Fix large-model FP16 conversion and add XLM-RoBERTa NER recipes

[ssss141414]

Summary

Adds CPU fp32 and fp16 token-classification recipes for Davlan/xlm-roberta-large-ner-hrl and generalized fixes for ONNX models whose external data exceeds protobuf's 2 GB in-memory limit. It also avoids unnecessary optional WindowsML provider-catalog initialization for explicit CPU sessions and static analysis, eliminating successful-command teardown crashes. After rebasing onto current main 38767add6f91c7b10b6394fae3af6f437e02effd, exact PR head cb7f8305754d4148ae507493e4e40efb893559d9 reaches Effort L2 / Goal L2 / Outcome L2: both required CPU precisions pass build, perf, and PyTorch-vs-ONNX numeric parity with full coverage.

Model metadata

What the model does

A multilingual named-entity recognition model that accepts tokenized text in Arabic, German, English, Spanish, French, Italian, Latvian, Dutch, Portuguese, or Chinese and emits one label score vector per token. The model card advertises person, organization, and location recognition, while pinned checkpoint revision 1f929ffad9b7353f9c84b0b3f579fc3bb0b3685e additionally publishes DATE labels; this conflict is preserved rather than silently reconciled. Confidence: verified.

Primary user stories

• Supply news-domain text in one of the ten advertised languages to obtain token-level named-entity spans for people, organizations, and locations. Confidence: verified from the pinned model card.
• Apply the checkpoint to multilingual NER outside the training news corpora while accounting for the documented risk that domain and time-period shift may reduce quality. Confidence: verified from the pinned model card.

Supported tasks

• token-classification through the checkpoint, Transformers, Optimum ONNX, and WinML surfaces. The pinned Hub metadata, XLMRobertaForTokenClassification architecture, Optimum registration, and winml inspect resolution agree. Confidence: verified.

Model architecture

XLMRobertaForTokenClassification
├── XLMRobertaModel (encoder-only; no pooler)
│   ├── Embeddings (vocab 250,002 × hidden 1,024; positions 514)
│   └── Encoder layer × 24
│       ├── Self-attention (16 heads × 64; Q/K/V + output projection)
│       ├── Residual + LayerNorm
│       ├── Feed-forward (1,024 → 4,096 → 1,024; GELU)
│       └── Residual + LayerNorm
├── Dropout
└── Token classifier (1,024 → 9 logits per token)

• Source/confidence: pinned checkpoint config and Transformers XLMRobertaForTokenClassification component sources (verified).

Validation and support evidence

Baseline

Fresh clean-main baseline: 38767add6f91c7b10b6394fae3af6f437e02effd, confirmed after git fetch origin main; winml, version 0.2.0. The PR was rebased conflict-free so its merge base equals this commit.

• Recipe-free pinned-snapshot CPU fp32 build: PASS, exit 0; CLI build time 184.1 s, wrapper elapsed 202.028 s; graph 328,813 bytes plus 2,237,493,248 bytes external data.
• Baseline perf: FAIL, process exit -1073741819 (0xC0000005) after writing valid diagnostic JSON. With 10 warmups and 100 iterations, mean/p50/p90/p95/p99 latency was 844.147/833.493/865.409/945.695/1,336.831 ms, throughput 1.18 samples/s, and RSS total delta 1,300.82 MB. Output existence does not upgrade the failed process exit to L1 PASS.
• Baseline eval: FAIL, process exit -1073741819 (0xC0000005) after writing JSON. Independently, the result is EVAL-BLOCKED-DATA-PROVENANCE: ORG precision/recall/F1 0/0/0 and overall accuracy 0.9090909090909091 are invalid diagnostics because checkpoint and dataset label IDs conflict.
• Current-main auto-config is semantically identical to the shipped fp32 recipe. The fp16 recipe preserves export, optimization, compile, and loader settings and changes /quant from null to explicit FP16 settings.
• Optimum already registers xlm-roberta token classification (VENDOR-ONLY); WinML adds no vendor registration. The contribution therefore repairs generalized conversion and lifecycle defects rather than adding a checkpoint-specific exporter.

Goal

Committed Effort L2 / Goal L2 / Outcome L2. Success requires both CPUExecutionProvider / cpu tuples (fp32, fp16) to pass structural build, crash-free perf, and named-input numeric parity against pinned PyTorch. Revision-3 reissued the charter after the current-main rebase and invalidated all measurements from the superseded base. L3 remains unavailable because no checkpoint-owner-authoritative dataset revision, split/subset, and exact nine-label mapping is published.

