[bong-water-water-bong]

build: rewrite build-machine paths out of the binaries and gate the shipped artifacts

Three related packaging properties, all enforced rather than assumed:

• Path mapping. ONEBIT_PATH_MAP_FLAGS (-ffile-prefix-map for the source tree and the build
  tree) is applied to every engine target and handed to the HRX llama.cpp build through
  cmake/hrx.cmake, so a string an assert or a log bakes in reads . / build instead of the
  machine that produced it. With -DONEBIT_GPU_PRIVATE the add-on checkout is mapped as well.
• Artifact hygiene gate. pack_artifact_hygiene() (scripts/pack-elf.sh) reports any shipped
  program or library that still carries a compiler identification section, a path into a build
  machine, or an absolute RUNPATH; scripts/package-linux.sh fails the package when it reports
  anything. pack_strip() now also drops .comment (and the gold-version note) after
  strip --strip-unneeded.
• Relative RUNPATH. Every shipped ELF gets $ORIGIN instead of whatever the build left, so a
  program loads its libraries from beside itself and from the system only — ds4-server included,
  which used to keep an SDK path.

Verified on this box with a Release build of the onebit target:

$ strings -a 1bit | grep -cE '^/(home|Users|root)/'      -> 0
$ readelf -p .comment 1bit                               -> GCC: (Ubuntu 16-…)
$ source scripts/pack-elf.sh; pack_artifact_hygiene …    -> 1bit: .comment names the compiler
$ pack_strip …; patchelf --set-rpath '$ORIGIN' …         -> gate: clean
$ readelf -p .comment 1bit                               -> (no .comment)
$ readelf -d 1bit | grep RUNPATH                         -> Library runpath: [$ORIGIN]

The HRX and NPU binaries take the same flags through the same two CMake entry points but were not
built here (they need the toolchain), so they are covered by the gate on the next package run, not
by this transcript.

🤖 Generated with Claude Code

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit a186574)

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Potential Path Exposure The pack_artifact_hygiene function checks for build-machine paths using a regex that may not be comprehensive enough. Specifically, the pattern ^/(home|Users|root)/[A-Za-z0-9_./-]+ might miss some edge cases or alternative path structures, potentially allowing paths to remain embedded in shipped binaries. strings -a "$f" 2>/dev/null | grep -qE "^/(home|Users|root)/[A-Za-z0-9_./-]+" && out="$out $f: embedded build-machine path" Compiler Identification Section The check for compiler identification in .comment section uses a simple grep pattern that may not be robust enough. It could potentially miss cases where the compiler name or version string is formatted differently, leading to false negatives in artifact hygiene checks. readelf -p .comment "$f" 2>/dev/null | grep -qE "clang version|GCC:" && out="$out $f: .comment names the compiler" RPATH Validation The pack_artifact_hygiene function validates RUNPATH entries but relies on a specific regex pattern to detect absolute paths. If the toolchain root path is not correctly set or if there are variations in how paths are expressed, this validation might fail to catch violations. if [ -x "$stage/hrx/llama/bin/llama-server" ]; then cp "$src/scripts/lemonade-hrx" "$src/scripts/install-lemonade-ppa.sh" "$stage/" mkdir -p "$stage/lemonade" cp "$src/config/lemonade/1bit-hrx.conf" "$stage/lemonade/"

[bong-water-water-bong]

Review (orchestrator): right set - path mapping for the source and build trees, a hygiene gate at pack time that fails on leftover build-machine paths, and $ORIGIN RUNPATH on every shipped ELF. Stays a draft until one package build on the box proves the gate and the packed binaries still load (after the leaderboard releases the lane); then it goes in ahead of the next packaging.

