Add restricted native MLX host consumer and fix review gaps

.agents/skills/fine-tuning/SKILL.md

@@ -57,8 +57,10 @@ Train language models with SFT, KTO, and GRPO locally or on supported cloud prov
 | Check SFT loss masking (tokenizer only) | `python tuner.py doctor sft-mask --dataset-path <jsonl> --model <tokenizer>` |
 | Inspect native training host candidate | `python tuner.py doctor native-training --json` — read-only platform/Python/package metadata; see `reference/native-local-training.md` |
 | Diagnose an offline SFT worker rejection | Read the exact retained `trainer.stderr.log`; closed phase/category/milestone labels locate a boundary, not a cause or retry authority; see `reference/sft-training.md` |
-| Native MLX prepared SFT candidate | Gated `ProviderFamilyV1` through existing TrainingAPI/RunsAPI; isolated worker, signed host catalog and native artifacts; no hardware qualification or launch CLI yet; see `reference/native-local-training.md` |
+| Native MLX restricted host consumer | `python -B examples/training_qualification/native_host.py inspect <canonical-host-config.json>` is read-only; exact-run `start` requires an externally signed root admission and separately supplied public-key pin. No live Mac qualification yet; see `reference/native-local-training.md` |
 | Capture reviewed native runtime bytes | `python -B scripts/capture_native_mlx_runtime.py --config <absolute-config> --dependency-lock <absolute-lock> --output <new-private-file>` — observation only; explicit roots, dependencies and original pins required; see `reference/native-local-training.md` |
+| Plan private native Mac runtime | `python -B examples/training_qualification/native_runtime_preparation.py plan <absolute-reviewed-config>` — local 54-wheel archive plan only; later `acquire`/`install` consume separate private claims. `seal-uv-locks` is a separately reviewed one-use custody repair for an exact completed install; see `reference/native-local-training.md` |
+| Prepare a reviewed private native model snapshot | `python -B examples/training_qualification/native_model_preparation.py inspect <absolute-config>` is local-only; `metadata-candidate` performs one bounded SDK metadata request and `acquire` downloads only after separate exact inventory review. Neither grants training admission; see `reference/native-local-training.md` |
 | Plan a derived training image | `python scripts/qualify_derived_training_image.py plan --config Trainers/image_profiles/<profile>.yaml` |
 | Warm Space scaffold | `python3 Trainers/cloud/scripts/manage_space.py render --template vllm_warm --output-dir /tmp/my-space --base-image ghcr.io/<org>/<image>:<tag>` |
 | Warm Space deploy | `python3 Trainers/cloud/scripts/manage_space.py deploy --space-id <user>/<space> --template vllm_warm --base-image ghcr.io/<org>/<image>:<tag> --hardware a10g-small --sleep-time 3600 --var BASE_MODEL=<model>` |

.agents/skills/fine-tuning/reference/native-local-training.md

@@ -60,19 +60,18 @@ original hash lock and use the existing `uv pip freeze`, `uv pip check`,
 `shasum -a 256` and `otool -L` tools for review evidence; do not install packages
 into the shared interpreter or treat a newly observed inventory as approved.
 
-There is no native launch CLI yet. The internal worker may run only in an
-independently admitted, host-owned bounded child. The desktop plan lists the
-implemented runtime/family boundaries and remaining consumer/qualification work.
-Do not call the worker as an ad hoc substitute for that composition.
+The internal worker may run only in an independently admitted, host-owned
+bounded child. Use the checked-in restricted host consumer described below;
+do not call the worker directly as an ad hoc substitute.
 
 ## Execution-boundary continuation
 
 The internal runtime modules now include a read-only native material capture,
 retained-source/tokenizer join, explicit LoRA/constant-AdamW composition,
 independent safetensors delta verifier, and owned subprocess guardian. These are
 reviewable runtime boundaries. The gated family described below composes them
-through the existing public coordinator; no global provider registration or
-native launch CLI is supplied.
+through the existing public coordinator; no global provider registration is
+supplied.
 
 `scripts/capture_native_mlx_runtime.py` takes a JSON object with `capture` and
 `expectation`. `expectation` uses the existing `MLXRuntimeExpectation` fields.
@@ -93,6 +92,17 @@ Mach-O dependencies, uncaptured external files and extra declared OS libraries
 reject. OS shared-cache dependencies are explicitly trusted through the recorded
 OS/kernel build, not falsely described as hashed ordinary files.
 
