feat: enable transformers v5 + add NVFP4/FP8/MXFP4 quantization schemes

[binaryaaron]

Summary

Stacked on top of #464 (vLLM 0.20 + torch 2.11 + CUDA 12.9 bump). When that lands, this PR auto-rebases onto main.

• Lifts dep floors: accelerate>=1.1.0, peft>=0.18.0, bitsandbytes>=0.46.1, huggingface-hub>=1.3,<2.
• Code: drops utils.is_safetensors_available() (helper removed in v5; safetensors is mandatory), drops safe_serialization= from save_pretrained() (parameter gone), and eagerly calls model_rebuild() on ModelMetadata subclasses to resolve Pydantic 2.12 + v5 type hints with from __future__ import annotations.
• New training.quantization_scheme config field: bnb-4bit, bnb-8bit, fp8, nvfp4, mxfp4. Legacy quantization_bits still works (back-compat).
• get_quantization_config() now dispatches on the scheme and returns the right v5 config class (BitsAndBytesConfig, FineGrainedFP8Config, TorchAoConfig(NVFP4WeightOnlyConfig), Mxfp4Config).
• LoftQ now raises ParameterError when paired with a non-bitsandbytes scheme (LoftQ requires the BNB runtime).
• Preflight memory estimator uses scheme.effective_bits for non-BNB schemes.
• New load_fast_tokenizer() helper centralizes the 4 AutoTokenizer.from_pretrained call sites and logs a warning when v5 falls back to the slow Python backend.
• Docs: new Quantization schemes section in configuration.md (per-scheme hardware/bits/backend table), troubleshooting entries for the vLLM-v5 resolver conflict and the slow-tokenizer warning, CHANGELOG entries.

Backward compatibility

• Existing configs with quantization_bits: 4 or quantization_bits: 8 and no quantization_scheme continue to work — the resolver maps them to bnb-4bit / bnb-8bit and the get_quantization_config(4) / get_quantization_config(8) integer callable signature is preserved.
• Existing Trainer(processing_class=...) call site was already v5-correct; no behavioral change.
• is_safetensors_available() removal makes safetensors.torch an unconditional import — v5 already requires this.

Test plan

• make test and make test-e2e

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Upgrade to Transformers v5; add a scheme-driven QuantizationScheme and generalized quantization config; centralize fast-tokenizer loading with a slow-backend warning; refactor HuggingFace backend, DP/save logic, dependency constraints, docs, and tests to use the new scheme and v5 APIs.

Changes

Transformers v5 Upgrade with Quantization Scheme Refactor

Layer / File(s)	Summary
Quantization Scheme Type & Config Schema src/nemo_safe_synthesizer/config/training.py	Adds QuantizationScheme StrEnum with properties (effective_bits, is_bitsandbytes), exposes it in __all__, adds TrainingHyperparams.quantization_scheme, and documents quantization_bits as a legacy fallback.
Fast Tokenizer Abstraction & Model Metadata src/nemo_safe_synthesizer/llm/utils.py, src/nemo_safe_synthesizer/llm/metadata.py	Introduce load_fast_tokenizer() forcing use_fast=True and warning on slow tokenizer; replace AutoTokenizer.from_pretrained() usages in prompt/metadata; add import-time Pydantic model_rebuild() for metadata forward refs.
Quantization Config Generalization src/nemo_safe_synthesizer/llm/utils.py	Refactor get_quantization_config() to accept QuantizationScheme | str | Literal[4, 8] and return QuantizationConfigMixin for BNB 4/8-bit, FP8, NVFP4, MXFP4; update TYPE_CHECKING typing accordingly.
HuggingFace Backend Integration src/nemo_safe_synthesizer/training/huggingface_backend.py	Use load_fast_tokenizer() in _load_pretrained_model; add _resolve_quantization_scheme() preferring quantization_scheme with bits fallback; change _get_quantization_config_if_enabled() to use scheme API; enforce LoftQ compatibility and set LoftQ bits from scheme effective bits; remove fixed group_by_length runtime arg.
DP Training, Save Behavior & v5 Cleanups src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py, src/nemo_safe_synthesizer/preflight/checks/environment.py, src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py	Unconditionally import safetensors.torch; update OpacusDPTrainer.create_optimizer signature; allow int for num_items_in_batch and remove v4-era TypeError shim around compute_loss; drop safe_serialization arg from save_pretrained; gate safetensors save via getattr; save processor post-save; prefer scheme effective bits in bytes_per_base_weight(); add tenacity type-ignore.
Documentation & Dependency Constraints CHANGELOG.md, docs/user-guide/configuration.md, docs/user-guide/troubleshooting.md, pyproject.toml	Document training.quantization_scheme, list supported schemes and backend mappings, show YAML example and LoftQ compatibility notes; add troubleshooting for Transformers v5/vLLM resolution conflicts and slow-tokenizer warnings; bump huggingface-hub and transformers ranges and relax optional group pins for accelerate, bitsandbytes, and peft.
Tests & Test Fixtures tests/training/test_huggingface_backend.py, tests/data_processing/*, tests/generation/*, tests/smoke/*, tests/llm/*, tests/llm/test_utils.py	Update tokenizer tests to patch load_fast_tokenizer(); adapt quantization tests to QuantizationScheme enum and add scheme-override test; add DP test for disabling model gradient checkpointing; add runtime type assertions and cast uses in fixtures/tests; add unit tests for load_fast_tokenizer and invalid quantization alias handling.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested reviewers

• kendrickb-nvidia

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and clearly describes the main changes: enabling transformers v5 and adding new quantization schemes (NVFP4/FP8/MXFP4), which are the primary objectives of this PR.
Docstring Coverage	✅ Passed	Docstring coverage is 84.48% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch aagonzales/feat/transformers-v5

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

CHANGELOG.md (1)

1-1: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Add SPDX headers to this Markdown file.

This file is missing the required SPDX header block for .md sources, which can break repository compliance/format checks.

Suggested fix

+<!-- SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
 # ___PROJECT___ 0.0.0 (DD Mon YYYY)

As per coding guidelines, All source files (.py, .sh, .yaml, .yml, .md) require SPDX copyright headers.

🧹 Nitpick comments (1)

src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py (1)

247-247: ⚡ Quick win

Remove the unnecessary # type: ignore comment.

