122 lines
7.0 KiB
Markdown
122 lines
7.0 KiB
Markdown
# macOS runtime preparation
|
|
|
|
Normal macOS `auto` builds select Metal with CPU fallback. The worker links
|
|
llama/ggml statically and uses Apple system libraries/frameworks. Searchi now
|
|
forces `GGML_METAL_EMBED_LIBRARY=ON` so upstream Metal kernel sources reside
|
|
inside the worker rather than requiring loose kernel files from the build tree.
|
|
|
|
After compilation, the builder inspects the artifact using Apple `lipo` and
|
|
`otool`; it does not execute the worker or initialize a GPU. Inspection requires:
|
|
|
|
- Supported arm64/x86_64 architectures, including both for a universal artifact.
|
|
- Only explicitly allowed Apple system libraries/frameworks, including Metal.
|
|
- A nonempty `__DATA,__ggml_metallib` section for each architecture.
|
|
- Current build-input provenance and a SHA-256 of the resulting worker.
|
|
|
|
The generated inventory declares the `static-metal-embedded` layout with an
|
|
empty packaged-library list. Normal macOS staging now requires this inventory;
|
|
the previous optional-inventory exception is removed for `auto`/`metal`.
|
|
Staging verifies source identity, worker bytes, Mach-O magic and the static
|
|
layout instead of requiring Windows DLLs or Linux shared libraries. Explicit
|
|
internal CPU tooling keeps its optional-inventory behavior.
|
|
|
|
On a native Mac with the required Apple build tools:
|
|
|
|
```sh
|
|
python3 tools/embeddinggemma2/build_runtime.py --backend auto --jobs 2
|
|
python3 tools/embeddinggemma2/stage_runtime.py --backend auto
|
|
```
|
|
|
|
The initial preparation was fixture-tested on 13 October; native Apple Silicon
|
|
execution was subsequently verified on 23 October as recorded below. This does
|
|
not create a macOS release download. Follow the [README installation guide](../README.md#macos-build-and-install-from-source)
|
|
for the tested source-build and local installation steps.
|
|
|
|
## Evidence, 2026-10-13
|
|
|
|
Four controlled Mach-O metadata-fixture tests passed, covering static system
|
|
dependencies, foreign library rejection, missing Metal data and per-architecture
|
|
section coverage. Staging tests exercise the empty-library macOS layout and the
|
|
mandatory normal-profile policy. These fixtures are not executable Mac builds.
|
|
|
|
Across macOS metadata, staging, builder, provenance and Windows/Linux packaging
|
|
suites: 75 tests passed with one platform-specific skip, in normal and optimized
|
|
Python modes. Actual Windows and Ubuntu WSL normal runtime builds passed after
|
|
the recipe change. Windows staging and Linux inventory verification passed.
|
|
Worker hashes remain identical to their previously tested CPU deployments:
|
|
Windows `c01cb3ec13cfca722ee768e8350e1399a8b9a4d14a24a35adc3473a5cfc82a73`;
|
|
Linux `b52d50a1e676bd4bf64124daff1c4ce83d86a8bde01e4eaf09838cbb24a4c28f`.
|
|
No GPU inference or native macOS execution was performed.
|
|
|
|
|
|
## Native Apple Silicon installation, 2026-10-23
|
|
|
|
Source `9a93ee6375d610d580ef16c5ec52218727fab187`, Apple M4/16 GiB,
|
|
macOS26.6.2, stable Rust, CMake4.4.3 and Node24.19.0. Normal `auto` worker
|
|
build/staging passed: arm64, embedded Metal library, Apple system-framework
|
|
linkage and artifact provenance verified. Both bundled Google assets passed
|
|
size/SHA-256 checks. The genuine query-role worker reported `device: gpu`,
|
|
512-token context and normalized 768-dimensional English/German embeddings.
