Post-merge trust fixes: .gitattributes for SHA pinning, cells.jsonl drift, README/AUDIT consistency

[Lightheartdevs]

Why

Post-merge audit of #18 flagged five concrete trust hits. Each is a real reproducibility / consistency issue. All five fixed here.

The five fixes

1. .gitattributes added at repo root

Without explicit rules, Windows reproducers checking out this repo with core.autocrlf=true (the default) silently convert JSONL line endings LF→CRLF on checkout, breaking the published SHA on workloads/prompts.jsonl. The reviewer's downloaded file genuinely didn't match the published hash. Now pinned:

• *.jsonl, power.csv, thermals.csv, *.log → binary (no transformation ever; SHAs match across platforms)
• *.md, *.yaml, *.json, *.csv (other than power/thermals), *.sh, *.py, *.ts, *.sha256 → text eol=lf

2. prompts.jsonl.sha256 in sha256sum --check format

Previously just the bare hash (9a27e...). Now standard <hash> <filename> form so sha256sum --check prompts.jsonl.sha256 works directly. Applied to all four sha256 files in the bundle + harness:

$ sha256sum --check prompts.jsonl.sha256
prompts.jsonl: OK
$ sha256sum --check smoke-prompts.jsonl.sha256
smoke-prompts.jsonl: OK

3. cells.jsonl drift fixed

The v1 aggregate/cells.jsonl had 35 rows for tower2/qwen3.6-27b/cuda while filesystem + manifest.json both said 36. Missing: ctx32768_gen2048_conc8 — the engine-bound timeout cell where only 1 of 8 slots completed per batch. The harness aggregator silently drops rows with per_slot_decode_tps_mean=null, which is exactly what that cell produced.

Row backfilled with:

• aggregate_decode_tps_mean=0.87 and batch_wall_s_mean=1200.10 from cell.json
• cold_start_decode_tps=1.52, cold_start_wall_s=1200.22
• power_w_silicon_mean=183.15, power_w_silicon_max=390.79 derived from this cell's power.csv (gpu0 filter, n=11419 samples)
• temp_c_max=57.0 from this cell's thermals.csv (gpu0 sensor)
• All per_slot_* fields explicitly null
• A notes field explaining the null + the reconstruction method

After fix: cells.jsonl 36 rows ↔ filesystem 36 dirs ↔ manifest.json 36 cells, internally consistent.

4. README/AUDIT.md drift on llama-server-*.log publication resolved

README.md said the per-cell llama-server-*.log debug logs are not included (correct — they're 40 MB across 251 files and excluded for bundle size). AUDIT.md said they are published in the reproducibility bundle and listed them as a per-cell artifact. Resolved AUDIT.md to README's position throughout, including a new explicit:

NOT included in the bundle (regeneratable):

• Per-cell llama-server-<port>.log — excluded to keep the bundle ~110 MB; regeneratable from the pinned SHA + per-cell cell.meta.json server invocation.
• Per-host build-<backend>.configure.log and build-<backend>.build.log — excluded for size; the build invocations themselves are in harness/HARNESS-README.md.

5. Harness docs de-drifted

harness/README.md still described Strix Halo as "ROCm canonical" with the grid "running twice (ROCm and Vulkan)" — pre-bug-discovery framing that contradicted the bundle's findings.md (Vulkan is canonical, ROCm 6.4.4 segfaulted — see Finding 1). Updated the hosts table, workload-size estimate, and engines/ inventory comments to reflect Vulkan-canonical reality.

harness/AUDIT.md was a full duplicate copy of the upstream bench-fleet AUDIT, with several pre-curation internal references (task #16, #20, #21, #37; "the user"; targets.json.broken_rocm_finding) that were sanitized in the bundle-level ../AUDIT.md during PR #18 but not propagated to the harness copy. Replaced with a single-paragraph pointer to ../AUDIT.md as single source of truth, so future curation passes have one file to update instead of two that can drift.

What this PR is NOT

No new bench data. The next round (MMBT Phase B Q8 quality companion, full 30-min sustained-thermal tier, PTX-JIT SOFT_MAX retry on Tower2 35B-A3B native CUDA) ships as a separate PR.

Verification

$ cd hardware-tests/qwen3.6-q8-fleet-2026-05-17/workloads
$ sha256sum --check prompts.jsonl.sha256
prompts.jsonl: OK

$ python3 -c "
import json
counts = {}
for line in open('hardware-tests/qwen3.6-q8-fleet-2026-05-17/aggregate/cells.jsonl'):
    r = json.loads(line)
    k = (r['host'], r['model'], r['backend'])
    counts[k] = counts.get(k, 0) + 1
print(counts[('tower2', 'qwen3.6-27b', 'cuda')])
"
36   # was 35, now matches manifest + filesystem

Test plan

• On Windows, git clone and verify sha256sum --check prompts.jsonl.sha256 passes (no CRLF conversion)
• Spot-check the backfilled ctx32768_gen2048_conc8 row in aggregate/cells.jsonl against tower2/qwen3.6-27b/cuda/ctx32768_gen2048_conc8/cell.json
• Confirm AUDIT.md no longer claims llama-server logs are published
• Confirm harness/README.md describes Vulkan as Strix canonical
• Confirm harness/AUDIT.md is a pointer stub to ../AUDIT.md

🤖 Generated with Claude Code