AR to diffusion conversion

architecture.json declares openbmb/MiniCPM5-2B at the pinned revision 12a3808a…. The trajectory shows the supplied checkpoint was copied from /artifacts/minicpm5-2b/model-00000-of-00001.safetensors to the remote base/ directory (trajectory#17-30 chunk) and hashed into evidence/base_sha256.txt. The real training run then started with `train_diffusion.py --base base/model-00000-of-00001.safetensors` (trajectory chunk steps-55-65), and train_diffusion.py requires --base and loads it through load_model. Lineage: masked denoising from the base gave checkpoints/step-2000; that fed the policy parent; layer pruning (evidence/pruning_initialization.json: 42→28 layers) produced pruned/initial; a further 3000 steps gave the shipped 28-layer model. The weight inventory of model/diffusion.safetensors (packed qkv/gate_up, vocab 130560, hidden 2048, 28 layers) is consistent with a pruned MiniCPM5-2B descendant. No other base model was downloaded: there are no snapshot_download calls and no other model sources in the trajectory.

The only declared corpus for training, distillation, pruning calibration and selection checks is openbmb/UltraData-SFT-2605 at the pinned revision (architecture.json, evidence/data_manifest.json), fetched by prepare_data.py with hf_hub_download. prepare_data.py also filters out benchmark-like sources and prompts (the gsm8k/mmlu/humaneval/… regex). Selection checks are built by build_training_checks.py from reserved rows (row%97) of that same SFT corpus, and diagnostic prompts are original synthetic text (evidence/synthetic_prompts.json). Searching the trajectory found no load_dataset or benchmark downloads: the gsm8k hits are only the exclusion regex. The 'public validation' run mentioned at the end of the session came after the model and settings were frozen and was not used for training. I did not find the dataset download log in the trajectory, so that is unverified, but the source is declared and public.

engine.py generates block by block with block_size=2. Each block starts with its non-anchor positions set to MASK (130559) and runs up to ceil(block/min_commit) bidirectional denoising passes. The Triton commit kernel in kernels.py fills masked positions in order of confidence rank (threshold 1.01, min_commit 1, settings from inference_config.json). The engine asserts that no MASK remains before the block is causally encoded into the clean-prefix cache. evidence/final_denoising_trace.json shows commits that are not left-to-right (a later position filled first). There is no autoregressive sampling path in server.py or engine.py.

serve.sh installs the vendored wheels offline and runs `exec python server.py`. server.py builds DiffusionEngine(ROOT, **inference_config.json), and engine.py loads `model/diffusion.safetensors` with diffusion_model.load_model. That file is the inventoried 28-layer BF16 checkpoint. The trajectory shows the final candidate (fallback28, pruned/step-3000) being placed at model/diffusion.safetensors with a 28-layer assertion. Frozen inference-file hashes were then checked against evidence/final_selection.json, and the final cold-start HTTP probe was served through the same serve.sh path.

I searched the trajectory for API_KEY, BASE_URL, OPENROUTER, `claude `, `codex exec` and uploads. The only matches for API keys and base URLs are in Spin documentation text. Remote compute and transfers used the Spin CLI and Spin S3, which is allowed. HF_TOKEN was used only for read downloads, plus a secret-scan script that checks the output folder does not contain the token. I found no use of harness model API keys or base URLs, no copying or echoing of them, no HF uploads, and no other harness CLIs launched as workers.