The type signature of before_sleep_log(logger, logging.WARNING) matches tenacity's expected Callable[[RetryCallState], None] contract for the before_sleep parameter. The type ignore is not suppressing a real mismatch. Remove it and run type checking to confirm.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 69db11f4-8a23-42a2-976c-5f54f05e8037

📥 Commits

Reviewing files that changed from the base of the PR and between 786660b and 5b81d84.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock, !uv.lock

📒 Files selected for processing (12)

• CHANGELOG.md
• docs/user-guide/configuration.md
• docs/user-guide/troubleshooting.md
• pyproject.toml
• src/nemo_safe_synthesizer/config/training.py
• src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py
• src/nemo_safe_synthesizer/llm/metadata.py
• src/nemo_safe_synthesizer/llm/utils.py
• src/nemo_safe_synthesizer/preflight/checks/environment.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/training/huggingface_backend.py
• tests/training/test_huggingface_backend.py

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)

• GitHub Check: Unit Tests (3.13)
• GitHub Check: Unit Tests (3.12)
• GitHub Check: Unit Tests (3.11)
• GitHub Check: Smoke Tests

🧰 Additional context used

📓 Path-based instructions (19)

**/*.{md,markdown,py}

📄 CodeRabbit inference engine (.cursor/rules/agent-markdown-style.mdc)

**/*.{md,markdown,py}: Avoid decorative bold (**text**) in list items, body text, and docstrings; use structural cues (headers, list markers, colons, backticks) for emphasis instead
Use backticks for code identifiers, paths, and CLI commands in markdown and docstrings

Files:

• docs/user-guide/troubleshooting.md
• src/nemo_safe_synthesizer/preflight/checks/environment.py
• src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py
• docs/user-guide/configuration.md
• CHANGELOG.md
• src/nemo_safe_synthesizer/llm/metadata.py
• tests/training/test_huggingface_backend.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py
• src/nemo_safe_synthesizer/training/huggingface_backend.py
• src/nemo_safe_synthesizer/config/training.py

**/*.{md,markdown}

📄 CodeRabbit inference engine (.cursor/rules/agent-markdown-style.mdc)

**/*.{md,markdown}: Bold is acceptable only in markdown tables where it's the conventional way to mark header-like cells in the body
Use ## headers to segment markdown sections instead of bold text
Use -- (em-dash) instead of - (hyphen) for asides in markdown

Files:

• docs/user-guide/troubleshooting.md
• docs/user-guide/configuration.md
• CHANGELOG.md

docs/**/*.md

📄 CodeRabbit inference engine (.cursor/rules/writing-docs.mdc)

docs/**/*.md: Classify documentation content using the Diataxis framework (TUTORIAL, HOW-TO, EXPLANATION, or REFERENCE) before writing, ensuring each page fits exactly ONE type
Use cross-links between different Diataxis content types (TUTORIAL, HOW-TO, EXPLANATION, REFERENCE) to connect related documentation
Use MkDocs Material admonitions syntax for notes, warnings, and collapsible tips: !!! note, !!! warning, ??? tip
Use MkDocs Material tabs syntax (=== "Label") for presenting multiple examples or implementations side-by-side
Use code blocks with metadata (title, hl_lines) to highlight relevant code snippets in documentation examples
Use Mermaid diagrams (flowchart, sequence diagrams, etc.) for visualizing architecture, workflows, and concepts in documentation
Write documentation following high signal-to-noise principles: every sentence must earn its place by providing essential information
Use progressive disclosure in documentation: start with simple concepts, then layer complexity for advanced readers
Include working code examples in documentation; ensure all code snippets are tested and actually work
List all prerequisites at the top of documentation pages before diving into main content
End documentation pages with 'Next steps' section containing links to related content and logical progression points

Classify documentation pages as tutorial, how-to, explanation, or reference per the Diataxis framework. Use MkDocs Material syntax for admonitions (!!! note), tabs (===), and code blocks with titles and highlights.

docs/**/*.md: Documentation pages are located in docs/ following Diataxis framework with subdirectories: getting-started/ (tutorials), user-guide/ (how-tos and reference), architecture/ (explanations), reference/ (API reference), and blog/ (dev notes)
Markdown documentation should use MkDocs Material features including admonitions (!!! note, !!! warning, ??? tip), content tabs, code blocks with syntax highlighting, Mermaid di...

Files:

• docs/user-guide/troubleshooting.md
• docs/user-guide/configuration.md

**/*.md

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*.md: No decorative **bold** in body text, list items, or docstrings. Use headers, list markers, colons, and backticks for structure.
Use -- (em-dash) for asides, not - (hyphen).
Use single backticks for code identifiers, paths, and CLI commands in Markdown.
Use Mermaid diagrams with no spaces in node IDs, quote labels with special characters, no explicit colors or styles.
Include SPDX copyright header in Markdown files using HTML comments: <!-- SPDX-FileCopyrightText: ... --> and <!-- SPDX-License-Identifier: Apache-2.0 -->. Exception: for .md files with YAML frontmatter, include hash-comment headers inside the frontmatter block.

Files:

• docs/user-guide/troubleshooting.md
• docs/user-guide/configuration.md
• CHANGELOG.md

**/*

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*: Include a newline at the end of all files, never trailing whitespace. This is enforced by pre-commit.
Use line length of 120 characters for code, comments, and docstrings (configured in ruff.toml).

Files:

• docs/user-guide/troubleshooting.md
• src/nemo_safe_synthesizer/preflight/checks/environment.py
• src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py
• docs/user-guide/configuration.md
• CHANGELOG.md
• src/nemo_safe_synthesizer/llm/metadata.py
• tests/training/test_huggingface_backend.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py
• src/nemo_safe_synthesizer/training/huggingface_backend.py
• src/nemo_safe_synthesizer/config/training.py
• pyproject.toml

---

⚙️ CodeRabbit configuration file

**/*: Review as a senior maintainer for NeMo Safe Synthesizer. Prioritize issues that can change behavior, break user workflows, weaken privacy guarantees, hide failures, make tests unreliable, or create maintenance risk. Avoid generic style commentary unless it points to a concrete project convention that automated tools will not catch.
Comment only when the finding is actionable and tied to changed code. For each finding, state the impact, the condition that triggers it, and the smallest practical fix. Prefer one precise comment over broad advice. Do not ask for refactors outside the PR scope unless the changed code creates the problem.
Review type guidance: - Potential issue: use for correctness bugs, data loss, privacy leaks,
security risks, broken public APIs, invalid config behavior, missing
validation, hidden failures, nondeterministic tests, or CI breakage.

• Refactor suggestion: use for local maintainability problems introduced
  by the diff when they have clear future cost, such as duplicated setup,
  unclear boundaries, over-mocking, avoidable complexity, or opaque test
  helpers.
• Nitpick: avoid in chill mode. Do not emit formatting, import-order,
  wording, or style-only comments unless automated tools cannot catch the
  issue and it affects maintainability.

Severity guidance: - Critical: security/privacy leaks, data loss, training/test/holdout
contamination, or broken release/package/core pipeline execution.

• Major: incorrect generation/training/evaluation behavior, broken
  CLI/SDK public API, invalid config defaults or validators, or GPU/vLLM
  cleanup and process-isolation bugs likely to fail CI or production
  runs.
• Minor: localized bugs, missing focused tests for changed behavior, or
  bad test patterns that weaken regression coverage.
• Trivial: small cleanup with no behavior impact. Usually suppress in
  chill mode.
• Info: context only. Avoid unless it helps reviewers understand risk.
  Safe-Synthesizer-specific review focus: - Data ...

Files:

• docs/user-guide/troubleshooting.md
• src/nemo_safe_synthesizer/preflight/checks/environment.py
• src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py
• docs/user-guide/configuration.md
• CHANGELOG.md
• src/nemo_safe_synthesizer/llm/metadata.py
• tests/training/test_huggingface_backend.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py
• src/nemo_safe_synthesizer/training/huggingface_backend.py
• src/nemo_safe_synthesizer/config/training.py
• pyproject.toml

**/*.{py,sh,yaml,yml,md}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

All source files (.py, .sh, .yaml, .yml, .md) require SPDX copyright headers; use make format to add them automatically

Files:

• docs/user-guide/troubleshooting.md
• src/nemo_safe_synthesizer/preflight/checks/environment.py
• src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py
• docs/user-guide/configuration.md
• CHANGELOG.md
• src/nemo_safe_synthesizer/llm/metadata.py
• tests/training/test_huggingface_backend.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py
• src/nemo_safe_synthesizer/training/huggingface_backend.py
• src/nemo_safe_synthesizer/config/training.py

docs/**

⚙️ CodeRabbit configuration file

Review documentation as MkDocs Material content. Check Diataxis fit, accurate commands, internal links, code fences, and markdown style from STYLE_GUIDE.md.

