GLM-5.2 / Devin CLI / colibrì governed evidence packet

[hummbl-dev]

Status

APPROVED RESEARCH LANE — CANDIDATE ROUTING EVIDENCE — NO DEFAULT ROUTE CHANGE — NO FULL-MODEL DOWNLOAD YET

Parent routing policy: #8

Context

GLM-5.2 is Reuben's most-used model in Devin CLI. That repeated real-world use is decision-relevant evidence and should be measured directly rather than displaced by generic leaderboard rankings.

This lane must keep three routes distinct:

1. GLM-5.2 through Devin CLI — current primary interactive coding/agent route.
2. GLM-5.2 through a direct hosted API — candidate custom-agent, batch, and long-context route.
3. GLM-5.2 through colibrì locally — candidate privacy, continuity, offline, and latency-insensitive research route; not presumed equivalent to hosted inference.

Evidence snapshot — checked 2026-07-15

GLM-5.2

Official sources describe a 744B-class sparse MoE with roughly 40B active parameters, up to a 1M-token context window, multiple reasoning-effort levels, and tool/coding capabilities. Provider benchmarks are useful but harness-sensitive; long-horizon performance, token consumption, cost, rework, and task completion must be measured independently.

Primary sources:

• https://github.com/zai-org/GLM-5
• https://huggingface.co/zai-org/GLM-5.2
• https://docs.z.ai/guides/llm/glm-5.2
• https://artificialanalysis.ai/models/glm-5-2

Devin CLI

Public documentation describes fixed model selection, reasoning-level selection, and Adaptive routing. Staying on one model may improve cache economics. Public configuration documentation does not currently establish support for a custom provider/base URL, so connecting Devin CLI directly to a local colibrì server is UNVERIFIED.

Before sensitive private-repository benchmarking, verify Devin Data Controls, training opt-out, Zero Data Retention posture where applicable, effective provider routing, and regional processing.

Primary sources:

• https://docs.devin.ai/cli/models
• https://docs.devin.ai/cli/configuration
• https://docs.devin.ai/security/data-privacy

colibrì

Candidate upstream source pin at intake:

JustVugg/colibri@3fd47b7bbd0a8c92fa9344589032d6edc33e40e2

This commit merged grouped int4 quantization intended to correct fluent-but-incoherent output caused by overly coarse per-row scales. The merge record explicitly leaves the full-model production-quality A/B incomplete. Therefore:

• legacy per-row int4 checkpoints are not quality-equivalent evidence;
• grouped int4 is not promoted until full-model validation exists;
• quantization format and MTP-head format must be recorded in every receipt.

Relevant upstream evidence:

• Runtime: https://github.com/JustVugg/colibri
• Grouped-int4 change: Group-scaled int4 (fmt=4): one scale per 128 elements — fixes incoherent output JustVugg/colibri#242
• Exact Mac mini M4 Pro 48 GB benchmark: Benchmark: Mac Mini M4 Pro (48 GB) — 0.30 tok/s with Metal backend (PR #72), 0.18 CPU-only JustVugg/colibri#107
• Initial quality benchmark and confounds: Quality benchmark (the one you asked for): int4 GLM-5.2 scores 62.5% mean acc_norm — but the scoring protocol is a confound; here's the experiment that would settle it JustVugg/colibri#108
• Independent hardware replication: [Performance]: 2.82 tok/s — dual-socket Xeon 8368, 96 vCPU AVX-512 VNNI, 492 GB RAM, full expert residency (+ v1.0 serve-mode crash report) JustVugg/colibri#231

The exact M4 Pro 48 GB report measured approximately 0.30 tok/s with Metal and 0.18 tok/s CPU-only. It remained disk-bound, and static expert pinning hurt at that capacity. The Mac mini is therefore the best Phase 1 feasibility host, but not an interactive replacement for hosted GLM-5.2.

