feat(w3): 打通完整 Qwen3 IR 数值验证，补齐诊断、复现与 CI

.github/workflows/ci.yml

@@ -125,6 +125,16 @@ jobs:
           $PY -m pip install -e ".[all]"
           $PY -m pip install "pytest>=7,<10" "PyYAML==6.0.3"
 
+      - name: Install pinned CPU dependencies for Qwen and W3 tests
+        run: |
+          set -euo pipefail
+          # The full test suite collects W3 subgraph and workflow tests.
+          # Install their actual dependencies instead of skipping those tests.
+          $PY -m pip install "torch==2.7.1" --index-url https://download.pytorch.org/whl/cpu
+          $PY -m pip install -r requirements/qwen3-small-probe.txt "PyYAML==6.0.3"
+          $PY -m pip check
+          $PY -c "import torch, yaml, safetensors; assert torch.__version__ == '2.7.1+cpu' and torch.version.cuda is None, torch.__version__"
+
       # Unconditional: a docs-only change never selects the deployment scope, so
       # this check cannot live behind a path filter.
       - name: Check public instructions and Bash syntax
@@ -192,6 +202,9 @@ jobs:
         env:
           PYTHONHASHSEED: "0"
           SCRATCHV_REQUIRE_RISCV_EXECUTION: "1"
+          OMP_NUM_THREADS: "1"
+          OPENBLAS_NUM_THREADS: "1"
+          MKL_NUM_THREADS: "1"
         run: |
           mkdir -p benchmark_reports
           $PY -m pytest tests/ -v --tb=short \

.github/workflows/llm-deploy.yml

@@ -15,16 +15,21 @@ name: LLM Deploy v1.0
 #   numeric:ir-qwen3-small  frontend:parse-qwen3
 #   unit:frontend-ops  unit:backend-ops  unit:runtime  integration:runtime-model
 #
-# Later weeks' gates (numeric:ir-full-qwen3 at W3, numeric:qemu-full-qwen3 at
-# W4, e2e:qemu-paris at W5, release:gate at W8) are NOT stubbed here. They get
-# added when their week arrives, from the plan's §4.3 table.
+# Explicit manual runs can also call the delivered W3 workflows from the same
+# commit. The default W1/W2 checks do not imply full-model IR acceptance.
 
 on:
   workflow_call:
   schedule:
     # Nightly, off the hour: 19:23 UTC = 03:23 北京时间.
     - cron: '23 19 * * *'
   workflow_dispatch:
+    inputs:
+      run_w3_validation:
+        description: Also run complete W3 preparation and seven-case IR validation
+        type: boolean
+        required: false
+        default: false
 
 permissions:
   contents: read
@@ -39,6 +44,11 @@ env:
   QWEN3_PY: output/qwen3-probe-venv/bin/python
 
 jobs:
+  w3-validation:
+    name: "W3 / explicit full validation"
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.run_w3_validation }}
+    uses: ./.github/workflows/w3-nightly.yml
+
   llm-deploy:
     name: "LLM Deploy v1.0 / W1 + W2"
     runs-on: ubuntu-24.04
@@ -85,6 +95,9 @@ jobs:
         id: docs
         run: python3 scripts/check_llm_deploy_docs.py --week W1
 
+      - name: "docs:linux-reproduction"
+        run: python3 scripts/check_linux_repro_docs.py --check-bash
+
       # ── probe:qemu-matmul ─────────────────────────────────────────────
       - name: "probe:qemu-matmul"
         id: matmul
@@ -534,3 +547,33 @@ jobs:
         env:
           W2_JOB_RESULTS: ${{ toJSON(needs) }}
         run: python3 scripts/check_w2_ci_results.py
+
+  w3-execution-summary:
+    name: "W3 / execution scope"
+    needs: [w3-validation]
+    if: always()
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: State whether W3 actually ran
+        env:
+          W3_RESULT: ${{ needs.w3-validation.result }}
+        run: |
+          python3 - <<'PY'
+          import os
+          result = os.environ.get("W3_RESULT", "")
+          labels = {"success": "PASS", "failure": "FAIL", "cancelled": "CANCELLED", "skipped": "NOT RUN"}
+          label = labels.get(result, "UNCONFIRMED")
+          with open(os.environ["GITHUB_STEP_SUMMARY"], "a", encoding="utf-8") as stream:
+              stream.write("## W3 execution scope\n\n")
+              stream.write(f"**{label}** — W3 preparation and full 28-layer IR numeric.\n\n")
+              if result == "skipped":
+                  stream.write("W3 is opt-in and is not executed by default on pull requests. W1/W2 success is not W3 acceptance.\n\n")
+              elif result == "success":
+                  stream.write("See the W3 preparation and W3 complete IR numeric summaries in this run for numerical data.\n\n")
+              else:
+                  stream.write("No W3 acceptance claimed; inspect the called jobs and any partial evidence.\n\n")
+              stream.write("<details><summary>Scope and evidence</summary>\n\nManual LLM Deploy runs can enable `run_w3_validation`. "
+                           "Numerical reports are retained in `w3-preparation-reports` and `w3-full-numeric-reports` when generated. "
+                           "Full-model QEMU is a separate W4 gate; independent reproduction and team sign-off remain separate.\n\n</details>\n")
+          PY

