Repository navigation
fix(interop): sync Pelorus v0.2.2 parser safety - #1515
Merged
Merged
Conversation
6 tasks
The branch was rebased onto master at 7e20ab7 (#1507, the ADM stack train). `.standards-baseline.json` keys every infraction by file:line, so a textual merge of two baselines is meaningless; the conflict was settled by taking master's file and re-recording it against the restacked tree. The total is unchanged at 1367, the same count master carries: the 25 changed entries are line-key shifts in the Pelorus mirror files this branch edits, not new debt. Recorded with the engine `.github/workflows/standards-gate.yml` pins (PRAETOR_REF 846da59), which is the engine CI validates the baseline against.
lusoris
force-pushed
the
fix/pelorus-interop-sync-v022
branch
from
September 22, 2026 16:14
3f398b1 to
b618184
Compare
lusoris
added a commit
that referenced
this pull request
Sep 22, 2026
Merge origin/master into integration/zero-warning-hiss21. Eleven paths conflicted; ten resolved mechanically. The one that mattered was core/src/interop/pelorus_interop.c, where the two sides did opposite things: master (#1515) bumped PELORUS_VENDOR_SHA 818d844 -> 93bef120 (v0.2.2) and re-vendored the mirror. this branch (#1518) left the pin at 818d844 and split pel_blob_pack, pel_blob_find_section, pel_qp_report_from_blocks and pel_x265_csv_parse in the mirror in place, for the HISS-21 burn-down. ADR-1113 makes core/src/interop/pelorus_*.c a verbatim copy of libpelorus/src/*.c at PELORUS_VENDOR_SHA; lint and standards fixes for them belong upstream in VMAFx/pelorus followed by a --update re-vendor, never in the mirror. The branch is therefore the side in violation, so this merge takes master on both counts: the bumped pin and the re-vendored mirror. docs/state.md has tracked this as T-PELORUS-MIRROR-SOURCE-DRIFT-2026-09-22 and predicted the consequence. The consequence landed as predicted. Restoring the verbatim mirror reinstates nine recorded findings (three HISS-04 in pelorus_interop.c, one HISS-02 and one HISS-04 in pelorus_qp_report_csv.c, four HISS-04 in the test_pelorus_interop.c fixture), taking the debt total 279 -> 288. Rather than raise the ratchet with an --allow-increase exception, twelve real findings are cleared in the fork's own code to absorb them: core/src/model.c 4 HISS-01 vmaf_model_collection_append's cascading fail/fail_mc/fail_model unwind becomes model_collection_new(), which frees what it itself allocated on each early return, in the same order (mc->model before mc). The out-param is assigned only on success; the historical contract that a failed first append leaves the caller's handle NULL is kept explicitly. core/src/feature/float_adm.c 3 HISS-01 + 1 HISS-04 init's three `goto fail` unwinds call a shared adm_state_release(), which close() now uses too. extract's four per-scale appends and eleven debug appends move into adm_append_scale_scores() and adm_append_debug_scores() verbatim: same appends, same order, same arguments. core/src/feature/integer_motion.c 1 HISS-01 + 2 HISS-04 extract's forward `goto write_score` becomes an if-wrap around the SAD block. init's ISA dispatch chain moves into motion_select_pipeline() with the guards and their evaluation order intact, so the last matching ISA still wins. flush's per-index loop body moves into motion_flush_one(), with the loop-carried prev_processed threaded through a pointer so the moving-average recurrence is unchanged. Every edited file is taken to zero HISS findings, per ADR-0141. No arithmetic was rewritten anywhere; only whole statements moved, in the same order. Proof of behaviour-neutrality: all three Netflix golden pairs were scored with --feature float_adm --feature motion --feature adm at --precision max, before and after, from the same build directory. The output JSON is byte-identical apart from the fps timing field. The 158-test CPU meson suite passes. Net: .standards-baseline.json 279 -> 276, recorded with a plain `praetorctl baseline -record` under the pinned