MakazhanAlpamys/Soup v0.67.0

v0.67.0 — Adapter Lifecycle Finish

on GitHub

What's New

Six surfaces close v0.57 (adapters diff / merge / blame / branch) and turn adapter management into a real version-control + collaboration workflow.

• soup adapters merge --strategy cmaes --eval <suite> --budget 1h — Sakana-style evolutionary search over LoRA merge weights. Pure-Python rank-mu CMA-ES (no cma dependency). Softmaxes N-1 logits onto the simplex, samples a population, keeps elite half, plateau-detects (3 generations without improvement → converged=True). Operator-supplied eval_fn closure; failures swallowed with sentinel score. Budget bounds reused from v0.57 blame.parse_budget (60s..24h).
• soup_cli.utils.vector_bank — VeRA / VB-LoRA storage format. VectorBank = {shared random projection matrix P, per-user scaling vector v_u} — thousands of per-user adapters at MB-each instead of hundreds-of-MB per LoRA. Atomic JSON I/O + cwd containment + symlink rejection + 16 MiB cap.
• task='moe_lora_routing' — MoLE per-token gating over N task LoRAs. New MoleGatingConfig (num_task_adapters [2,64] / hidden_dim / temperature / top_k); cross-validator rejects mlx backend.
• soup adapters pr <title> --base-sha <hex> --adapter <path> --eval <json> — GitHub-shaped PR rendering. PR = {base SHA, dataset diff, adapter weights, eval-delta report} → review-friendly Markdown with eval-delta tables + per-sample baseline/candidate diffs. _md_table_escape neutralises \ | \n \r \t in cells.
• soup lock write / show / check — Shared run lockfile. Closure of (base_model_sha, dataset_sha, env_hash) → committed to git so teams coordinate on reproducible training runs. soup lock check exits 3 on drift; soup_version + created_at are advisory-only. Composes with v0.64 soup env lock.
• soup adapters bisect <ckpt1> <ckpt2> ... --eval-command "..." — Binary search over training history. Operator supplies a shell template with {ckpt} placeholder (argv-list mode via shlex.split after shlex.quote(ckpt) — no shell=True). Probes both endpoints first, then ~log₂(n) midpoint probes. Exit 3 on BROKEN_AT. Composes with v0.66 influence-blame.

Install / Upgrade

pip install -U soup-cli==0.67.0

Security

• Atomic disk writes (tempfile.mkstemp + os.replace) for all new I/O surfaces via shared paths.atomic_write_text.
• POSIX symlink rejection at every write boundary (TOCTOU defence).
• Size-cap before json.load on load_bank (16 MiB) and read_lock (1 MiB).
• Subprocess in soup adapters bisect uses argv-list mode (no shell=True); operator-supplied {ckpt} is shlex.quote-protected.
• Closed allowlists wrapped in frozenset / MappingProxyType for all v0.67.0 schemas.
• Rich-markup escape on user-controlled fields in every renderer.

Known Limitations

1. CMA-ES live eval-suite auto-wiring deferred to v0.67.1 — the CLI prints the validated plan today; operators inject eval_fn via the Python API.
2. VeRA / VB-LoRA apply_bank_to_serve deferred to v0.67.1 — schema + atomic JSON I/O ship now; live multi-tenant serving via v0.22.0 multi-adapter surface lands in v0.67.1.
3. MoLE build_gating_kernel deferred to v0.67.1 — schema accepts task='moe_lora_routing'; the live torch gating module lands in v0.67.1.
4. soup adapters bisect assumes monotonic regression — non-monotonic histories produce undefined boundaries (does not crash).
5. adapter_pr is a renderer, not a publisher — pushing to a GitHub PR / issue comment is the v0.68.0 GitHub Action deliverable.
6. soup.lock does NOT auto-compute env_hash — operators run soup env lock (v0.64) then pass the hash to soup lock write.
7. CMA-ES _LcgRng is a small in-tree LCG (no numpy at module top). Production randomness should inject a custom eval_fn.
8. cmaes_merge weight cap — _MAX_ADAPTERS=16 mirrors v0.57.0 adapter_merge.

Tests

+185 tests across 7 new files. Total: 11021 passed, 84 skipped.

🤖 Generated with Claude Code