feat: enable model-free WebUI startup - #1871
Open
inureyes wants to merge 8 commits into
Open
Conversation
Enable the bundled WebUI flag to start a model-free authenticated UI surface without loading a checkpoint. The startup path now builds shared WebUI security state, defers generated session-key disclosure until after bind, updates Host/Origin policy to the exact bound authority, and mounts static shell routes outside legacy API-key auth without widening the public endpoint list. Router and single-model apps now expose canonical bootstrap, catalog, runtime, operations, and events routes under the validated API prefix. Runtime observations require an opaque model_id, reject autoload, and return truthful nullable measurements while download and removal stay read-only for the follow-up adapter issue. Validation: cargo check --profile test-fast --features metal,accelerate --lib --tests; cargo test --profile test-fast --features metal,accelerate ui_compat_args -- --nocapture; cargo test --profile test-fast --features metal,accelerate router_server_security -- --nocapture; make verify-webui-contract WEBUI_CONTRACT_PY=/tmp/mlxcel-webui-contract/bin/python; PATH=/tmp/mlxcel-webui-contract/bin:$PATH make verify-versions verify-kernel-dtype-keys; make verify-llama-compat; cargo clippy --profile test-fast --features metal,accelerate --lib --tests -- -D warnings. Refs #1834. Closes #1838
Share the WebUI SSE replay parser between router and single-model routes, project selected router runtime settings from the chosen entry, validate explicit cache roots before startup, and treat bracketed IPv6 loopback hosts as loopback for WebUI security. Refresh the WebUI and llama compatibility docs to describe the now-mounted production WebUI path and the remaining unsupported adjacent llama.cpp browser surfaces. Validated with targeted WebUI route/startup tests and scoped clippy for lib/tests with metal and accelerate features. Refs #1838; Refs #1834
inureyes
added
type:enhancement
Use the router pool cache as the WebUI bootstrap authority so default cache roots and MLXCEL_MODELS_DIR roots expose the same roots and action states as the lifecycle cache actually mounted by startup. Also align the llama-compat manifest's synthetic WebUI static-assets claim with its entry id so the manifest/router parity test keeps enforcing symbolic route claims. Refs #1838 and #1834.
Install an actual cache source in the mounted cached-bootstrap fixture test instead of relying on a startup hint. A panic-on-use downloader keeps bootstrap network calls forbidden, and a separate no-cache case retains the misleading startup hint to guard the pool-authority regression. Preserve whole-response fixture equality and dynamic-only normalization. The no-cache expected response changes only cache roots and unavailable-action reasons; production code, shared fixtures, schema, and frontend assets are unchanged. Validate with all 55 narrow router/security tests, scoped lib/tests Clippy, 41 strict contract fixtures, the llama compatibility manifest, and formatting checks. Refs #1838.
The real model inventory exposed DFlash loader diagnostics longer than the frozen WebUI schema permits. Redact the private model path before limiting the catalog diagnostic to 512 Unicode code points, preserving its leading not-standalone explanation without changing core loader errors or filtering inventory. Align the shared frontend validator's minLength and maxLength checks with JSON Schema code-point semantics using an allocation-free loop instead of UTF-16 code-unit length. Add a whole mounted DFlash response fixture, independent structural negative cases, and ASCII/BMP/astral boundary tests on both sides of the contract. Regenerate the bundle manifest through the canonical deterministic build without changing styles. Validation: 36 catalog Rust tests, scoped lib/tests Clippy, 48 frontend tests, typecheck and lint, 42 strict schema fixtures, two clean bundle builds, formatting and license checks. Independent correctness and security reviews found no remaining issue in this bounded integration correction. Refs #1838; Refs #1834.
Mount side-effect-free unsupported responses for every declared single-model WebUI control and a canonical not-found response for operation lookup. Preserve the outer authentication, origin policy, and two MiB request-body checks without touching the provider or lifecycle state. Declare the missing catalog-refresh 422 response and add strict whole-envelope fixtures plus mounted fake-state regressions for valid controls, unchanged observations, security refusals, and declared/chunked body limits. Refresh the deterministic bundle manifest for the contract fixture change. Refs #1838
Update both technical reports with revision-specific CPU, full-suite, real router, and production startup evidence. Record the unresolved Metal recovery abort and keep explicit single-model and release acceptance unverified until the host is healthy. Clarify that the unavailable GB10 check exception does not waive local failures and that PR #1871 remains in review rather than complete.
21 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mlxcel-server --webuiandmlxcel serve --webui; the public shell and authenticated UI APIs share the canonical prefix, post-bind authority, API keys, and security middleware.-mremains read-only and returns canonical refusals for controls.Validation by source checkpoint
985f4a871ff25a18534563fbPending host recovery — not ready to merge
The full suite at
1ff25a18failed in the unchanged core testdflash_round_loop_starts_at_the_configured_depthwith a Metal command-buffer GPU-recovery abort. The exact same binary passed one isolated run and aborted on the next; the cause is not established, and this failure is not waived. GPU testing is paused pending host recovery/reboot.-m --webuireal-checkpoint acceptance; the prepared harness has not run.The unavailable required GB10 checks alone have a user-approved exception because that runner is down. This is not CUDA validation and does not waive the local GPU failure or pending acceptance. The issue and PR remain
status:review.Refs #1834; Closes #1838