Files:

• docs/user-guide/troubleshooting.md
• docs/user-guide/configuration.md

**/*.py

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*.py: Use American English spelling: 'initialize' not 'initialise', 'recognize' not 'recognise', 'color' not 'colour'.
Use observability.get_logger(__name__) for logging, never logging.getLogger() or structlog.get_logger() directly.
Use category loggers: .runtime for internals, .user for progress/results, .system for system events.
Never use print() for operational output. Use click.echo() for CLI output or sys.stdout.write() for raw output in tools.
Use extra={} in logging for structured data that downstream tools should query or aggregate; use f-strings for human-readable context.
Raise from the custom error hierarchy with dual inheritance: SafeSynthesizerError (base), UserError, DataError, ParameterError, GenerationError, InternalError.
Use NSSBaseModel for config/parameter models in config/ which define user-facing configuration. Use raw BaseModel or module-specific bases for data transfer objects and internal structures.
Use BaseSettings for env/CLI settings. Prefer AliasChoices on individual fields when a field needs to respond to both its Python name and an env var name.
Include Field(description=...) for Pydantic model fields as the canonical field docstring for API documentation and CLI help text.
Use assignment-style type = Field(default=..., description="...") as the default for Pydantic model fields because type checkers understand default, default_factory, and alias in assignment style.
Use Annotated only when the field carries additional metadata beyond Field() -- ValueValidator, AutoParam, DependsOnValidator, reusable constrained type aliases, nested-type constraints, or discriminated unions.
Put defaults as bare assignment (= value), not inside Field(default=...), when using Annotated. Exception: use assignment-style Field(default_factory=...) for defaults that cannot be expressed as bare assignments.
Use @dataclass(frozen=True) for immutable value objects and validators; mu...

Files:

• src/nemo_safe_synthesizer/preflight/checks/environment.py
• src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py
• src/nemo_safe_synthesizer/llm/metadata.py
• tests/training/test_huggingface_backend.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py
• src/nemo_safe_synthesizer/training/huggingface_backend.py
• src/nemo_safe_synthesizer/config/training.py

src/**/*.py

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

src/**/*.py: Use relative imports in src/ (e.g., from ..observability import get_logger).
Do not use print() statements in library code. Use get_logger(__name__) from observability.py or click.echo() for CLI.
Do not use assert for validation in library code. Use if/raise for input validation. assert statements can be stripped by -O and must never guard correctness.

API reference documentation is auto-generated from Python docstrings using Google-style formatting; write docstrings in src/nemo_safe_synthesizer/ and they will appear in the reference section on next build

Files:

• src/nemo_safe_synthesizer/preflight/checks/environment.py
• src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py
• src/nemo_safe_synthesizer/llm/metadata.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py
• src/nemo_safe_synthesizer/training/huggingface_backend.py
• src/nemo_safe_synthesizer/config/training.py

---

⚙️ CodeRabbit configuration file

Review library code against STYLE_GUIDE.md. Focus on behavior, API contracts, error handling, resource cleanup, typing, logging, and user-facing failures. Public APIs and nontrivial functions need Google-style docstrings.

Files:

• src/nemo_safe_synthesizer/preflight/checks/environment.py
• src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py
• src/nemo_safe_synthesizer/llm/metadata.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py
• src/nemo_safe_synthesizer/training/huggingface_backend.py
• src/nemo_safe_synthesizer/config/training.py

**/*.{py,sh,yaml,yml}

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

Include SPDX copyright header at the top: # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. and # SPDX-License-Identifier: Apache-2.0. The make format command handles this automatically.

Files:

• src/nemo_safe_synthesizer/preflight/checks/environment.py
• src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py
• src/nemo_safe_synthesizer/llm/metadata.py
• tests/training/test_huggingface_backend.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py
• src/nemo_safe_synthesizer/training/huggingface_backend.py
• src/nemo_safe_synthesizer/config/training.py

src/nemo_safe_synthesizer/evaluation/**/*.py

⚙️ CodeRabbit configuration file

Treat evaluation changes as correctness-sensitive. Check metric inputs, holdout usage, privacy metric semantics, report data shape, missing-data handling, and whether unavailable metrics fail or degrade intentionally.

Files:

• src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py

tests/**

📄 CodeRabbit inference engine (.cursor/rules/repo-navigation.mdc)

Tests should mirror the src/ directory structure in tests/

Files:

• tests/training/test_huggingface_backend.py

tests/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/repo-navigation.mdc)

Tests in tests/e2e/ should be auto-marked with e2e marker, tests in tests/smoke/ with smoke marker, others with unit marker

tests/**/*.py: Use absolute imports in tests/ (e.g., from nemo_safe_synthesizer.observability import get_logger).
Use fixture_ prefix convention for fixtures for grep-ability and to separate fixtures from test functions. Add a one-line docstring describing the fixture's purpose and data.
Use function-scoped fixtures by default. Session scope only when empirically justified by test runtime.
Use bare assert as the primary assertion style; pytest.raises() with match= for exceptions; pytest.approx() for floating-point comparisons.
Mark CUDA-dependent tests with @pytest.mark.e2e, @pytest.mark.smoke, or @pytest.mark.requires_gpu.
Mock only external boundaries, not internal implementation details.
Ensure test isolation: no shared mutable state or execution-order dependencies between tests. If something must be run first before executing a test, include it in the test or a fixture.
Use @pytest.mark.parametrize for testing multiple input combinations rather than copy-pasting similar tests.

Use make test for unit tests, make test-unit-slow for unit tests including slow tests, make test-smoke for CPU smoke tests, make test-smoke-gpu for GPU smoke tests, and make test-e2e for end-to-end tests before submitting PR

Files:

• tests/training/test_huggingface_backend.py

---

⚙️ CodeRabbit configuration file

Review tests against tests/TESTING.md. Check marker usage, fixture naming, tmp_path usage, determinism, and GPU/vLLM process-isolation requirements. Flag slop tests that only check that code runs, assert result is not None when stronger invariants exist, over-mock internal implementation details, patch around the bug instead of reproducing it, or add broad snapshot/golden churn without a clear contract. Flag change detector tests that fail on harmless refactors, formatting, record ordering, incidental wording, or private implementation details without demonstrating a behavior regression. Prefer existing fixtures or focused new fixtures for repeated setup; keep tests DRY when reasonable without making the behavior under test opaque. print() is allowed in tests.

Files:

• tests/training/test_huggingface_backend.py

**/*test*.py

📄 CodeRabbit inference engine (AGENTS.md)

The unit_test marker is deprecated; use unit instead

Files:

• tests/training/test_huggingface_backend.py

src/nemo_safe_synthesizer/privacy/**/*.py

⚙️ CodeRabbit configuration file

Treat privacy changes as high-risk. Check DP accounting, parameter validation, data leakage, seed handling, model state persistence, and whether privacy guarantees are documented accurately.

