONSTER/npu-kernels npu/ship-sealed-kernels) was proven on device: the sealed dx kernel set decodes byte-identical logits to the plain set (Qwen3-0.6B, 24/24 vs fp64, logits md5 9a405cf6…), 64/64 greedy at ~90 tok/s, a set sealed with a foreign key is refused cleanly (signature verification failed, no NPU dispatch), a plain ELF is refused under REQUIRE_SEALED, with 0 amdxdna/IOMMU faults.

Remaining (needs a post-freeze Strix Halo build)

• Run the gate npu phase end to end on the box.
• Wire the kernel build + seal + ship into scripts/weekly.sh so a release package carries them.

Pin PR — please review; not auto-merging, do not merge without the hardware gate.

🤖 Generated with Claude Code

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit 73c18dc)

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review NPU Phase Logic The new 'npu' phase in hw-gate.sh introduces logic to run a private checker ($HW_GATE_NPU_CHECK) for verifying NPU correctness and performance. However, the script assumes that the checker will produce output lines in a specific format (e.g., oracle PASS, tok_s 42.5). If the checker does not conform to this expected format, the parsing logic in lines 568-569 could fail or misinterpret results, leading to incorrect pass/fail decisions. This is a potential correctness issue if the private checker's output format changes or is not strictly adhered to. get() { sed -n "s/^$1 //p" "$log" | tail -n 1; } oracle=$(get oracle); greedy=$(get greedy64); prefill=$(get prefill); repro=$(get reproducible); tps=$(get tok_s) st=PASS for v in "$oracle" "$greedy" "$prefill" "$repro"; do [ "$v" = PASS ] || st=FAIL; done [ "$rc" = 75 ] && { st=FAIL; infra=1; } slow="" # no number is a failure, not a skipped floor (the first on-device run printed an empty tok_s) if ! [[ "$tps" =~ ^[0-9]+(\.[0-9]+)?$ ]]; then st=FAIL; slow=" (no tok/s reported: the speed floor cannot be checked)" elif awk -v t="$tps" -v f="$floor" 'BEGIN{exit !(t+0 < f+0)}'; then st=FAIL; slow=" (below the ${floor} tok/s floor)"; fi result npu $st $(( $(date +%s) - t0 )) "oracle=${oracle:-?} greedy64=${greedy:-?} prefill=${prefill:-?} reproducible=${repro:-?}${tps:+ tok/s=$tps}$slow" NPU Kernel Sealing Verification The package_checks function in scripts/weekly.sh includes checks to ensure that NPU kernel files are sealed (identified by the magic header 1BPKCRYP). However, the check only verifies the presence of the header and does not validate the integrity or authenticity of the sealed kernel artifacts. If a malicious or corrupted kernel file is mistakenly included in the package, it could pass this check and be loaded by the NPU engine, potentially leading to incorrect behavior or security vulnerabilities. [ "$(basename "$f")" = layout.json ] && continue [ "$(head -c 8 "$f")" = 1BPKCRYP ] || { echo "FAIL $f is not a sealed kernel artifact"; nk=$((nk + 1)); } done < <(find "$t" -path '*/npu/kernels/*' -type f -print0) [ "$nk" = 0 ] || bad=1 Symbol Table and Private Source Detection The package_checks function in scripts/weekly.sh attempts to verify that the packed 1bit binary does not contain a symbol table or references to private source files. However, the method of detecting private source names using strings -a "$f" | grep -c -F -f <(printf '%s\n' "$privsrc") is not robust. It may produce false positives if strings from the binary match substrings of private source names, or it may miss some references if they are not directly present in the strings output. This could lead to a false sense of security if private information is still present in the binary. privsrc=$(for pin in npu-runtime npu-kernels; do [ -d "$W/$pin" ] || continue git -C "$W/$pin" ls-files -- "$(sed -n 's/^path=//p' "$SRC/config/$pin.config")" 2>/dev/null done | grep -E '\.(c|cc|cpp|cxx|h|hpp|py)$' | xargs -r -n1 basename | LC_ALL=C sort -u) n=0; [ -z "$privsrc" ] || n=$(strings -a "$f" | grep -c -F -f <(printf '%s\n' "$privsrc") || true) [ "$n" = 0 ] || { echo "FAIL the packed 1bit names a private source file ($n strings)"; b1=1; }

[github-actions]

Persistent review updated to latest commit 4e03ad6

[github-actions]

Persistent review updated to latest commit c2a5592

[github-actions]

Persistent review updated to latest commit 949029b

[github-actions]

Persistent review updated to latest commit 2c418be

[github-actions]

Persistent review updated to latest commit 7d0738a

[github-actions]

Persistent review updated to latest commit 73c18dc