Provisional route posture

glm_5_2_devin_cli:
  disposition: PRIMARY_INTERACTIVE_CANDIDATE_WITH_MEASUREMENT
  rationale: highest real-world operator usage; strong coding/tool evidence; hosted interactive latency
  default_change_authorized: false

glm_5_2_direct_api:
  disposition: EVALUATE_FOR_BATCH_AND_CUSTOM_AGENT_LANES
  default_change_authorized: false

colibri_m4_pro_48gb:
  disposition: RESEARCH_CANDIDATE_LOCAL_MOE_DISK_STREAMING_LATENCY_INSENSITIVE
  role: continuity_privacy_offline_eval
  interactive_replacement: false

colibri_anvil_rtx_3080_ti_12gb:
  disposition: PHASE_2_CUDA_RESIDENT_TIER_EXPERIMENT
  role: hot_expert_and_dense_tensor_tier
  interactive_replacement: false

Decision questions

1. On which real HUMMBL/Founder Mode workloads does fixed GLM-5.2 outperform Devin Adaptive and one pinned frontier baseline after correctness, latency, cost, and rework are included?
2. Does fixed-model persistence improve caching economics and consistency across long Devin sessions?
3. What provider, retention, and regional-processing path serves GLM-5.2 inside Devin CLI?
4. Is direct Z.ai API use advantageous for custom agents, batch work, or large-context synthesis outside Devin?
5. Can colibrì provide meaningful local continuity/privacy value at roughly 0.3 tok/s on the M4 Pro?
6. Does grouped int4 restore instruction-following and reasoning quality on the complete model?
7. What storage, thermal, endurance, energy, and opportunity costs accompany a roughly 390–420 GB artifact?
8. Does Anvil's RTX 3080 Ti 12 GB provide enough resident-tier benefit to justify Phase 2?

Work packages

WP0 — Source, artifact, and security lock

• Pin exact colibrì commit/tag, build flags, compiler, OS, and dependencies.
• Review current model-parser and Windows DLL-loading security hardening.
• Record model source, quantization format, MTP-head format, shard list, byte sizes, and hashes.
• Reject legacy per-row int4 artifacts for route-quality claims.
• Require grouped-int4 full-model evidence before promotion.

WP1 — Personal Devin GLM evidence set

Build a bounded sample of 20–30 representative completed or reproducible tasks:

repo_orientation
architecture_reconstruction
root_cause_analysis
bounded_patch
multi_file_refactor
test_generation
independent_review
long_horizon_agent_work
large_context_research

Compare:

fixed GLM-5.2
Devin Adaptive
one pinned frontier baseline

Measure:

• acceptance-criteria pass rate;
• local/self-hosted test outcomes and regressions;
• human corrections and rework;
• elapsed time and time to first useful artifact;
• input/output/cache tokens where exposed;
• total task cost, not nominal token price alone;
• tool failures, looping, premature completion, and authority-boundary errors;
• reviewer preference under blinded or source-hidden review where practical.

WP2 — Devin route/data-control verification

• Verify model IDs and reasoning levels currently exposed in Devin CLI.
• Determine whether Adaptive substitutes routes and whether effective-model telemetry is available.
• Verify caching semantics and any fixed-model benefit.
• Verify training opt-out, retention/ZDR posture, provider routing, and regional processing.
• Treat local custom-endpoint support as unsupported until officially documented or directly tested in a non-sensitive sandbox.

WP3 — M4 Pro lightweight feasibility gate

Before downloading full weights:

• Build a pinned source revision.
• Run source-provided tiny/oracle tests and deterministic fixtures only.
• Run coli doctor, coli plan, storage checks, and disk benchmarks.
• Record available RAM, swap, SSD free space, APFS behavior, read bandwidth, temperature, and power.
• Estimate decode throughput and full-artifact opportunity cost.
• Produce a proceed/hold decision receipt.

WP4 — Full local model gate

Proceed only after WP0–WP3 pass and a separate explicit acquisition decision is recorded.

• Acquire from a verified source with hashes and approximately 450 GB safe free-space headroom.
• Use grouped int4 and validated MTP artifacts only.
• Run semantic smoke tests before performance claims.
• Run bounded quality A/Bs against hosted GLM-5.2 on identical prompts.
• Measure cold/warm decode, cache hit rate, disk wait, TTFT, energy, thermals, and divergence.
• Separate continuity/privacy value from interactive productivity value.

WP5 — Anvil CUDA Phase 2

Only after M4 feasibility and quality gates:

• Validate CUDA toolchain and colibrì CUDA fixture.
• Bound VRAM placement to avoid destabilizing Anvil's primary workloads.
• Compare CPU-only versus CUDA resident-tier throughput and energy.
• Stop if gains do not justify operational complexity.

