Polish pass: fix syntax bug, scrub private IP, add tests/CI/packaging

[Peterc3-dev]

Full polish pass on the Python side of unified-ml. No behavior changes to the GPU/HIP/Vulkan paths — only bug fixes, hygiene, tests, and packaging.

What changed

Bug fixes (verified)

• python/unified_ml.py — fixed a hard SyntaxError: time.strftime(%Y-%m-%d %H:%M:%S) was missing the quotes around the format string. The module did not even parse before this. Confirmed it now py_compiles.
• src/gguf_loader.py — close() / __del__ raised AttributeError when __init__ failed early (e.g. missing file), because _mm/_fp were never assigned. Now guarded with getattr. A regression test covers the missing-file path.

Security / path hygiene (verified)

• Removed a private Tailscale IP from NPU_STATUS.md (Host: line) — replaced with a generic node description.
• Removed a developer-specific "musicgen venv" reference in vulkan/benchmark_comparison.py docstring.
• Repo-wide scan confirms no remaining private IPs or hardcoded /home/... paths.

Lint (verified)

• ruff check . passes (was failing: the syntax error plus several F401/F841).
• Removed unused imports (sys, os, json, typing.List, typing.Optional) and unused warmup/timed loop assignments.
• Replaced the try: import torch availability probe with importlib.util.find_spec("torch") (no side-effect import).
• Added [tool.ruff] config to pyproject.toml. Import-sorting (I) deliberately left out to avoid churning untouched import blocks.

Tests (verified — 14 passing)

• New tests/test_gguf_loader.py: builds a minimal valid GGUF v3 file in a tmp dir and round-trips header/metadata/tensor-info parsing, the 32-byte data-section alignment rule, array-metadata parsing, and error paths (bad magic, missing file, missing tensor). Plus bit-exact F32/Q8_0/Q4_0 dequant math against hand-constructed inputs (scalar vs vectorized agreement).
• New tests/test_unified_ml.py: covers the stdlib-only subprocess wrapper — DeviceInfo repr, binary discovery, and error handling on missing binaries (uses fake executables, runs nothing GPU-related).
• No test imports torch / HIP / Vulkan / model weights. Only numpy (a light dep) is used.

Packaging + CI (added)

• requirements.txt — pins numpy (the only always-required runtime dep); torch and kompute documented as optional, install-the-build-that-matches-your-GPU extras.
• pyproject.toml — project metadata, optional-dependency extras, ruff + pytest config.
• .github/workflows/ci.yml — runs ruff check . and pytest -q tests on Python 3.11/3.12, installing only ruff/pytest/numpy. Scoped to the pure-logic tests so it stays green without a GPU or model weights.

Not verified (out of scope / no hardware)

• The HIP kernels (src/*.hip), Vulkan shaders, and the torch/kompute benchmark code paths were not executed — they require ROCm, a GPU, Kompute, and/or model weights that aren't available in this environment. Those files were read and lint-checked but their runtime behavior is unchanged and unexercised.
• No benchmark numbers were run or modified; all figures in the README/NPU_STATUS are pre-existing and untouched.

🤖 Generated with Claude Code

[Peterc3-dev]

Independent verification — verdict: SOLID ✅

Cloned wave5-python (HEAD 640c734) to a clean env, made a fresh venv with only ruff pytest numpy (exactly CI's dep set), and re-ran everything. Self-report (lintClean=true, testsPass=true) confirmed.

Lint — ruff check . → All checks passed! (exit 0) across the whole repo, including the benchmark scripts (ruff is static-only, so torch/kompute absence is irrelevant).

Tests — pytest -q tests → 14 passed, 0 skipped/failed (0.06s). The tests are real, not stubs: synthetic GGUF v3 files built in tmp, bit-exact F32/Q8_0/Q4_0 dequant assertions, scalar-vs-vectorized Q4_0 cross-check, array-metadata parsing, and all four error paths (bad magic, missing file, missing tensor, no binaries). The unified_ml tests use fake executables — nothing GPU-related runs.

CI will be green on a clean GitHub runner. The workflow installs only ruff pytest numpy and scopes pytest to tests/. I confirmed no test imports torch / kompute / HIP (grep clean), so the classic 'CI dies importing torch' failure does not apply here.

Bug fixes verified against master:

• python/unified_ml.py: master genuinely fails py_compile — time.strftime(%Y-%m-%d %H:%M:%S) is an unquoted-format-string SyntaxError. Fixed version compiles clean. The 'module did not even parse' claim is accurate.
• src/gguf_loader.py: __init__ raises FileNotFoundError before _fp/_mm are assigned, so the old close()/__del__ (if self._mm:) would AttributeError on early failure. The getattr guard is correct, and test_missing_file_raises covers it.

Security/path scrub verified: repo-wide grep finds no Tailscale/RFC1918 IPs, no /home/ paths, no secrets. The private IP 100.77.212.27 is gone from NPU_STATUS.md and the 'musicgen venv' reference is gone from vulkan/benchmark_comparison.py. Remaining 'token' hits are all GGUF tokenizer field names — false positives.

No overclaims in the PR body. The 'Not verified' section honestly scopes out HIP/Vulkan/torch runtime paths, which is correct — those need a GPU. The benchmark scripts and shaders were lint-only, as stated.

Minor notes (non-blocking):

• Verified on Python 3.14 locally (CI matrix is 3.11/3.12); ruff/pytest both pass, and nothing in the diff uses version-fragile syntax, so the matrix should hold.
• ruff config omits import-sorting (I) by design — reasonable for a polish pass that avoids churning untouched import blocks.

Clean, honest, and CI-green-able without hardware. Recommend merge.