build(llup): migrate llama.cpp candidate to v0.3.0

[daniele21]

Scope

Implements the LLUP v0.3.0 candidate migration on top of the frozen control dev.

• moves candidate llama.cpp identity from b9637 / aedb2a5e9ca3d4064148bbb919e0ddc0c1b70ab3 to stable v0.3.0 / c1d0e7a004015f23bc0233470b747b596f29b264;
• moves third_party/llama.cpp to the same exact immutable upstream commit;
• adapts the Harness sampled-token wrapper to the expanded llama_sampler_i interface;
• preserves legacy mmap/mlock semantics through the existing model_load_params_compat.h owner;
• adapts JSON/JSON_SCHEMA grammar construction to v0.3.0 common_json without changing the public output-constraint contract;
• propagates the candidate revision into both LlamaCppInferenceBackend.revision and Qwen35RuntimeTuningProfiles.LLAMA_CPP_REVISION, so execution fingerprints, capability checks and evidence identify the actual candidate backend;
• extends verify-llama-cpp-pin.sh and its regression fixture so the authoritative pin manifest, backend runtime revision and Qwen runtime capability revision must agree fail-closed;
• preserves backend-neutral public contracts, Android ARM64 CPU portability, default resident-model capacity 1 and one active production decode;
• does not enable OpenCL/GPU, multi-model residency or concurrent production decode.

Ownership / invariants

backends/llama-cpp remains the native/runtime adaptation owner and third_party/llama.cpp remains unpatched upstream source. models/model-profile continues to own the reviewed Qwen runtime capability policy. The pin verifier prevents production pin, checked-out upstream revision, backend runtime identity and Qwen capability identity from silently diverging.

Merge gate: b9637 remains the production/control baseline until LLUP-70. This PR MUST stay open and unmerged through LLUP-50 physical A/B and the complete LLUP-60 affected evidence replay. Merge/promotion is authorized only by the LLUP-70 decision.

Current exact identities

• candidate HEAD: 59af48313b450d9cff13c7f43458c2e5e6560374;
• base/control: dev@80164329bbc41a00b75721e3d0524294c03fdb56;
• candidate backend: v0.3.0 / c1d0e7a004015f23bc0233470b747b596f29b264;
• control backend: b9637 / aedb2a5e9ca3d4064148bbb919e0ddc0c1b70ab3.

The current candidate incorporates the canonical Android AAB packaging command from dev. This changes build/package identity but not llama.cpp runtime behavior; exact-head evidence was therefore refreshed rather than reused from the prior candidate parent.

Validation

Validation depth: FULL because the upstream dependency/JNI/package change propagates into execution fingerprints and shared model-profile/evidence contracts.

Authoritative deterministic candidate evidence:

• repository-owned FULL run 33332939707: SUCCESS on exact candidate 59af48313b450d9cff13c7f43458c2e5e6560374 and base 80164329bbc41a00b75721e3d0524294c03fdb56;
• repository guards and exact-head verification: PASS;
• native host tests: PASS;
• Android validation full: PASS;
• Android native packaging verification: PASS;
• aggregate repository validation and remote-preflight reporting: PASS.

Automated status:

• LLUP-20 candidate migration: PASS;
• LLUP-30 correctness/lifecycle + execution/backend identity propagation: PASS;
• LLUP-40 Android ARM64 build/package gate: PASS;
• candidate deterministic exact-head state: AUTOMATED_PREFLIGHT_CONFIRMED.

Older FULL runs on 6cfa8b8..., b37cd810... and f796235... remain provenance only and are stale for current exact-head qualification.

LLUP-50 preparation

LLUP-50 remains REAL_ENVIRONMENT and is not claimed complete. The frozen same-device comparison now uses:

• control runtime: 80164329bbc41a00b75721e3d0524294c03fdb56;
• candidate runtime: 59af48313b450d9cff13c7f43458c2e5e6560374;
• control evidence ref: evidence/llup50-control@fcbefc7cd9af84de570da96d039582175dd1700b;
• candidate evidence ref: evidence/llup50-candidate@a2a050d9551db541bb4c6b152cba8623c782164d.

The two evidence refs carry the same instrumentation-only model-load probe and record evidence-harness SHA separately from runtime source SHA. Draft PR #491 owns the exact-APK physical runner/comparator.

Repository-owned package automation run 33334957429 completed SUCCESS and produced exact-ref control, candidate and candidate-runtime app/test APK pairs plus manifests. Therefore deterministic package preparation is complete; executing those artifacts on the representative device remains the LLUP-50 REAL_ENVIRONMENT gate.

Existing instrumentation covers model-load latency, cold/warm TTFT, prefill/decode throughput, total latency, PSS/memory/thermal evidence, cancellation/recovery, LOW_MEMORY release and A→B→A switching.

Remaining promotion boundary

PR #492 owns refreshed LLUP-60A automated evidence on top of this exact candidate and remains separate from device-only LLUP-60B. No automated success alone authorizes promotion.

Sequence remains:

1. finish exact-head LLUP-60A automated replay/preflight;
2. execute LLUP-50 same-device A/B;
3. execute required representative-device LLUP-60B evidence;
4. re-check freshness and FULL promotion requirements;
5. make explicit LLUP-70 promote/reject decision;
6. only if LLUP-70 authorizes promotion, merge this PR and then unblock MRES-10.

No ad-hoc percentage promotion threshold is introduced.

[daniele21]

/preflight strong

[daniele21]

/preflight full

[daniele21]

LLUP qualification status: keep this PR open and unmerged through LLUP-50/60. /preflight full run 33320793455 is validating exact candidate head 6cfa8b8bf7dd264949da797115b216c130d546df against dev@ab5b35519d51ee903e1127b2973ab8cf30407704; selector is profile=full android=true native=true packaging=true modules=all. Repository guards and native host tests are green; Android all-modules validation/package verification is still running. The prior /preflight strong on this PR was cancelled only because the FULL run superseded it via workflow concurrency, not because of a test failure.

[daniele21]

Automated candidate qualification is now complete on exact 6cfa8b8bf7dd264949da797115b216c130d546df / dev@ab5b35519d51ee903e1127b2973ab8cf30407704: /preflight full run 33320793455 passed repository guards, native host tests, all-module Android validation, native packaging verification, aggregate validation and reporting. Classify LLUP-20/30/40 deterministic gates as AUTOMATED_PREFLIGHT_CONFIRMED.

Next gate is LLUP-50 REAL_ENVIRONMENT. Freeze the comparison identities:

• control: dev@ab5b35519d51ee903e1127b2973ab8cf30407704, llama.cpp b9637 / aedb2a5e9ca3d4064148bbb919e0ddc0c1b70ab3;
• candidate: this PR head 6cfa8b8bf7dd264949da797115b216c130d546df, llama.cpp v0.3.0 / c1d0e7a004015f23bc0233470b747b596f29b264.
  Use the repository Package Android Artifacts workflow with candidate_ref equal to each exact commit, then the existing physical evidence runners on the same device/model/workload identity. Do not merge before LLUP-70.

Current connector note: repository automation for exact-ref packaging exists and is operational by workflow_dispatch, but the connected GitHub tool surface does not expose a workflow-dispatch mutation. This is an AUTOMATION_CAPABILITY_GAP at the connector boundary, not a missing repository gate; deterministic validation itself is already complete.

[daniele21]

/preflight full

[daniele21]

/preflight full

[daniele21]

/preflight full