build(glm): add source-locked checkpoint serving recipe

.gitattributes

@@ -1 +1,3 @@
 patches/releases/**/integration.patch -whitespace
+# Captured diagnostics retain their original bytes for evidence checksums.
+recipes/glm53/evidence/**/*.log -whitespace

recipes/glm53/Dockerfile.glm53-cache-contracts

@@ -0,0 +1,88 @@
+# syntax=docker/dockerfile:1.7
+ARG BASE_IMAGE=voipmonitor/vllm@sha256:93ac5228f1cbde2182ca294d8b479259144742af2756a49ff207dd245429bf43
+ARG FLASHINFER_WHEELS_IMAGE=voipmonitor/vllm@sha256:79edbc91874d9468e3e6268e1584503e3dec55f2a4d3bdd70d5c43e9b41675c7
+ARG LMCACHE_NATIVE_IMAGE=localinferencelab/vllm@sha256:3ae04d964f8e7e936ef4b34dd75406b9169fead8062fb8b4b1634f3bbf512827
+FROM ${FLASHINFER_WHEELS_IMAGE} AS flashinfer-wheels
+FROM ${LMCACHE_NATIVE_IMAGE} AS lmcache-build
+COPY --from=source_bundles /lmcache.bundle /source-bundles/lmcache.bundle
+COPY --from=source_bundles /uv /source-bundles/uv
+COPY install_source_bundle.sh /build-tools/install_source_bundle.sh
+COPY pack_lmcache_native_reuse.py /build-tools/pack_lmcache_native_reuse.py
+ARG LMCACHE_COMMIT
+ARG LMCACHE_TREE
+ARG LMCACHE_BUNDLE_SHA256
+ARG LMCACHE_VERSION
+ARG LMCACHE_NATIVE_MODE=reuse-all
+ARG UV_SHA256
+WORKDIR /tmp
+RUN test "$(sha256sum /source-bundles/lmcache.bundle | cut -d' ' -f1)" = "${LMCACHE_BUNDLE_SHA256}" \
+    && test "$(sha256sum /source-bundles/uv | cut -d' ' -f1)" = "${UV_SHA256}" \
+    && bash /build-tools/install_source_bundle.sh /source-bundles/lmcache.bundle \
+        "${LMCACHE_COMMIT}" "${LMCACHE_TREE}" /tmp/lmcache-source \
+    && /source-bundles/uv pip install --python /opt/venv/bin/python \
+        'setuptools>=77.0.3,<81' setuptools_scm wheel packaging ninja \
+    && cd /tmp/lmcache-source \
+    && case "${LMCACHE_NATIVE_MODE}" in \
+         reuse-all) export NO_NATIVE_EXT=1 ;; \
+         cpu-rebuild-cuda-reuse) unset NO_NATIVE_EXT; export NO_GPU_EXT=1 MAX_JOBS=8 ;; \
+         *) echo "Unsupported LMCache native mode" >&2; exit 1 ;; \
+       esac \
+    && SETUPTOOLS_SCM_PRETEND_VERSION_FOR_LMCACHE="${LMCACHE_VERSION}" \
+        /source-bundles/uv run --no-project --python /opt/venv/bin/python \
+        /opt/venv/bin/python -m pip wheel --no-build-isolation --no-deps --wheel-dir /artifacts . \
+    && /opt/venv/bin/python /build-tools/pack_lmcache_native_reuse.py \
+        --source /tmp/lmcache-source --reference-source /opt/lmcache/source \
+        --reference-package /opt/venv/lib/python3.12/site-packages/lmcache \
+        --wheel-dir /artifacts --mode "${LMCACHE_NATIVE_MODE}" \
+    && install -Dm755 /opt/lmcache/lib/liblmcache_cumem_shareable.so /artifacts/liblmcache_cumem_shareable.so \
+    && cd /artifacts && sha256sum *.whl *.so > SHA256SUMS
+
+FROM ${BASE_IMAGE}
+ARG SOURCE_LOCK_SHA256
+ARG CACHE_FINGERPRINT
+# One source installation layer above the immutable flattened runtime.
+RUN --mount=type=bind,from=source_bundles,source=/,target=/source-bundles,ro \