Outcome

• Exact tested state: baseline/merge base 38767add6f91c7b10b6394fae3af6f437e02effd; PR head cb7f8305754d4148ae507493e4e40efb893559d9.
• L0 PASS, L1 PASS, L2 PASS for CPU fp32 and fp16; overall verdict PASS, coverage full, no deferred tuples, and no ceiling downgrade.
• Shipped two recipes plus generalized large-external-data FP16 conversion, explicit-CPU session/device routing, static-analyze lifecycle fixes, and focused tests.
• examples/recipes/README.md is untouched; no model-ID or model-type special case was added; no model-8 path is present.
• Learner audit: the rebase and refreshed measurements preserve the existing XLM-R findings' semantics (large-external-data FP16 repair, explicit-CPU lifecycle repair, fp16 CPU tradeoff with parity, and static-analysis shape). No new methodology trigger fired, so Lane A remains unchanged; existing xlm-roberta-001 through xlm-roberta-004 and _meta-083 remain the applicable record.

Per-EP/device/precision results — including perf and eval data

Goal ladder

Tier	EP / device	Precision	Verdict	Exact evidence
L0	CPUExecutionProvider / cpu	fp32	PASS	Exit 0; 190.694599 s; checker PASS; 862 nodes; 403 initializers; 396 FLOAT; 328,813-byte graph + 2,237,493,248-byte sidecar
L0	CPUExecutionProvider / cpu	fp16	PASS	Exit 0; 256.2238233 s; checker PASS; 863 nodes; 403 initializers; 396 FLOAT16; 328,462-byte graph + 1,118,746,624-byte sidecar
L1	CPUExecutionProvider / cpu	fp32	PASS	10 warmups + 100 iterations; command exit 0
L1	CPUExecutionProvider / cpu	fp16	PASS	10 warmups + 100 iterations; command exit 0
L2	CPUExecutionProvider / cpu	fp32	PASS	CPU requested/active; finite [1,512,9] logits; 14 active tokens; top-1 match 1.0
L2	CPUExecutionProvider / cpu	fp16	PASS	CPU requested/active; finite [1,512,9] logits; 14 active tokens; top-1 match 1.0
L3	CPUExecutionProvider / cpu	fp32	EVAL-BLOCKED-DATA-PROVENANCE	Smoke command exit 0; no valid task metric
L3	CPUExecutionProvider / cpu	fp16	EVAL-BLOCKED-DATA-PROVENANCE	Smoke command exit 0; no valid task metric

Exact perf

Precision	Mean	Min	Max	p50	p90	p95	p99	Std. dev.	Warmup mean	Throughput	RSS load Δ	RSS inference Δ	RSS total Δ	VRAM total Δ
fp32	835.589 ms	786.039 ms	900.489 ms	832.447 ms	867.318 ms	873.330 ms	900.489 ms	21.297 ms	842.874 ms	1.20 samples/s	1,166.94 MB	134.40 MB	1,301.34 MB	0 MB
fp16	953.995 ms	911.581 ms	1,083.109 ms	948.777 ms	980.120 ms	1,006.781 ms	1,083.109 ms	28.266 ms	959.719 ms	1.05 samples/s	1,180.77 MB	166.70 MB	1,347.47 MB	0 MB

Exact L2 parity against pinned PyTorch

The reference and both ONNX runs use the exact sentence Microsoft hired Alice in Berlin on 19 July 2026., tokenizer output padded/truncated to [1,512], and checkpoint revision 1f929ffad9b7353f9c84b0b3f579fc3bb0b3685e.

Precision	Scope	Cosine	Max abs	Mean abs	Top-1 label match
fp32	Full [1,512,9] logits	0.9999999999999452	0.000016689300537109375	0.0000018852588254958391	1.0
fp32	14 active-token logits	0.9999999999997312	0.000016689300537109375	0.000002866344792502267	1.0
fp16	Full [1,512,9] logits	0.9999999662786659	0.006743431091308594	0.0017111350381229487	1.0
fp16	14 active-token logits	0.9999999294059181	0.006743431091308594	0.0015683119732236106	1.0

Eval: EVAL-BLOCKED-DATA-PROVENANCE

Both fp32 and fp16 smoke commands exited 0 against BramVanroy/conll2003 revision 4ffbd53d9e0b92b473b9b7dcff12f53e7c17ce0c, split validation, first unshuffled streaming sample (samples=1, seed 42). The emitted values are retained only as invalid diagnostics and excluded from support claims:

Precision	ORG P/R/F1 (number)	Overall P/R/F1	Overall accuracy	Eval time / latency	Samples/s	Valid task metric
fp32	0/0/0 (1)	0/0/0	0.9090909090909091	0.8206391999847256 s	1.2185623109627384	No
fp16	0/0/0 (1)	0/0/0	0.9090909090909091	0.9112470999825746 s	1.0973971824098234	No

The checkpoint map is [O, B-DATE, I-DATE, B-PER, I-PER, B-ORG, I-ORG, B-LOC, I-LOC]; the dataset map is [O, B-PER, I-PER, B-ORG, I-ORG, B-LOC, I-LOC, B-MISC, I-MISC]. Numeric IDs 1–8 are incompatible, and the dataset has no DATE labels. No checkpoint-owner-authoritative dataset revision, split/subset, and exact DATE/PER/ORG/LOC mapping exists, so an inferred remap would be semantically unsafe and no L3 metric is claimed.