Files:

• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py

src/nemo_safe_synthesizer/training/**/*.py

⚙️ CodeRabbit configuration file

Review training changes for dataset preprocessing, model path handling, artifact writes, LoRA/DP behavior, GPU memory usage, reproducibility, and cleanup on failure.

Files:

• src/nemo_safe_synthesizer/training/huggingface_backend.py

src/nemo_safe_synthesizer/config/**/*.py

⚙️ CodeRabbit configuration file

Treat config changes as user-facing API changes. Check Pydantic field descriptions, defaults, validators, aliases, override behavior, CLI help text impact, YAML compatibility, and documented parameter semantics.

Files:

• src/nemo_safe_synthesizer/config/training.py

pyproject.toml

📄 CodeRabbit inference engine (.cursor/rules/repo-navigation.mdc)

Package metadata, dependencies, and extras (cpu/cu128/engine) should be configured in pyproject.toml

Order sections in pyproject.toml as: [project], [dependency-groups], [project.optional-dependencies], [tool.uv], [build-system], [tool.*].

Files:

• pyproject.toml

---

⚙️ CodeRabbit configuration file

Treat pyproject.toml as high-risk. Check package metadata, uv indexes, dependency groups, optional extras, Python version bounds, hatch config, ty config, script entry points, dependency consistency, and whether changes require regenerating uv.lock.

Files:

• pyproject.toml

**/*.toml

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*.toml: Use spaces around = for key-value pairs in TOML files.
Use # comment format for comments in TOML files; use inline comments for dependency pins.

Files:

• pyproject.toml

🪛 LanguageTool

docs/user-guide/configuration.md

[grammar] ~123-~123: Ensure spelling is correct
Context: ...Weight-only NVIDIA FP4. Requires recent torchao. | | mxfp4 | Mxfp4Config | 4 | Vari...

(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)

🪛 Ruff (0.15.12)

src/nemo_safe_synthesizer/llm/utils.py

[warning] 590-590: Do not catch blind exception: Exception

(BLE001)

🔇 Additional comments (3)

src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py (1)

26-26: LGTM!

Also applies to: 49-49, 571-573, 576-576, 654-657, 672-675

src/nemo_safe_synthesizer/preflight/checks/environment.py (1)

209-215: LGTM!

pyproject.toml (1)

28-28: LGTM!

Also applies to: 92-92, 120-121, 126-126, 136-136, 143-144, 153-153, 160-160, 189-189

[coderabbitai]

🧹 Nitpick comments (1)

src/nemo_safe_synthesizer/llm/utils.py (1)

705-718: ⚡ Quick win

Remove or document the ty:ignore[unresolved-import] on Mxfp4Config.

The class exists in transformers v5 (web search confirms it is documented for MXFP4 quantization). The suppress is likely a workaround for incomplete type stubs in transformers, not a missing runtime import. Per the style guide, ty:ignore should not be used without an active fix attempt. Either remove the suppress if type stubs have caught up, or add a comment (e.g., # ty:ignore[unresolved-import] # transformers v5 lacks stubs) explaining the known limitation.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ba45f891-8d35-446f-9e5b-dabe8e1bf785

📥 Commits

Reviewing files that changed from the base of the PR and between b8e2f25 and f42bf59.

📒 Files selected for processing (5)

• src/nemo_safe_synthesizer/llm/utils.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• tests/data_processing/test_assembler.py
• tests/generation/test_processors.py
• tests/smoke/conftest.py

✅ Files skipped from review due to trivial changes (2)

• tests/data_processing/test_assembler.py
• tests/smoke/conftest.py

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)

• GitHub Check: Unit Tests (3.12)
• GitHub Check: Smoke Tests
• GitHub Check: Unit Tests (3.13)
• GitHub Check: Unit Tests (3.11)

🧰 Additional context used

📓 Path-based instructions (10)

**/*.{md,markdown,py}

📄 CodeRabbit inference engine (.cursor/rules/agent-markdown-style.mdc)

**/*.{md,markdown,py}: Avoid decorative bold (**text**) in list items, body text, and docstrings; use structural cues (headers, list markers, colons, backticks) for emphasis instead
Use backticks for code identifiers, paths, and CLI commands in markdown and docstrings

Files:

• tests/generation/test_processors.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py

tests/**

📄 CodeRabbit inference engine (.cursor/rules/repo-navigation.mdc)

Tests should mirror the src/ directory structure in tests/

Files:

• tests/generation/test_processors.py

tests/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/repo-navigation.mdc)

Tests in tests/e2e/ should be auto-marked with e2e marker, tests in tests/smoke/ with smoke marker, others with unit marker

tests/**/*.py: Use absolute imports in tests/ (e.g., from nemo_safe_synthesizer.observability import get_logger).
Use fixture_ prefix convention for fixtures for grep-ability and to separate fixtures from test functions. Add a one-line docstring describing the fixture's purpose and data.
Use function-scoped fixtures by default. Session scope only when empirically justified by test runtime.
Use bare assert as the primary assertion style; pytest.raises() with match= for exceptions; pytest.approx() for floating-point comparisons.
Mark CUDA-dependent tests with @pytest.mark.e2e, @pytest.mark.smoke, or @pytest.mark.requires_gpu.
Mock only external boundaries, not internal implementation details.
Ensure test isolation: no shared mutable state or execution-order dependencies between tests. If something must be run first before executing a test, include it in the test or a fixture.
Use @pytest.mark.parametrize for testing multiple input combinations rather than copy-pasting similar tests.

Use make test for unit tests, make test-unit-slow for unit tests including slow tests, make test-smoke for CPU smoke tests, make test-smoke-gpu for GPU smoke tests, and make test-e2e for end-to-end tests before submitting PR

Files:

• tests/generation/test_processors.py

---

⚙️ CodeRabbit configuration file

Review tests against tests/TESTING.md. Check marker usage, fixture naming, tmp_path usage, determinism, and GPU/vLLM process-isolation requirements. Flag slop tests that only check that code runs, assert result is not None when stronger invariants exist, over-mock internal implementation details, patch around the bug instead of reproducing it, or add broad snapshot/golden churn without a clear contract. Flag change detector tests that fail on harmless refactors, formatting, record ordering, incidental wording, or private implementation details without demonstrating a behavior regression. Prefer existing fixtures or focused new fixtures for repeated setup; keep tests DRY when reasonable without making the behavior under test opaque. print() is allowed in tests.

