[carinapeng]

Summary

llm-runner refused --json-schema with speculative decoding because the verifier had no notion of the grammar. Greedy speculative decoding now runs under a grammar:

• Masked acceptance. The target's choice at each verified position is its argmax over the tokens the grammar allows, and the grammar advances by every emitted token. Output is schema-valid and token-for-token identical to grammar-constrained greedy decoding of the target alone. A drafted token the grammar forbids ends acceptance early; it is never emitted.
• Grammar proposals. A span the grammar fully determines (keys, separators, literals) is verified as the proposal in place of drafted tokens. It is checked against the matcher and rolled back, so the grammar advances only when tokens are committed.
• Early stop. If a run ends inside an accepted block, the grammar is rolled back to the emitted stream.
• llm-runner. --json-schema is accepted with --draft-model and --prompt-lookup under greedy decoding. New --grammar-proposal-max (default 7, 0 disables, at most 63). Sampling with a schema is refused.

Verification scores full logits per slot; a top-k shortcut would need a new engine primitive and is not part of this change.

Testing

• 9 new decoder tests and 2 option tests, including a differential test against a reference constrained-greedy loop (5 configurations × 12 seeds). Replacing the masked argmax, or removing the early-stop rollback, makes them fail.
• swift test --filter "Speculative|Grammar|Constrained|StaticShape|PromptLookup": 102 tests pass. swift format lint clean.
• iPhone 17 Pro, Gemma 4 E2B and E4B, four-field schema: output byte-identical to plain constrained decoding at proposal limits 0, 3 and 7, and valid JSON.

The gain is bounded by how much of the output the schema forces.