Delta

Recipes

• Added examples/recipes/Davlan_xlm-roberta-large-ner-hrl/cpu/cpu/token-classification_fp32_config.json; it is semantically identical to current-main auto-config.
• Added examples/recipes/Davlan_xlm-roberta-large-ner-hrl/cpu/cpu/token-classification_fp16_config.json; JSON pointer /quant changes from null to FP16 mode with samples=10, calibration_method=minmax, uint8 weight/activation defaults, task=token-classification, model identity/type fields, fp16_keep_io_types=true, and no block list. /export, /optim, /compile, and /loader remain identical.

Generalized source fixes

• convert_to_fp16() and FP16Pass.run() accept/pass a model path, use infer_shapes_path() through a closed temporary file, and disable duplicate ORT FP16 shape inference. Already-FP16 path input materializes external tensors before return, so relocation remains self-contained. No checkpoint special case is used.
• WinMLSession.__init__() and resolve_device() bypass optional WindowsML provider-catalog initialization for explicit built-in CPU routing.
• analyze() enumerates local optional EP/device pairs only when runtime unknown-op probing is requested; default static rule analysis does not load optional plugins.
• Added focused FP16 path/relocation, quant-pass, CPU-session, and device-resolution tests.

Fresh post-rebase gates

• Focused: 180 passed, 6 skipped, 2 deselected in 4.70 s; process exit 0.
• Broad affected suite: 2,445 passed, 69 skipped, 2 deselected, 1 xfailed in 195.28 s; process exit 0.
• mypy -p winml.modelkit: PASS; changed-file Ruff: PASS; git diff --check 38767add6f91c7b10b6394fae3af6f437e02effd...HEAD: PASS.
• Scope: exactly 11 contribution files; no recipe README, model-8, or tracked scratch path.

Analyze summary — component level and op level

ANALYZE-PARTIAL-SUCCESS: each all-EP command exited 1 because QNN classifications are partial, while each emitted complete valid 11-run / 11-result JSON. This is static rule compatibility analysis, not measured accelerator execution.

Component-level summary

Both artifacts carry XLMRobertaForTokenClassification hierarchy metadata: 558,850,057 parameters, 444 total modules, 172 traced modules, 344 execution steps, embeddings plus all 24 encoder layers, and the per-token classifier.

Artifact	Architecture coverage	Mapping	Confidence	Actionable static findings
fp32	embeddings; 24× encoder attention/FFN; classifier	855 mapped, 0 partial, 7 unmapped of 862	partial	QNN NPU/GPU partial: Add, Div, Erf, Mul; unsupported: none
fp16	embeddings; 24× encoder attention/FFN; classifier	855 mapped, 0 partial, 8 unmapped of 863	partial	QNN NPU/GPU partial: Add, Div, Erf, Mul; unsupported: none

Dropout is optimized away in evaluation export. The extra fp16 unmapped node is the graph-output cast.

Op-level summary

Artifact	Graph	Dominant operators	Static EP roll-up
fp32	862 ops / 18 types	Add 244; MatMul 193; Mul 97; Reshape 96; Transpose 96; LayerNormalization 49; Softmax 24; Div 24; Erf 24; Cast 5	TensorRT RTX and OpenVINO NPU/GPU/CPU fully supported; QNN NPU/GPU partial as above
fp16	863 ops / 18 types	Same counts except Cast 6	Same roll-up

Rule-less groups reported all 18 types unknown: CUDA/GPU, MIGraphX/GPU, DML/GPU, CPU/CPU, and VitisAI/NPU. Rules provenance: public release v0.2.0, archive rules-v0.2.0.zip, SHA-256 6dcabbe7f5493fbc2bd23de195ab6e35b3578d510f18c2e220bc5538a1f232cc, 1,746 parquet files.

Reproduce commands

These PowerShell commands separate a clean baseline worktree at exact current-main commit from exact PR-head validation. Every checkpoint-loading operation consumes the materialized pinned $SNAPSHOT; no floating Hub model ID is passed to build or eval.

$ErrorActionPreference = 'Stop'
$BASE = '38767add6f91c7b10b6394fae3af6f437e02effd'
$HEAD = 'cb7f8305754d4148ae507493e4e40efb893559d9'
$REV = '1f929ffad9b7353f9c84b0b3f579fc3bb0b3685e'
$ROOT = (Resolve-Path $PWD).Path
$OUT = Join-Path (Split-Path $ROOT -Parent) 'winml-pr1137-repro'
$SNAPSHOT = Join-Path $OUT 'checkpoint_snapshot'
$BASELINE_TREE = Join-Path $OUT 'baseline-main-tree'
$BASELINE_OUT = Join-Path $OUT 'baseline_fp32'
$env:OUT = $OUT
$env:SNAPSHOT = $SNAPSHOT
New-Item -ItemType Directory -Force -Path $OUT | Out-Null

