Skip to content

ROADMAP.adoc

Latest commit

 

History

History
142 lines (111 loc) · 10.4 KB

ROADMAP.adoc

File metadata and controls

142 lines (111 loc) · 10.4 KB
Raw

Axiom.jl Roadmap

Current Baseline (v1.0.0)

Axiom.jl currently ships:

  • Core tensor/layer pipeline in Julia

  • Verification checks (@ensure, property checks, certificates)

  • High-performance Zig backend with SIMD vectorization and multi-threaded dispatch

  • GPU extension hooks for CUDA/ROCm/Metal

Current priority is stabilization: build/test/runtime reliability, accurate docs, and explicit feature status.

Near-Term Plan

Must

  • ✓ Complete backend parity and reliability for CPU + Zig + GPU extension paths.

  • ✓ Harden verification/certificate workflows for repeatable CI and artifact integrity.

  • ✓ Keep README/wiki claims aligned with tested behavior.

Must execution order (sorted):

  • 1) Backend parity/reliability (CPU + Rust + GPU extensions) - Completed (2026-02-16)

  • 2) Verification/certificate workflow hardening - Completed (2026-02-16)

  • 3) README/wiki claim alignment sweep - Completed (2026-02-16)

Must completion gates:

  • ✓ Core-op parity tests pass on CPU Julia and Zig backend (matmul, dense, conv, normalization, activations) with documented tolerance budgets.

  • ✓ GPU extension paths (CUDA/ROCm/Metal) have deterministic CI jobs where hardware is available, and explicit fallback-behavior tests where it is not.

  • ✓ instantiate/build/precompile/test succeeds in CI on supported Julia versions without manual steps.

  • ✓ Runtime smoke tests for documented examples pass on CPU and at least one accelerated backend.

  • ✓ No unresolved legacy triad markers (TO[D]O/FIXM[E]/TB[D]) in src, ext, and test for release-scoped areas.

  • ✓ README/wiki claims are audited against implemented APIs and CI-tested behavior, with roadmap links for deferred features.

Must progress snapshot (2026-02-16):

  • ✓ CI workflow now runs explicit instantiate/build/precompile/test steps across supported Julia versions.

  • ✓ Added backend parity script with documented tolerance budgets: test/ci/backend_parity.jl.

  • ✓ Added runtime smoke checks for CPU and accelerated paths: test/ci/runtime_smoke.jl.

  • ✓ Added deterministic GPU fallback checks and optional hardware smoke jobs: test/ci/gpu_fallback.jl, test/ci/gpu_hardware_smoke.jl.

  • ✓ Added non-GPU accelerator strategy checks and CI coverage: test/ci/coprocessor_strategy.jl.

  • ✓ Added certificate integrity CI checks and digest-report artifacts: test/ci/certificate_integrity.jl, .github/workflows/verify-certificates.yml.

  • ✓ Added in-tree gRPC unary protobuf binary-wire support (application/grpc) with JSON bridge fallback (application/grpc+json).

  • ✓ Added pure-Julia PyTorch descriptor import (axiom.pytorch.sequential.v1) and expanded ONNX export coverage (Dense/Conv/Norm/Pool + activations). (Direct .pt/.pth/.ckpt binary import is not shipped — it would need a PyTorch/Python runtime; export to the descriptor first.)

  • ✓ Added consolidated readiness gate script for local/CI release checks: scripts/readiness-check.sh.

  • ✓ Added REAL authenticating hybrid Ed448+Dilithium5 (ML-DSA-87) certificate signing (G01, opt-in): Rust cdylib shim in crypto/ (pqcrypto-dilithium for Dilithium5, system libcrypto via the openssl crate for Ed448 — no hand-rolled cryptography) exposed to Julia via Libdl/ccall in src/verification/signing.jl; sign_certificate_hybrid / verify_certificate_hybrid / save_certificate_hybrid in src/verification/certificates.jl; content is hashed with SHA3-512 (estate hashing standard) before signing. The default generate_certificate / save_certificate path is unchanged (still an unkeyed SHA-256 content digest, authenticated=false) — hybrid signing is strictly additive and opt-in. See crypto/README.md for the C ABI and test/verification/hybrid_signing_tests.jl for the forged-signature-rejection proof.

Should

  • ❏ Improve performance benchmarking and regression tracking across backends.

  • ❏ Expand verification property coverage and diagnostics.

  • ❏ Strengthen release automation and compatibility testing.

Should completion gates:

  • ❏ Baseline benchmark suite published for CPU Julia, Zig, and GPU extension paths with trend tracking.

  • ❏ Verification diagnostics include actionable counterexample metadata and failure categorization.

  • ❏ Compatibility matrix is validated across OS/Julia combinations used by supported deployments.

  • ❏ Release process produces versioned artifacts and changelog validation automatically.

Could

  • ✓ Add richer model packaging and registry workflows (baseline shipped via model_package_manifest, export_model_package, build_registry_entry, export_registry_entry, plus CI/evidence coverage).

  • ✓ Expand advanced optimization passes (fusion, mixed precision) with explicit CI/benchmark evidence coverage (test/ci/optimization_passes.jl, scripts/optimization-evidence.jl).

  • ✓ Add deeper runtime observability for verification paths (structured telemetry APIs + CI/evidence coverage).