+    --mount=type=bind,from=native_artifact,source=/,target=/flashkda-artifacts,ro \
+    --mount=type=bind,from=lmcache-build,source=/artifacts,target=/lmcache-artifacts,ro \
+    --mount=type=bind,from=flashinfer-wheels,source=/opt/flashinfer-wheels,target=/flashinfer-wheels,ro \
+    --mount=type=bind,source=.,target=/build-inputs,ro \
+    bash /build-inputs/install_glm53_source_locked.sh
+
+ENV LMCACHE_EXPECTED_SOURCE_ROOT=/opt/venv/lib/python3.12/site-packages/lmcache \
+    VLLM_DEFAULT_MOE_BACKEND=b12x \
+    LOCAL_INFERENCE_CACHE_FINGERPRINT=${CACHE_FINGERPRINT} \
+    XDG_CACHE_HOME=/cache/jit/${CACHE_FINGERPRINT} \
+    VLLM_CACHE_ROOT=/cache/jit/${CACHE_FINGERPRINT}/vllm \
+    VLLM_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/vllm \
+    TRITON_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/triton \
+    TORCHINDUCTOR_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/torchinductor \
+    CUTE_DSL_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/cute-dsl \
+    B12X_CUTE_COMPILE_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/b12x/cute \
+    B12X_COMPILE_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/b12x/compile \
+    SPARKINFER_COMPILE_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/b12x/compile \
+    CUDA_CACHE_PATH=/cache/jit/${CACHE_FINGERPRINT}/cuda \
+    VLLM_GLM53_L2_PREFETCH=1 VLLM_GLM53_L2_PREFETCH_PERSIST_MB=0 \
+    VLLM_GLM53_DFLASH_ATTN=1 VLLM_CAUSAL_CONV1D_UPDATE_HOIST=1 \
+    VLLM_GLM53_KDA_GATE_SIDE_STREAM=1 VLLM_GLM53_MTP_DRAFT_HEAD=nvfp4 \
+    VLLM_MXFP8_LM_HEAD=0 VLLM_MTP_NVFP4_LM_HEAD=0 VLLM_LM_HEAD_A16=1 \
+    VLLM_USE_FLASHINFER_SAMPLER=1 VLLM_PCIE_TWOSHOT_ALLREDUCE_MAX_SIZE=768KB \
+    VLLM_GLM53_ONLINE_DENSE_MXFP8=0 VLLM_DISABLE_SHARED_EXPERTS_STREAM=0 \
+    VLLM_DISABLED_KERNELS=MarlinFP8ScaledMMLinearKernel \
+    B12X_DYNAMIC_SPLIT_ROUTE_COMPUTE=1 B12X_DYNAMIC_DIRECT_EXPERT_SCALES=1 \
+    B12X_DYNAMIC_SPLIT_LOW_SMEM=1 B12X_DYNAMIC_SKIP_SPLIT_BARRIER_RESET=1 \
+    B12X_DYNAMIC_SPLIT_FAST_PREPARE=1 B12X_DYNAMIC_WORK_SOURCE=persistent_grid \
+    B12X_DYNAMIC_SPLIT_COMPUTE_MAC=224 B12X_PCIE_ONESHOT_THREADS=512 \
+    B12X_PCIE_ONESHOT_BLOCK_LIMIT=4 B12X_PCIE_ONESHOT_PDL=1 B12X_MHC_PDL=1 \
+    NCCL_MIN_NCHANNELS=16 NCCL_MAX_NCHANNELS=16 NCCL_BUFFSIZE=2097152 \
+    OMP_NUM_THREADS=1 MAX_NUM_BATCHED_TOKENS=4096 MAX_CUDAGRAPH_CAPTURE_SIZE=256 \
+    CUDAGRAPH_CAPTURE_SIZES="1 2 4 8 16 32 40 48 64 96 128 192 256" \
+    PREFILL_SCHEDULE_INTERVAL=1 FAIRNESS_ENGINE=compute_share \
+    PREFILL_COMPUTE_SHARE=0.4 GLM53_KDA_PREFILL_BACKEND=flashkda
+LABEL local-inference.status="research-only" \
+    local-inference.runtime.source-lock.path="/opt/glm53-flash/source.lock" \
+    local-inference.runtime.source-lock.sha256="${SOURCE_LOCK_SHA256}" \
+    local-inference.runtime.cache-fingerprint="${CACHE_FINGERPRINT}" \
+    local-inference.release.overlay2-rootfs-layers="2"
+WORKDIR /
+ENTRYPOINT ["/usr/local/bin/serve-glm53-flash.sh"]
+CMD []