.github/workflows/w3-full-numeric.yml

@@ -0,0 +1,146 @@
+name: W3 full IR numeric
+on:
+  workflow_dispatch:
+    inputs:
+      case:
+        description: Full suite or one-case diagnostic (subset returns PARTIAL if numerically correct)
+        type: choice
+        default: all
+        options:
+          - all
+          - short_17
+  workflow_call:
+    inputs:
+      case:
+        description: Full suite or short_17 diagnostic; partial coverage never passes acceptance
+        type: string
+        required: false
+        default: all
+permissions:
+  contents: read
+concurrency:
+  group: w3-full-numeric-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  full-numeric:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    env:
+      OMP_NUM_THREADS: "1"
+      OPENBLAS_NUM_THREADS: "1"
+      MKL_NUM_THREADS: "1"
+      PYTHONIOENCODING: utf-8
+      SELECTED_CASE: ${{ inputs.case || 'all' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.12"
+      - name: Validate requested coverage
+        run: |
+          set -euo pipefail
+          case "${SELECTED_CASE:-all}" in
+            all|short_17) ;;
+            *) printf 'Unsupported case: %s\n' "$SELECTED_CASE" >&2; exit 1 ;;
+          esac
+      - name: Record Linux runner resources
+        run: |
+          set -euo pipefail
+          mkdir -p output
+          {
+            printf 'commit=%s\nrun_id=%s\nattempt=%s\n' "$GITHUB_SHA" "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT"
+            cat /etc/os-release
+            uname -a
+            lscpu
+            free -b
+            df -B1 .
+          } | tee output/w3-runner-resources.txt
+      - name: Install fixed CPU environment
+        run: |
+          set -euo pipefail
+          python -m pip install torch==2.7.1 --index-url https://download.pytorch.org/whl/cpu
+          python -m pip install -r requirements/qwen3-small-probe.txt PyYAML==6.0.3
+          python -m pip install -e .
+          python -m pip check
+          python -m pip freeze > output/w3-dependencies.txt
+          python --version >> output/w3-runner-resources.txt
+      - name: Full runner and memory policy regressions
+        run: |
+          set -euo pipefail
+          mkdir -p output
+          python -B -X utf8 -m pytest tests/test_w3_full*.py tests/test_w3_actions_summary.py tests/test_w3_workflows.py tests/test_ir_interpreter*.py tests/test_onnx_initializers.py -q -p no:cacheprovider --basetemp output/pytest-w3-full --junitxml output/w3-full-tests.xml
+      - name: Download fixed ONNX assets
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          from probes.w1_qwen3_export.run import acquire_model
+          acquire_model(Path("output/assets/onnx"))
+          PY
+      - name: Compare complete IR and ORT outputs
+        id: probe
+        run: |
+          set -euo pipefail
+          args=()
+          SELECTED_CASE="${SELECTED_CASE:-all}"
+          if [[ "$SELECTED_CASE" != "all" ]]; then args=(--case "$SELECTED_CASE"); fi
+          python -B -X utf8 probes/w3_qwen3_full/run.py --model-dir output/assets/onnx --output-dir output/w3-full --worker-timeout 1800 --max-worker-memory-gib 8 --fp32-mode reference "${args[@]}"
+      - name: Summarize W3 full numerical evidence
+        if: always()
+        env:
+          PROBE_OUTCOME: ${{ steps.probe.outcome }}
+        run: python -B -X utf8 scripts/summarize_w3_ci.py --kind full --report-dir output/w3-full
+      - name: Record evidence retention scope
+        if: always()
+        run: |
+          mkdir -p output
+          cat > output/w3-full-evidence-retention.json <<'JSON'
+          {
+            "reports_retention_days": 30,
+            "raw_evidence_retention_days": 3,
+            "reports_scope": "Reports, hashes and schemas record the original run's checks; reports alone cannot independently revalidate the numerical results.",
+            "independent_revalidation": "Download w3-full-numeric-raw before expiry to retain the complete emitted inputs, logits, diagnostic logits and checkpoints together with reports. Failed or interrupted runs may contain incomplete evidence."
+          }
+          JSON
+      - name: Upload numerical reports (30 days)
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: w3-full-numeric-reports
+          if-no-files-found: warn
+          retention-days: 30
+          path: |
+            output/w3-runner-resources.txt
+            output/w3-dependencies.txt
+            output/w3-full-tests.xml
+            output/w3-full-evidence-retention.json
+            output/w3-full/**/report.json
+            output/w3-full/**/report.md
+            output/w3-full/**/report.html
+            output/w3-full/**/progress.json
+            output/w3-full/**/*.log
+            output/w3-full/**/checkpoint_schema.json
+      - name: Upload full raw numerical evidence (3 days)
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: w3-full-numeric-raw
+          if-no-files-found: warn
+          retention-days: 3
+          compression-level: 1
+          path: |
+            output/w3-runner-resources.txt
+            output/w3-dependencies.txt
+            output/w3-full-tests.xml
+            output/w3-full-evidence-retention.json
+            output/w3-full/**/report.json
+            output/w3-full/**/report.md
+            output/w3-full/**/report.html
+            output/w3-full/**/progress.json
+            output/w3-full/**/*.log
+            output/w3-full/**/inputs.npz
+            output/w3-full/**/checkpoint_schema.json
+            output/w3-full/**/checkpoints.npz
+            output/w3-full/**/logits.npy
+            output/w3-full/**/diagnostic_logits.npy