Files:

• tests/generation/test_processors.py

**/*.py

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*.py: Use American English spelling: 'initialize' not 'initialise', 'recognize' not 'recognise', 'color' not 'colour'.
Use observability.get_logger(__name__) for logging, never logging.getLogger() or structlog.get_logger() directly.
Use category loggers: .runtime for internals, .user for progress/results, .system for system events.
Never use print() for operational output. Use click.echo() for CLI output or sys.stdout.write() for raw output in tools.
Use extra={} in logging for structured data that downstream tools should query or aggregate; use f-strings for human-readable context.
Raise from the custom error hierarchy with dual inheritance: SafeSynthesizerError (base), UserError, DataError, ParameterError, GenerationError, InternalError.
Use NSSBaseModel for config/parameter models in config/ which define user-facing configuration. Use raw BaseModel or module-specific bases for data transfer objects and internal structures.
Use BaseSettings for env/CLI settings. Prefer AliasChoices on individual fields when a field needs to respond to both its Python name and an env var name.
Include Field(description=...) for Pydantic model fields as the canonical field docstring for API documentation and CLI help text.
Use assignment-style type = Field(default=..., description="...") as the default for Pydantic model fields because type checkers understand default, default_factory, and alias in assignment style.
Use Annotated only when the field carries additional metadata beyond Field() -- ValueValidator, AutoParam, DependsOnValidator, reusable constrained type aliases, nested-type constraints, or discriminated unions.
Put defaults as bare assignment (= value), not inside Field(default=...), when using Annotated. Exception: use assignment-style Field(default_factory=...) for defaults that cannot be expressed as bare assignments.
Use @dataclass(frozen=True) for immutable value objects and validators; mu...

Files:

• tests/generation/test_processors.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py

**/*.{py,sh,yaml,yml}

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

Include SPDX copyright header at the top: # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. and # SPDX-License-Identifier: Apache-2.0. The make format command handles this automatically.

Files:

• tests/generation/test_processors.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py

**/*

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*: Include a newline at the end of all files, never trailing whitespace. This is enforced by pre-commit.
Use line length of 120 characters for code, comments, and docstrings (configured in ruff.toml).

Files:

• tests/generation/test_processors.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py

---

⚙️ CodeRabbit configuration file

**/*: Review as a senior maintainer for NeMo Safe Synthesizer. Prioritize issues that can change behavior, break user workflows, weaken privacy guarantees, hide failures, make tests unreliable, or create maintenance risk. Avoid generic style commentary unless it points to a concrete project convention that automated tools will not catch.
Comment only when the finding is actionable and tied to changed code. For each finding, state the impact, the condition that triggers it, and the smallest practical fix. Prefer one precise comment over broad advice. Do not ask for refactors outside the PR scope unless the changed code creates the problem.
Review type guidance: - Potential issue: use for correctness bugs, data loss, privacy leaks,
security risks, broken public APIs, invalid config behavior, missing
validation, hidden failures, nondeterministic tests, or CI breakage.

• Refactor suggestion: use for local maintainability problems introduced
  by the diff when they have clear future cost, such as duplicated setup,
  unclear boundaries, over-mocking, avoidable complexity, or opaque test
  helpers.
• Nitpick: avoid in chill mode. Do not emit formatting, import-order,
  wording, or style-only comments unless automated tools cannot catch the
  issue and it affects maintainability.

Severity guidance: - Critical: security/privacy leaks, data loss, training/test/holdout
contamination, or broken release/package/core pipeline execution.

• Major: incorrect generation/training/evaluation behavior, broken
  CLI/SDK public API, invalid config defaults or validators, or GPU/vLLM
  cleanup and process-isolation bugs likely to fail CI or production
  runs.
• Minor: localized bugs, missing focused tests for changed behavior, or
  bad test patterns that weaken regression coverage.
• Trivial: small cleanup with no behavior impact. Usually suppress in
  chill mode.
• Info: context only. Avoid unless it helps reviewers understand risk.
  Safe-Synthesizer-specific review focus: - Data ...

Files:

• tests/generation/test_processors.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py

**/*test*.py

📄 CodeRabbit inference engine (AGENTS.md)

The unit_test marker is deprecated; use unit instead

Files:

• tests/generation/test_processors.py

**/*.{py,sh,yaml,yml,md}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

All source files (.py, .sh, .yaml, .yml, .md) require SPDX copyright headers; use make format to add them automatically

Files:

• tests/generation/test_processors.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py

src/**/*.py

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

src/**/*.py: Use relative imports in src/ (e.g., from ..observability import get_logger).
Do not use print() statements in library code. Use get_logger(__name__) from observability.py or click.echo() for CLI.
Do not use assert for validation in library code. Use if/raise for input validation. assert statements can be stripped by -O and must never guard correctness.

API reference documentation is auto-generated from Python docstrings using Google-style formatting; write docstrings in src/nemo_safe_synthesizer/ and they will appear in the reference section on next build

Files:

• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py

---

⚙️ CodeRabbit configuration file

Review library code against STYLE_GUIDE.md. Focus on behavior, API contracts, error handling, resource cleanup, typing, logging, and user-facing failures. Public APIs and nontrivial functions need Google-style docstrings.

Files:

• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/llm/utils.py

src/nemo_safe_synthesizer/privacy/**/*.py

⚙️ CodeRabbit configuration file

Treat privacy changes as high-risk. Check DP accounting, parameter validation, data leakage, seed handling, model state persistence, and whether privacy guarantees are documented accurately.

Files:

• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py

🪛 Ruff (0.15.13)

src/nemo_safe_synthesizer/llm/utils.py

[warning] 590-590: Do not catch blind exception: Exception

(BLE001)

🔇 Additional comments (5)

src/nemo_safe_synthesizer/llm/utils.py (3)

573-574: Force use_fast=True instead of allowing override.

The docstring states "use_fast is forced to True" but setdefault allows callers to pass use_fast=False, which would silently bypass the helper's intent.

Suggested fix

-    kwargs.setdefault("use_fast", True)
+    kwargs["use_fast"] = True

---

683-684: Reject invalid legacy bit values instead of silently defaulting to 8-bit.

The current logic maps any non-4 integer (e.g., 2, 16, 32) to BNB_8BIT. This silently accepts invalid inputs and conflicts with the ValueError behavior documented for unknown schemes.

Suggested fix

     if isinstance(scheme, int):
-        scheme = QuantizationScheme.BNB_4BIT if scheme == 4 else QuantizationScheme.BNB_8BIT
+        if scheme == 4:
+            scheme = QuantizationScheme.BNB_4BIT
+        elif scheme == 8:
+            scheme = QuantizationScheme.BNB_8BIT
+        else:
+            raise ValueError(f"Unknown quantization bit-count alias: {scheme!r}. Expected 4 or 8.")

---

18-28: LGTM!

Also applies to: 538-543, 546-581, 584-591, 594-636, 657-682, 687-704

tests/generation/test_processors.py (1)

6-6: LGTM!

Also applies to: 48-48, 463-463

src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py (1)

26-26: LGTM!

Also applies to: 49-49, 506-508, 548-548, 571-578, 662-662, 679-681

[greptile-apps]

Greptile Summary

This PR upgrades the safe-synthesizer library to support transformers v5, introducing new quantization schemes (fp8, nvfp4, mxfp4) alongside the existing bitsandbytes options. Several v5 API breaking changes are handled: safe_serialization= removed from save_pretrained(), utils.is_safetensors_available() dropped, group_by_length removed from training args, and BitsAndBytesConfig invalid bnb_8bit_* kwargs eliminated.

• New QuantizationScheme enum in config/training.py centralises quantization config construction; get_quantization_config() in llm/utils.py is updated to dispatch through it while preserving the legacy integer-alias path for backward compatibility.
• load_fast_tokenizer() helper replaces four scattered AutoTokenizer.from_pretrained call sites, forces use_fast=True, and warns when the tokenizer falls back to the slow Python backend.
• DP training improvements: create_optimizer signature updated to accept the optional model arg that transformers v5 now passes, gradient checkpointing is explicitly disabled at the model level for Opacus compatibility, and compute_loss now handles tuple loss returns from v5.

