Merge branch 'main' into grug_moe_heuristic

Author: ClassicLarry

.agents/skills/agent-research/SKILL.md

@@ -58,8 +58,7 @@ When using W&B:
   - iteration is quick,
   - you are tuning kernels or benchmarks,
   - full pipeline apparatus is unnecessary.
-- Use `.agents/skills/dev-tpu/SKILL.md` for the standard Iris-backed workflow.
-- Use `.agents/skills/dev-tpu-ray/SKILL.md` only when you specifically need the legacy Ray-backed workflow.
+- Use `.agents/skills/dev-tpu/SKILL.md` for the Iris-backed workflow.
 
 Rule of thumb:
 - Start with dev TPU for fast hillclimbing.

.agents/skills/babysit-job/SKILL.md

@@ -7,10 +7,7 @@ description: Monitor/babysit a job continuously and recover on failure. Use when
 
 Monitor a job continuously and recover on failure. For **Zephyr pipelines**,
 delegate to **babysit-zephyr** instead. Otherwise, follow this skill — Iris is
-the default execution backend.
-
-**Ray is deprecated.** If the user asks to run or babysit a Ray job, tell them
-Ray is no longer supported and they should use Iris instead.
+the execution backend.
 
 ## Required Info
 

.agents/skills/canary-triage/SKILL.md

@@ -28,8 +28,9 @@ write a Slack summary. Diagnosis and reporting only — no code changes, no PRs.
 The cluster is still live. Collect signal now — it will be torn down after you.
 
 - Iris job state via `.venv/bin/iris --config=$IRIS_CONFIG job list --json`
-- **GPU lane:** you have kubectl at `~/.kube/coreweave-iris`, namespace `$IRIS_NAMESPACE`.
+- **GPU lane:** you have kubectl at `~/.kube/coreweave-iris`, namespace `$IRIS_NAMESPACE` (defaults to `iris-ci` — the canary shares this namespace with PR CI).
   Get pod status, controller logs, task pod logs, warning events, pod describe.
+  **Filter by `iris.job_id=<CANARY_JOB_ID with '/' replaced by '.'>`** so you only see this canary's pods, not co-tenant CI pods. Example: `kubectl -n iris-ci get pods -l iris.job_id=runner.iris-run-job-abc123`.
 - **TPU lane:** use `iris process logs` and `iris job list`.
 - Re-run `scripts/canary/validate_canary_metrics.py` if you need the validation output.
 

.agents/skills/dev-tpu-ray/SKILL.md

@@ -9,7 +9,7 @@ Use this skill when you want the standard fast TPU debugging loop without wiring
 
 `scripts/iris/dev_tpu.py` reserves a TPU-backed worker through Iris, waits for the worker VM to come up, and lets you SSH into it or run commands directly against it.
 
-This is the preferred dev TPU workflow. Unlike the legacy Ray path, it does not create a persistent `~/.ssh/config` alias. It uses `gcloud` SSH and SCP against the worker that Iris assigned to the holder job.
+It uses `gcloud` SSH and SCP against the worker that Iris assigned to the holder job. There is no persistent `~/.ssh/config` alias.
 
 ## Critical concurrency rule
 

.agents/skills/dev-tpu/SKILL.md

@@ -85,6 +85,11 @@ A specification contains:
 
 ## Creating the PR
 
+Unless the user says otherwise, and when permissions allow, push directly to a
+branch on the main repository and open the PR from that branch. Do not default
+to pushing to a fork. Use a fork only when direct push to the main repository
+is not available or the user explicitly asks for it.
+
 Use `gh pr create` with these flags:
 
 ```bash

.agents/skills/pull-request/SKILL.md

@@ -15,10 +15,12 @@ permissions:
   pull-requests: read   # needed for issue_comment to access PR metadata
   statuses: write       # post commit status from issue_comment trigger
 
-# Single concurrency group — only one CW CI run at a time across all PRs.
-# The warm cluster is shared; concurrent runs would conflict.
+# Shared concurrency group with marin-canary-ferry-cw.yaml — both rebuild/roll
+# the shared iris-ci controller and submit against the shared H100 in
+# US-WEST-04A. Only one run cluster-wide at a time. cancel-in-progress=false
+# so a mid-flight canary is not killed by a PR firing.
 concurrency:
-  group: iris-coreweave-ci
+  group: iris-coreweave-ci-shared
   cancel-in-progress: false
 
 jobs:
@@ -173,9 +175,9 @@ jobs:
           AWS_ENDPOINT_URL: https://74981a43be0de7712369306c7b19133d.r2.cloudflarestorage.com
           FSSPEC_S3: '{"endpoint_url": "https://74981a43be0de7712369306c7b19133d.r2.cloudflarestorage.com"}'
         run: |
-          IRIS_CONTROLLER_URL="http://localhost:${LOCAL_PORT}"
-          timeout 600 uv run tests/integration_test.py \
-            --controller-url "$IRIS_CONTROLLER_URL"
+          export IRIS_CONTROLLER_URL="http://localhost:${LOCAL_PORT}"
+          timeout 600 uv run pytest tests/test_integration_test.py \
+            -m integration -o "addopts=" --timeout=600 -v -s
 
       - name: Stop port-forward
         if: always()

.github/workflows/iris-coreweave-ci.yaml

@@ -0,0 +1,66 @@
+name: Iris - IAP Proxy
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'infra/iris-iap-proxy/**'
+      - '.github/workflows/iris-iap-proxy.yaml'
+  pull_request:
+    paths:
+      - 'infra/iris-iap-proxy/**'
+      - '.github/workflows/iris-iap-proxy.yaml'
+
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build container image
+        uses: docker/build-push-action@v6
+        with:
+          context: infra/iris-iap-proxy
+          push: false
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  deploy:
+    needs: build
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        cluster: [marin, marin-dev]
+    concurrency:
+      group: iris-iap-proxy-deploy-${{ matrix.cluster }}
+      cancel-in-progress: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          credentials_json: ${{ secrets.MARIN_CD_CLOUD_RUN_SA_KEY }}
+
+      - name: Set up Google Cloud SDK
+        uses: google-github-actions/setup-gcloud@v2
+        with:
+          project_id: ${{ secrets.GCP_PROJECT_ID }}
+          install_components: beta
+
+      - name: Deploy to Cloud Run
+        run: ./infra/iris-iap-proxy/deploy.sh ${{ matrix.cluster }}