TileOPs-Metax/docs/trust-model.md

3.4 KiB

Trust Model

Each development stage owns a specific concern. Boundaries prevent one stage from silently weakening another's guarantees.

Pipeline

Manifest → Test → Implementation → Benchmark

Each stage declares OWNS / MUST NOT / MAY READ in its domain rule file.

Manifest

Source of truth for op interfaces. Human-reviewed, separate PR.

  • OWNS: op signatures, dtypes, workload shapes, roofline formulas, status, kernel_map (dispatch registration table)
  • MUST NOT: contain kernel internals, dispatch strategy, or test logic
  • MAY READ: PyTorch public API (to match signatures)

→ Rules: manifest-spec.md | Guide: testing.md §Writing a Test

Test

PR-level correctness verification. QA writes tests against manifest spec.

  • OWNS: ref_program, tolerances, assertions, tests/, workloads/
  • MUST NOT: contain kernel code, benchmark logic, or performance measurements
  • MAY READ: manifest (to verify interface), workloads/ (via WorkloadBase inheritance)

→ Rules: testing-budget.md | Guide: testing.md §Writing a Test

Implementation

Kernel (L1) + Op (L2). Developer reads manifest + ref_program for behavior; high-perf optimization is independent.

  • OWNS: TileLang kernels, op dispatch, class variable protocol
  • MUST NOT: define workload shapes, own correctness assertions, modify manifest
  • MAY READ: manifest (interface), tests/ (behavior understanding — not to reverse-engineer passing)

→ Rules: ops-design.md | Guide: ops-design.md, testing.md §Writing an Op

Benchmark

Nightly performance guard. Independent baselines — cannot modify op/tests/workloads.

  • OWNS: profiling, baseline comparisons, benchmarks/
  • MUST NOT: contain correctness assertions, kernel code, or import oracle/ref functions from tests/ or workloads/ (benchmark-local baseline functions are allowed)
  • MAY READ: workloads/ (composition), tileops/ops/ (to profile)

→ Rules: benchmark.md | Guide: testing.md §Writing a Benchmark

Workloads Layer

Shared input-definition layer — not a development stage. Test stage OWNS it (QA creates workload classes first).

Provides: WorkloadBase (gen_inputs), FixtureMeta/FixtureBase (parametrize), per-op workload subclasses.

Must not contain: ref_program, check/tolerance logic, calculate_flops/memory, benchmark baselines. Reason: prevents shared oracle surface between test correctness and benchmark baselines.

WorkloadBase (workloads/base.py)        # gen_inputs() only — default implementation
  ├── TestBase (tests/test_base.py)     # adds ref_program(), check()
  └── concrete subclasses typically define shape + dtype

# Public benchmark interface (capability protocols)
ShapeDtypeWorkload                      # shape + dtype metadata
InputGeneratingWorkload                 # gen_inputs()
BenchmarkWorkload                       # both (when a workload defines shape, dtype, gen_inputs)
BenchmarkBase[W] (benchmarks/)          # generic over workload type

→ Cross-refs: architecture.md, testing.md