Orin sm_87 receipt at 0.7.0

CHANGELOG.md

@@ -12,6 +12,13 @@ repository. Everything below describes the packaged A2R-Lab releases.
 
 ## [Unreleased]
 
+- Receipts: the first Jetson AGX Orin (sm_87) receipt,
+  `receipts/gpu-proof-sm87.json` with its header-key ledger, recorded at the
+  0.7.0 receipt commit 607efc2: 2056 tests, 2055 passed and the one expected
+  racecheck skip; `make verify-all` verifies it next to the primary. The
+  compatibility page's Orin row records that receipt in place of the 0.5.1
+  smoke runs.
+
 ## [0.7.0] — 2026-10-31
 
 Consumers rebuild their prepared artifacts (schema 2), declare pybind modules

RELEASING.md

@@ -141,6 +141,16 @@ baseline. To record a secondary receipt, install the dev requirements on the
 Jetson and run `SPLIT=1 test/run_gpu_proof.sh` on a clean checkout of the release
 tip; the driver detects the architecture, writes that row's path and never
 touches `gpu-proof.json`. Commit the receipt with its header-key ledger.
+The signing key stays on the desktop, so a Jetson records with
+`PYTEST_ARGS="--gpu-proof-signing-backend none"`; the driver's final merge then
+refuses the unsigned shards (rc=1 after a clean shard board) and writes neither
+the receipt nor the ledger. Copy the run directory's `receipts/` to the desktop,
+branch from the release tip, merge and sign there with
+`gpu-proof merge --out receipts/gpu-proof-sm87.json --repo . <shard receipts>`,
+build the ledger from the shard sidecars with the driver's
+`aggregate_header_keys` pointed at `receipts/gpu-proof-sm87-header-keys.json`,
+commit both, then run `make verify-all`: the policy refuses a dirty
+verification tree, and the receipt itself counts as dirt until it is committed.
 `make verify-all` verifies every receipt on disk, one line per architecture, and
 `test/receipt_integrity.py --table` prints their rows for the compatibility page.
 A release does not wait for secondary receipts; they are documentation of the

docs/agent_debugging_guide.md

@@ -3794,3 +3794,27 @@ can reuse the address. That is process-local and deterministic. The same rule ap
 to any runner: never compare `cudaMemGetInfo`, `nvidia-smi` memory or any other
 device-wide counter across a window in which another process may run; a receipt
 shard always has to assume a neighbour.
+
+### 7.z83 A Jetson receipt ends with the merge refused, not with a failure (2026-11-02, Orin sm_87 at 0.7.0)
+
+The Orin recorded the 0.7.0 collection at the receipt commit in 24 hours, 82
+shards, 2056 ids, one expected racecheck skip, and the driver still exited 1:
+its final `gpu-proof merge --verify-inputs` refuses the unsigned shards that
+`--gpu-proof-signing-backend none` produces, and because the merge failed the
+driver never wrote the receipt, the header-key ledger or the durations. A
+watcher keyed on the exit code reports the run dead; the shard board above the
+merge line is the truth to read first.
+
+The landing is done on the desktop, where the signing key is: copy the run
+directory's `receipts/` (the shard receipts and the 41 `*.header_keys.jsonl`
+sidecars, 4 MB without `compile/`), branch from the release tip, `gpu-proof
+merge --out receipts/gpu-proof-sm87.json --repo .` over the shard receipts,
+then build the ledger with the driver's own `aggregate_header_keys` after
+pointing its module-level `HEADER_KEYS_PATH` at
+`receipts/gpu-proof-sm87-header-keys.json` (load the module through
+`importlib` and register it in `sys.modules` before `exec_module`, or its
+dataclasses fail to resolve). Commit the receipt and the ledger together before
+`make verify-all`: the release policy refuses a dirty verification tree, and an
+untracked receipt is dirt, so the verify fails on both architectures until the
+commit exists. The primary ledger `test/gpu-proof-header-keys.json` must stay
+untouched by the secondary landing; check `git diff --stat` on it.

docs/source/user_guide/getting_started/compatibility.rst

@@ -10,18 +10,18 @@ Platforms and toolchain
   different architecture is refused at context creation with a clear error.
   The model, the API and the generated code carry over between machines; the
   binary does not.
-* The GPU test receipt and the release timing ran on Linux x86-64 with CUDA
-  toolkit 13.2 and one RTX 5090 (sm_120); the table below lists that
-  environment. CUDA 12 toolkits and other GPUs are untested. Jetson-class
-  devices are within the design (single-block kernels, resource tiers, runtime
-  memory fitting); the Orin ran the smoke set listed below and the Xavier the
-  header-only example, but no receipt covers them yet.
+* The primary GPU test receipt and the release timing ran on Linux x86-64
+  with CUDA toolkit 13.2 and one RTX 5090 (sm_120). A secondary receipt of the
+  same 2056 tests at the same commit ran on a Jetson AGX Orin (sm_87, aarch64,
+  CUDA toolkit 13.2); the table below lists both environments. CUDA 12
+  toolkits and other GPUs are untested. The Xavier (sm_72) ran the header-only
+  example and has no receipt.
 * The host compiler standard is C++17 for the code generator, benchmarks and a
   numpy-only build. With the ``[torch]`` extra the wrapper reads the standard
   that torch's ATen header guard demands and compiles with it. The torch we run
   (2.12.0, cu128) compiles with C++17. A torch that demands C++20 needs an nvcc
-  and host compiler accepting C++20; that path has run only in the Orin smoke
-  below (torch 2.14.0+cu130), never under a receipt.
+  and host compiler accepting C++20; that path ran under the Orin receipt below
+  (torch 2.14.0+cu130).
   ``GRID_RBD_CXX_STD`` forces the standard.
 * The ``[jax]`` / ``[torch]`` extras pin the CPU packages; install the CUDA
   wheel yourself. We run ``jax[cuda12]`` (``jax-cuda12-plugin`` 0.10.0) and a
@@ -32,10 +32,13 @@ Platforms and toolchain
 What we ran
 -----------
 
