Merge release v1.0.10-beta

Release v1.0.10-beta

Author: debuggerone

.dockerignore

@@ -1,6 +1,8 @@
 .git
 .github
-dist/
+dist/*
+!dist/docker-packages/
+!dist/docker-packages/**
 compat-artifacts/
 .cache/
 benchmarks/results

.github/workflows/ci.yml

@@ -62,10 +62,12 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - runner: ubuntu-24.04
+          - runner: king
             arch-label: linux-amd64
+            local-lsquic-cache-dir: /opt/king/cache/lsquic/runtime
           - runner: ubuntu-24.04-arm
             arch-label: linux-arm64
+            local-lsquic-cache-dir: ""
 
     steps:
       - name: Checkout repository
@@ -74,8 +76,17 @@ jobs:
       - name: Install system dependencies
         run: bash ./infra/scripts/install-ci-system-dependencies.sh
 
+      - name: Restore local pinned LSQUIC runtime cache
+        id: restore-local-lsquic-runtime-cache
+        if: matrix.local-lsquic-cache-dir != ''
+        env:
+          KING_CI_LOCAL_LSQUIC_CACHE_DIR: ${{ matrix.local-lsquic-cache-dir }}
+          KING_LSQUIC_RUNTIME_PREFIX: ${{ github.workspace }}/.cache/king/lsquic/runtime/prefix
+        run: bash ./infra/scripts/local-lsquic-runtime-cache.sh restore --github-output "${GITHUB_OUTPUT}"
+
       - name: Restore pinned LSQUIC runtime cache
         id: restore-lsquic-runtime-cache
+        if: steps.restore-local-lsquic-runtime-cache.outputs.cache-hit != 'true'
         uses: actions/cache/restore@v5
         with:
           path: .cache/king/lsquic/runtime/prefix
@@ -86,8 +97,7 @@ jobs:
         env:
           KING_LSQUIC_RUNTIME_PREFIX: ${{ github.workspace }}/.cache/king/lsquic/runtime/prefix
         run: |
-          if [[ "${{ steps.restore-lsquic-runtime-cache.outputs.cache-hit }}" == "true" ]] \
-            && bash ./infra/scripts/build-lsquic-runtime.sh --verify-current; then
+          if bash ./infra/scripts/build-lsquic-runtime.sh --verify-current; then
             echo "cache-current=true" >> "${GITHUB_OUTPUT}"
             exit 0
           fi
@@ -100,6 +110,13 @@ jobs:
           KING_LSQUIC_RUNTIME_PREFIX: ${{ github.workspace }}/.cache/king/lsquic/runtime/prefix
         run: bash ./infra/scripts/build-lsquic-runtime.sh
 
+      - name: Save local pinned LSQUIC runtime cache
+        if: matrix.local-lsquic-cache-dir != '' && steps.restore-local-lsquic-runtime-cache.outputs.cache-hit != 'true'
+        env:
+          KING_CI_LOCAL_LSQUIC_CACHE_DIR: ${{ matrix.local-lsquic-cache-dir }}
+          KING_LSQUIC_RUNTIME_PREFIX: ${{ github.workspace }}/.cache/king/lsquic/runtime/prefix
+        run: bash ./infra/scripts/local-lsquic-runtime-cache.sh save
+
       - name: Save pinned LSQUIC runtime cache
         if: steps.verify-lsquic-runtime-cache.outputs.cache-current != 'true'
         uses: actions/cache/save@v5
@@ -187,6 +204,11 @@ jobs:
         working-directory: extension
         run: ../infra/scripts/check-stub-parity.sh
 
+      - name: Run model-optional inference verification matrix
+        if: matrix.shard-index == 1
+        working-directory: extension
+        run: ../bin/king-inference-verify-matrix --json
+
       - name: Run canonical PHPT suite
         working-directory: extension
         env:

.github/workflows/local-inference-runner.yml

@@ -0,0 +1,59 @@
+name: King Local Inference Runner
+
+on:
+  push:
+    branches:
+      - '**'
+  pull_request:
+    branches:
+      - main
+    types:
+      - opened
+      - synchronize
+      - reopened
+  workflow_dispatch:
+
+concurrency:
+  group: king-local-inference-runner-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+  KING_CI_LOCAL_INFERENCE_MODEL_DIR: /opt/king/cache/inference-models
+  KING_CI_LOCAL_LSQUIC_CACHE_DIR: /opt/king/cache/lsquic/runtime
+
+jobs:
+  local-inference-runner:
+    name: Local inference cache readiness
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: king
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Resolve local GGUF inference model cache
+        id: inference-model
+        run: bash ./infra/scripts/local-inference-model-cache.sh resolve --require --github-output "${GITHUB_OUTPUT}"
+
+      - name: Export local inference model path
+        env:
+          MODEL_PRESENT: ${{ steps.inference-model.outputs.model-present }}
+          MODEL_PATH: ${{ steps.inference-model.outputs.model-realpath }}
+        run: |
+          test "${MODEL_PRESENT}" = "true"
+          test -r "${MODEL_PATH}"
+          printf 'KING_INFERENCE_TEST_MODEL_PATH=%s\n' "${MODEL_PATH}" >> "${GITHUB_ENV}"
+          printf 'KING_INFERENCE_CPU_TEST_MODEL_PATH=%s\n' "${MODEL_PATH}" >> "${GITHUB_ENV}"
+
+      - name: Verify heavy native dependency cache hook
+        run: |
+          test -x ./infra/scripts/local-lsquic-runtime-cache.sh
+          test -n "${KING_CI_LOCAL_LSQUIC_CACHE_DIR}"
+
+      - name: Verify no public inference port is exposed
+        run: bash ./infra/scripts/check-inference-port-exposure.sh --ports 8080,18129