Confidence Score: 5/5

Safe to merge — all three previously identified blocking issues (invalid bnb_8bit_* kwargs, create_optimizer model-arg mismatch, group_by_length removal) are correctly resolved, and the new quantization dispatch logic is well-tested.

The quantization scheme dispatch is clean and each path has targeted unit tests. The DP training changes (create_optimizer signature, tuple-loss guard, gradient-checkpointing model-level disable) address real v5 API shifts. Backward compatibility through the legacy quantization_bits alias is preserved. The only finding is a style inconsistency in how Mxfp4Config is imported.

No files require special attention; the one import-style note in config/training.py is cosmetic.

Important Files Changed

Filename	Overview
src/nemo_safe_synthesizer/config/training.py	Adds QuantizationScheme StrEnum with per-scheme config constructors; each static builder is correct (4-bit uses NF4+double quant+bf16, 8-bit is bare load_in_8bit=True, fp8/nvfp4/mxfp4 dispatch to the right v5 config classes); Mxfp4Config is imported from the private submodule path.
src/nemo_safe_synthesizer/llm/utils.py	Refactors get_quantization_config() to delegate through QuantizationScheme; adds load_fast_tokenizer() helper that forces use_fast=True and warns on slow fallback; get_device_name() moved up but logic unchanged.
src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py	create_optimizer now accepts the optional model arg v5 passes and calls super without it; safe_serialization= removed from save_pretrained; safetensors import made unconditional; tuple-loss guard added in training_step; processing_class preferred over tokenizer for save.
src/nemo_safe_synthesizer/training/huggingface_backend.py	_resolve_quantization_scheme() cleanly separates scheme resolution from config construction; LoftQ guard raises ParameterError for non-BNB schemes; gradient_checkpointing_disable called explicitly on model in DP path; load_fast_tokenizer replaces AutoTokenizer.from_pretrained.
src/nemo_safe_synthesizer/llm/metadata.py	Adds module-level model_rebuild() loop for all ModelMetadata subclasses with explicit torch namespace to resolve Pydantic 2.12 + v5 forward-reference annotations; load_fast_tokenizer substituted at two call sites.
src/nemo_safe_synthesizer/preflight/checks/environment.py	bytes_per_base_weight extended to read effective_bits from the new quantization_scheme when set, falling back to legacy quantization_bits; correct for QLORA path.
tests/training/test_huggingface_backend.py	Tests updated to patch load_fast_tokenizer, new tests for explicit scheme override, LoftQ rejection of non-BNB schemes, and model-level gradient checkpointing disable in DP path.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["quantize_model=True"] --> B{"quantization_scheme set?"}
    B -- "Yes" --> C["Use QuantizationScheme directly"]
    B -- "No" --> D{"quantization_bits?"}
    D -- "4" --> E["BNB_4BIT"]
    D -- "8" --> F["BNB_8BIT"]
    C --> G{"scheme.is_bitsandbytes?"}
    E --> G
    F --> G
    G -- "True + loftq" --> H["LoftQConfig(loftq_bits=bits)"]
    G -- "False + loftq" --> I["ParameterError raised"]
    G -- "Any + lora/qlora" --> J["to_transformers_config()"]
    J --> K{"scheme"}
    K -- "bnb-4bit" --> L["BitsAndBytesConfig\nload_in_4bit NF4+double+bf16"]
    K -- "bnb-8bit" --> M["BitsAndBytesConfig\nload_in_8bit=True"]
    K -- "fp8" --> N["FineGrainedFP8Config()"]
    K -- "nvfp4" --> O["TorchAoConfig\nNVFP4WeightOnlyConfig"]
    K -- "mxfp4" --> P["Mxfp4Config()"]
    L & M & N & O & P --> Q["quantization_config= in from_pretrained"]

Loading

_{Reviews (8): Last reviewed commit: "docs: use valid TOML for vLLM version-se..." | Re-trigger Greptile}

[codecov]

Codecov Report

❌ Patch coverage is 82.64840% with 38 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/nemo_safe_synthesizer/config/training.py	66.66%	20 Missing ⚠️
...fe_synthesizer/privacy/dp_transformers/dp_utils.py	27.27%	8 Missing ⚠️
tests/smoke/test_nss_training_gpu.py	33.33%	4 Missing ⚠️
src/nemo_safe_synthesizer/llm/utils.py	88.88%	2 Missing ⚠️
...o_safe_synthesizer/training/huggingface_backend.py	91.66%	2 Missing ⚠️
...o_safe_synthesizer/preflight/checks/environment.py	75.00%	1 Missing ⚠️
tests/smoke/conftest.py	50.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[mckornfield]

this (I hope) will alleviate some of the weirdness on that version of the telemetry, but can do it in its own pr

[kendrickb-nvidia]

Please put this in it's own PR. I promise I will approve it quickly :)

[binaryaaron]

Reverted the telemetry change from this PR

[kendrickb-nvidia]

This change is still visible in the github console view I'm seeing.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 13c72857-14ce-477d-a277-45b9d5be1989

📥 Commits

Reviewing files that changed from the base of the PR and between 8153a64 and 955c2c0.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock, !uv.lock

📒 Files selected for processing (18)

• CHANGELOG.md
• docs/user-guide/configuration.md
• docs/user-guide/troubleshooting.md
• pyproject.toml
• src/nemo_safe_synthesizer/config/training.py
• src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py
• src/nemo_safe_synthesizer/llm/metadata.py
• src/nemo_safe_synthesizer/llm/utils.py
• src/nemo_safe_synthesizer/preflight/checks/environment.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/telemetry.py
• src/nemo_safe_synthesizer/training/huggingface_backend.py
• tests/data_processing/test_assembler.py
• tests/generation/test_processors.py
• tests/llm/test_metadata.py
• tests/llm/test_utils.py
• tests/smoke/conftest.py
• tests/training/test_huggingface_backend.py

💤 Files with no reviewable changes (1)

• CHANGELOG.md

✅ Files skipped from review due to trivial changes (1)

• src/nemo_safe_synthesizer/evaluation/components/text_semantic_similarity.py

🚧 Files skipped from review as they are similar to previous changes (10)

• tests/data_processing/test_assembler.py
• src/nemo_safe_synthesizer/telemetry.py
• tests/training/test_huggingface_backend.py
• docs/user-guide/configuration.md
• tests/generation/test_processors.py
• tests/smoke/conftest.py
• src/nemo_safe_synthesizer/llm/metadata.py
• src/nemo_safe_synthesizer/config/training.py
• src/nemo_safe_synthesizer/privacy/dp_transformers/dp_utils.py
• src/nemo_safe_synthesizer/training/huggingface_backend.py

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)

• GitHub Check: Smoke Tests
• GitHub Check: Unit Tests (3.13)
• GitHub Check: Unit Tests (3.11)
• GitHub Check: Unit Tests (3.12)

🧰 Additional context used

📓 Path-based instructions (15)

**/*.{md,markdown,py}

📄 CodeRabbit inference engine (.cursor/rules/agent-markdown-style.mdc)

