commit 3dcadfed6620bb769ad4c3ce2cc7f2de6cb46d32
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Aug 16 10:20:06 2026 -0300

fix(sci-ml/{sherpa-onnx-1.13.5-r1, llama-swap-250-r1}): strip build paths from binaries

Both packages baked the portage sandbox path into what they install: 113
occurrences in sherpa-onnx, 305 in llama-swap. In sherpa-onnx it was not merely
debug metadata -- upstream uses __FILE__ in its message macros, so
`sherpa-onnx --help` opened by printing
/var/tmp/portage/sci-ml/sherpa-onnx-1.13.5/work/.../parse-options.cc:415
straight at the user.

sherpa-onnx: append -ffile-prefix-map over $, not $ -- the vendored
dependencies configure under $_build/_deps and leak their own paths, so
remapping the source tree alone would have cleared about half of them.
-ffile-prefix-map rather than -fdebug-prefix-map because the latter leaves the
user-visible strings untouched, and those are the ones that matter here. The
target path follows Gentoo's split-debug convention so a debugger still
resolves sources under FEATURES=splitdebug.

llama-swap: -trimpath on go build.

Verified rather than assumed:
- the mechanism, on gcc 16.2.0: a test file's __FILE__ is rewritten and the
original path disappears from the compiled binary
- llama-swap rebuilt with the flag: 305 occurrences -> 0, and it still runs
- sherpa-onnx configure: -ffile-prefix-map lands in CMAKE_CXX_FLAGS and
CMAKE_C_FLAGS. Its full rebuild costs hours and is left to the gate, so
113 -> 0 is expected but NOT yet observed. Do not record it as proven
until the gate says so.

Revbumped because the installed binary changes; without it, anyone who already
merged these keeps the leaking build forever. Both gates must be re-run.

This is an improvement on ::gentoo's baseline rather than a rule being
enforced: docker ships 1327 such paths and podman 2759.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit 06a03d69edb17f05008b3bdf89763c4ce7714be6
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Aug 16 07:17:00 2026 -0300

fix(sci-ml/llama-swap-250): survey LICENSE instead of inheriting trivy's list

The LICENSE set was copied from dev-util/trivy without checking, on the
assumption that one Go package's vendored license set resembles another's. It
does not: the list carried MPL-2.0, and no module vendored here is under it.

Surveyed properly by running `go mod vendor` at v250 and classifying all 85
license files across the 80 vendored modules: 50 MIT, 15 BSD-2, 12 Apache-2.0,
6 BSD (3-clause), 1 ISC. The single unclassified file,
modernc.org/memory/LICENSE-LOGO, is a Wikimedia URL for a logo rather than a
code license; that module ships its real LICENSE separately.

This matters more than a tidy-up: Go links statically, so every one of these
licenses ships inside the installed binary, and a wrong set misstates what the
user is actually receiving. The procedure is recorded in the ebuild so the
survey is re-run at each bump rather than the list being carried forward.

All five licenses exist in ::gentoo/licenses. pkgcheck unchanged: the only
findings remain the amd64/x32 nodejs profile artifact and UnknownRestrict on
network-sandbox, neither of which this ebuild can fix.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

commit 494447b3a9e9c2b9a276dfcfc7f8346b92fa186d
Author: lucascouts <lucascs@protonmail.com>
Date: Sun Aug 16 07:14:48 2026 -0300

add(sci-ml/{koboldcpp-1.118.1, sherpa-onnx-1.13.5, llama-swap-250}), mod(.autoupdate/packages.toml)

Story 003 Tasks 1, 3 and 4. NOT MERGED ANYWHERE: authoring and pkgcheck only.
No emerge has been run against any of the three, which is why this sits on a
branch instead of master. Story 002 recorded what skipping that gate costs --
six defects shipped, two of them invisible to pkgcheck until resolution was
attempted. The gate commands are in each task in .epic/stories/003-*/tasks.md.

koboldcpp -- adapted from istitov/stuff sci-misc/koboldcpp.
LLAMA_PORTABLE=1 keeps the Makefile off -march=native; cpu_flags_x86_* wired
to its three tiers via LLAMA_NOAVX1/LLAMA_NOAVX2. cuda and rocm each get
their own emake run: a single invocation defines ggml-cuda.o twice and the
HIP recipes silently override the CUDA ones, so USE="cuda rocm" would have
produced a "cuBLAS" library built by hipcc. GPU_TARGETS is set explicitly
because upstream's default appends $(shell amdgpu-arch), sizing the package
by the build host's GPU. Five prebuilt blobs beyond the documented glslc
pair are removed. pkgcheck: zero findings.

sherpa-onnx -- adapted from istitov/stuff, links sci-libs/onnxruntime rather
than bundling. 17 distfiles pre-staged so CMake FetchContent resolves
locally; the .zip pins stay .zip because the cmake modules match those
filenames literally and fall through to the network otherwise (verified in
the 1.13.5 sources; pkgcheck's TarballAvailable is a false positive here and
says so inline). Dropped QA_PREBUILT, which claimed to cover prebuilt
libraries that this ebuild in fact compiles. Fixed a doubled Prefix in the
site-packages relocation: python_get_sitedir already carries EPREFIX and was
being passed to dodir and concatenated with ED. No -bin, deliberately.

llama-swap -- SRC_URI is now solely the upstream tarball; the adopted ebuild
took even the main source from a third party's personal account. Adds
-tags embed_ui, without which USE=ui ran the whole npm build and shipped a
binary with no UI. The systemd unit could never have worked: it used %i and
User=%i but installed as llama-swap.service, and systemd only expands %i for
a name containing '@' -- now installed via systemd_newunit as
llama-swap@.service, with the EnvironmentFile it expects shipped as an
example. Keeps ~arm64, unlike the ggml family: this is pure Go with no cgo
and no arch-specific path, and upstream builds linux-arm64 itself.

Uses ego mod download under RESTRICT="network-sandbox", matching
dev-util/trivy and dev-util/act. This is a KNOWING divergence from story 003
R4.1, which asked for a sandbox-clean default: upstream ships no vendor/
directory, so the alternative commits the overlay to hosting a generated
tarball on distfiles.obentoo.org and to hold = true forever after. The
alternative implementation is preserved and documented; the choice between
them should be made once, for this package and sci-ml/localai together.

All three records download-validate against upstream and pass the bentoo
checker. KEYWORDS is ~amd64 for the two C++ packages, consistent with the
decision taken across the ggml family: an unvalidated keyword is worse than
none.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>