# Materialize the immutable checkpoint revision once.
@'
import os
from huggingface_hub import snapshot_download
snapshot_download(
    repo_id="Davlan/xlm-roberta-large-ner-hrl",
    revision="1f929ffad9b7353f9c84b0b3f579fc3bb0b3685e",
    local_dir=os.environ["SNAPSHOT"],
)
'@ | .\.venv\Scripts\python.exe -

# Clean current-main baseline, separate from the PR checkout.
git fetch origin main
git worktree add --detach $BASELINE_TREE $BASE
Push-Location $BASELINE_TREE
uv sync --locked --all-extras --all-groups
if ((git rev-parse HEAD).Trim() -ne $BASE) { throw 'baseline HEAD mismatch' }
.\.venv\Scripts\winml.exe --version
.\.venv\Scripts\winml.exe build -m $SNAPSHOT -o $BASELINE_OUT --ep cpu --device cpu --no-analyze --no-optimize --no-quant --no-compile --rebuild --no-color
.\.venv\Scripts\winml.exe perf -m "$BASELINE_OUT/model.onnx" --ep cpu --device cpu --memory --output "$OUT/baseline_perf.json" --overwrite --format json --no-color
# Expected baseline perf process exit: -1073741819 (0xC0000005), after diagnostic JSON is written.
.\.venv\Scripts\winml.exe eval -m "$BASELINE_OUT/model.onnx" --model-id $SNAPSHOT --task token-classification --ep cpu --device cpu --dataset BramVanroy/conll2003 --dataset-revision 4ffbd53d9e0b92b473b9b7dcff12f53e7c17ce0c --split validation --samples 1 --no-shuffle --streaming --output "$OUT/baseline_eval.json" --overwrite --no-color
# Expected baseline eval process exit: -1073741819 (0xC0000005); emitted metrics are provenance-invalid.
Pop-Location

# Exact PR-head recipe validation.
Set-Location $ROOT
if ((git rev-parse HEAD).Trim() -ne $HEAD) { throw 'PR HEAD mismatch' }
.\.venv\Scripts\winml.exe --version
.\.venv\Scripts\winml.exe build -c examples\recipes\Davlan_xlm-roberta-large-ner-hrl\cpu\cpu\token-classification_fp32_config.json -m $SNAPSHOT -o "$OUT/build_fp32" --ep cpu --device cpu --precision fp32 --no-analyze --no-compile --rebuild --no-color
.\.venv\Scripts\winml.exe build -c examples\recipes\Davlan_xlm-roberta-large-ner-hrl\cpu\cpu\token-classification_fp16_config.json -m $SNAPSHOT -o "$OUT/build_fp16" --ep cpu --device cpu --precision fp16 --no-analyze --no-compile --rebuild --no-color

# Freeze semantic tokenizer inputs and pinned PyTorch reference logits.
@'
import os
import numpy as np
import torch
from transformers import AutoModelForTokenClassification, AutoTokenizer
snapshot = os.environ["SNAPSHOT"]
out = os.environ["OUT"]
inputs = AutoTokenizer.from_pretrained(snapshot)(
    "Microsoft hired Alice in Berlin on 19 July 2026.",
    return_tensors="np", padding="max_length", truncation=True, max_length=512,
)
feeds = {
    "input_ids": inputs["input_ids"].astype(np.int32),
    "attention_mask": inputs["attention_mask"].astype(np.int32),
}
np.savez(os.path.join(out, "semantic_inputs_512.npz"), **feeds)
model = AutoModelForTokenClassification.from_pretrained(snapshot).eval()
with torch.inference_mode():
    logits = model(
        input_ids=torch.from_numpy(feeds["input_ids"].astype(np.int64)),
        attention_mask=torch.from_numpy(feeds["attention_mask"].astype(np.int64)),
    ).logits.cpu().numpy()
np.save(os.path.join(out, "pytorch_logits.npy"), logits)
'@ | .\.venv\Scripts\python.exe -

.\.venv\Scripts\winml.exe perf -m "$OUT/build_fp32/model.onnx" --ep cpu --device cpu --precision fp32 --input-data "$OUT/semantic_inputs_512.npz" --iterations 100 --warmup 10 --memory --output "$OUT/perf_fp32.json" --overwrite --format json --no-color
.\.venv\Scripts\winml.exe perf -m "$OUT/build_fp16/model.onnx" --ep cpu --device cpu --precision fp16 --input-data "$OUT/semantic_inputs_512.npz" --iterations 100 --warmup 10 --memory --output "$OUT/perf_fp16.json" --overwrite --format json --no-color