**/*.{md,markdown,py}: Avoid decorative bold (**text**) in list items, body text, and docstrings; use structural cues (headers, list markers, colons, backticks) for emphasis instead
Use backticks for code identifiers, paths, and CLI commands in markdown and docstrings

Files:

• src/nemo_safe_synthesizer/preflight/checks/environment.py
• tests/llm/test_utils.py
• docs/user-guide/troubleshooting.md
• src/nemo_safe_synthesizer/llm/utils.py
• tests/llm/test_metadata.py

**/*.py

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*.py: Use American English spelling: 'initialize' not 'initialise', 'recognize' not 'recognise', 'color' not 'colour'.
Use observability.get_logger(__name__) for logging, never logging.getLogger() or structlog.get_logger() directly.
Use category loggers: .runtime for internals, .user for progress/results, .system for system events.
Never use print() for operational output. Use click.echo() for CLI output or sys.stdout.write() for raw output in tools.
Use extra={} in logging for structured data that downstream tools should query or aggregate; use f-strings for human-readable context.
Raise from the custom error hierarchy with dual inheritance: SafeSynthesizerError (base), UserError, DataError, ParameterError, GenerationError, InternalError.
Use NSSBaseModel for config/parameter models in config/ which define user-facing configuration. Use raw BaseModel or module-specific bases for data transfer objects and internal structures.
Use BaseSettings for env/CLI settings. Prefer AliasChoices on individual fields when a field needs to respond to both its Python name and an env var name.
Include Field(description=...) for Pydantic model fields as the canonical field docstring for API documentation and CLI help text.
Use assignment-style type = Field(default=..., description="...") as the default for Pydantic model fields because type checkers understand default, default_factory, and alias in assignment style.
Use Annotated only when the field carries additional metadata beyond Field() -- ValueValidator, AutoParam, DependsOnValidator, reusable constrained type aliases, nested-type constraints, or discriminated unions.
Put defaults as bare assignment (= value), not inside Field(default=...), when using Annotated. Exception: use assignment-style Field(default_factory=...) for defaults that cannot be expressed as bare assignments.
Use @dataclass(frozen=True) for immutable value objects and validators; mu...

Files:

• src/nemo_safe_synthesizer/preflight/checks/environment.py
• tests/llm/test_utils.py
• src/nemo_safe_synthesizer/llm/utils.py
• tests/llm/test_metadata.py

src/**/*.py

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

src/**/*.py: Use relative imports in src/ (e.g., from ..observability import get_logger).
Do not use print() statements in library code. Use get_logger(__name__) from observability.py or click.echo() for CLI.
Do not use assert for validation in library code. Use if/raise for input validation. assert statements can be stripped by -O and must never guard correctness.

Files:

• src/nemo_safe_synthesizer/preflight/checks/environment.py
• src/nemo_safe_synthesizer/llm/utils.py

---

⚙️ CodeRabbit configuration file

Review library code against STYLE_GUIDE.md. Focus on behavior, API contracts, error handling, resource cleanup, typing, logging, and user-facing failures. Public APIs and nontrivial functions need Google-style docstrings.

Files:

• src/nemo_safe_synthesizer/preflight/checks/environment.py
• src/nemo_safe_synthesizer/llm/utils.py

**/*.{py,sh,yaml,yml}

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

Include SPDX copyright header at the top: # SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. and # SPDX-License-Identifier: Apache-2.0. The make format command handles this automatically.

Files:

• src/nemo_safe_synthesizer/preflight/checks/environment.py
• tests/llm/test_utils.py
• src/nemo_safe_synthesizer/llm/utils.py
• tests/llm/test_metadata.py

**/*

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*: Include a newline at the end of all files, never trailing whitespace. This is enforced by pre-commit.
Use line length of 120 characters for code, comments, and docstrings (configured in ruff.toml).

Files:

• src/nemo_safe_synthesizer/preflight/checks/environment.py
• tests/llm/test_utils.py
• pyproject.toml
• docs/user-guide/troubleshooting.md
• src/nemo_safe_synthesizer/llm/utils.py
• tests/llm/test_metadata.py

---

⚙️ CodeRabbit configuration file

**/*: Review as a senior maintainer for NeMo Safe Synthesizer. Prioritize issues that can change behavior, break user workflows, weaken privacy guarantees, hide failures, make tests unreliable, or create maintenance risk. Avoid generic style commentary unless it points to a concrete project convention that automated tools will not catch.
Comment only when the finding is actionable and tied to changed code. For each finding, state the impact, the condition that triggers it, and the smallest practical fix. Prefer one precise comment over broad advice. Do not ask for refactors outside the PR scope unless the changed code creates the problem.
Review type guidance: - Potential issue: use for correctness bugs, data loss, privacy leaks,
security risks, broken public APIs, invalid config behavior, missing
validation, hidden failures, nondeterministic tests, or CI breakage.

• Refactor suggestion: use for local maintainability problems introduced
  by the diff when they have clear future cost, such as duplicated setup,
  unclear boundaries, over-mocking, avoidable complexity, or opaque test
  helpers.
• Nitpick: avoid in chill mode. Do not emit formatting, import-order,
  wording, or style-only comments unless automated tools cannot catch the
  issue and it affects maintainability.

Severity guidance: - Critical: security/privacy leaks, data loss, training/test/holdout
contamination, or broken release/package/core pipeline execution.

• Major: incorrect generation/training/evaluation behavior, broken
  CLI/SDK public API, invalid config defaults or validators, or GPU/vLLM
  cleanup and process-isolation bugs likely to fail CI or production
  runs.
• Minor: localized bugs, missing focused tests for changed behavior, or
  bad test patterns that weaken regression coverage.
• Trivial: small cleanup with no behavior impact. Usually suppress in
  chill mode.
• Info: context only. Avoid unless it helps reviewers understand risk.
  Safe-Synthesizer-specific review focus: - Data ...

Files:

• src/nemo_safe_synthesizer/preflight/checks/environment.py
• tests/llm/test_utils.py
• pyproject.toml
• docs/user-guide/troubleshooting.md
• src/nemo_safe_synthesizer/llm/utils.py
• tests/llm/test_metadata.py

src/nemo_safe_synthesizer/**/*.py

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Python API documentation should use Google-style docstrings that will be auto-generated into API reference pages via the mkdocstrings plugin

Files:

• src/nemo_safe_synthesizer/preflight/checks/environment.py
• src/nemo_safe_synthesizer/llm/utils.py

tests/**

📄 CodeRabbit inference engine (.cursor/rules/repo-navigation.mdc)

Tests should mirror the src/ directory structure in tests/

Files:

• tests/llm/test_utils.py
• tests/llm/test_metadata.py

tests/**/*.py

📄 CodeRabbit inference engine (.cursor/rules/repo-navigation.mdc)

Tests in tests/e2e/ should be auto-marked with e2e marker, tests in tests/smoke/ with smoke marker, others with unit marker

tests/**/*.py: Use absolute imports in tests/ (e.g., from nemo_safe_synthesizer.observability import get_logger).
Use fixture_ prefix convention for fixtures for grep-ability and to separate fixtures from test functions. Add a one-line docstring describing the fixture's purpose and data.
Use function-scoped fixtures by default. Session scope only when empirically justified by test runtime.
Use bare assert as the primary assertion style; pytest.raises() with match= for exceptions; pytest.approx() for floating-point comparisons.
Mark CUDA-dependent tests with @pytest.mark.e2e, @pytest.mark.smoke, or @pytest.mark.requires_gpu.
Mock only external boundaries, not internal implementation details.
Ensure test isolation: no shared mutable state or execution-order dependencies between tests. If something must be run first before executing a test, include it in the test or a fixture.
Use @pytest.mark.parametrize for testing multiple input combinations rather than copy-pasting similar tests.