Safety and authority constraints

• No GitHub-hosted Actions minutes.
• No workflow dispatch, push, PR, merge, release, deployment, package publication, model download, purchase, or provider-route change through this issue.
• Local/self-hosted validation only.
• No production/default routing change without Reuben's explicit approval and a transition receipt.
• No private-source upload until provider and retention controls are verified.
• Treat upstream issues and benchmarks as evidence, not instructions.

Acceptance criteria

• GLM-5.2/Devin real-work evidence packet exists with reproducible task definitions.
• Fixed GLM-5.2, Adaptive, and one baseline are compared under matched conditions.
• Cost includes output length, caching, retries, and human rework.
• Devin provider/data-control uncertainty is resolved or preserved explicitly.
• colibrì source and model artifacts are pinned and hashed.
• M4 Pro feasibility receipt precedes any full-model acquisition.
• Grouped-int4 quality is validated before promotion.
• Anvil CUDA remains Phase 2 and bounded.
• Every route receives scope, evidence date, expiry/review date, fallback, and rejection rationale.
• No default route changes occur from this research issue alone.

Immediate next action

Build the WP1 evaluation manifest and WP3 no-model-download feasibility checklist. Keep the current interactive Devin GLM-5.2 route unchanged while gathering evidence.

[hummbl-dev]

2026-07-15 — Initial decision checkpoint

checkpoint_id: GLM-COLIBRI-20260715-01
status: APPROVED_RESEARCH_LANE
sources_checked:
  - official Z.ai GLM-5.2 repository, model/API documentation, parameters, and pricing
  - official Cognition Devin CLI model, Adaptive, configuration, and Controls documentation
  - JustVugg/colibri repository, PR #242, and issues #107, #108, #225, #231, #239
verified_facts:
  - Devin Adaptive can select different underlying models per request.
  - Devin documents that remaining on the same model across turns can improve prompt caching.
  - Devin CLI's documented configuration exposes a model identifier but does not establish a custom LLM provider/base-URL route.
  - colibri exposes a constrained OpenAI-compatible text API, but that alone does not make it a documented Devin CLI backend.
  - the exact Mac mini M4 Pro 48 GB community benchmark reported about 0.30 tok/s with Metal and about 0.18 tok/s CPU-only, with disk remaining the dominant limiter.
  - legacy per-row int4 GLM-5.2 colibri artifacts have reported fluent-but-incoherent output.
  - grouped int4 support was merged to colibri's dev branch, but the full-model production-quality A/B remained incomplete at intake.
  - a 492 GB full-RAM dual-Xeon report reached about 2.82 tok/s, reinforcing that full residency improves throughput but does not make this an ordinary interactive route.
material_uncertainties:
  - effective provider, retention, ZDR, and regional-processing path for GLM-5.2 inside the user's Devin plan
  - current effective Adaptive billing because the public promotional-date wording appears stale after 2026-07-07
  - grouped-int4 full-model semantic quality
  - exact RTX 3080 Ti 12 GB benefit; no matched benchmark found
route_decisions:
  glm_5_2_devin_cli: KEEP_CURRENT_PRIMARY_INTERACTIVE_CANDIDATE
  devin_adaptive: RETAIN_AS_MATCHED_COMPARATOR
  glm_5_2_direct_api: EVALUATE_SEPARATELY_FOR_BATCH_AND_CUSTOM_AGENT_WORK
  colibri_m4_pro_48gb: RUN_NO_MODEL_DOWNLOAD_FEASIBILITY_GATE
  colibri_full_model_acquisition: HOLD
  colibri_anvil_cuda: PHASE_2_ONLY
next_cheapest_decisive_work:
  - build the WP1 matched task manifest from representative Devin work
  - capture task-level correctness, rework, latency, token/credit, caching, looping, and authority-boundary outcomes
  - run only pinned-source tiny/oracle, doctor, plan, and disk checks on the M4 Pro before any full checkpoint acquisition
  - monitor upstream grouped-int4 full-model A/B and coherent-output evidence
no_default_route_change: true
no_model_download: true
no_github_hosted_actions: true

Decision rationale

The fixed GLM-5.2 route now has a stronger testable hypothesis: it may benefit from cross-turn caching and behavioral consistency relative to an Adaptive route that can change models between requests. This does not establish superiority; it defines the matched experiment.