.github/workflows/w3-nightly.yml

@@ -0,0 +1,43 @@
+name: W3 nightly
+on:
+  workflow_dispatch:
+  workflow_call:
+  schedule:
+    # 03:23 Asia/Shanghai. Jobs stay disabled until the repository opts in.
+    - cron: '23 19 * * *'
+permissions:
+  contents: read
+concurrency:
+  group: w3-nightly-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  preparation:
+    if: ${{ github.event_name == 'workflow_dispatch' || vars.W3_NIGHTLY_ENABLED == 'true' }}
+    uses: ./.github/workflows/w3-preparation.yml
+  full-numeric:
+    if: ${{ github.event_name == 'workflow_dispatch' || vars.W3_NIGHTLY_ENABLED == 'true' }}
+    uses: ./.github/workflows/w3-full-numeric.yml
+    with:
+      case: all
+  acceptance:
+    if: ${{ always() && (github.event_name == 'workflow_dispatch' || vars.W3_NIGHTLY_ENABLED == 'true') }}
+    needs: [preparation, full-numeric]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    env:
+      PREPARATION_RESULT: ${{ needs.preparation.result }}
+      FULL_NUMERIC_RESULT: ${{ needs.full-numeric.result }}
+    steps:
+      - name: Require both complete gates
+        run: |
+          set -euo pipefail
+          {
+            printf '## W3 automated gates\n\n'
+            printf 'Commit: `%s`\n\n' "$GITHUB_SHA"
+            printf '| Gate | Result |\n| --- | --- |\n'
+            printf '| Preparation | %s |\n' "$PREPARATION_RESULT"
+            printf '| Complete seven-case Qwen3 IR numeric | %s |\n\n' "$FULL_NUMERIC_RESULT"
+            printf 'Only two successful gates pass this run. This does not approve the W3 team milestone or replace independent reproduction.\n'
+          } >> "$GITHUB_STEP_SUMMARY"
+          test "$PREPARATION_RESULT" = success
+          test "$FULL_NUMERIC_RESULT" = success