f41e74d8 engine -- no exception flag, no reason string, no policy carve-out. The README praetor-managed governance block is reconciled to the new count. The clang-tidy cpu baseline tightens for the two files that improved (float_adm.c 5 -> 4, integer_motion.c 11 -> 9; total 742 -> 739), the host measurement having been calibrated against four untouched files first. ssimulacra2.c's single goto was deliberately left alone: clearing it would have obliged splitting picture_to_linear_rgb (111 LOC) and create_recursive_gaussian (66 LOC), scalar colour math that four SIMD ports must stay bit-exact against. Still outstanding: the four splits want landing upstream in VMAFx/pelorus, then a --update re-vendor and a pin bump, which would drop the nine mirror entries from the baseline. Refs: ADR-1113, ADR-0141, ADR-1298
5 of 10 tasks
lusoris
added a commit
that referenced
this pull request
Oct 4, 2026
scripts/ci/assertion-density.sh piped git ls-files through the Pelorus mirror filter inside a process substitution, whose exit status bash drops, so a failing filter read as "no fork-added files found" and the gate passed. Its test, which no CI job ran, built fixture repos without the filter and failed every match case since #1515. The listing now runs in a checked command substitution and a failure exits 2. The fixture repos carry the real filter, run_test is split into helpers and checks the exit status as well as the output (HISS baseline 445 to 444), and a new case requires exit 2 from a filter that exits 3.
Tualua
pushed a commit
to Tualua/vmafx
that referenced
this pull request
Oct 4, 2026
VMAFx#1984) * fix(ci): fail the assertion-density gate when its source listing fails scripts/ci/assertion-density.sh piped git ls-files through the Pelorus mirror filter inside a process substitution, whose exit status bash drops, so a failing filter read as "no fork-added files found" and the gate passed. Its test, which no CI job ran, built fixture repos without the filter and failed every match case since VMAFx#1515. The listing now runs in a checked command substitution and a failure exits 2. The fixture repos carry the real filter, run_test is split into helpers and checks the exit status as well as the output (HISS baseline 445 to 444), and a new case requires exit 2 from a filter that exits 3. * docs: regenerate the indexes and the citation map after rebasing
3 of 6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Re-pin VMAFx's read-only Pelorus interop mirror to released Pelorus v0.2.2 (
93bef1206d68d9e09024c08a12732fb8e77b9b16). The released parser removes undefined behavior for valid blobs at misaligned caller-buffer bases by copying wire headers and directory entries through aligned locals, while the wire ABI remains 1.3. This also restores the shared 16-vector fixture to exact Pelorus source and makes provenance, complete-file drift, and manifest-scoped lint boundaries fail closed in required CI.Type
feat— new featurefix— bug fixperf— performance improvementrefactor— no behavior changedocs— documentation onlytest— test-onlybuild/ci— tooling / infraport— cherry-pick from upstream Netflix/vmafsycl/cuda/simd— backend-specificChecklist
make test-fast; the exact pre-existing tooling limitation is recorded under "Known follow-ups". The changed interop target passes in normal, ASan, and UBSan builds./cross-backend-diffis not applicable.PELORUS_ABI_MAJOR/MINORremains1/3and no wire field, section, struct size, or layout changes.docs/adr/_index_fragments/1276-pelorus-v022-parser-safety-repin.md,_order.txt, and the generated ADR/tag indexes.Bug-status hygiene (ADR-0165)
docs/state.mdclosesT-PELORUS-FIXTURE-DRIFT-2026-09-18and retains the fixture'sfopen(path, "w")CodeQL finding as the separate open upstream-ownedT-PELORUS-FIXTURE-WORLD-WRITABLE-FOPEN-2026-09-18item.Netflix golden-data gate (ADR-0024)
assertAlmostEqual(...)score is modified.Cross-backend numerical results
N/A — this is a CPU-only vendored parser/tooling sync; no SIMD or GPU implementation changes.
