fix: accept vLLM patch releases with unchanged audited files in FPM observation

docs/perf-model/fpm-self-service/implementation.md

@@ -1714,7 +1714,7 @@ service or regression-training command is needed for measured FPM interpolation.
 
 Fresh config-based onboarding does not ask for activation, runtime, communication or aggregate non-KV memory bytes. Optional derived values appear as planning estimates in the preview and provenance. They do not complete the saved memory profile. Supplying all four non-KV byte overrides explicitly retains the complete declared-profile route; a partial override remains recorded but does not establish simulation readiness. Existing complete profiles remain supported.
 
-Collection observes initialized worker cache allocation and scheduler pool capacity without an extra GPU run. For pending profiles on audited vLLM 0.27.0, 0.32.0 or 0.33.0, both phases use synchronous scheduling because the current prefill benchmark requires it. Review this fixed collection policy in stage 2; it is not an assertion about vLLM serving defaults. The observer supports the audited full/sliding-attention cache interfaces of vLLM 0.27.0, 0.32.0 and 0.33.0, including supported convolution storage represented by those interfaces. In vLLM 0.27.0, each `KVCacheTensor` record lists the layers that share it in `shared_by`. In 0.32.0 and 0.33.0, all cache layers share one buffer, and each record places its `layers` by `layer_stride`, `block_stride` and `offset`. The observer reads both record shapes. Historical memory artifacts retain this strict version guard. Finalization refuses vLLM 0.32.0 and 0.33.0 runs in which Model Runner V2 drops piecewise CUDA graphs because no `@support_torch_compile` module is active. The [runtime probe and observation import](#resolve-cache-geometry-with-a-runtime-probe) route also accepts source-audited campaign-local adapters for other exact runtime builds; its evidence is checked independently before producing a profile. Unknown layouts report unresolved memory; they do not automatically qualify for finalization. Do not substitute guessed bytes to hide that diagnostic.
+Collection observes initialized worker cache allocation and scheduler pool capacity without an extra GPU run. For pending profiles on audited vLLM 0.27.0, 0.32.0 or 0.33.0, or on an accepted patch release of 0.32 or 0.33, both phases use synchronous scheduling because the current prefill benchmark requires it. Review this fixed collection policy in stage 2; it is not an assertion about vLLM serving defaults. The observer supports the audited full/sliding-attention cache interfaces of vLLM 0.27.0, 0.32.0 and 0.33.0, including supported convolution storage represented by those interfaces. In vLLM 0.27.0, each `KVCacheTensor` record lists the layers that share it in `shared_by`. In 0.32.0 and 0.33.0, all cache layers share one buffer, and each record places its `layers` by `layer_stride`, `block_stride` and `offset`. The observer reads both record shapes. Historical memory artifacts retain this strict version guard. The observers also accept a final patch release of vLLM 0.32 or 0.33, for example 0.33.1. The condition is that every vLLM source file that they read is byte-identical to the audited release. The imported `vllm` package must also report the same version as the package metadata (`vllm.__version__`). Otherwise the record is unresolved, and the error names both versions. So the observers refuse a vLLM tree on the Python path that reports another version. The observer compares SHA-256 hashes inside the container. A changed or missing file leaves the record unresolved, and the error names the file. The records, the collection plan and the onboarding plan of such a release name the audited release. The records and the finalize provenance keep the installed patch release, for example 0.33.1, in `backend_version`. `audited_backend_version` only names the audited release that the observers check the files against. It is not the backend version of the data. A pre-release, a development build or a local build such as `0.33.1+cu130` is refused. A new minor release (0.x), for example 0.34.0, still needs a source audit. Finalization refuses vLLM 0.32.0 and 0.33.0 runs in which Model Runner V2 drops piecewise CUDA graphs because no `@support_torch_compile` module is active. The [runtime probe and observation import](#resolve-cache-geometry-with-a-runtime-probe) route also accepts source-audited campaign-local adapters for other exact runtime builds; its evidence is checked independently before producing a profile. Unknown layouts report unresolved memory; they do not automatically qualify for finalization. Do not substitute guessed bytes to hide that diagnostic.
 
 The supported memory evidence requires automatic HBM-only allocation without weight offload, synchronous scheduling, complete graph settings, and an audited unquantized, FP8 or ModelOpt NVFP4 precision mapping. Mixed precision such as NVFP4 routed experts with BF16 attention and shared experts is supported. Unknown precision mappings remain unresolved. Worker and scheduler settings must agree, with recorded worker graph downgrades allowed only for the audited runtime behavior.
 

python/aisimulate/collector/fpm_forward/execution_evidence.py

@@ -20,7 +20,7 @@
 from .cpu_affinity import inspect_cpu_affinity
 from .native_artifact import NativeCollection, _rank_artifacts
 from .planner import FPMCell, FPMCollectionPlan, _canonical_hash
-from .runtime.fpm_memory_observer import EXECUTION_SUPPORTED_VERSIONS
+from .runtime.fpm_memory_observer import EXECUTION_SUPPORTED_VERSIONS, audited_release
 from .runtime_memory import _dtype, _validate_graph, _validate_precision, _validate_revision
 