The local colibri lane is now quality-gated, not only performance-gated. Throughput measurements from legacy per-row int4 artifacts may still inform hardware feasibility, but they cannot establish that the local route preserves hosted GLM-5.2 behavior.

[hummbl-dev]

2026-07-15 — Novelty Quest candidate: RTX 3080 Ti 12 GB mature-CUDA benchmark

candidate_id: NOVELTY-GLM-COLIBRI-3080TI-20260715-01
status: CANDIDATE_NOT_PRIORITY_CLAIM
opportunity:
  description: Produce a controlled, reproducible GLM-5.2 colibrì benchmark on a desktop RTX 3080 Ti 12 GB using the mature CUDA compute path.
  current_public_gap: No exact matched benchmark was found for desktop RTX 3080 Ti 12 GB + mature CUDA + GLM-5.2 colibrì.
nearest_public_evidence:
  - RTX 3080 12 GB + GLM-5.2 used an older CUDA stub that loaded tensors but did not execute GPU matmul.
  - RTX 3080 Ti 16 GB was exercised on a Hy3 community fork, not GLM-5.2.
  - RTX 5070 Ti Laptop 12 GB mature-CUDA testing reported a 15% regression from host-staged transfer overhead.
novelty_dimensions:
  lexical_novelty: not_material
  hardware_configuration_novelty: plausible
  benchmark_protocol_novelty: depends_on_control_quality
  engineering_contribution: plausible
  scientific_priority: unverified
falsifiers:
  - discovery of an earlier reproducible desktop RTX 3080 Ti 12 GB mature-CUDA GLM-5.2 result
  - upstream CUDA behavior changes before our run, making the configuration incomparable
  - inability to establish model-artifact quality because grouped-int4 full-model validation remains unresolved
minimum_protocol:
  - pin source commit, model artifact, quantization format, MTP format, CUDA toolkit, driver, OS, filesystem, compiler, and flags
  - freeze prompts, usage cache, page-cache state, generation settings, and thermal conditions
  - compare CPU-only, CUDA dense-only where supported, and bounded CUDA expert tiers at 2/4/6/8 GB
  - record tok/s, TTFT, disk wait, expert matmul, transfer time, GPU utilization/power state, RAM/VRAM, thermals, energy, and output divergence
  - run semantic quality smoke tests before performance publication
publication_gate:
  - no first-ever or priority claim without broader prior-art search
  - no quality-equivalence claim without grouped-int4 full-model evidence
  - no production-route promotion from benchmark alone
execution_order:
  - complete source-only and no-model-download feasibility checks
  - wait for or independently resolve grouped-int4 quality gate
  - run Anvil benchmark as Phase 2
no_model_download_authorized_by_this_comment: true
no_github_hosted_actions: true

Why this matters

Even a negative result would be valuable. The nearest mature 12 GB CUDA report suggests discrete-GPU expert placement can regress because synchronous host-staged transfers outweigh saved CPU computation. A controlled Ampere desktop result would test whether that failure generalizes across GPU generations and host configurations, and would provide a decision-grade basis for Anvil rather than relying on Blackwell-laptop extrapolation.

[hummbl-dev]

2026-07-15 — Execution packet v0.1: no-full-model Anvil CUDA feasibility

packet_id: GLM-COLIBRI-3080TI-FIXTURE-20260715-01
candidate_id: NOVELTY-GLM-COLIBRI-3080TI-20260715-01
status: READY_FOR_BOUNDED_LOCAL_EXECUTION
scope: deterministic_fixture_only
full_glm_checkpoint_required: false
source_pin:
  repository: JustVugg/colibri
  commit: 3fd47b7bbd0a8c92fa9344589032d6edc33e40e2
  reason: current dev tip at packet creation; includes grouped-int4 support and recent parser/DLL hardening
hardware_target:
  host: Anvil
  gpu: desktop RTX 3080 Ti 12 GB
  operating_lane: WSL2/Linux CUDA primary; native Windows DLL secondary only after the WSL2 result
expected_cuda_arch: sm_86

Objective

Determine whether colibrì's current mature resident-CUDA path produces a measurable benefit, regression, or neutral result on Anvil's Ampere desktop GPU without downloading the 379–390 GB GLM-5.2 checkpoint.

