[jerryfane]

Description and motivation

Add a clean, pinned native macOS path for the new Drama 3 NVFP4 checkpoint and engine. This is actual Zig/Metal support, not a Python fallback or checkpoint conversion.

Native implementation: ashhart/TensorFold#1268. This recipe carries the ordered/checksummed patches, so building it does not require waiting for that source PR to merge.

Changes

• Darwin scripts/build-engine.sh --weights nvfp4 selects a separate upstream pin, applies three verified patches, and builds the native server, codec generator and voice writer with Zig 0.17.0 / apple_m1. Existing full-model and CUDA NVFP4 pins/series stay unchanged.
• Packed block-16 NVFP4 experts, compact original-ID routing, BF16 dense/tower storage and reference-conditioned CFG on Metal; paired and separate execution share the same semantics.
• Shared weight selection for both pilots. The selected checkpoint manifest is required even for explicit --checkpoint overrides; a missing default can be downloaded, but an existing incomplete/modified directory is refused, not silently repaired or replaced. Explicit legacy overrides do not acquire a false pinned-provenance label.
• Mac launcher supports the quant's explicit CFG policy. No new production service, implicit backend fallback, global configuration change, or model conversion.
• Update Mac prerequisites/build/run/correctness documentation, patch attribution/index, changelog and results index. Publish sanitized results/macos-nvfp4.json; no voice data, PCM, weights or private paths.

Exact checkpoint: plotarmordev/drama-3-NVFP4-Pruned@494db08481db952f834b2241bce63fb3dfa72554 (all 15 files verified). Engine base: 3d219d2156d4c25dcfb74370c8703cd89e58aa49, native 1.1.4.

Testing

Actual Mac execution

Apple M5 Ultra, applegpu_g17, retained 256 GiB inventory. Three sequential single-stream native servers: paired gamma 1.5, separate gamma 1.5, and opt-in request gamma.

28 HTTP checks, zero failed checks: 15 complete nonempty/nonzero PCM replies, one deliberate early stream cancellation, and 12 expected validation refusals. Paired/separate, streamed/whole, repeated reference, A→B→A and post-cancellation responses matched exactly. Gamma 1/2 requests were each repeatable. All original server/client owners settled; servers exited 0. No Studio/oMLX/production changes.

The observed early close plus exact follow-up is the cancellation evidence; it is not an internal engine-submission/cancellation trace. Live inference used the native binary directly; launcher selection has CPU coverage, not a separate end-to-end launcher/model run.

Numerical contract, including the initial failure

Initial registered Metal run:

SUMMARY 14 kernels: 13 pass gates 1-4, 1 fail, 0 known findings; 0 controls: 0 red as planted, 0 missed; 0 limit problems; gates 2138 ms, limits 6587 ms

The shared-gate precision stress was underpowered because sigmoid saturation hid FP16 overflow. A test-only correction centers the exact dot at one and proves FP16/BF16 discrimination with an independent CPU regression; no kernel or tolerance change. Only the failed variant was rerun:

SUMMARY 1 kernels: 1 pass gates 1-4, 0 fail, 0 known findings; 0 controls: 0 red as planted, 0 missed; 0 limit problems; gates 159 ms, limits 0 ms

The other 13 passes and all original runtime-limit checks remain retained. This is not presented as a second full-suite pass.

Build / CPU / publication

• Eight selected-weight regressions passed.
• Clean pinned build produced all three advertised artifacts. The test-only correction applied cleanly and its contract runner built.
• Native CPU runner receipts: 20 CFG cases, 84 contract-host cases, 6 format/guidance cases, 2 independent reference tests, and the new nonlinear stress regression passed. Metal host: 3 passed/2 skipped; CUDA host compile passed, not device execution.
• Initial native server receipt: 737 passed/3 skipped/1 incidental scheduler-count assertion failure, plus 5 JSON passes. Removed only that count assertion and retained behavior/deadline assertions; focused 16-case follow-up passed. No broad-suite-pass claim.
• Final CLI-only grouping avoids pending upstream Notes flag-table collisions. Its native build/version/help passed. Final ordered patch application has the exact Git tree of upstream source 6585530054e273aa1a1554549585489f2497cb41.
• The report distinguishes the live-qualified binary from this later CPU/CLI-only build, along with original versus publication patch-mail identities. Completed GPU checks were not replayed. All bounded proof/build owners exited 0 and settled.

Unrun / limitations: Metal M1–M4, smaller-memory capacity, CUDA model parity, teacher-forced fidelity, full mixed-family/golden suite, multilane speech, drafted-token equivalence, voice encoder execution, WER/speaker quality and latency/RTF. The standalone quant diagnostic was built, not run. Existing full-model qualification is not relabeled as NVFP4 evidence.

Performance or quality claim

None. This PR establishes scoped native Mac functionality and correctness checks, not a speedup, quality equivalence, minimum RAM, or whole-host exclusivity.

Checklist

• Separate Mac series; ordered patches, SHA256SUMS, attribution and patch table updated; all patches linked to upstream #1268.
• Clean build entry point and ordered follow-up application proven; all advertised artifacts built, with the final CLI-only native rebuild separately identified.
• Deterministic selection, format, routing, guidance, numerical and lifecycle regressions included; initial failures retained.
• No production changes or implicit alternate runtime/checkpoint paths.
• No personal voices, recordings, private identities/hosts/paths, weights or credentials in outgoing artifacts.
• Legacy compare_gate.py / stream_check.py full-model A/B gate: not run for this newly supported NVFP4 backend; the actual native HTTP/PCM equality checks above are reported explicitly instead.
• Performance/quality claim checklist: n/a; no such claim.

[plotarmordev]

Thanks, Jerry, this is careful work. I checked what I can from Linux: the three Mac patches apply to 3d219d2 and give exactly the tree of ashhart/TensorFold#1268 (engine HEAD e5e86adb, matching your receipt), the new CPU test steps pass here, the Metal host code compiles for aarch64-macos, and the existing full and CUDA NVFP4 builds come out unchanged. I can't run Metal myself, so the Mac results rest on your receipt. I've merged it.

A few small things for a follow-up, none blocking:

• pilot_macos.py downloads a missing checkpoint while holding the shared GPU lock. The Linux launcher downloads before taking the lock; could the Mac one do the same and keep only the verification under the lock?
• Patch 0001 drops busy_replies > 1 from speech_redraw_test.zig. It passes here on Linux with the assertion kept, so I'd rather settle that in #1268 than in the recipe.
• results/macos-nvfp4.json could record the settings each run used, so the receipt stands on its own.