Merge branch 'main' into fix/normalize-shell-line-endings

Author: jkim323

.cspell.json

@@ -8,42 +8,91 @@
 	],
 	"words": [
 		"acrosmorbt",
+		"admissionregistration",
+		"apprmt",
 		"aoai",
 		"asname",
+		"autocast",
+		"autoremote",
 		"balasubramanian",
 		"behaviour",
 		"chatcmpl",
+		"configfromkube",
+		"containerfile",
 		"dedented",
+		"directqueue",
+		"dockerbuild",
+		"dockerio",
+		"dockerrun",
 		"dsse",
 		"envaccount",
 		"envcontainer",
 		"failuremode",
+		"feetech",
 		"fixpoint",
 		"freqs",
 		"fstring",
+		"getparam",
+		"getserverlabel",
 		"getfixturevalue",
+		"gitlink",
+		"healthz",
 		"headlessly",
 		"hfpins",
 		"imwrite",
 		"isfolder",
 		"leisaac",
+		"loglevel",
 		"minimise",
+		"messagepack",
 		"misattributed",
+		"modpath",
+		"MJPG",
 		"mlruns",
+		"mutatingwebhookconfiguration",
 		"myacct",
 		"mycontainer",
+		"mypackage",
+		"nindent",
+		"nodeagent",
+		"noremotefuncs",
+		"noserverdeployment",
 		"noout",
 		"noseparator",
+		"nvidiactl",
+		"offloadable",
+		"ospo",
+		"perclient",
+		"perclientserverlabel",
 		"nvmap",
 		"pixelformat",
 		"plottable",
 		"pollable",
 		"poutine",
 		"preds",
+		"printloglevel",
 		"prio",
+		"pyrealsense",
+		"pyremote",
+		"pyremotecp",
+		"pyremotesitecustomize",
+		"readyz",
+		"realsense",
 		"rebindings",
 		"recognised",
 		"refetches",
+		"remoteablecm",
+		"remoteableconts",
+		"remoteableenv",
+		"remoteable",
+		"remoteclass",
+		"remoteclasses",
+		"remoted",
+		"remotefunc",
+		"remotefuncs",
+		"remoteurl",
+		"remoteloc",
+		"remoterport",
 		"rescan",
 		"rfft",
 		"rfftfreq",
@@ -53,22 +102,42 @@
 		"serialise",
 		"serialised",
 		"serialises",
+		"serverimage",
+		"serverlabel",
+		"serverlabelkey",
+		"serverlabelval",
+		"serverreplicas",
+		"serverport",
+		"serverstages",
+		"singleinstance",
+		"sitecustomize",
+		"sitecustomizer",
+		"smolvla",
 		"sparkline",
+		"srvs",
+		"stageobj",
+		"teleop",
+		"teleoperation",
 		"taplo",
 		"tegra",
+		"tensorize",
 		"trackio",
 		"unbuilt",
 		"unimportable",
 		"unparseable",
 		"unpickler",
 		"unstub",
 		"uppercased",
+		"upstreaming",
 		"uvlock",
 		"varname",
 		"veryfast",
 		"vLLM",
 		"visualisation",
 		"worldv",
+		"xaviercfg",
+		"xavierconfig",
+		"xavierdeployment",
 		"xticklabels",
 		"yoloe",
 		"yolov"
@@ -98,6 +167,7 @@
 		"**/.terraform/**",
 		"**/.terraform.lock.hcl",
 		"**/scripts/tests/Fixtures/**",
+		"gpu-offload/runtime/**/*.py",
 		"**/TERRAFORM.md",
 		"CHANGELOG.md",
 		"**/CHANGELOG.md"