# Compare full and active-token logits against pinned PyTorch.
@'
import json
import os
import numpy as np
import onnxruntime as ort
out = os.environ["OUT"]
data = np.load(os.path.join(out, "semantic_inputs_512.npz"))
reference = np.load(os.path.join(out, "pytorch_logits.npy")).astype(np.float64)
active = data["attention_mask"].astype(bool)
def metric(expected, actual):
    a = expected.ravel(); b = actual.ravel()
    return {
        "cosine": float(np.dot(a, b) / (np.linalg.norm(a) * np.linalg.norm(b))),
        "max_abs": float(np.max(np.abs(b - a))),
        "mean_abs": float(np.mean(np.abs(b - a))),
        "top1_label_match_rate": float(np.mean(
            np.argmax(actual.reshape(-1, 9), axis=-1) ==
            np.argmax(expected.reshape(-1, 9), axis=-1)
        )),
    }
for precision in ("fp32", "fp16"):
    session = ort.InferenceSession(
        os.path.join(out, "build_" + precision, "model.onnx"),
        providers=["CPUExecutionProvider"],
    )
    actual = session.run(None, {
        item.name: data[item.name].astype(np.int32) for item in session.get_inputs()
    })[0].astype(np.float64)
    result = {
        "precision": precision,
        "finite": bool(np.isfinite(actual).all()),
        "active_token_count": int(active.sum()),
        "full_logits": metric(reference, actual),
        "active_token_logits": metric(reference[active], actual[active]),
    }
    with open(os.path.join(out, "parity_" + precision + ".json"), "w") as handle:
        json.dump(result, handle, indent=2)
    print(json.dumps(result, indent=2))
'@ | .\.venv\Scripts\python.exe -

# Pin public static-analysis rules.
$RULES_ZIP = Join-Path $OUT 'rules-v0.2.0.zip'
$RULES_DIR = Join-Path $OUT 'rules-v0.2.0'
Invoke-WebRequest 'https://github.com/microsoft/winml-cli/releases/download/v0.2.0/rules-v0.2.0.zip' -OutFile $RULES_ZIP
if ((Get-FileHash $RULES_ZIP -Algorithm SHA256).Hash.ToLowerInvariant() -ne '6dcabbe7f5493fbc2bd23de195ab6e35b3578d510f18c2e220bc5538a1f232cc') { throw 'rules SHA-256 mismatch' }
Expand-Archive $RULES_ZIP $RULES_DIR -Force
$env:WINMLCLI_RULES_DIR = (Resolve-Path $RULES_DIR).Path
.\.venv\Scripts\winml.exe analyze --model "$OUT/build_fp32/model.onnx" --ep all --device all --htp-metadata "$OUT/build_fp32/export_htp_metadata.json" --output "$OUT/analyze_fp32.json" --overwrite --format json --no-color
.\.venv\Scripts\winml.exe analyze --model "$OUT/build_fp16/model.onnx" --ep all --device all --htp-metadata "$OUT/build_fp16/export_htp_metadata.json" --output "$OUT/analyze_fp16.json" --overwrite --format json --no-color
Remove-Item Env:WINMLCLI_RULES_DIR
# Analyze exit 1 is expected for partial QNN classifications; validate complete 11-result JSON.

.\.venv\Scripts\winml.exe eval -m "$OUT/build_fp32/model.onnx" --model-id $SNAPSHOT --task token-classification --ep cpu --device cpu --precision fp32 --dataset BramVanroy/conll2003 --dataset-revision 4ffbd53d9e0b92b473b9b7dcff12f53e7c17ce0c --split validation --samples 1 --no-shuffle --streaming --output "$OUT/eval_fp32.json" --overwrite --no-color
.\.venv\Scripts\winml.exe eval -m "$OUT/build_fp16/model.onnx" --model-id $SNAPSHOT --task token-classification --ep cpu --device cpu --precision fp16 --dataset BramVanroy/conll2003 --dataset-revision 4ffbd53d9e0b92b473b9b7dcff12f53e7c17ce0c --split validation --samples 1 --no-shuffle --streaming --output "$OUT/eval_fp16.json" --overwrite --no-color
# Both eval commands exit 0, but their metrics remain EVAL-BLOCKED-DATA-PROVENANCE.

[ssss141414]

REQUEST_CHANGES

Independent review of PR #1137 at 53d68e6b7157980058df1aeab354c0d873a45edc against current origin/main e7509b1e908c74beff0a5655b8f8d7de69c5afae.

Blocking findings

1. The new path API can emit a non-self-contained artifact for an already-FP16 external-data model. In src/winml/modelkit/quant/fp16.py:59-71, path input is loaded with load_external_data=False, and the already-FP16 early return returns that graph-only ModelProto. Saving it to another directory preserves the source-relative external-data location instead of materializing destination data. I reproduced this independently: the destination graph existed, no destination sidecar was written, its initializer still referenced source.onnx.data, onnx.checker passed only while the source sidecar existed, and failed after source removal. This violates the generalized path-input contract and is not covered by tests/unit/optim/test_fp16.py:67-82, which tests only FP32 external-data conversion. Please return a fully loaded/materializable model (or otherwise make relocation safe) on this branch and add a regression test that converts an already-FP16 external-data path, saves to a different directory, deletes the source, then loads/checks the destination successfully.