+For `@rpath` dependencies, inspect the complete captured load chain. Apple's
+[run-path guidance](https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/RunpathDependentLibraries.html)
+and `dyld(1)` contract describe `LC_RPATH` entries from the chain leading to the
+dependent image; expand `@loader_path` relative to the image declaring each
+entry. The static checker requires one captured Mach-O target across every
+proven context and rejects ambiguous targets, paths outside the capture,
+unreachable cycles and excessive contexts. Do not insert an ambient search
+directory or a package-specific fallback to make a candidate pass. A static
+capture remains an observation; repeat it on the final independently reviewed
+pushed source after any checker change.
+
 This captures installed bytes and static native dependencies. It does **not**
 prove selected wheel archive provenance, attest dynamic `dlopen` behavior,
 freeze the filesystem against a malicious same-uid process, or independently
@@ -113,8 +123,11 @@ LoRA target/layer explicitly, checks the realized trainable names/shapes and use
 explicit AdamW parameters with constant schedule. Unsupported schedules reject.
 It checks the optimizer's actual step count. The native adapter verifier checks
 tensor headers, bounds, names/shapes/dtypes, finite values and a nonzero numeric
-parameter delta. Final validation is a distinct pass **after reloading the saved
-adapter**; upstream in-loop validation occurs before the last optimizer update.
+parameter delta. Final validation loads a second clean pinned base, attaches the
+same configured LoRA, loads the saved final adapter and compares every trainable
+tensor against the saved bytes before evaluating that second model. A no-op or
+partial reload rejects. Upstream in-loop validation occurs before the last
+optimizer update.
 It saves native `adapter_config.json`, `input_binding.json` and
 `native_result.json` exclusively. These worker files become authenticated public
 artifact roles only through the family verifier described below.
@@ -151,7 +164,11 @@ embedded in a launcher.
 `native_mlx_child.py` is an internal `-I -S -B` entrypoint. It restricts import
 roots, checks imported source/extension origins against capture members and
 compiles pinned Python source rather than ambient bytecode. It joins the exact
-staged dataset, capture, lock and snapshots to the recompiled workload. It is
+staged dataset, capture, lock and snapshots to the recompiled workload. Before
+optimizer work, it builds the exact complete tokenizer role archive, extracts
+those bytes into a private temporary directory and loads the tokenizer locally
+with remote code disabled. The host later publishes that same deterministic
+archive. It is
 not a public invocation or an independent source/qualification authority.
 `native_runtime_spec` represents the capture with the existing `RuntimeSpec`
 `native_environment` discriminator; it invents no OCI image. Legacy OCI
@@ -166,9 +183,31 @@ must authenticate actual source evidence and current hardware before signing
 command material. `NativeCommandCatalogV1` retains create-only signed material
 through the existing record port. Signed terminal evidence must also match the
 retained process outcome on every read. It is not an engine database or replay grant.
+Immediately before a submit process claim, the family recaptures the admitted
+runtime/source closure and verifies complete model/tokenizer inventories. Drift
+at this boundary rejects before `run_once`; later dispatch remains uncertain.
+The CPU artifact verifier requires every configured target in the exact final
+model layer set and complete tokenizer snapshot selection.
+
+No accepting **ordinary** hardware authority is shipped. An unadmitted
+candidate has observe/artifact capabilities disabled and preflight is not
+ready. A separately verified `NativeRestrictedAdmissionV1` enables only its
+exact compiled workload and host selection, including project, request, run,
+attempt, private state root, process limits, artifact budget, source, runtime,
+prepared bytes and model/tokenizer snapshots, subject to a finite start expiry;
+it is not qualification. Retained public reads authenticate that signed selection
+after expiry and remote branch advancement without new dispatch authority. The host
+consumer in `examples/training_qualification/native_host.py` verifies the
+external signature using a separately supplied reviewed public-key SHA-256.
+It has no signing key or acceptance switch. The same host checks the actual
+clean pushed Git ref, full runtime recapture, private prepared publication,
+model snapshot inventories and M4 hardware before issuing command material.
+The proposal remains parameters, not an admission. See
+`examples/training_qualification/native-host.md` for exact config fields,
+preparation/readback commands, and the root signing boundary. No Mac training,
+ML import, model download or host qualification has been performed for this
+consumer yet.
 