.github/workflows/release-merge-publish.yml

@@ -21,6 +21,7 @@ env:
   REGISTRY: ghcr.io
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
   PHP_BASE_MAX_AGE_DAYS: "14"
+  KING_CI_LOCAL_DOCKER_BUILDX_CACHE_DIR: /opt/king/cache/docker/buildx
 
 jobs:
   resolve-release-merge:
@@ -158,6 +159,13 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
+      - name: Resolve Docker Buildx cache
+        id: base-buildx-cache
+        run: |
+          bash ./infra/scripts/resolve-docker-buildx-cache.sh \
+            --scope "php-base-${{ matrix.php-version }}" \
+            --github-output "${GITHUB_OUTPUT}"
+
       - name: Log in to Container Registry
         uses: docker/login-action@v4
         with:
@@ -251,11 +259,18 @@ jobs:
           push: true
           tags: ${{ steps.meta-base.outputs.ref }}
           labels: ${{ steps.meta-base.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: ${{ steps.base-buildx-cache.outputs.cache-from }}
+          cache-to: ${{ steps.base-buildx-cache.outputs.cache-to }}
           build-args: |
             PHP_VERSION=${{ matrix.php-version }}
 
+      - name: Commit local Docker Buildx cache
+        if: steps.decide-base.outputs.rebuild == 'true' && steps.base-buildx-cache.outputs.use-local-cache == 'true'
+        run: |
+          bash ./infra/scripts/commit-docker-buildx-cache.sh \
+            --cache-dir "${{ steps.base-buildx-cache.outputs.local-cache-dir }}" \
+            --next-dir "${{ steps.base-buildx-cache.outputs.local-cache-next-dir }}"
+
   build-release-packages:
     name: Build release artifacts for ${{ matrix.php-version }} / ${{ matrix.arch-label }}
     needs:
@@ -722,6 +737,13 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
+      - name: Resolve Docker Buildx cache
+        id: dockerhub-buildx-cache
+        run: |
+          bash ./infra/scripts/resolve-docker-buildx-cache.sh \
+            --scope "dockerhub-runtime-php8.5" \
+            --github-output "${GITHUB_OUTPUT}"
+
       - name: Log in to Docker Hub
         uses: docker/login-action@v4
         with:
@@ -744,14 +766,21 @@ jobs:
           push: true
           tags: ${{ steps.meta-dockerhub.outputs.tags }}
           labels: ${{ steps.meta-dockerhub.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: ${{ steps.dockerhub-buildx-cache.outputs.cache-from }}
+          cache-to: ${{ steps.dockerhub-buildx-cache.outputs.cache-to }}
           build-args: |
             PHP_VERSION=8.5
             PHP_BASE_IMAGE=${{ steps.meta-dockerhub.outputs.php_base_image }}
             BUILD_DATE=${{ steps.meta-dockerhub.outputs.created_at }}
             VCS_REF=${{ needs.resolve-release-merge.outputs.release-commit }}
 
+      - name: Commit local Docker Buildx cache
+        if: steps.dockerhub-buildx-cache.outputs.use-local-cache == 'true'
+        run: |
+          bash ./infra/scripts/commit-docker-buildx-cache.sh \
+            --cache-dir "${{ steps.dockerhub-buildx-cache.outputs.local-cache-dir }}" \
+            --next-dir "${{ steps.dockerhub-buildx-cache.outputs.local-cache-next-dir }}"
+
       - name: Generate Docker Hub runtime CVE inventory
         id: dockerhub-cve-inventory
         run: |
@@ -867,6 +896,13 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
+      - name: Resolve Docker Buildx cache
+        id: runtime-buildx-cache
+        run: |
+          bash ./infra/scripts/resolve-docker-buildx-cache.sh \
+            --scope "runtime-php${{ matrix.php-version }}" \
+            --github-output "${GITHUB_OUTPUT}"
+
       - name: Log in to Container Registry
         uses: docker/login-action@v4
         with:
@@ -883,10 +919,17 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: ${{ steps.runtime-buildx-cache.outputs.cache-from }}
+          cache-to: ${{ steps.runtime-buildx-cache.outputs.cache-to }}
           build-args: |
             PHP_VERSION=${{ matrix.php-version }}
             PHP_BASE_IMAGE=${{ steps.meta.outputs.php_base_image }}
             BUILD_DATE=${{ steps.meta.outputs.created_at }}
             VCS_REF=${{ needs.resolve-release-merge.outputs.release-commit }}
+
+      - name: Commit local Docker Buildx cache
+        if: steps.runtime-buildx-cache.outputs.use-local-cache == 'true'
+        run: |
+          bash ./infra/scripts/commit-docker-buildx-cache.sh \
+            --cache-dir "${{ steps.runtime-buildx-cache.outputs.local-cache-dir }}" \
+            --next-dir "${{ steps.runtime-buildx-cache.outputs.local-cache-next-dir }}"

.gitignore

@@ -2,6 +2,7 @@ libcurl
 quiche
 llama-fork/
 node_modules
+.venv/
 .cargo/
 
 # Archived source snapshots
@@ -39,6 +40,7 @@ compat-artifacts/
 dist/
 !packages/iibin/dist/
 !packages/iibin/dist/**
+var/
 .cache/
 .vite/
 .codex
@@ -47,6 +49,9 @@ dist/
 .env.local
 *.env.local
 
+# Local planning notes that are not part of the public docs set.
+docs/future-plan.md
+
 # Model weights MUST NEVER be checked in (they are large and provenance
 # belongs on a model registry / object store, not in git). Catch-all
 # patterns repo-wide — if you actually need a tiny test fixture that