.github/dependabot.yml

@@ -499,3 +499,91 @@ updates:
   commit-message:
     prefix: chore
     include: scope
+- package-ecosystem: docker
+  directory: /gpu-offload/controller
+  schedule:
+    interval: weekly
+    day: monday
+  cooldown:
+    default-days: 7
+  groups:
+    gpu-offload-controller-docker-dependencies:
+      patterns:
+      - "*"
+      update-types:
+      - minor
+      - patch
+  open-pull-requests-limit: 5
+  labels:
+  - dependencies
+  - docker
+  - gpu-offload
+  commit-message:
+    prefix: chore
+    include: scope
+- package-ecosystem: docker
+  directory: /gpu-offload/examples/first-run
+  schedule:
+    interval: weekly
+    day: monday
+  cooldown:
+    default-days: 7
+  groups:
+    gpu-offload-examples-first-run-docker-dependencies:
+      patterns:
+      - "*"
+      update-types:
+      - minor
+      - patch
+  open-pull-requests-limit: 5
+  labels:
+  - dependencies
+  - docker
+  - gpu-offload
+  commit-message:
+    prefix: chore
+    include: scope
+- package-ecosystem: docker
+  directory: /gpu-offload/examples/ur10e-single
+  schedule:
+    interval: weekly
+    day: monday
+  cooldown:
+    default-days: 7
+  groups:
+    gpu-offload-examples-ur10e-single-docker-dependencies:
+      patterns:
+      - "*"
+      update-types:
+      - minor
+      - patch
+  open-pull-requests-limit: 5
+  labels:
+  - dependencies
+  - docker
+  - gpu-offload
+  commit-message:
+    prefix: chore
+    include: scope
+- package-ecosystem: docker
+  directory: /gpu-offload/examples/so101-real-hardware/docker
+  schedule:
+    interval: weekly
+    day: monday
+  cooldown:
+    default-days: 7
+  groups:
+    gpu-offload-examples-so101-real-hardware-docker-dependencies:
+      patterns:
+      - "*"
+      update-types:
+      - minor
+      - patch
+  open-pull-requests-limit: 5
+  labels:
+  - dependencies
+  - docker
+  - gpu-offload
+  commit-message:
+    prefix: chore
+    include: scope

.github/instructions/mise-tasks.instructions.md

@@ -0,0 +1,41 @@
+---
+description: when working with mise for tasks in the mise.toml file, follow these instructions to ensure proper usage and organization. Mise should be used for all additional tool installs
+---
+
+<!-- applyTo: '**/*.toml' -->
+
+# Use Mise.jdx.dev for all additional tool installs
+
+tools such as gh, uv, az, cmake, rust, etc.  -- ask if not sure
+
+## use UV for all python
+
+Always use uv for all python installs and never use system python. Use uv to install python and then use uv to install pip and then use uv to install any additional python packages.
+use uv venv and mise to create a virtual environment for your project. This will ensure that your project dependencies are isolated and do not interfere with system packages.
+
+Never pollute system python
+
+## Use Mise toml correctly
+
+### Task Grouping
+
+Tasks can be grouped semantically by using name prefixes separated with :s. For example all testing related tasks may begin with test:. Nested grouping can also be used to further refine groups and simplify pattern matching. For example running mise run test:**:local will match test:units:local, test:integration:local and test:e2e:happy:local (See Wildcards for more information).
+
+TIP
+
+Since TOML keys can't contain colons without quoting, use quoted keys in mise.toml:
+
+[tasks."test:unit"]
+run = 'cargo test --lib'
+
+### Run Tasks
+
+Do not put embedded scripts in the TOML -- instead
+
+- for platform overall -- put that in 'gpu-offload/scripts'
+- for example specific -- put in 'gpu-offload/examples' with some prefix that correlates to the example name
+
+### Task ordering
+
+The goal of task ordering is to allow a human to "git clone..." then go through the setup, verification, coding, etc., then teardown --
+Utilize "Task Grouping" in mise.toml to assist in that order so when "mise tasks" is execute the human can see the logical order of how to run things -- that means align the alphanumeric sort to accommodate. -- Always prefix the task name with a Alpha -- not a number or symbol -

.github/workflows/dependency-pinning-scan.yml

@@ -12,7 +12,7 @@ on:
         description: 'Comma-separated list of dependency types to check'
         required: false
         type: string
-        default: 'github-actions,npm,pip,shell-downloads,shell-inline-pip,gh-extension,powershell-modules,docker,workflow-npm-commands'
+        default: 'github-actions,npm,pip,shell-downloads,shell-inline-pip,gh-extension,powershell-modules,docker,dockerfile-base-image,workflow-npm-commands'
       soft-fail:
         description: 'Whether to continue on compliance violations'
         required: false