-One machine produced every piece of GPU evidence in this release: the full
-test receipt (``gpu-proof.json``, verified by CI), the release timing on the
+The RTX 5090 produced the primary evidence in this release: the full test
+receipt (``gpu-proof.json``, verified by CI), the release timing on the
 :doc:`release measurements <../../release_measurements>` page, and the
-installed-wheel check of the release playbook. Everything validated ran in
+installed-wheel check of the release playbook. The Jetson AGX Orin recorded
+the secondary receipt ``receipts/gpu-proof-sm87.json``, the same collection
+at the same commit, which ``make verify-all`` checks against its own
+expected-skips baseline. Everything validated ran in
 fp32, the default compute precision; the fp64 tier (``dtype="float64"``) is
 an alpha feature outside the receipt.
 
@@ -63,21 +66,23 @@ an alpha feature outside the receipt.
      - Ubuntu 24.04.5, Linux 7.0.0-38, x86-64
      - full receipt; release timing; install check (a fresh venv with
        torch 2.11.0+cu128 and jax 0.11.2 from PyPI)
-     - receipt 2026-10-24; timing 2026-09-27 to 2026-10-07; install check
+     - receipt 2026-11-01; timing 2026-09-27 to 2026-10-07; install check
        2026-10-15
    * - sm_87 (compute capability 8.7)
      - NVIDIA Jetson AGX Orin, 64 GB
      - 13.2 (V13.2.78)
-     - L4T R39.2 (JetPack; driver API 13.2)
+     - L4T R39.2 (JetPack; driver 595.78)
      - CPython 3.12.3
      - 2.14.0+cu130 (NVIDIA Jetson build)
-     - jax 0.11.1 (NVIDIA Jetson build)
-     - Ubuntu 24.04.4, Linux 6.8.12-tegra, aarch64
-     - smoke runs on the 0.5.1 main checkout, no receipt: the iiwa14 numpy,
-       torch and jax wrappers (30, 25 and 60 tests), the CUDA equivalence
-       harness on iiwa14 fixed and go2 floating (72 tests), the g1 plant
-       Hessian; pinocchio 3.9.0 and mujoco 3.9.0 from PyPI aarch64 wheels
-     - 2026-10-16
+     - jax 0.11.1 with jax-cuda13-plugin 0.11.1 (NVIDIA Jetson build)
+     - Ubuntu 24.04.4, Linux 6.8.12-1021-tegra, aarch64
+     - secondary receipt ``receipts/gpu-proof-sm87.json`` at the 0.7.0
+       receipt commit 607efc2: 2056 tests, 2055 passed, 1 skipped (the
+       compute-sanitizer racecheck cell listed in
+       ``test/gpu-proof-expected-skips-sm87.txt``), 82 shards in 24 hours
+       with ``GRID_SPLIT_COMPILE_JOBS=2`` and ``GRID_RBD_BUILD_JOBS=4``;
+       pinocchio 3.9.0 and mujoco 3.9.0 from PyPI aarch64 wheels
+     - receipt 2026-11-01 to 2026-11-02
    * - sm_72 (compute capability 7.2)
      - NVIDIA Jetson AGX Xavier, 32 GB
      - 11.4 (V11.4.315)
@@ -97,14 +102,16 @@ compiles the generated kernels and the per-robot ``.so``. The torch wheel
 carries its own CUDA 12.8 runtime libraries for torch's kernels, and the
 ``jax-cuda12-plugin`` carries CUDA 12 runtime libraries for XLA; neither uses
 ``nvcc``. The driver has to satisfy every runtime in the process, and
-615.71.09 does. A ``jax[cuda13]`` plugin, a torch wheel other than cu128, a
-CUDA 12 toolkit and CPython 3.10, 3.11 or 3.13 on a GPU are untested; the CI
-wheel builds for CPython 3.10, 3.11 and 3.13 and the CPU test lane on 3.10 and
-3.13 run on CPU only. The Jetson rows record smoke runs, not receipts. No
-secondary receipt has been recorded yet; the first Orin receipt lands under
-``receipts/`` through the per-architecture table in
-``test/gpu-proof-receipts.yaml``; the Xavier stays header-only because JetPack 5 ships CUDA
-11.4 and Python 3.8, below the floors of the generator and the bindings.
+615.71.09 does. On x86-64, a ``jax[cuda13]`` plugin, a torch wheel other
+than cu128, a CUDA 12 toolkit and CPython 3.10, 3.11 or 3.13 on a GPU are
+untested; the CI wheel builds for CPython 3.10, 3.11 and 3.13 and the CPU test
+lane on 3.10 and 3.13 run on CPU only. The Orin receipt is the one run of
+``jax-cuda13-plugin`` and a cu130 torch wheel, on aarch64. The Orin row is a
+secondary receipt, recorded through the per-architecture table in
+``test/gpu-proof-receipts.yaml`` and verified by ``make verify-all``; it
+documents the architecture and does not gate CI. The Xavier stays header-only
+because JetPack 5 ships CUDA 11.4 and Python 3.8, below the floors of the
+generator and the bindings.
 
 Runtime contexts
 ----------------