Could completion gates:

  • ✓ Packaging format includes model metadata, verification claims, and reproducible hashes (MODEL_PACKAGE_FORMAT, test/ci/model_package_registry.jl).

  • ✓ Optional optimization passes are benchmarked and guarded behind explicit flags (compile(…​; optimize, precision), scripts/optimization-evidence.jl).

  • ✓ Verification runtime emits structured telemetry suitable for dashboards/incident analysis (verification_result_telemetry, verification_telemetry_report, scripts/verification-telemetry-evidence.jl).

Deferred Commitments (Tracked)

These roadmap promises are still tracked explicitly (with current delivery state):

  • ✓ from_pytorch(…​) import API (shipped: pure-Julia axiom.pytorch.sequential.v1 descriptor import + CI interop smoke). Direct binary .pt/.pth/.ckpt import is out of scope (needs a PyTorch/Python runtime); a native Julia checkpoint reader (zip + pickle) is future work.

  • ✓ to_onnx(…​) export API (baseline shipped: Dense/Conv/Norm/Pool + common activations for supported Sequential/Pipeline models).

  • ✓ Production-hardened GPU paths across CUDA/ROCm/Metal (baseline shipped: deterministic fallback CI + optional hardware smoke + extension-hook dispatch + device-range guards + runtime self-healing diagnostics + backend-specific performance evidence via test/ci/gpu_resilience.jl and scripts/gpu-performance-evidence.jl).

  • ❏ Non-GPU accelerators (TPU/NPU/PPU/MATH/FPGA/DSP) backend strategy (in progress: targets, detection, compiled dispatch, fallback/strategy CI, capability/evidence reporting, runtime self-healing diagnostics, resilience CI/evidence, and TPU/NPU/DSP/MATH strict-mode gating shipped via coprocessor_capability_report, coprocessor_runtime_diagnostics, scripts/coprocessor-evidence.jl, test/ci/coprocessor_resilience.jl, scripts/coprocessor-resilience-evidence.jl, test/ci/tpu_required_mode.jl, scripts/tpu-strict-evidence.jl, test/ci/npu_required_mode.jl, scripts/npu-strict-evidence.jl, test/ci/dsp_required_mode.jl, scripts/dsp-strict-evidence.jl, test/ci/math_required_mode.jl, and scripts/math-strict-evidence.jl; production kernels remain).

  • ❏ Accelerator rollout sequence (2026-02-17): Maths/Physics basics shipped first; cryptographic coprocessor + FPGA production-ready next; VPU + QPU basics after; remaining accelerator production hardening targeted for v2.

  • ❏ Proof-assistant export beyond skeleton artifacts (in progress: obligation manifests, bundle export, status metadata, assistant reconciliation, deterministic reconciliation CI, and evidence artifacts shipped via proof_obligation_manifest, export_proof_bundle, proof_assistant_obligation_report, reconcile_proof_bundle, test/ci/proof_bundle_reconciliation.jl, and scripts/proof-bundle-evidence.jl; full assistant proof replay remains a Stage 4 track).

Readiness verification (2026-02-17): scripts/readiness-check.sh ⇒ Passed: 29, Failed: 0, Skipped: 0.

See docs/wiki/Roadmap-Commitments.md for staged targets and acceptance criteria.

Certificate Signing: Private Key Custody

The hybrid Ed448+Dilithium5 signing capability (crypto/, src/verification/signing.jl) authenticates certificate content; it does not, by itself, solve key custody. That is an operational concern, tracked here explicitly rather than left implicit:

  • Private keys are never generated by, stored in, or committed to this repository. generate_hybrid_keypair() exists only for tests/examples and produces keys held purely in-memory for the lifetime of that process.

  • Real signing keys are provisioned out-of-band. The intended custody model is an HSM (hardware security module) or an offline/air-gapped signing workstation: the private Ed448 and Dilithium5 keys are generated there, never leave that boundary, and every real certificate signature is produced by sending the certificate’s canonical content (or its SHA3-512 digest) to that boundary and receiving back a HybridSignature — the private keys themselves are never loaded into the same process that runs model training/verification.

  • Only public keys are ever embedded in a certificate. save_certificate_hybrid and hybrid_signature_to_dict only ever serialize the public Ed448 and Dilithium5 keys (hex-encoded) alongside the signature values, so that verification is self-contained without needing to distribute or trust a separate keyring file.

  • Key rotation / revocation is not yet implemented — there is currently no certificate-transparency-style log or revocation list for hybrid signing public keys; a verifier that trusts a given public key trusts every certificate signed by it until a rotation policy is added. This is an explicit gap, not an oversight, and is a natural follow-on once an HSM/offline signer is actually provisioned in a deployment.

  • .gitignore enforces this at the file level as defence in depth (.pem, .key, secrets/ are ignored both at the repo root and inside crypto/), but the real control is procedural: nobody should ever generate a real signing key inside a working copy of this repository in the first place.

Definition of Done for "Production Ready"

  1. Clean instantiate/build/precompile/test on supported Julia versions

  2. Runtime smoke tests for documented examples pass

  3. No unresolved work-marker markers in src, ext, and test

  4. Public docs match implemented APIs and backend support status