 _GRAPH_FIELDS = {"mode", "cudagraph_mode", "cudagraph_capture_sizes", "max_cudagraph_capture_size"}
@@ -361,7 +361,8 @@ def inspect_execution_evidence(
     actual_pin = getattr(plan, "runtime_backend_version", None)
     if actual_pin is not None and collection.backend_version != actual_pin:
         failures.append("observed backend version differs from the frozen plan")
-    if collection.backend_version not in EXECUTION_SUPPORTED_VERSIONS:
+    release = audited_release(collection.backend_version, EXECUTION_SUPPORTED_VERSIONS)
+    if release is None:
         missing.append(f"execution configuration inspection is unaudited for {collection.backend_version}")
     workers = []
     ranks = set()
@@ -391,6 +392,12 @@ def inspect_execution_evidence(
         if payload.get("status") != "observed":
             missing.append(f"worker {rank}: {payload.get('error', 'execution observation unresolved')}")
             continue
+        if (
+            release is not None
+            and release != collection.backend_version
+            and payload.get("audited_backend_version") != release
+        ):
+            failures.append(f"runtime execution evidence was not checked against audited vLLM {release}: {path}")
         groups = payload.get("attention_groups")
         if (
             not isinstance(groups, list)

python/aisimulate/collector/fpm_forward/planner.py

@@ -38,7 +38,7 @@
     with_kv_warmup_defaults,
 )
 from .memory_admission import TopologyMemoryDecision, filter_memory_infeasible_topologies
-from .runtime.fpm_memory_observer import MEMORY_SUPPORTED_VERSIONS
+from .runtime.fpm_memory_observer import MEMORY_SUPPORTED_VERSIONS, audited_release
 from .topology import enumerate_fpm_topologies, topology_strategy
 from .types import ParallelTopology
 
@@ -60,16 +60,24 @@ def _runtime_memory_policy(
         deployment.resources.memory_source == "pending" for deployment in profile.deployments
     ):
         return None
-    available = backend_version in MEMORY_SUPPORTED_VERSIONS
-    return {
+    release = audited_release(backend_version, MEMORY_SUPPORTED_VERSIONS)
+    available = release is not None
+    policy: dict[str, object] = {
         "source": "vllm_initialization",
         # Other versions keep the 0.27.0 value, so the hashes of their saved plans do not change.
         "supported_vllm_version": backend_version if available else "0.27.0",
         "selected_vllm_version": backend_version,
-        "observation": "enabled" if available else "unavailable_for_runtime",
-        "evidence_schema_version": 1,
-        "async_scheduling": False if available else None,
     }
+    if available and release != backend_version:
+        policy["audited_vllm_version"] = release
+    policy.update(
+        {
+            "observation": "enabled" if available else "unavailable_for_runtime",
+            "evidence_schema_version": 1,
+            "async_scheduling": False if available else None,
+        }
+    )
+    return policy
 
 
 _INSTALLED_DISTRIBUTION = "aisim"

python/aisimulate/collector/fpm_forward/runner.py

@@ -50,7 +50,11 @@
 from .config import FPM_KV_WARMUP_DEFAULTS, with_kv_warmup_defaults
 from .native_artifact import COLLECTOR_PROVENANCE_FILENAME, validate_native_collection
 from .planner import FPMCell, FPMCollectionPlan
-from .runtime.fpm_memory_observer import EXECUTION_SUPPORTED_VERSIONS, MEMORY_SUPPORTED_VERSIONS
+from .runtime.fpm_memory_observer import (
+    EXECUTION_SUPPORTED_VERSIONS,
+    MEMORY_SUPPORTED_VERSIONS,
+    audited_release,
+)
 from .types import KVWARM_STRATEGIES
 
 logger = logging.getLogger(__name__)
@@ -137,15 +141,15 @@ def _observe_runtime_memory(plan: FPMCollectionPlan, cell: FPMCell) -> bool:
     return (
         deployment is not None
         and deployment.resources.memory_source == "pending"
-        and getattr(plan, "runtime_backend_version", None) in MEMORY_SUPPORTED_VERSIONS
+        and audited_release(getattr(plan, "runtime_backend_version", None), MEMORY_SUPPORTED_VERSIONS) is not None
     )
 
 
 def _observe_runtime_execution(plan: FPMCollectionPlan, cell: FPMCell) -> bool:
     if getattr(plan, "runtime_instrumentation", None) is not None:
         return False
     return (
-        getattr(plan, "runtime_backend_version", None) in EXECUTION_SUPPORTED_VERSIONS
+        audited_release(getattr(plan, "runtime_backend_version", None), EXECUTION_SUPPORTED_VERSIONS) is not None
         and not cell.execution_identity[0]
     )