recipes/glm53/Dockerfile.glm53-managed-checkpoint-native

@@ -0,0 +1,33 @@
+# syntax=docker/dockerfile:1.7
+
+ARG RUNTIME_IMAGE=voipmonitor/vllm@sha256:93ac5228f1cbde2182ca294d8b479259144742af2756a49ff207dd245429bf43
+FROM ${RUNTIME_IMAGE} AS native-build
+
+COPY --from=vllm_source / /tmp/vllm-source/
+COPY --from=cutlass_source / /tmp/cutlass-source/
+WORKDIR /tmp/vllm-source
+
+ENV VLLM_CUTLASS_SRC_DIR=/tmp/cutlass-source \
+    TORCH_CUDA_ARCH_LIST=12.0a \
+    CUDA_VISIBLE_DEVICES=""
+
+# FetchContent applies the source-locked FlashKDA patch. No external FlashKDA
+# source override is supplied: this exercises the ordinary vLLM build contract.
+RUN --mount=type=cache,id=glm53-managed-checkpoint-native,target=/tmp/flashkda-managed-build,sharing=locked \
+    test -z "${FLASH_KDA_SRC_DIR:-}" \
+    && cmake -S . -B /tmp/flashkda-managed-build -G Ninja \
+      -DCMAKE_BUILD_TYPE=Release -DCMAKE_CUDA_ARCHITECTURES=120 \
+      -DVLLM_TARGET_DEVICE=cuda \
+      -DVLLM_PYTHON_EXECUTABLE=/opt/venv/bin/python -DNVCC_THREADS=2 \
+    && cmake --build /tmp/flashkda-managed-build --target _flashkda_C --parallel 2 \
+    && install -Dm755 /tmp/flashkda-managed-build/_flashkda_C.abi3.so \
+      /artifacts/_flashkda_C.abi3.so \
+    && git -C /tmp/flashkda-managed-build/_deps/flashkda-src rev-parse HEAD \
+      > /artifacts/flashkda-base.commit \
+    && sha256sum cmake/external_projects/patches/flashkda-packed-checkpoints.patch \
+      > /artifacts/flashkda-patch.sha256 \
+    && sha256sum /artifacts/_flashkda_C.abi3.so \
+      > /artifacts/flashkda-extension.sha256
+
+FROM scratch AS artifact
+COPY --from=native-build /artifacts/ /

recipes/glm53/Dockerfile.glm53-reasoning-default

@@ -0,0 +1,19 @@
+# syntax=docker/dockerfile:1
+FROM voipmonitor/vllm@sha256:f5f121e37fd2afbb6f8f036e7eb627435cfb736de0a4420306dc2a25b6631669
+
+ARG SOURCE_LOCK_SHA256
+# The reasoning default changes only request rendering. Target/draft weights,
+# model kernels, cache implementation, and collective policies remain pinned.
+RUN --mount=type=bind,source=serve-glm53-flash-nvfp4-dflash2.sh,target=/inputs/launcher,readonly \
+    --mount=type=bind,source=reasoning-high.source.lock,target=/inputs/source.lock,readonly \
+    test "$(sha256sum /inputs/source.lock | cut -d' ' -f1)" = "${SOURCE_LOCK_SHA256}" && \
+    test "$(sha256sum /inputs/launcher | cut -d' ' -f1)" = \
+        "$(awk -F= '$1 == "input.serve-glm53-flash-nvfp4-dflash2.sh.sha256" {print $2}' /inputs/source.lock)" && \
+    install -m755 /inputs/launcher /usr/local/libexec/serve-glm53-flash-nvfp4-dflash2.sh && \
+    install -m644 /inputs/source.lock /opt/glm53-flash/source.lock
+
+LABEL org.opencontainers.image.version="r28-high" \
+    local-inference.release.name="jovian-judgement-community-20260908-r28-high" \
+    local-inference.release.overlay2-rootfs-layers="3" \
+    local-inference.runtime.default.reasoning-effort="high" \
+    local-inference.runtime.source-lock.sha256="${SOURCE_LOCK_SHA256}"