2. The PR's reproduce block claims to pin the checkpoint, but the WinML build/eval commands do not. $REV is used only by the tokenizer/PyTorch reference script. Both winml build -m Davlan/xlm-roberta-large-ner-hrl commands and both eval model-ID loads are floating Hub references, and neither recipe records a revision. The claimed L0/L1/L2 evidence is explicitly for revision 1f929ffad9b7353f9c84b0b3f579fc3bb0b3685e; materialize that revision and make every checkpoint-loading command consume the pinned snapshot (or add an equivalent supported revision mechanism). Also include the reviewer-contract-required explicit recipe-free baseline build, winml --version, and git rev-parse HEAD commands rather than only prose results.

3. External review-thread gate is not clean. Enumeration found 2 line comments, both from github-advanced-security[bot], on src/winml/modelkit/quant/fp16.py:59 and tests/unit/optim/test_fp16.py:19 for mixed import onnx / from onnx ... usage; issue comments: 0. These discussions need a fixing commit or explicit posted rationale and resolution before approval.

Independent verification completed

• Fresh isolated checkout; merge base equals current main; git diff --check passed.
• Scope is exactly 11 files: 2 model-7 recipes, 5 shared source files, and 4 tests. No model 8, README, skill, scratch, or local-path leakage is present in Lane B.
• Focused affected tests: 179 passed, 6 skipped, 2 deselected. Broad affected suite: 2439 passed, 69 skipped, 2 deselected, 1 xfailed. Mypy passed. Changed-file Ruff passed. Repository-wide Ruff has five pre-existing diagnostics outside the diff.
• CI completed successfully for lint, analyze, command/model/optim/remaining tests, CLA, and CodeQL; CodeQL nevertheless posted the two line discussions above.
• The explicit-CPU session/device bypasses and lazy static-analyze provider discovery are generalized and have focused tests; no checkpoint special case was found.
• The eval result is honestly classified EVAL-BLOCKED-DATA-PROVENANCE: commands exited 0, exact dataset revision/split/subset and conflicting label maps are preserved, emitted numbers are marked invalid, and no L3 claim is made.
• Lane A is present at exact commit 5592a6c666f55df61110e840f73839dac99edd9c: _meta-083, planner/reviewer provenance-block vocabulary, and XLM-RoBERTa findings are present. PR P1-INFRA-003: CI/CD Pipeline — ADO + GitHub Actions + Self-hosted Runners #159 remains open.
• PR remains Draft and carries model-scale-by-skill.

Please preserve Draft state while addressing these findings.

[ssss141414]

Explainer follow-up on findings #1?#3:

1. This repo is missing a LICENSE file #1 ? fixed in b2935ab: the FP16 path now materializes relocatable external data, with an already-FP16 relocation regression test.
2. Adding Microsoft SECURITY.MD #2 ? PR body updated: Reproduce now materializes checkpoint revision 1f929ffad9b7353f9c84b0b3f579fc3bb0b3685e once as portable $SNAPSHOT; the explicit recipe-free baseline, both recipe builds, tokenizer/PyTorch reference, and both eval model-ID loads consume that snapshot. It also includes explicit winml --version and git rev-parse HEAD commands.
3. This repo is missing important files #3 ? addressed by b2935ab and thread replies: both sites use unified import onnx; CodeQL Analyze succeeded, both inline discussions were answered, and both threads are resolved.

[ssss141414]

REQUEST_CHANGES

Independent reviewer verdict for model 7 only at PR head b2935ab32ea152a4d176f0308cac1e0dfce044ef.

Blocking gate

1. The baseline is stale against current origin/main. After git fetch origin main, current main is 38767add6f91c7b10b6394fae3af6f437e02effd; the PR cites baseline/head e7509b1e908c74beff0a5655b8f8d7de69c5afae, and git rev-list --count e7509b1e..origin/main reports 12 commits. The reviewer contract's _meta-052 gate requires the baseline HEAD to equal current main. In addition, the current reproduce block runs git rev-parse HEAD and its "recipe-free baseline build" in the PR checkout, so at b2935ab3 that command verifies the fixed PR head rather than a clean-main baseline.

Exact owner routing

• Producer: rebase the PR onto 38767add6f91c7b10b6394fae3af6f437e02effd (or newer current main), resolve any drift, and rerun the generalized/focused gates.
• Planner: refresh charter.baseline from a clean current-main checkout, including exact winml --version, git rev-parse HEAD, recipe-free pinned-snapshot command, result, and auto-config/recipe diff.
• Tester: rerun both CPU fp32/fp16 L0-L2 tuples and the provenance-blocked eval smoke after the rebase; regenerate perf/parity/artifact evidence rather than carrying forward results from the superseded base.
• Explainer: replace the stale baseline commit/version/results and render commands that explicitly separate the clean-main baseline checkout from PR-head recipe validation. Preserve Draft and model-scale-by-skill.

