name: wai-quantum OpenCL member

# The fabric's OpenCL member: the gate kernel in OpenCL C, built at run time by
# each device's own compiler and certified bit-exact against the CPU
# reference's pinned corpus digests.
#
# - opencl-hw (jetson-hub): the platforms the host declares (by default the
#   discrete GPU's and the CPU's), each by a key that carries the device's
#   vendor id (opencl-<kind>-<vendor id, hex>). The device
#   tests must find exactly the declared devices, agree with the CPU on the
#   arithmetic probe and on random states (out-of-range runs included),
#   reproduce all four pinned certificates on each device (two gatesets,
#   random-v1 and fabric-v1), and catch every kernel mutant on each; and the
#   dense f64 state vector must come back with the CPU's bits on each.
# - opencl-amd (framework-128gb): the same on its integrated GPU, through the
#   GPU vendor's OpenCL platform, the state vector included.
# - opencl-macos (the macOS runner): the same on the platform's GPU, through its
#   OpenCL 1.2; that GPU has no binary64, so the state vector is refused there,
#   with the reason.
# - opencl-absent (a container with no OpenCL): the same build finds no member
#   and says why, rather than failing; the device tests run over no member with
#   the declaration `none`.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - 'wai/wai-quantum/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-quantum-opencl.yml'
  schedule:
    - cron: '35 5 * * *'

jobs:
  # Does this pull request's own diff touch the paths below? This forge matches a
  # workflow's `paths:` against the push, so a merge of main into a branch fires the
  # workflow whatever the pull request changes; every job here waits on this answer.
  # A push to main, a schedule, or anything the script cannot determine answers
  # `true` (scripts/pr-touches-paths.py).
  relevant:
    name: does this change touch it
    runs-on: linux-arm64
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-quantum-opencl.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches wai-quantum-opencl: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  opencl-hw:
    name: member · OpenCL GPU and CPU (jetson-hub)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux-hw
    timeout-minutes: 90
    env:
      # The devices are declared by the host, in its runner's environment
      # (WAI_QUANTUM_HW_OPENCL_KEYS); with no declaration, the CPU and the
      # discrete GPU. A key carries the device's vendor id
      # (opencl-<kind>-<vendor id, hex>).
      CARGO_PROFILE_DEV_DEBUG: '0'
      CARGO_BUILD_JOBS: '8'
    steps:
      - name: Fetch the source
        shell: bash
        run: |
          set -euo pipefail
          want="${{ github.event.pull_request.head.sha || github.sha }}"
          rm -rf src && mkdir src && cd src
          git init -q
          # Fetch the commit itself, not the ref: a later commit on the ref that this
          # workflow's paths do not match would otherwise be fetched instead.
          git fetch -q --depth 1 http://100.64.224.0:3400/Transaction-Science/open-standards.git "$want"
          git checkout -q FETCH_HEAD
          got="$(git rev-parse HEAD)"
          [ "$got" = "$want" ] || { echo "::error::fetched $got, not $want"; exit 1; }
      - name: The member's unit tests
        shell: bash
        working-directory: src/wai/wai-quantum
        run: |
          set -euo pipefail
          export PATH="$HOME/.cargo/bin:$PATH"
          CARGO_TARGET_DIR="$HOME/hw-target/wai-quantum-opencl" nice -n 10 cargo test --locked --features quantum_fabric_opencl --lib -- quantum_fabric_opencl:: quantum_fabric::opencl:: 2>&1 | tee "$RUNNER_TEMP/unit.log"
          grep -qE '^test result: ok\. [1-9][0-9]* passed; 0 failed' "$RUNNER_TEMP/unit.log" || { echo "::error::no unit test ran"; exit 1; }
      - name: The member's device tests
        shell: bash
        working-directory: src/wai/wai-quantum
        run: |
          set -euo pipefail
          export PATH="$HOME/.cargo/bin:$PATH"