recipes/glm53/Dockerfile.glm53-scheduler-overlay

@@ -0,0 +1,21 @@
+# syntax=docker/dockerfile:1
+FROM voipmonitor/vllm@sha256:f5f121e37fd2afbb6f8f036e7eb627435cfb736de0a4420306dc2a25b6631669
+
+ARG SOURCE_LOCK_SHA256
+ARG CACHE_FINGERPRINT
+RUN --mount=type=bind,source=.,target=/recipe,readonly \
+    --mount=type=bind,from=source_bundles,target=/inputs,readonly \
+    SOURCE_LOCK_SHA256=${SOURCE_LOCK_SHA256} \
+    /opt/venv/bin/python /recipe/install_glm53_scheduler_overlay.py
+
+ENV LOCAL_INFERENCE_CACHE_FINGERPRINT=${CACHE_FINGERPRINT} \
+    XDG_CACHE_HOME=/cache/jit/${CACHE_FINGERPRINT} \
+    VLLM_CACHE_ROOT=/cache/jit/${CACHE_FINGERPRINT}/vllm \
+    VLLM_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/vllm \
+    TRITON_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/triton \
+    TORCHINDUCTOR_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/torchinductor \
+    CUTE_DSL_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/cute-dsl \
+    B12X_CUTE_COMPILE_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/b12x/cute \
+    B12X_COMPILE_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/b12x/compile \
+    SPARKINFER_COMPILE_CACHE_DIR=/cache/jit/${CACHE_FINGERPRINT}/b12x/compile \
+    CUDA_CACHE_PATH=/cache/jit/${CACHE_FINGERPRINT}/cuda

recipes/glm53/Dockerfile.jovian-stable-native

@@ -0,0 +1,25 @@
+# syntax=docker/dockerfile:1.7
+ARG RUNTIME_IMAGE=voipmonitor/vllm@sha256:93ac5228f1cbde2182ca294d8b479259144742af2756a49ff207dd245429bf43
+FROM ${RUNTIME_IMAGE} AS native-build
+COPY --from=vllm_source / /tmp/vllm-source/
+COPY --from=cutlass_source / /tmp/cutlass-source/
+WORKDIR /tmp/vllm-source
+ENV VLLM_CUTLASS_SRC_DIR=/tmp/cutlass-source \
+    TRITON_KERNELS_SRC_DIR=/opt/glm53-flash/vllm/vllm/third_party/triton_kernels \
+    TORCH_CUDA_ARCH_LIST=12.0a CUDA_VISIBLE_DEVICES=""
+ARG BUILD_JOBS=8
+# The caller-owned DeepSeek query output changes the registered stable operator
+# schema. Rebuild that extension; retain the separately qualified FlashKDA and
+# MoE artifacts rather than substituting unrelated native implementations.
+RUN --mount=type=cache,id=jovian-shared-stable-native-cu133,target=/tmp/stable-build,sharing=locked \
+    cmake -S . -B /tmp/stable-build -G Ninja \
+      -DCMAKE_BUILD_TYPE=Release -DCMAKE_CUDA_ARCHITECTURES=120 \
+      -DVLLM_TARGET_DEVICE=cuda \
+      -DVLLM_PYTHON_EXECUTABLE=/opt/venv/bin/python -DNVCC_THREADS=2 \
+    && cmake --build /tmp/stable-build --target _C_stable_libtorch --parallel "${BUILD_JOBS}" \
+    && install -Dm755 /tmp/stable-build/_C_stable_libtorch.abi3.so \
+      /artifacts/_C_stable_libtorch.abi3.so \
+    && cp native-source.identity /artifacts/native-source.identity \
+    && cd /artifacts && sha256sum _C_stable_libtorch.abi3.so > SHA256SUMS
+FROM scratch AS artifact
+COPY --from=native-build /artifacts/ /