.github/workflows/dependency-review.yml

@@ -34,6 +34,7 @@ jobs:
           # GHSA-46r5-x6jq-v8g6: mlflow — AJAX artifact download authorization bypass; no upstream fix; server-side only, repo uses client only (CVE-2026-33866)
           # GHSA-fh64-r2vc-xvhr: mlflow — stored XSS via YAML MLmodel artifacts; fixed in 3.11.1; blocked by azureml-mlflow<=3.9.0 ceiling; server-side only (CVE-2026-33865)
           # GHSA-h35f-9h28-mq5c: setuptools — macOS Unicode normalization bypass when publishing sdists; runtime lock installs wheels on Linux and never publishes packages
+          # GHSA-xrqw-3rrv-vx5w: transformers — save_pretrained() path traversal via attacker-controlled chat_template keys; fixed in 5.10.0; lerobot==0.6.1 constrains transformers<5.6.0 so no fix is installable yet; the SO-101 example never calls save_pretrained() on a Hub-downloaded tokenizer/processor, only load()s its own pinned checkpoint (CVE-2026-9856)
           allow-ghsas: >-
             GHSA-wf7f-8fxf-xfxc,
             GHSA-pgqp-8h46-6x4j,
@@ -42,4 +43,5 @@ jobs:
             GHSA-7qhf-v65m-g5f3,
             GHSA-46r5-x6jq-v8g6,
             GHSA-fh64-r2vc-xvhr,
-            GHSA-h35f-9h28-mq5c
+            GHSA-h35f-9h28-mq5c,
+            GHSA-xrqw-3rrv-vx5w

.github/workflows/gpu-offload-kind-smoke.yml

@@ -0,0 +1,62 @@
+name: GPU Offload Kind Smoke
+
+# End-to-end CPU-only smoke coverage for the gpu-offload stack: runs the
+# first-run example against a real `kind` cluster to prove admission (the
+# webhook mutates the client and generates the server Deployment) and a real
+# remote call (the function executes on the generated server pod, not the
+# client). detect-platform.sh resolves to platform=cpu on any GPU-less
+# runner, and every GPU-only step in the pipeline self-skips, so this is a
+# complete run of the real controller, Helm chart, and images without needing
+# a GPU. See .github/workflows/pr-validation.yml (gpu_offload_e2e) for the
+# path gate.
+
+'on':
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  kind-smoke:
+    name: Kind Smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    env:
+      # Force the deterministic CPU/kind path rather than relying on
+      # runner auto-detection (detect-platform.sh would resolve the same way
+      # on a GPU-less runner, but this keeps the gate explicit).
+      GPU_OFFLOAD_PLATFORM: cpu
+    defaults:
+      run:
+        working-directory: gpu-offload
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install host packages
+        run: scripts/install-host-packages.sh
+
+      - name: Install mise
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c  # v4.3.0
+        with:
+          working_directory: gpu-offload
+
+      - name: Trust the gpu-offload mise config
+        run: mise trust
+
+      - name: Install kind, kubectl, and Helm
+        run: mise run b-host-02-kubernetes-tools
+
+      - name: Set up the offload cluster
+        run: mise run f-10-setup
+
+      - name: Verify admission and remote execution
+        run: mise run f-20-verify
+
+      - name: Tear down the cluster
+        if: always()
+        run: mise run f-40-teardown-all

.github/workflows/main.yml

@@ -144,6 +144,13 @@ jobs:
       contents: read
       id-token: write
 
+  # Pytest: gpu-offload controller and runtime components
+  pytest-gpu-offload:
+    name: Pytest GPU Offload
+    uses: ./.github/workflows/pytest-gpu-offload.yml
+    permissions:
+      contents: read
+
   # Pytest: shared CI scripts component
   pytest-shared-ci:
     name: Pytest Shared CI
@@ -307,6 +314,7 @@ jobs:
       - pytest-dm-tools
       - pytest-data-pipeline
       - pytest-inference
+      - pytest-gpu-offload
       - pytest-shared-ci
       - dataviewer-frontend-tests
       - dataviewer-backend-pytests