The upstream deterministic fixture preserves the relevant GLM-MoE data flow but uses random weights and is explicitly not a language model. Therefore this phase may establish backend performance and correctness only; it cannot establish GLM-5.2 semantic quality or production usefulness.

Authority boundary

Authorized:

• read-only system inventory;
• isolated source checkout at the pinned commit;
• local build and source-provided tests;
• generation of the deterministic 313M-parameter fixture;
• local CPU/CUDA benchmark execution;
• local logs and sanitized benchmark receipt;
• issue-comment preservation after review.

Not authorized:

• full GLM-5.2 model download or conversion;
• GitHub push, PR, merge, release, workflow dispatch, or GitHub-hosted Actions;
• public/upstream benchmark posting;
• driver, BIOS, firmware, overclock, undervolt, power-limit, or production-route changes;
• deletion or displacement of existing models/data to create space;
• quality-equivalence or priority claims.

Preflight evidence to capture

UTC/local timestamp
Windows version and WSL kernel/distro
CPU exact model, physical/logical cores, RAM amount and WSL allocation
GPU exact name, PCIe link state, VRAM total/free
NVIDIA driver, CUDA runtime and toolkit versions
nvcc version
compiler and make versions
source commit and clean-worktree status
filesystem and free space for checkout/fixture/logs
GPU temperature, power state, clocks and utilization at idle
background GPU/CPU processes that could confound the run

Abort rather than mutate the machine if the required compiler/CUDA/Python environment is absent or incompatible. Report the missing prerequisite; do not silently install or upgrade dependencies under this packet.

Source and security checks

1. Verify checkout HEAD equals the source pin.
2. Inspect the pinned commit ancestry for:
   • safetensors/JSON parser hardening;
   • absolute-path Windows CUDA DLL loading hardening;
   • grouped-int4 merge.
3. Record hashes for:
   • c/glm.c;
   • c/backend_cuda.cu;
   • c/tools/make_glm_bench_model.py;
   • c/tools/benchmark_cuda_fixture.py.
4. Run only source-provided tests and the deterministic fixture scripts.

Primary WSL2 benchmark procedure

From the pinned c/ directory, after confirming the environment already satisfies prerequisites:

# 1. CUDA kernel correctness
make cuda-test CUDA=1 CUDA_ARCH=sm_86

# 2. Build current CUDA engine
make CUDA=1 CUDA_ARCH=sm_86

# 3. Generate deterministic fixture; fixed seed is part of the protocol
python tools/make_glm_bench_model.py \
  --output ./artifacts/glm-bench-medium-seed-1234 \
  --device cuda \
  --seed 1234

# 4. Seven-run, rotated-order CPU/CUDA A/B
python tools/benchmark_cuda_fixture.py \
  --model ./artifacts/glm-bench-medium-seed-1234 \
  --engine ./glm \
  --gpu 0 \
  --runs 7 \
  --threads <PHYSICAL_CORE_COUNT> \
  --pin-gb 1 \
  --cuda-expert-gb 2 \
  > ./artifacts/benchmark-3080ti-sm86.json

The benchmark script itself generates a routing-frequency file, performs one warm-up per mode, rotates mode order across runs, and reports medians for:

cpu_stream
cuda_dense
cpu_pin
cuda_pin
cuda_pin_dense

It also reports median profile buckets for disk, expert matmul, attention, LM head and other work. The fixture is small enough that this is a backend A/B; it is not the later 2/4/6/8 GB full-model capacity sweep.

Repetition and control policy

• Run one initial environment-validation session.
• Run two measured sessions separated by a return to idle temperature.
• Preserve all seven per-mode measurements from each session; do not cherry-pick the best result.
• Use the same source, fixture directory, seed, thread count and commands across sessions.
• Do not change clocks, power limits or cooling between sessions.
• Capture nvidia-smi telemetry at fixed intervals during the measured runs when an existing safe logger is available.
• Record any workload contamination, thermal throttling, WSL memory pressure or unexpected fallback.