-No accepting hardware authority is shipped. Candidate descriptors have
-observe/artifact capabilities disabled and preflight is not ready. A
 `NativeQualificationV1` contains exact selected profile/source/runtime/hardware
 and two distinct retained attempt-evidence references; its independent host
 authority must authenticate the supporting real runs, selected wheel/install
@@ -186,6 +225,85 @@ configured member archive from the verified snapshot. Lineage/metrics retain
 the exact worker bindings. Finite file/aggregate budgets and public 1 MiB
 stream chunks apply. CPU verification does not rerun the final evaluation.
 
-See `docs/plans/native-desktop-training-api-v1.md` for remaining host assembly,
-review and real-Mac acceptance. The CPU facade tests substitute the ML child;
+R5 Mac preparation retained a clean pushed `aba3c576` source clone and two
+genuine synthetic prepared publications under a fresh 0700 private stage.
+The selected Homebrew stdlib cannot currently pass static capture: its Cellar
+ancestor is group-writable. The candidate venv lacks `jsonschema` required by
+the current host composition. Preserve both as blockers rather than changing
+shared Homebrew permissions, weakening native tree traversal, or claiming a
+capture. Existing wheel-cache metadata does not attest absent wheel archives.
+The current child also imports `jsonschema` through
+`tuner.training.contracts` → `tuner.project.execution_source` → the eager
+`tuner.project` initializer. The host and child need the same exact inventory
+under the current `verify_native_material` contract. The r7 candidate keeps
+the original 50 lock unchanged and adds four reviewed Mac wheel hashes in
+`requirements.host-additions.lock`. Its flat `requirements.runtime.lock` is
+exactly the original bytes plus those four lines (SHA-256
+`7c167018ee6bd61a3609971e3f834082c798e7bd2a3fa0c5c2564887da4fde4f`).
+The candidate proposal selects this 54-package lock; it grants no runtime or
+hardware authority.
+
+Use `examples/training_qualification/native_runtime_preparation.py plan` with
+the exact checked-in `native-private-runtime.example.json` to inspect the
+166,269,790-byte archive selection without effects. Only after independent
+review, copy that config to a new 0600 file in an existing 0700 private parent
+and use its `acquire`, `install`, and `verify` phases from a clean pushed source.
+The CLI retains the exact Astral 3.11.14+20260211 interpreter archive and 54
+wheel archives, checks hashes before an offline uv local-mirror install, binds
+the uv executable hash/version, confines caches and temporary paths to the
+private root, and retains consumed claims. HTTPS transfers stop before writing
+an excess byte; finite expansion checks are pre-install inventory bounds, not
+a hard aggregate filesystem quota for uv temporary files. A 2 GiB retained
+private-tree guard runs after each phase. Include narrow
+`source/shared` in the subsequent final-source static capture alongside
+`source/tuner` and `source/synaptic_tuner`. Do not chmod Homebrew or reuse the
+old venv/capture attempt.
+
+Pinned uv 0.12.23 was observed creating empty owner-owned `uv-python/.lock`
+and `venv/.lock` at mode 0666 despite umask 077 inside the private 0700
+runtime. The checked-in fresh `install` seals only those exact regular,
+zero-byte, single-link files to 0600 after the last uv call and checks the
+installed tree before its result. For the already completed r9 install,
+`seal-uv-locks <same-absolute-config>` is a separate, one-use repair action
+requiring independent review and exact retained source/config/archive/uv/
+install-record admission. It writes a consumed repair claim before either
+descriptor mode change; interruption or identity drift retains the claim and
+partial evidence without automatic replay. It preserves the original install
+claim/result. `verify` rejects incomplete repair records and writable members.
+Do not run static capture until custody passes; the capture must bind the
+final pushed source, including `shared`, and the combined 54-package lock.
+
+The checked-in `examples/training_qualification/native_model_preparation.py`
+is the later reviewed model-acquisition action: `inspect` is local,
+`metadata-candidate` reads at most 2 MiB of the exact Hub metadata response
+before JSON/SDK `ModelInfo` parsing, and `acquire` requires a separately
+reviewed complete member/tokenizer selection. Model files stream from the
+exact pinned Hub resolve URLs into precreated private 0700 nested parents;
+per-file and aggregate caps reject before excess writes. The SDK's unbounded
+snapshot/cache download path is not used. Unexpected redirect hosts fail
+closed. It verifies upstream hashes and publishes private create-only
+snapshots. Its receipt is
+`OBSERVED_NOT_ADMITTED`. No complete Mac model snapshot or tokenizer labels
+have yet been acquired/reviewed. See `examples/training_qualification/native-host.md` for
+exact staging paths, publication digests and commands.
+
+The first bounded model acquisition left a consumed partial workspace with
+five verified small members and a zero-byte `model.safetensors`. Preserve it;
+the byte count alone does not diagnose the transport. A separately admitted
+`probe-transfer` uses the existing helper and a fresh private record root,
+binding the exact reviewed acquisition config hash and selected member. It
+performs at most one HEAD chain and one GET chain, up to three redirects each,
+20 seconds per request, 120 seconds for the owned child, and reads no more
+than one GET body byte without a Range header. Unknown redirect origins stop
+before follow. Closed observations contain no URL, query, header value,
+credential or exception text. Its consumed claim and result cannot repair or
+authorize replay of the old acquisition. See the host example for the config.
+The r13 one-use probe observed HTTP 302 on both methods to the exact
+`us.aws.cdn.hf.co` origin documented by Hugging Face; the preexisting
+acquisition allowlist rejected it before follow. Only that exact observed
+origin was added to the helper allowlist. Preserve the r12 consumed workspace;
+the probe cannot retroactively establish its failure cause or admit a retry.
+
+See `docs/plans/native-desktop-training-api-v1.md` for remaining review and
+real-Mac acceptance. The CPU facade tests substitute the ML child;
 they are not a hardware result and must never unlock the candidate.

