[1/3] Managed Torch runtime foundation and cross-platform installation

.gitattributes

@@ -1,10 +1,19 @@
 # Attribution hashes must match native checkouts even with core.autocrlf=true.
+*.py text eol=lf
 rust/Cargo.lock text eol=lf
 rust/**/Cargo.toml text eol=lf
 pnpm-lock.yaml text eol=lf
 electron/package.json text eol=lf
 frontend/package.json text eol=lf
+scripts/release/artifact-plan.json text eol=lf
+scripts/release/licenses/managed-python-sources.json text eol=lf
+scripts/release/torch-managed-python-acceptance.py text eol=lf
+rust/crates/pumas-app-manager/src/version_manager/managed_python.rs text eol=lf
+docs/plans/torch-cross-platform-runtime-management/reports/v2.14.0-*-cpu-rpc-restart-acceptance/runtime.json text eol=lf
+docs/plans/torch-cross-platform-runtime-management/reports/managed-python-license-collection/*/managed-python-licenses/full-archive-manifest.json text eol=lf
 
 # Preserve verbatim third-party legal bytes, including mixed line endings.
 scripts/release/licenses/* -text -whitespace
 docs/release-attribution/**/THIRD-PARTY-NOTICES.txt -text -whitespace
+# Archive-captured CPython metadata and license texts are evidence and must remain verbatim.
+docs/plans/torch-cross-platform-runtime-management/reports/managed-python-license-collection/**/managed-python-licenses/full-archive/** -text -whitespace

.github/workflows/build.yml

@@ -5,7 +5,8 @@ on:
     branches: [main]
     tags: ['v*']
   pull_request:
-    branches: [main]
+    # Temporary review bases for the three-part Torch PR stack.
+    branches: [main, prep/torch-managed-foundation, prep/torch-install-flow]
   workflow_dispatch:
 
 permissions:
@@ -88,7 +89,7 @@ jobs:
         include:
           - os: ubuntu-24.04
             headless_os: linux
-          - os: macos-14
+          - os: macos-15
             headless_os: macos
           - os: windows-2025
             headless_os: windows
@@ -164,12 +165,24 @@ jobs:
           if-no-files-found: error
 
   torch-quality:
-    name: Torch source QA
+    name: Torch native QA (${{ matrix.os }})
     needs: lint-workflows
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, windows-2025, macos-15]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Install repository Rust toolchain
+        run: rustup toolchain install --no-self-update
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: rust -> target
+          key: torch-native-${{ runner.os }}
       - uses: actions/setup-python@v6
         with:
           python-version-file: .python-version
@@ -178,8 +191,82 @@ jobs:
       - run: python -m pip install -r torch-server/requirements-dev.txt
       - run: python -m ruff check torch-server scripts/release
       - run: python -m ruff format --check torch-server scripts/release
-      # Unit fixtures do not claim GPU inference or a shipped Torch runtime.
+      # Fixtures validate tags and resolver behavior; the native tests below
+      # validate host APIs without claiming GPU inference or model support.
       - run: python -m unittest discover -s torch-server/tests
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.14'
+      - name: Self-test native Torch acceptance script
+        run: python scripts/release/torch-managed-python-acceptance.py --self-test
+      - name: Test native Torch wheel filtering
+        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager torch_alternatives
+      - name: Test native managed Python candidate selection
+        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager version_manager::managed_python::tests
+      - name: Test native Torch preview provider paths
+        if: runner.os == 'Linux'
+        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager version_manager::torch_preview::tests
+      - name: Test native Torch preview Python fallback selection
+        if: runner.os == 'Windows' || runner.os == 'macOS'
+        shell: pwsh
+        run: |
+          $testName = 'auto_python_fallback_requires_a_definite_unsupported_attempt'
+          $testList = @(cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager $testName -- --list)
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          if (@($testList | Where-Object { $_ -match '::auto_python_fallback_requires_a_definite_unsupported_attempt: test$' }).Count -eq 0) {
+            throw "No tests matched $testName"
+          }
+          cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager $testName
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Test Windows Torch activation fixture
+        if: runner.os == 'Windows'
+        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager restart_falls_back_from_invalid_active_torch_to_verified_default
+      - name: Test Windows locked-stage cleanup ownership
+        if: runner.os == 'Windows'
+        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager locked_stage_stays_owned
+      - name: Test native managed Python paths
+        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library test_venv_python_path
+      - name: Test Unix managed process-group ownership
+        if: runner.os != 'Windows'
+        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library platform::managed_child
+      - name: Test Windows managed Job ownership
+        if: runner.os == 'Windows'
+        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library platform::managed_child
+
+  torch-native-e2e:
+    name: Torch native RPC E2E (${{ matrix.os }})
+    needs: lint-workflows
+    if: github.event_name == 'workflow_dispatch' || (github.ref_type == 'tag' && startsWith(github.ref_name, 'v'))
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, windows-2025, macos-15]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Install repository Rust toolchain
+        run: rustup toolchain install --no-self-update
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: rust -> target
+          key: torch-native-e2e-${{ runner.os }}
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.14'
+      - name: Build native RPC for Torch acceptance
+        run: cargo build --locked --manifest-path rust/Cargo.toml -p pumas-rpc
+      - name: Accept v2.14 CPU/Core via native RPC (${{ runner.os }})
+        run: python scripts/release/torch-managed-python-acceptance.py rust/target/debug --evidence-dir torch-native-evidence
+      - name: Upload native Torch acceptance evidence
+        if: always()
+        uses: actions/upload-artifact@v7.0.1
+        with:
+          name: torch-native-${{ runner.os }}
+          path: torch-native-evidence/
+          if-no-files-found: ignore
 
   build-rust:
     name: Rust release (${{ matrix.os }})
@@ -188,7 +275,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04, macos-14]
+        os: [ubuntu-24.04, macos-15]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 120
     steps:
@@ -228,7 +315,7 @@ jobs:
         include:
           - os: ubuntu-24.04
             platform: linux
-          - os: macos-14
+          - os: macos-15
             platform: mac
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
@@ -294,7 +381,7 @@ jobs:
             platform: linux
             headless: headless-linux
             check: linux-no-inference
-          - os: macos-14
+          - os: macos-15
             platform: mac
             headless: headless-macos
             check: mac-no-inference

.pre-commit-config.yaml

@@ -18,10 +18,10 @@ repos:
     rev: v4.5.0
     hooks:
       - id: trailing-whitespace
-        # Preserve verbatim upstream legal texts and their recorded hashes.
-        exclude: ^(scripts/release/licenses/|docs/release-attribution/)
+        # Preserve verbatim upstream legal texts and hash-pinned archive evidence.
+        exclude: ^(scripts/release/licenses/|docs/release-attribution/|docs/plans/torch-cross-platform-runtime-management/reports/managed-python-license-collection/.*/managed-python-licenses/full-archive/)
       - id: end-of-file-fixer
-        exclude: ^(scripts/release/licenses/|docs/release-attribution/)
+        exclude: ^(scripts/release/licenses/|docs/release-attribution/|docs/plans/torch-cross-platform-runtime-management/reports/managed-python-license-collection/.*/managed-python-licenses/full-archive/)
       - id: check-yaml
       - id: check-merge-conflict
       - id: check-json