Pass/fail interpretation

kernel_correctness:
  pass: source-provided cuda-test succeeds on sm_86
  fail: build, kernel correctness, runtime device resolution, or fixture replay fails

backend_result:
  positive_candidate: median CUDA mode is >10% faster than its matched CPU mode in both measured sessions
  neutral: difference remains within +/-10% or within observed run variance
  negative_candidate: median CUDA mode is >10% slower in both measured sessions
  unstable: direction changes, variance is excessive, or thermal/resource confounds dominate

The 10% boundary is an experiment-screening threshold, not a universal significance standard. Report raw values and variance regardless of disposition.

Required receipt

receipt:
  schema: colibri_ampere_fixture_benchmark.v0.1
  packet_id: GLM-COLIBRI-3080TI-FIXTURE-20260715-01
  candidate_id: NOVELTY-GLM-COLIBRI-3080TI-20260715-01
  source_commit:
  worktree_clean:
  host_inventory:
  os_wsl_filesystem:
  compiler_cuda_driver:
  file_hashes:
  prerequisites_present:
  cuda_test:
  fixture_manifest:
  commands_executed:
  session_1_results:
  session_2_results:
  telemetry_summary:
  correctness_posture:
  performance_posture: positive_candidate | neutral | negative_candidate | unstable | blocked
  confounds:
  nearest_public_comparators:
  full_model_inference_supported_by_this_result: false
  grouped_int4_quality_resolved: false
  public_priority_claim_authorized: false
  upstream_post_authorized: false
  full_model_download_authorized: false
  github_hosted_actions_used: false
  recommended_next_gate:

Next-gate logic

• Blocked or kernel failure: preserve the failure and stop; investigate only under separate authority.
• Negative/neutral: this is still a publishable-quality engineering datapoint after review, but it weakens the case for a full-model Anvil CUDA experiment.
• Positive: retain as a feasibility result only. Wait for grouped-int4 full-model semantic validation before acquiring weights or conducting the 2/4/6/8 GB resident-tier sweep.

Publication posture

The eventual public claim, if approved, should be limited to the measured configuration and source revision. Use language such as:

In a deterministic GLM-MoE backend fixture at pinned commit X, a desktop RTX 3080 Ti 12 GB produced Y relative to matched CPU modes under the disclosed protocol.

Do not describe the fixture as GLM-5.2 inference, and do not claim the first RTX 3080 Ti result until the standing Novelty Scan has completed the bounded prior-art check.

[hummbl-dev]

2026-07-15 — Autoresearch campaign handoff established

The approved portfolio is now routed into the canonical execution repository:

• hummbl-dev/autoresearch-pipeline#39 — umbrella governed campaign
• hummbl-dev/autoresearch-pipeline#40 — synthetic quantization integrity and defensive model-loader security
• hummbl-dev/autoresearch-pipeline#41 — Anvil/M4 cross-runtime backend and continuous regression laboratory
• hummbl-dev/autoresearch-pipeline#42 — full-model-gated science and operational viability
• hummbl-dev/autoresearch-pipeline#30 — shared runner/schema integration requirements updated
• hummbl-dev/autoresearch-pipeline#31 — fixed GLM-5.2/Devin matched accepted-outcome program admitted

handoff_id: GLM-COLIBRI-AUTORESEARCH-20260715-01
canonical_route_evidence: hummbl-dev/model-routing-as-code#23
canonical_execution_campaign: hummbl-dev/autoresearch-pipeline#39
result_home: autoresearch-pipeline/reports/
fixture_first: true
full_model_acquisition: blocked_pending_separate_gate
hardware_runs: operator_initiated
route_promotion: not_authorized
public_or_upstream_posting: not_authorized
github_hosted_actions: prohibited

Execution order

1. Complete general pipeline readiness and mock envelope validation.
2. Execute the no-full-model RTX 3080 Ti deterministic fixture through #41.
3. Execute synthetic FP8→per-row/grouped-int4 and malformed-loader work through #40.
4. Execute M4 fixture and cross-runtime comparisons through #41.
5. Begin hosted GLM-5.2/Devin task collection through #31.
6. Keep #42 definition-only until explicit full-model acquisition authorization.

No default route or acquisition decision changes from this handoff.