[github-actions]

Persistent review updated to latest commit 9658e78

[bong-water-water-bong]

Package-stage proof on strixhalo (copy of the packed lemonade-onebit-rc-2026-10-23, gpu-hold -l "build pi-issues-b" -t 45, no program run):

Gate, on the artifact as shipped — 21 ELFs checked:

21  .comment names the compiler
16  embedded build-machine path

After pack_strip() + rpath handling: .comment findings → 0 (verified by readelf -p .comment), RUNPATH findings → 0, and the 16 path findings remain, which is the expected split: those are __FILE__ string literals in asserts/logs, so packaging cannot remove them — only a rebuild with the prefix map does, which is what the ryzen onebit build in the first commit shows (0 /home strings).

Loadability, ldd only: checked_elfs=21 unresolved=1, and the one is pre-existing and unrelated: llama-perplexity ships without libllama-perplexity-impl.so (the build produced impl libs for server and bench only). Worth its own fix — either build the perplexity impl lib or stop shipping the binary.

One correction this proof forced (second commit): a blanket $ORIGIN leaves ds4-server, ds4, ds4-bench unloadable — they link libhipblaslt.so.1, libhipblas.so.3, librocblas.so.5, libamdhip64.so.7 from the toolchain, and that closure is 905 MB, so it cannot be bundled. pack_localize already does the right thing ($ORIGIN plus the SDK entries the link needed); only the top-level 1bit, which it does not visit, needed its rpath dropped. The gate now accepts an absolute RUNPATH only under the toolchain root and still fails on one pointing at a build tree or a home directory.

[bong-water-water-bong]

Full build + package stage on strixhalo, from a clean tree with these flags (gpu-hold -l "build pi-issues-b" -t 60 then -t 45, nice -n 19 taskset -c 0-3):

$ ninja -C build -j4 1bit llama_hrx        # HRX ExternalProject rebuilt with the flags
[22/22] Linking CXX executable 1bit
build_rc=0   (253 s)

$ scripts/package-linux.sh build /tmp/pkg-out secproof
  hrx/llama/bin: 25 files
→ 1bit-secproof-linux-x86_64.tar.zst   (packaged tree: 23 files, 41M)

=== hygiene gate on the packaged tree ===
(empty — clean)

=== build-machine paths in the shipped 1bit and the HRX library ===
1bit-secproof-linux-x86_64/1bit                              paths=0  comment=0
1bit-secproof-linux-x86_64/hrx/llama/bin/libggml-hrx.so.0.18.0  paths=0  comment=0

=== runpath ===
1bit                     (none)
hrx/llama/bin/llama-server   Library runpath: [$ORIGIN]

=== load check (ldd, no program run) ===
checked_elfs=15  unresolved=0

So every shipped ELF in this package is clean: no build-machine path (the HRX library previously carried
ggml-hrx.cpp, ../ggml-impl.h, graph-program-cache.cpp, and the add-on's hip-abi-check.cpp paths), no
.comment, and the only absolute string the HRX tree had left — a RUNPATH list into the build tree — is
rewritten by pack_localize into $ORIGIN.

Negative control, same gate on the previous candidate (built without the flags):

21  .comment names the compiler
16  embedded build-machine path

Two limits of this run, stated because they matter: this tree has no add-on checkout and no NPU kernel
sets, so the package is 41 MB against 147 MB for the real one, and package_checks's assertion that
libggml-hrx.so carries ggml_hrx_hip_addon_register cannot pass here — that check is for the release lane
with -DONEBIT_GPU_PRIVATE. The ds4-server rpath path was confirmed separately on the packed candidate
($ORIGIN + the SDK entry pack_localize keeps; its ROCm closure is 905 MB and is not bundled).

Also in this branch: the gate read $ONEBIT_TOOLCHAIN_ROOT, set only by weekly.sh; under set -u its RUNPATH
rule errored out silently instead of checking, so it now defaults to /opt/rocm-therock.

[bong-water-water-bong]

Review (orchestrator): proven on the public tree (full build with the flags, package stage, gate clean with a negative control, loads from $ORIGIN incl. the DwarfStar binaries). Merging on green CI; the first package built WITH the private add-on (pi flint's decoy package build on strixhalo, rebased onto this) is the proof for the add-on's code objects, and the gate failing loudly there is the intended behaviour.

[github-actions]

Persistent review updated to latest commit a186574