Performance
N/A — no performance claim or performance-sensitive path change.
Provenance and safety evidence
93bef1206d68d9e09024c08a12732fb8e77b9b16(release v0.2.2); ABI remains 1.3.scripts/sync-pelorus-interop.shreads only that Git object, compares every rendered mirror and the complete shared fixture byte-for-byte through EOF, and fails closed for a plain directory, a checkout missing the object, final-newline drift, prefix drift, or any unmanifested tracked native file in the exempt namespaces.Pre-Commitworkflow derives the pin from the guard, checks outVMAFx/pelorusat that exact object with credentials disabled, and runs the guard before the ordinary pre-commit hooks.NOLINTs, and zero compile failures.Verification
scripts/sync-pelorus-interop.sh "$PELORUS_CHECKOUT"— PASS against the exact v0.2.2 object.bash scripts/ci/tests/test-sync-pelorus-interop.sh— PASS, including missing-object, non-Git, prefix/EOF drift, synthetic re-pin, and every supported native suffix.python3 -m unittest scripts.ci.tests.test_pelorus_mirror scripts.ci.tests.test_tidy_ratchet scripts.ci.tests.test_tidy_scoped_write— 42/42 PASS.test_pelorus_interopunder normal, ASan, and UBSan builds — 1/1 PASS in each build; all 16 checks pass for libpelorus 0.2.2 / ABI 1.3.mkdocs build --strict— PASS.bash scripts/release/concat-changelog-fragments.sh --checkandbash scripts/docs/concat-adr-index.sh --check— PASS.make verify-allandgit diff --check origin/master...HEAD— PASS.Deep-dive deliverables (ADR-0108)
docs/research/2072-pelorus-interop-v022-sync-2026-09-20.md, indexed indocs/research/README.md.docs/adr/1276-pelorus-v022-parser-safety-repin.md#alternatives-considered.AGENTS.mdinvariant note —.github/AGENTS.md,core/test/AGENTS.md,scripts/AGENTS.md, andscripts/ci/AGENTS.mdrecord the exact-object, exact-fixture, and manifest-boundary invariants with ADR-1113/ADR-1276 provenance.changelog.d/fixed/pelorus-interop-v022-parser-alignment.md; the renderedCHANGELOG.mdis current.docs/rebase-notes.mdentryfix/pelorus-interop-sync-v022 — exact v0.2.2 parser safety mirror (2026-09-20).Reproducer
CC=clang CXX=clang++ meson setup core/build-pr-pelorus-v022-ubsan core \ -Db_sanitize=undefined -Db_lto=false -Db_lundef=false \ -Denable_cuda=false -Denable_sycl=false \ -Dc_args=-fno-sanitize=function -Dcpp_args=-fno-sanitize=function meson compile -C core/build-pr-pelorus-v022-ubsan test_pelorus_interop UBSAN_OPTIONS=halt_on_error=1:print_stacktrace=1 \ meson test -C core/build-pr-pelorus-v022-ubsan --print-errorlogs \ test_pelorus_interopExpected result:
test_pelorus_interoppasses 1/1 with all 16 shared vectors and no alignment diagnostic.Known follow-ups
make test-fastcompletes its build step, then Meson fails before executing the suite withFileNotFoundError: [Errno 2] No such file or directory: '.venv/bin/ninja'. The existing build directory records the repository-relative virtualenv Ninja path, which becomes invalid when Meson resolves it fromcore/build. The relevant Makefile configuration is unchanged fromorigin/master; focused normal/ASan/UBSan interop tests pass as listed above.fopen(path, "w"), which CodeQL flags under a permissive umask.docs/state.mdkeeps this open for an upstream Pelorus fix followed by a reviewed re-pin; this PR deliberately does not fork-patch the exact mirror.Breaking changes / migration
None. The Pelorus library version becomes 0.2.2, but the public wire ABI remains 1.3 and consumers require no migration.