Previous blockers re-verified

• Finding This repo is missing a LICENSE file #1 closed: convert_to_fp16() materializes already-FP16 external tensors before returning. The committed regression passed. An independent reproduction observed 8192 bytes of returned raw_data, zero external-data entries, a destination sidecar of 8192 bytes, and successful ONNX check/load/value comparison after deleting the source directory.
• Finding Adding Microsoft SECURITY.MD #2 closed except for the newly stale-main gate above: snapshot_download() materializes revision 1f929ffad9b7353f9c84b0b3f579fc3bb0b3685e; recipe-free build, both recipe builds, tokenizer/PyTorch, and both eval commands route checkpoint loads through $SNAPSHOT. Explicit winml --version and git rev-parse HEAD commands are present.
• Finding This repo is missing important files #3 closed: both CodeQL sites use unified import onnx; both discussions have replies and are resolved; CodeQL Analyze is successful.

Independent verification

• Exact isolated checkout: requested/live head both b2935ab32ea152a4d176f0308cac1e0dfce044ef; merge base is the cited old base e7509b1e....
• Diff scope: 11 files — 2 model-7 recipes, 5 generalized source files, and 4 focused test files; production recipe README unchanged; no model-ID branch or unrelated model contribution found.
• Focused affected non-E2E suite: 127 passed, 6 skipped, 2 deselected. Five newly added/regression tests: 5 passed.
• Changed-file Ruff: PASS. Repository-wide Ruff reports five pre-existing diagnostics in unchanged scripts/sam3_reference_check.py; none is introduced by this diff. git diff --check: PASS.
• Full changed-test invocation additionally reached two OpenVINO E2E tests and failed because this host exposes only CPUExecutionProvider; rerunning the intended non-E2E affected scope passed as above.
• CI: all required lint, CodeQL Analyze, test, and CLA jobs completed successfully; no failing or pending check. The aggregate CodeQL check is neutral while the Python Analyze job is successful.
• Conversation enumeration: 2 issue comments, 4 inline comments, 2 GraphQL review threads; 0 open threads. Both threads are resolved (one outdated, one current).
• Shipment metadata: PR remains Draft and retains model-scale-by-skill.

Public-contract audit

• Required section order and metadata are present. Architecture is a source-derived collapsed tree (24× encoder layer) rather than a flat list.
• Perf evidence is concrete for both precisions (mean/p50/p90/p95/p99, throughput, RAM/VRAM); L2 parity is concrete for full and active-token logits.
• Eval evidence identifies dataset revision/split/subset and both label maps. Emitted values are explicitly marked semantically invalid under EVAL-BLOCKED-DATA-PROVENANCE; no L3 PASS or valid L3 metric is claimed.
• Component/op analysis is compact and actionable: mapped/unmapped coverage, total/unique/dominant operators, and grouped EP outcomes are present.
• Reproduction uses portable $OUT/$SNAPSHOT; no inaccessible absolute local artifact/log path or scratch hash is cited. Public commit/rules hashes are traceable.

All prior code/thread blockers are closed, but _meta-052 is fail-closed. Keep the PR Draft and re-request independent review after the baseline and evidence are refreshed on current main.

[ssss141414]

Addressed the latest REQUEST_CHANGES for model 7 only.

• Rebase/current-main gate: PR head is now cb7f8305754d4148ae507493e4e40efb893559d9; its merge base is exact current-main baseline 38767add6f91c7b10b6394fae3af6f437e02effd.
• Fresh clean-main baseline: winml, version 0.2.0; recipe-free pinned-snapshot fp32 build passed (exit 0, CLI 184.1 s, wrapper 202.028 s, 328,813-byte graph + 2,237,493,248-byte sidecar). Baseline perf and eval each reproduced the post-output teardown failure with process exit -1073741819 (0xC0000005); the body now carries the exact fresh diagnostic values and keeps eval independently classified EVAL-BLOCKED-DATA-PROVENANCE.
• Fresh PR-head tuple march: both CPUExecutionProvider/cpu/fp32 and /fp16 pass L0, L1, and L2 with full coverage and no ceiling downgrade. Fresh build times are 190.694599 s / 256.2238233 s; perf is 835.589/832.447 ms mean/p50 at 1.20 samples/s and 1,301.34 MB RSS delta for fp32, and 953.995/948.777 ms at 1.05 samples/s and 1,347.47 MB for fp16. Pinned-PyTorch full-logit cosine is 0.9999999999999452 / 0.9999999662786659, with top-1 match 1.0 for both.
• Fresh eval/analyze: both pinned eval smokes exit 0 but remain honestly EVAL-BLOCKED-DATA-PROVENANCE; no L3 metric is claimed. Both analyses emitted complete 11-run JSON; command exit 1 is retained as ANALYZE-PARTIAL-SUCCESS for QNN partial classifications. The body includes the refreshed component/op summaries and public rules-v0.2.0 provenance.
• Fresh validation gates: focused suite 180 passed, 6 skipped, 2 deselected; broad affected suite 2445 passed, 69 skipped, 2 deselected, 1 xfailed; mypy, changed-file Ruff, and git diff --check all pass. Current CI has nine completed successful checks, including CodeQL, lint, all five CI test shards, CLA, and the CodeQL status check.
• Reproduction/body: the PR body now explicitly separates the clean-main worktree from exact PR-head validation, materializes checkpoint revision 1f929ffad9b7353f9c84b0b3f579fc3bb0b3685e, and makes every checkpoint-loading build/eval/reference command consume $SNAPSHOT. It includes winml --version, both git rev-parse HEAD assertions, exact baseline/recipe/perf/parity/analyze/eval commands, the architecture tree, complete fp32/fp16 evidence, and no local scratch paths or internal artifact hashes.
• Learner audit: refreshed measurements do not change the semantics of existing XLM-R model or methodology findings, so Lane A is explicitly unchanged.

