name: wai-quantum tensor-engine member

# The fabric's tensor-engine member: the gate's products as exact bf16 limb
# convolutions on a tensor processor's matrix engine, accumulated in fp32. The
# kernel runs under the engine's kernel toolchain (Apache-2.0, pinned below),
# whose simulator is the target here: every certificate says it was earned in
# a simulator.
#
# - tensor-engine-sim (the container runner): the device tests must find the
#   declared target, agree with the CPU on the arithmetic probe and on random
#   states (out-of-range runs included), reproduce all four pinned
#   certificates, and catch every mutant, the limb size the engine's inputs
#   cannot hold among them.
# - tensor-engine-absent: with no kernel toolchain named, the same build finds
#   no member and says why; the device tests run over no member with the
#   declaration `none`.

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - 'wai/wai-quantum/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-quantum-tensor-engine.yml'
  schedule:
    - cron: '27 4 * * *'

env:
  KERNEL_TOOLCHAIN: nki==0.6.0+31049202112.g85070674

jobs:
  # Does this pull request's own diff touch the paths below? This forge matches a
  # workflow's `paths:` against the push, so a merge of main into a branch fires the
  # workflow whatever the pull request changes; every job here waits on this answer.
  # A push to main, a schedule, or anything the script cannot determine answers
  # `true` (scripts/pr-touches-paths.py).
  relevant:
    name: does this change touch it
    runs-on: gate
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-quantum-tensor-engine.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches wai-quantum-tensor-engine: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  tensor-engine-sim:
    name: member · tensor engine, the kernel toolchain's simulator (linux)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux
    timeout-minutes: 60
    container:
      image: debian@sha256:913f6706df59a68922d1dd08f78c2476560a8d367897200a6005b00e5f67c2d5
      options: --memory=6g --memory-swap=6g
    env:
      WAI_QUANTUM_TENSOR_ENGINE_EXPECT: tensor-engine-simulator
    steps:
      - name: Tools
        shell: bash
        run: |
          set -euo pipefail
          apt-get update -qq
          apt-get install -y -qq --no-install-recommends ca-certificates curl git build-essential python3 python3-venv >/dev/null
      # No Node for a checkout action: the forge's archive of the exact commit,
      # its embedded commit id checked.
      - name: Fetch the source
        shell: bash
        run: |
          set -euo pipefail
          want="${{ github.event.pull_request.head.sha || github.sha }}"
          rm -rf src src.tar.gz src.tar && mkdir src
          curl -sSf -o src.tar.gz "http://100.64.224.0:3400/Transaction-Science/open-standards/archive/$want.tar.gz"
          gzip -dc src.tar.gz > src.tar
          got="$(git get-tar-commit-id < src.tar)"
          [ "$got" = "$want" ] || { echo "::error::the archive is of $got, not $want"; exit 1; }
          # -m: every file gets the time it was extracted, not its commit's. The build
          # reuses a target directory kept between runs, and cargo takes a crate as
          # built when no source file is newer than its last build: with the commit's
          # times, an older commit ran the binary another commit had built there.
          tar -xmf src.tar -C src --strip-components=1
          rm src.tar.gz src.tar
      - name: The member's tests on the simulator
        shell: bash
        working-directory: src/wai/wai-quantum
        run: |
          set -euo pipefail
          cache=/ci-cache/wai-quantum-tensor-engine
          mkdir -p "$cache"
          exec 9>"$cache/.lock"
          flock 9
          # Every source file newer than every build in the cache, now that the lock is
          # held: another run may have built here while this one waited for it, after
          # this one's extraction. (../.. is the extracted tree.)