.claude/skills/fine-tuning/SKILL.md

@@ -57,8 +57,10 @@ Train language models with SFT, KTO, and GRPO locally or on supported cloud prov
 | Check SFT loss masking (tokenizer only) | `python tuner.py doctor sft-mask --dataset-path <jsonl> --model <tokenizer>` |
 | Inspect native training host candidate | `python tuner.py doctor native-training --json` — read-only platform/Python/package metadata; see `reference/native-local-training.md` |
 | Diagnose an offline SFT worker rejection | Read the exact retained `trainer.stderr.log`; closed phase/category/milestone labels locate a boundary, not a cause or retry authority; see `reference/sft-training.md` |
-| Native MLX prepared SFT candidate | Gated `ProviderFamilyV1` through existing TrainingAPI/RunsAPI; isolated worker, signed host catalog and native artifacts; no hardware qualification or launch CLI yet; see `reference/native-local-training.md` |
+| Native MLX restricted host consumer | `python -B examples/training_qualification/native_host.py inspect <canonical-host-config.json>` is read-only; exact-run `start` requires an externally signed root admission and separately supplied public-key pin. No live Mac qualification yet; see `reference/native-local-training.md` |
 | Capture reviewed native runtime bytes | `python -B scripts/capture_native_mlx_runtime.py --config <absolute-config> --dependency-lock <absolute-lock> --output <new-private-file>` — observation only; explicit roots, dependencies and original pins required; see `reference/native-local-training.md` |
+| Plan private native Mac runtime | `python -B examples/training_qualification/native_runtime_preparation.py plan <absolute-reviewed-config>` — local 54-wheel archive plan only; later `acquire`/`install` consume separate private claims. `seal-uv-locks` is a separately reviewed one-use custody repair for an exact completed install; see `reference/native-local-training.md` |
+| Prepare a reviewed private native model snapshot | `python -B examples/training_qualification/native_model_preparation.py inspect <absolute-config>` is local-only; `metadata-candidate` performs one bounded SDK metadata request and `acquire` downloads only after separate exact inventory review. Neither grants training admission; see `reference/native-local-training.md` |
 | Plan a derived training image | `python scripts/qualify_derived_training_image.py plan --config Trainers/image_profiles/<profile>.yaml` |
 | Warm Space scaffold | `python3 Trainers/cloud/scripts/manage_space.py render --template vllm_warm --output-dir /tmp/my-space --base-image ghcr.io/<org>/<image>:<tag>` |
 | Warm Space deploy | `python3 Trainers/cloud/scripts/manage_space.py deploy --space-id <user>/<space> --template vllm_warm --base-image ghcr.io/<org>/<image>:<tag> --hardware a10g-small --sleep-time 3600 --var BASE_MODEL=<model>` |