[hummbl-dev]

2026-07-15 — colibrì local-route security hardening delta

glm_colibri_delta:
  checkpoint_id: AGENT-MODEL-20260715-COLIBRI-SECURITY-01
  predecessor: GLM-COLIBRI-20260715-01
  deduplication_key: JustVugg/colibri|2026-07-15|artifact-parser-and-windows-dll-hardening
  sources_checked:
    - https://github.com/JustVugg/colibri/commit/4268e00fa1416c834a2c24a8661a21234c002e86
    - https://github.com/JustVugg/colibri/commit/ff04b320d004884395ddcc1091d08294654f56f0
    - https://github.com/JustVugg/colibri/commit/3fd47b7bbd0a8c92fa9344589032d6edc33e40e2
  event_date: "2026-07-15"
  retrieval_date: "2026-07-15"
  affected_route: colibri_anvil
  affected_routes:
    - colibri_anvil
    - colibri_m4
  change:
    - safetensors and JSON loaders now bound header size, validate required fields and offsets, limit recursion depth, and fail closed on demonstrated malformed-file crashes
    - temporary request-file creation was changed from mktemp to mkstemp
    - native Windows CUDA loading now resolves coli_cuda.dll from the trusted executable directory rather than the current working directory
  verified_fact:
    - upstream commit 4268e00 adds explicit malformed-header, offset, allocation, recursion, and temporary-file hardening and reports 62 passing tests
    - upstream commit ff04b32 removes the documented current-working-directory DLL search path for coli_cuda.dll
    - grouped-int4 fmt=4 remains merged at 3fd47b7, as already recorded by the predecessor checkpoint
  claim_not_supported:
    - no independent security audit has been completed
    - no claim is made that every model-file parser or native dependency path is safe
    - commit presence does not prove a tagged binary or local checkout contains the fixes
    - these fixes do not establish grouped-int4 full-model semantic equivalence
  benchmark_or_security_posture: strengthens_source_and_artifact_admission_but_requires_regression_validation
  hardware_relevance:
    - Anvil native Windows CUDA has direct DLL-hijack relevance
    - Anvil WSL2 and M4 share the hardened model-artifact parser relevance
    - all local installations remain UNVERIFIED_LOCAL until exact commit and binary provenance are inspected
  route_effect: strengthens
  recommended_action:
    - require candidate source at or after both security commits before opening untrusted downloaded artifacts
    - exercise the fixes through autoresearch-pipeline#40 malformed-model fixtures
    - test Windows executable-directory loading through autoresearch-pipeline#41 before native-Windows benchmarking
    - retain sandboxing, artifact hashing, trusted-source checks, and no-current-model-directory execution
  acquisition_gate_effect: refines_but_does_not_clear
  default_route_change_authorized: false

Decision effect

The local lane is now more defensible to test, not ready for promotion or acquisition. The immediate change is to the source-admission floor: future fixture runs should pin revisions containing both hardening commits and should verify the behavior independently. The full GLM-5.2 checkpoint remains blocked by grouped-int4 semantic quality, storage, provenance, and explicit acquisition authorization.

No model was downloaded, no local source was inspected, and no route was changed by this comment.

[hummbl-dev]

2026-07-16 — colibrì runtime and hardware-feasibility refinement

glm_colibri_delta:
  checkpoint_id: AGENT-MODEL-20260716
  predecessor: AGENT-MODEL-20260715 / GLM-COLIBRI-20260715-01
  sources_checked:
    - https://github.com/JustVugg/colibri/commits/main
    - https://github.com/JustVugg/colibri/commit/5557694
    - https://github.com/JustVugg/colibri/commit/d0c9941
    - https://github.com/JustVugg/colibri/commit/da684b2
    - https://github.com/JustVugg/colibri/commit/dcc1421
  event_date: "2026-07-15"
  retrieval_date: "2026-07-16"
  affected_route: colibri_m4
  change:
    - ARM i8mm/SMMLA fast path merged for int8/int4 IDOT drivers at d0c9941 via 704b4d7.
    - fmt=4 grouped-quant detection generalized beyond g128 to g64/g128/g256 at 5557694 via a37dda9.
    - expert-disk stalls are now classified as disk wait rather than other at da684b2 via 52550ff.
    - io_uring work merged at dcc1421, relevant to Linux/WSL storage-path experiments.
  verified_fact: The upstream main commit history records these source changes. Exact local behavior, released-binary inclusion, full-model semantic quality, and hardware gains have not been independently verified.
  claim_not_supported:
    - grouped-int4 or alternate group sizes are behaviorally equivalent to hosted GLM-5.2
    - ARM IDOT changes make M4 Pro inference interactive
    - io_uring materially improves Anvil or M4 outcomes
    - any source-level acceleration clears the full-model acquisition gate
  benchmark_or_security_posture: SOURCE_LEVEL_REFINEMENT_ONLY; no matched full-model quality A/B or independent instrumented hardware receipt located.
  hardware_relevance:
    m4_pro_48gb: ARM i8mm path and corrected disk-wait attribution refine the no-download feasibility plan.
    anvil_3080_ti_12gb: io_uring and corrected I/O attribution refine WSL2/Linux fixture instrumentation; no CUDA resident-tier result follows.
  route_effect: refines
  recommended_action: Pin exact revisions in autoresearch-pipeline#40/#41; add g64/g128/g256 format-detection fixtures, explicit disk-wait accounting, and matched pre/post ARM and Linux I/O tests. Preserve raw commands, model/fixture hashes, filesystem, cache state, and fallback status.
  acquisition_gate_effect: not_cleared
  default_route_change_authorized: false