Draft state and the model-scale-by-skill label are preserved. Model 8 has not been started.

[ssss141414]

APPROVE — independent adding-model-support review (model 7 only)

Reviewed exact PR head cb7f8305754d4148ae507493e4e40efb893559d9 from an isolated clean checkout against exact current-main/base 38767add6f91c7b10b6394fae3af6f437e02effd.

Gate results

• State/scope: PASS. Remote head, fetched PR ref, and reviewed checkout agree. Merge base and current origin/main both equal 38767add.... The 11-file Effort-L2 diff contains two CPU recipes, generalized FP16/session/device/analyze fixes, and focused tests; recipe README and model-8 paths are absent.
• Planner/tester/explainer refresh: PASS. Revision-3 charter invalidates all pre-rebase measurements and pins head/base; revision-3 verdict reports full CPU fp32/fp16 L0-L2 coverage; public body renders the fresh build/perf/parity/eval/analyze evidence and required hierarchy.
• Pinned reproduction/public evidence: PASS. The reproduce block materializes checkpoint revision 1f929ffad9b7353f9c84b0b3f579fc3bb0b3685e into $SNAPSHOT; clean-main baseline build/perf/eval and PR-head builds, PyTorch reference, and eval commands consume it. Baseline and PR worktrees are separated, version and HEAD checks are explicit, public rules are release/SHA-pinned, and no local/scratch path or private artifact hash leaked into the body.
• Prior relocation blocker: CLOSED independently. A fresh already-FP16 external-data reproduction returned 8,192 bytes of materialized raw_data with zero external entries, wrote an 8,192-byte destination sidecar, deleted the source tree, then passed ONNX checker/load and exact tensor equality. The dedicated regression also passed.
• Independent tests: PASS. Directly changed focused scope: 38 passed. A wider affected run produced 127 passed / 6 skipped / 2 OpenVINO tests failed because this review environment exposes only CPU; the same two tests fail identically at exact current main, so this is not a PR regression. git diff --check and changed-file Ruff pass.
• Deterministic Ruff gate: PASS for this PR. Full ruff check . reports the same five diagnostics in unchanged scripts/sam3_reference_check.py at exact current main; no changed Python file has a Ruff diagnostic.
• Independent artifacts/parity: PASS. Both artifacts pass ONNX checker with named input_ids/attention_mask [1,512] and logits [1,512,9]. FP16 contains FLOAT16 initializers and its 1,118,746,624-byte sidecar is half the 2,237,493,248-byte fp32 sidecar. Fresh inference used only CPUExecutionProvider; cosine/max-abs were 0.9999999999999452 / 1.66893e-05 (fp32) and 0.9999999662786659 / 0.00674343 (fp16).
• Independent L1 probes: PASS and crash-free. fp32 mean/p50 808.950/811.882 ms, fp16 943.546/928.497 ms, both exit 0 with reported precision correct. Means are within 3.2% and 1.1% of the fresh 100-iteration evidence, respectively.
• Eval provenance: PASS as a blocker classification, not L3. Both exact pinned smoke commands exit 0; the incompatible checkpoint [O, DATE, PER, ORG, LOC] and dataset [O, PER, ORG, LOC, MISC] ID maps remain preserved, emitted values are explicitly invalid, and no L3 metric is claimed.
• Engineering review: PASS. The FP16 change is class-wide and path-based rather than model-specific, uses closed-file infer_shapes_path() for >2 GB models, materializes already-FP16 external tensors before relocation, and keeps the existing in-memory API. Explicit CPU routing bypasses only optional provider-catalog discovery; accelerator routing remains on the existing policy path. Static analyze avoids optional plugin loading only when runtime unknown-op probing is disabled. Tests cover each changed behavior.
• Discussion gates: PASS. Enumerated 4 issue comments, 6 inline comments, and all 3 GraphQL review threads; 0 open threads. All concrete CodeQL findings have replies/resolution and fresh successful CodeQL.
• CI/state: PASS. All 9 reported checks are completed/successful. PR remains DRAFT with model-scale-by-skill.

Verdict

APPROVE. All model-7 reviewer gates pass at the exact requested head. Keep the PR in Draft; this verdict does not authorize transition to Ready for Review.