All Python test files must exist under the tests/ directory and be discoverable by pytest with naming following the convention test_*.py or *_test.py

Files:

• tests/llm/test_utils.py
• tests/llm/test_metadata.py

---

⚙️ CodeRabbit configuration file

Review tests against tests/TESTING.md. Check marker usage, fixture naming, tmp_path usage, determinism, and GPU/vLLM process-isolation requirements. Flag slop tests that only check that code runs, assert result is not None when stronger invariants exist, over-mock internal implementation details, patch around the bug instead of reproducing it, or add broad snapshot/golden churn without a clear contract. Flag change detector tests that fail on harmless refactors, formatting, record ordering, incidental wording, or private implementation details without demonstrating a behavior regression. Prefer existing fixtures or focused new fixtures for repeated setup; keep tests DRY when reasonable without making the behavior under test opaque. print() is allowed in tests.

Files:

• tests/llm/test_utils.py
• tests/llm/test_metadata.py

**/*test*.py

📄 CodeRabbit inference engine (AGENTS.md)

The unit_test marker is deprecated; use unit instead

Files:

• tests/llm/test_utils.py
• tests/llm/test_metadata.py

pyproject.toml

📄 CodeRabbit inference engine (.cursor/rules/repo-navigation.mdc)

Package metadata, dependencies, and extras (cpu/cu128/engine) should be configured in pyproject.toml

Order sections in pyproject.toml as: [project], [dependency-groups], [project.optional-dependencies], [tool.uv], [build-system], [tool.*].

The pyproject.toml file must be kept in sync with uv.lock to avoid lock file drift. Run make lock-check to verify synchronization

Files:

• pyproject.toml

---

⚙️ CodeRabbit configuration file

Treat pyproject.toml as high-risk. Check package metadata, uv indexes, dependency groups, optional extras, Python version bounds, hatch config, ty config, script entry points, dependency consistency, and whether changes require regenerating uv.lock.

Files:

• pyproject.toml

**/*.toml

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*.toml: Use spaces around = for key-value pairs in TOML files.
Use # comment format for comments in TOML files; use inline comments for dependency pins.

Files:

• pyproject.toml

**/*.{md,markdown}

📄 CodeRabbit inference engine (.cursor/rules/agent-markdown-style.mdc)

**/*.{md,markdown}: Bold is acceptable only in markdown tables where it's the conventional way to mark header-like cells in the body
Use ## headers to segment markdown sections instead of bold text
Use -- (em-dash) instead of - (hyphen) for asides in markdown

Files:

• docs/user-guide/troubleshooting.md

**/*.md

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

**/*.md: No decorative **bold** in body text, list items, or docstrings. Use headers, list markers, colons, and backticks for structure.
Use -- (em-dash) for asides, not - (hyphen).
Use single backticks for code identifiers, paths, and CLI commands in Markdown.
Use Mermaid diagrams with no spaces in node IDs, quote labels with special characters, no explicit colors or styles.
Include SPDX copyright header in Markdown files using HTML comments: <!-- SPDX-FileCopyrightText: ... --> and <!-- SPDX-License-Identifier: Apache-2.0 -->. Exception: for .md files with YAML frontmatter, include hash-comment headers inside the frontmatter block.

Markdown documentation files must pass ruff formatting and linting checks

Files:

• docs/user-guide/troubleshooting.md

docs/**/*.md

📄 CodeRabbit inference engine (STYLE_GUIDE.md)

Classify documentation pages as tutorial, how-to, explanation, or reference per the Diataxis framework. Use MkDocs Material syntax for admonitions (!!! note), tabs (===), and code blocks with titles and highlights.

Documentation files should follow the Diataxis framework with content organized into directories: getting-started/ for tutorials, user-guide/ for how-tos and reference, architecture/ for explanations, reference/ for API documentation, and dev-notes/ for release notes and design posts

docs/**/*.md: Classify documentation content using the Diataxis framework (TUTORIAL, HOW-TO, EXPLANATION, or REFERENCE) and ensure each page fits ONE type only
Use MkDocs Material admonition syntax (!!! note, !!! warning, ??? tip) for callouts and collapsible content
Use MkDocs Material tab syntax (=== "Tab Name") to present multiple variations or language-specific examples
Include code block metadata in MkDocs Material format: use title attribute for filenames and hl_lines for syntax highlighting of specific lines
Use Mermaid diagram syntax for flowcharts and visual representations in documentation
List prerequisites at the top of each documentation page before main content
End documentation pages with 'Next steps' section containing links to related content

Files:

• docs/user-guide/troubleshooting.md

docs/**

⚙️ CodeRabbit configuration file

Review documentation as MkDocs Material content. Check Diataxis fit, accurate commands, internal links, code fences, and markdown style from STYLE_GUIDE.md.

Files:

• docs/user-guide/troubleshooting.md

🪛 LanguageTool

docs/user-guide/troubleshooting.md

[style] ~75-~75: Consider using “incompatible” to avoid wordiness.
Context: ...des several early 5.x releases that are not compatible with its runtime. Keep vLLM's exclusion...

(NOT_ABLE_PREMIUM)

🪛 Ruff (0.15.13)

src/nemo_safe_synthesizer/llm/utils.py

[warning] 590-590: Do not catch blind exception: Exception

(BLE001)

tests/llm/test_metadata.py

[error] 394-394: Possible hardcoded password assigned to: "bos_token"

(S105)

---

[error] 396-396: Possible hardcoded password assigned to: "eos_token"

(S105)

---

[error] 414-414: Possible hardcoded password assigned to: "bos_token"

(S105)

---

[error] 416-416: Possible hardcoded password assigned to: "eos_token"

(S105)

🔇 Additional comments (5)

src/nemo_safe_synthesizer/preflight/checks/environment.py (1)

209-215: LGTM!

docs/user-guide/troubleshooting.md (1)

69-107: LGTM!

Also applies to: 140-148

pyproject.toml (1)

28-28: LGTM!

Also applies to: 92-92, 120-121, 126-126, 136-136, 143-144, 153-153, 160-160

tests/llm/test_metadata.py (1)

390-398: LGTM!

Also applies to: 410-418, 735-746, 757-768, 803-825, 842-870, 872-898, 904-925, 933-952

tests/llm/test_utils.py (1)

7-33: LGTM!

[kendrickb-nvidia]

Please put this in it's own PR. I promise I will approve it quickly :)

[binaryaaron]

huh, never realized it was duplicated here.

[mckornfield]

I have one run from slurm of this, not the latest commit, want me to do another or you got something going?

[kendrickb-nvidia]

This change is still visible in the github console view I'm seeing.

[binaryaaron]

@kendrickb-nvidia - rebased it and the telemetry changes render correctly now (and by correctly, i mean they are no longer visible).