|
|
|
|
The release Tauri app was installed outside the checkout with both helpers and
|
|
the model files. Local ad-hoc signing and deep/strict signature verification
|
|
passed. Installed UI checks covered model readiness, English/German document
|
|
retrieval, code-only retrieval, source previews, explanations and filters.
|
|
Seven actual native screenshots were captured. All66frontend tests passed
|
|
under Node24; global Node26 failed one Unicode-highlighting test.
|
|
|
|
Homebrew FFmpeg supplied local media helpers with external Homebrew library
|
|
dependencies. Speech recognition was unavailable during this initial check; the full installation below supersedes that limitation. Intel/universal execution,
|
|
GPU failure recovery, shortcut/tray interaction, clean-machine distribution,
|
|
Developer ID signing and notarization remain unchecked. These results do not
|
|
replace those gates or establish broad media accuracy.
|
|
|
|
## Full media and speech installation, 2026-10-23
|
|
|
|
The installed native app now includes the auto Metal/CPU whisper.cpp runtime at
|
|
`d1be6fde11ac6e0407606b4e42fe72d34add8037`, with verified multilingual base
|
|
and Silero6.2 model assets. All speech shared libraries use loader-relative
|
|
paths. `tools/speech-runtime/macos_smoke.py` checked installed linkage and real
|
|
recognition of a public-domain recording; the observed backend was `MTL0`.
|
|
|
|
An owned13-file corpus produced38indexed content segments, including8recognized
|
|
speech segments, with no reported media/speech failures. Native UI checks found
|
|
and played a waterfall video at4seconds, a spoken sentence in audio and video
|
|
near2seconds, and a tagged piano track by artist. A semantic piano-description
|
|
query ranked the track first among related suggestions. These checks do not
|
|
establish general lyrics recognition or large-library retrieval quality.
|
|
|
|
CLI and stdio MCP use the same normal query worker. A three-file fixture passed
|
|
semantic search, code filtering, source excerpt reading and invalid-handle
|
|
rejection. The worker reported GPU,768dimensions and512query-context tokens.
|
|
Ten distinct queries through an already-running MCP process had median8.28ms
|
|
request wall time; ten repeated cached queries median0.29ms. Three fresh CLI
|
|
processes including worker startup had median1018ms. These are small-index local
|
|
measurements, not desktop UI timings or production-scale latency guarantees.
|
|
|
|
Commit validation: all57native desktop tests pass, including real filesystem
|
|
create/update/rename/delete events using canonical Mac paths;66frontend tests,
|
|
format/build checks,3speech builder tests and installed Metal recognition pass.
|
|
The broader workspace run exposes an existing stale permission-denial rollback
|
|
expectation in `targeted_reconciliation` (current engine skips unreadable inputs).
|
|
Strict current-toolchain Clippy also flags unchanged permission-literal and
|
|
ANN-cache boolean expressions. These failures are not qualified as passing gates.
|
|
|
|
### Native document extraction policy
|
|
|
|
Mac parent/worker DOCX roundtrip and malformed-PDF rejection tests now pass.
|
|
Darwin rejects finite `RLIMIT_AS` and `RLIMIT_DATA` on the tested system. The
|
|
worker retains the30-second CPU limit; the parent checks resident memory through
|
|
`proc_pidinfo` during its existing5ms polling loop and rejects usage above512MiB,
|
|
killing/reaping its owned process group. Input/output bounds and the parent
|
|
wall deadline remain active. This sampled RSS guard may overshoot between polls;
|
|
it is not equivalent to a kernel-enforced hard address-space limit. Linux and
|
|
Windows retain their existing resource policies. An owned live-child test
|
|
verifies budget rejection; five process-owner tests and two actual parent/worker
|
|
roundtrip/rejection tests pass on the Mac.
|
|
|
|
Resident-memory inspection also retries the short exit-to-waitable transition
|
|
before treating a live child as uninspectable. Ten fresh installed CLI/helper
|
|
DOCX runs returned the expected passage; the native roundtrip test repeats that
|
|
short-lived worker path ten times to cover the race.
|