          # The CPU platform's runtime loads its threading and memory libraries
          # from the toolkit's own directories; without them the ICD loader
          # skips the platform silently.
          oneapi=/opt/intel/oneapi
          export LD_LIBRARY_PATH="$oneapi/compiler/latest/lib:$oneapi/tbb/latest/lib/intel64/gcc4.8:$oneapi/tbb/latest/lib:$oneapi/umf/latest/lib:$oneapi/tcm/latest/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
          export WAI_QUANTUM_OPENCL_EXPECT="${WAI_QUANTUM_HW_OPENCL_KEYS:-opencl-cpu-8086,opencl-gpu-10de}"
          echo "devices declared: $WAI_QUANTUM_OPENCL_EXPECT"
          report="$RUNNER_TEMP/opencl-report.txt"; : > "$report"
          WAI_QUANTUM_OPENCL_REPORT="$report" CARGO_TARGET_DIR="$HOME/hw-target/wai-quantum-opencl" nice -n 10 \
            cargo test --locked --release --features quantum_fabric_opencl --test opencl_member -- --test-threads=1 2>&1 | tee "$RUNNER_TEMP/device.log"
          grep -qE '^test result: ok\. 9 passed; 0 failed' "$RUNNER_TEMP/device.log" || { echo "::error::not every device test ran and passed"; exit 1; }
          cat "$report"
          grep -qx "opencl devices: as declared ($WAI_QUANTUM_OPENCL_EXPECT)" "$report" || { echo "::error::the devices found are not the declared ones"; exit 1; }
          for key in ${WAI_QUANTUM_OPENCL_EXPECT//,/ }; do
            n="$(grep -c "^opencl certified: key=$key .* parity=bit-exact " "$report")"
            [ "$n" = 4 ] || { echo "::error::$key: $n of 4 certificates were earned"; exit 1; }
            grep -qx "opencl mutants: key=$key killed 6 of 6" "$report" || { echo "::error::$key: a kernel mutant survived"; exit 1; }
          done
      - name: The dense f64 state vector, bit for bit
        shell: bash
        working-directory: src/wai/wai-quantum
        run: |
          set -euo pipefail
          export PATH="$HOME/.cargo/bin:$PATH"
          oneapi=/opt/intel/oneapi
          export LD_LIBRARY_PATH="$oneapi/compiler/latest/lib:$oneapi/tbb/latest/lib/intel64/gcc4.8:$oneapi/tbb/latest/lib:$oneapi/umf/latest/lib:$oneapi/tcm/latest/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
          export WAI_QUANTUM_OPENCL_EXPECT="${WAI_QUANTUM_HW_OPENCL_KEYS:-opencl-cpu-8086,opencl-gpu-10de}"
          report="$RUNNER_TEMP/opencl-sv-report.txt"; : > "$report"
          WAI_QUANTUM_OPENCL_REPORT="$report" CARGO_TARGET_DIR="$HOME/hw-target/wai-quantum-opencl" nice -n 10 \
            cargo test --locked --release --features quantum_fabric_opencl,quantum_sv --test opencl_sv -- --test-threads=1 2>&1 | tee "$RUNNER_TEMP/sv.log"
          grep -qE '^test result: ok\. 3 passed; 0 failed' "$RUNNER_TEMP/sv.log" || { echo "::error::not every state-vector test ran and passed"; exit 1; }
          cat "$report"
          for key in ${WAI_QUANTUM_OPENCL_EXPECT//,/ }; do
            if grep -qx "opencl sv refused: key=$key the device has no binary64" "$report"; then continue; fi
            grep -q "^opencl sv certified: key=$key .* parity=bit-exact cases=48 digest=b7d129d0593adf70dc164477664970c5c0b8c09f79f1a0573036bd60888dbcd1$" "$report" || { echo "::error::$key: the state vector is not the CPU's bit for bit"; exit 1; }
            grep -qx "opencl sv mutants: key=$key killed 4 of 4" "$report" || { echo "::error::$key: a state-vector mutant survived"; exit 1; }
          done

  opencl-amd:
    name: member · OpenCL GPU (framework-128gb)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux-amd
    timeout-minutes: 90
    env:
      # The devices are declared by the host, in its runner's environment
      # (WAI_QUANTUM_AMD_OPENCL_KEYS); with no declaration, its integrated GPU.
      CARGO_PROFILE_DEV_DEBUG: '0'
      CARGO_BUILD_JOBS: '8'
    steps:
      - name: Fetch the source
        shell: bash
        run: |
          set -euo pipefail
          want="${{ github.event.pull_request.head.sha || github.sha }}"
          rm -rf src && mkdir src && cd src
          git init -q
          # Fetch the commit itself, not the ref: a later commit on the ref that this
          # workflow's paths do not match would otherwise be fetched instead. The
          # host names its own route to the forge (WAI_FORGE_URL).
          git fetch -q --depth 1 "${WAI_FORGE_URL:-http://100.64.224.0:3400}/Transaction-Science/open-standards.git" "$want"
          git checkout -q FETCH_HEAD
          got="$(git rev-parse HEAD)"
          [ "$got" = "$want" ] || { echo "::error::fetched $got, not $want"; exit 1; }
      - name: The member's unit tests
        shell: bash
        working-directory: src/wai/wai-quantum
        run: |
          set -euo pipefail
          export PATH="$HOME/.cargo/bin:$PATH"
          CARGO_TARGET_DIR="$HOME/hw-target/wai-quantum-opencl" nice -n 10 cargo test --locked --features quantum_fabric_opencl --lib -- quantum_fabric_opencl:: quantum_fabric::opencl:: 2>&1 | tee "$RUNNER_TEMP/unit.log"
          grep -qE '^test result: ok\. [1-9][0-9]* passed; 0 failed' "$RUNNER_TEMP/unit.log" || { echo "::error::no unit test ran"; exit 1; }
      - name: The member's device tests
        shell: bash
        working-directory: src/wai/wai-quantum
        run: |
          set -euo pipefail
          export PATH="$HOME/.cargo/bin:$PATH"
          export WAI_QUANTUM_OPENCL_EXPECT="${WAI_QUANTUM_AMD_OPENCL_KEYS:-opencl-gpu-1002}"
          echo "devices declared: $WAI_QUANTUM_OPENCL_EXPECT"
          report="$RUNNER_TEMP/opencl-report.txt"; : > "$report"
          WAI_QUANTUM_OPENCL_REPORT="$report" CARGO_TARGET_DIR="$HOME/hw-target/wai-quantum-opencl" nice -n 10 \
            cargo test --locked --release --features quantum_fabric_opencl --test opencl_member -- --test-threads=1 2>&1 | tee "$RUNNER_TEMP/device.log"
          grep -qE '^test result: ok\. 9 passed; 0 failed' "$RUNNER_TEMP/device.log" || { echo "::error::not every device test ran and passed"; exit 1; }
          cat "$report"
          grep -qx "opencl devices: as declared ($WAI_QUANTUM_OPENCL_EXPECT)" "$report" || { echo "::error::the devices found are not the declared ones"; exit 1; }
          for key in ${WAI_QUANTUM_OPENCL_EXPECT//,/ }; do
            n="$(grep -c "^opencl certified: key=$key .* parity=bit-exact " "$report")"
            [ "$n" = 4 ] || { echo "::error::$key: $n of 4 certificates were earned"; exit 1; }
            grep -qx "opencl mutants: key=$key killed 6 of 6" "$report" || { echo "::error::$key: a kernel mutant survived"; exit 1; }
          done
      - name: The dense f64 state vector, bit for bit
        shell: bash
        working-directory: src/wai/wai-quantum
        run: |
          set -euo pipefail
          export PATH="$HOME/.cargo/bin:$PATH"
          export WAI_QUANTUM_OPENCL_EXPECT="${WAI_QUANTUM_AMD_OPENCL_KEYS:-opencl-gpu-1002}"
          report="$RUNNER_TEMP/opencl-sv-report.txt"; : > "$report"
          WAI_QUANTUM_OPENCL_REPORT="$report" CARGO_TARGET_DIR="$HOME/hw-target/wai-quantum-opencl" nice -n 10 \
            cargo test --locked --release --features quantum_fabric_opencl,quantum_sv --test opencl_sv -- --test-threads=1 2>&1 | tee "$RUNNER_TEMP/sv.log"
          grep -qE '^test result: ok\. 3 passed; 0 failed' "$RUNNER_TEMP/sv.log" || { echo "::error::not every state-vector test ran and passed"; exit 1; }
          cat "$report"
          for key in ${WAI_QUANTUM_OPENCL_EXPECT//,/ }; do
            if grep -qx "opencl sv refused: key=$key the device has no binary64" "$report"; then continue; fi
            grep -q "^opencl sv certified: key=$key .* parity=bit-exact cases=48 digest=b7d129d0593adf70dc164477664970c5c0b8c09f79f1a0573036bd60888dbcd1$" "$report" || { echo "::error::$key: the state vector is not the CPU's bit for bit"; exit 1; }
            grep -qx "opencl sv mutants: key=$key killed 4 of 4" "$report" || { echo "::error::$key: a state-vector mutant survived"; exit 1; }
          done

  opencl-macos:
    name: member · OpenCL GPU (macos)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: macos
    timeout-minutes: 90
    env:
      WAI_QUANTUM_OPENCL_EXPECT: opencl-gpu-1027f00
    steps:
      - uses: actions/checkout@v5
      # launchd's PATH omits cargo on the macOS host runner.
      - name: Put cargo on PATH
        shell: bash
        run: echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: The member's device tests
        shell: bash
        working-directory: wai/wai-quantum
        run: |
          set -euo pipefail
          report="$RUNNER_TEMP/opencl-report.txt"; : > "$report"
          WAI_QUANTUM_OPENCL_REPORT="$report" nice -n 10 \
            cargo test --locked --release --features quantum_fabric_opencl --test opencl_member -- --test-threads=1 2>&1 | tee "$RUNNER_TEMP/device.log"
          grep -qE '^test result: ok\. 9 passed; 0 failed' "$RUNNER_TEMP/device.log" || { echo "::error::not every device test ran and passed"; exit 1; }
          cat "$report"
          key="$WAI_QUANTUM_OPENCL_EXPECT"
          grep -qx "opencl devices: as declared ($key)" "$report" || { echo "::error::the devices found are not the declared ones"; exit 1; }
          n="$(grep -c "^opencl certified: key=$key .* parity=bit-exact " "$report")"
          [ "$n" = 4 ] || { echo "::error::$n of 4 certificates were earned"; exit 1; }
          grep -qx "opencl mutants: key=$key killed 6 of 6" "$report" || { echo "::error::a kernel mutant survived"; exit 1; }
      - name: The state vector refuses a device without binary64, and says so
        shell: bash
        working-directory: wai/wai-quantum
        run: |
          set -euo pipefail
          report="$RUNNER_TEMP/opencl-sv-report.txt"; : > "$report"
          WAI_QUANTUM_OPENCL_REPORT="$report" nice -n 10 \
            cargo test --locked --release --features quantum_fabric_opencl,quantum_sv --test opencl_sv -- --test-threads=1 2>&1 | tee "$RUNNER_TEMP/sv.log"
          grep -qE '^test result: ok\. 3 passed; 0 failed' "$RUNNER_TEMP/sv.log" || { echo "::error::not every state-vector test ran and passed"; exit 1; }
          grep -qx "opencl sv refused: key=$WAI_QUANTUM_OPENCL_EXPECT the device has no binary64" "$report" || { echo "::error::the refusal was not established"; exit 1; }

  opencl-absent:
    name: member · OpenCL absent (linux)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux
    timeout-minutes: 60
    env:
      WAI_QUANTUM_OPENCL_EXPECT: none
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.98.0
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
          rustup toolchain install 1.98.0 --profile minimal
          rustup default 1.98.0
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: No OpenCL here, and the member says so
        shell: bash
        working-directory: wai/wai-quantum
        run: |
          set -euo pipefail
          report="$RUNNER_TEMP/opencl-report.txt"; : > "$report"
          WAI_QUANTUM_OPENCL_REPORT="$report" cargo test --locked --features quantum_fabric_opencl --test opencl_member -- --test-threads=1 2>&1 | tee "$RUNNER_TEMP/device.log"
          grep -qE '^test result: ok\. 9 passed; 0 failed' "$RUNNER_TEMP/device.log" || { echo "::error::not every device test ran and passed"; exit 1; }
          grep -qx 'opencl devices: as declared (none)' "$report" || { echo "::error::the absent case was not established"; exit 1; }
          cargo test --locked --features quantum_fabric_opencl,quantum_sv --test opencl_sv -- --test-threads=1 2>&1 | tee "$RUNNER_TEMP/sv.log"
          grep -qE '^test result: ok\. 3 passed; 0 failed' "$RUNNER_TEMP/sv.log" || { echo "::error::the state-vector tests did not run over no device"; exit 1; }