          find ../.. -type f -exec touch {} +
          venv="$cache/kernel-toolchain"
          if ! "$venv/bin/python" -I -c 'import nki, ml_dtypes' 2>/dev/null || [ "$(cat "$venv/pinned" 2>/dev/null)" != "$KERNEL_TOOLCHAIN" ]; then
            rm -rf "$venv"
            python3 -m venv "$venv"
            "$venv/bin/pip" install -q --extra-index-url https://pip.repos.neuron.amazonaws.com "$KERNEL_TOOLCHAIN" numpy ml_dtypes # allow-name: the kernel toolchain's package index
            echo "$KERNEL_TOOLCHAIN" > "$venv/pinned"
          fi
          export RUSTUP_HOME="$cache/rustup" CARGO_HOME="$cache/cargo" CARGO_TARGET_DIR="$cache/target"
          export PATH="$CARGO_HOME/bin:$PATH" WAI_QUANTUM_TENSOR_ENGINE_PYTHON="$venv/bin/python" WAI_QUANTUM_TENSOR_ENGINE_CACHE="$RUNNER_TEMP/tensor-engine"
          if ! command -v rustup >/dev/null; then
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --no-modify-path --profile minimal --default-toolchain none
          fi
          rustup toolchain install
          cargo test --locked --features quantum_fabric_tensor_engine --lib -- quantum_fabric_tensor_engine:: quantum_fabric::tensor_engine:: 2>&1 | tee "$RUNNER_TEMP/unit.log"
          # The first build after the refresh compiles wai-quantum; one that compiled
          # none ran a binary another commit left in the cache.
          grep -qE '^ *Compiling wai-quantum v[0-9]' "$RUNNER_TEMP/unit.log" || { echo "::error::the build compiled no wai-quantum: its tests ran a binary already in the cache"; exit 1; }
          grep -qE '^test result: ok\. [1-9][0-9]* passed; 0 failed' "$RUNNER_TEMP/unit.log" || { echo "::error::no unit test ran"; exit 1; }
          key="$WAI_QUANTUM_TENSOR_ENGINE_EXPECT"
          report="$RUNNER_TEMP/tensor-engine-report.txt"; : > "$report"
          WAI_QUANTUM_TENSOR_ENGINE_REPORT="$report" cargo test --locked --release --features quantum_fabric_tensor_engine --test tensor_engine_member -- --test-threads=1 2>&1 | tee "$RUNNER_TEMP/device.log"
          grep -qE '^test result: ok\. 9 passed; 0 failed' "$RUNNER_TEMP/device.log" || { echo "::error::not every device test ran and passed"; exit 1; }
          cat "$report"
          grep -qx "tensor-engine devices: as declared ($key)" "$report" || { echo "::error::the target found is not the declared one"; exit 1; }
          grep -q "^tensor-engine member: key=$key .*; simulator:" "$report" || { echo "::error::the member does not say it ran in a simulator"; exit 1; }
          n="$(grep -c "^tensor-engine certified: key=$key .* parity=bit-exact " "$report")"
          [ "$n" = 4 ] || { echo "::error::$n of 4 certificates were earned"; exit 1; }
          grep -qx "tensor-engine mutants: key=$key killed 4 of 4" "$report" || { echo "::error::a mutant survived"; exit 1; }

  tensor-engine-absent:
    name: member · tensor engine absent (linux-arm64)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux-arm64
    timeout-minutes: 60
    env:
      WAI_QUANTUM_TENSOR_ENGINE_EXPECT: none
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.99.1
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.99.1
          rustup toolchain install 1.99.1 --profile minimal
          rustup default 1.99.1
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: No kernel toolchain here, and the member says so
        shell: bash
        working-directory: wai/wai-quantum
        run: |
          set -euo pipefail
          report="$RUNNER_TEMP/tensor-engine-report.txt"; : > "$report"
          WAI_QUANTUM_TENSOR_ENGINE_REPORT="$report" cargo test --locked --features quantum_fabric_tensor_engine --test tensor_engine_member -- --test-threads=1 2>&1 | tee "$RUNNER_TEMP/device.log"
          grep -qE '^test result: ok\. 9 passed; 0 failed' "$RUNNER_TEMP/device.log" || { echo "::error::not every device test ran and passed"; exit 1; }
          grep -qx 'tensor-engine devices: as declared (none)' "$report" || { echo "::error::the absent case was not established"; exit 1; }