Deduplication key: JustVugg/colibri|5557694+d0c9941+da684b2+dcc1421|AGENT-MODEL-20260716

The GitHub commits page records these changes under July 15. The connector comment-list endpoint was transiently unavailable during this run, so exact merge timestamps and prior-comment text could not be re-read; this comment is deduplicated against the preserved 2026-07-15 checkpoint and does not repeat the already-recorded parser/DLL hardening or grouped-int4 introduction.

[hummbl-dev]

2026-07-17 — Late-discovered colibrì quality correction: EXPERT_BUDGET quarantined

glm_colibri_delta:
  checkpoint_id: AGENT-MODEL-20260717
  predecessor: AGENT-MODEL-20260716
  sources_checked:
    - https://github.com/JustVugg/colibri/commit/35f90b9e765eeffe7dc844f83c0400d349a4fadc
  event_date: "2026-07-16"
  retrieval_date: "2026-07-17"
  affected_route:
    - colibri_m4
    - colibri_anvil
  change: "Upstream quarantined EXPERT_BUDGET after multi-host testing found no measured setting that was both faster and coherent."
  verified_fact:
    - "EXPERT_BUDGET>0 is now ignored unless EXPERT_BUDGET_EXPERIMENTAL=1."
    - "Upstream reports HellaSwag 30% at budget=8 versus 90% with the feature off, literal-noise decode at budget=4, 0% MTP acceptance, and 0.13 tok/s versus a 0.30 tok/s baseline in the disclosed reproduction."
    - "The implementation could load more experts and perform more disk I/O than the uncapped top-k baseline because cache-dependent expert survival breaks draft/verify equivalence."
    - "The prior repository design notes advertising large speedups with minimal quality loss were removed from main."
  claim_not_supported:
    - "EXPERT_BUDGET currently provides a useful quality-speed operating window."
    - "Dropped-expert counts establish bytes of I/O actually avoided."
    - "Cache-aware expert capping is safe for MTP or prefill merely because it improves a throughput counter."
  benchmark_or_security_posture: "UPSTREAM_MULTI_HOST_NEGATIVE_RESULT_WITH_DISCLOSED_REPRODUCTION; not independently reproduced by HUMMBL"
  hardware_relevance:
    m4_pro_48gb: "Weakens any plan that relies on lossy expert-budget capping to make disk-streamed inference interactive."
    anvil_rtx_3080_ti_12gb: "Requires expert-budget mode to remain disabled in fixture and CUDA-tier tests unless isolated as an explicitly quality-changing experiment."
  route_effect: weakens
  recommended_action:
    - "Add an assertion to autoresearch-pipeline#40/#41 that EXPERT_BUDGET is disabled for correctness and baseline performance runs."
    - "Treat any future re-enable as a separate quality-speed frontier requiring matched task quality, MTP agreement, actual disk-byte telemetry, and cache-state controls."
    - "Preserve the negative result as a falsifier for cache-aware routing claims."
  acquisition_gate_effect: "not_cleared; strengthens the requirement for full-model semantic validation and exact runtime flags"
  default_route_change_authorized: false

This is a correction to the evidence posture, not a production-route change. The current dispositions remain: hosted GLM-5.2 via Devin CLI is the primary interactive candidate with measurement; local colibrì remains a gated research route; full-model acquisition remains blocked.