[ishanvohra2]

Replaces #51. This feature branch starts from 2026-08-11 and targets 2026-08-11. Includes the fixes requested by Gustavo in the previous review.

🎯 What problem does this PR solve?

• FLUX.2-klein 4B spends most of its generation time in denoising on the 16 GiB M4. The measured GGML Metal baseline took 132.36 seconds for four denoiser calls.
• Casting the BF16 checkpoint to FP16 overflows the text MLP gate multiplication in double block 4, producing nonfinite values in later denoising steps.

📝 How does it solve it?

• Adds an optional macOS Core ML denoiser, enabled with -DSD_COREML=ON and selected through SDCPP_FLUX2_COREML_MODEL=/absolute/path/to/model.mlmodelc.
• Keeps residual streams in FP32 while retaining FP16 linear weights through the exporter's --safe-fp16 option. Preserves FP32 timestep and normalization math and adapts RoPE to Core ML's tensor-rank limit.
• Avoids loading a second copy of the denoiser weights into GGML. Checks tensor shapes, types, contiguity, and finite outputs, and reports unsupported inputs or invalid models.
• Adapts the integration to the 2026-08-11 runner, sd::Tensor, and model-manager APIs. Updates benchmark parsing for this branch’s timing and backend logs.
• Adds staged export/compile tooling, denoiser-call capture, numerical comparison, phase benchmarks, and opt-in four-step integration tests.

🧪 How was it tested?

Prior implementation measurements (from #51): the tables below were measured before this port to 2026-08-11; full-model M4 validation of the port remains pending.

Manual validation on Apple M4 with 16 GiB RAM, macOS 15.3.2, FLUX.2-klein 4B, 1024×1024, four Euler steps, CFG 1, prompt a lovely cat, and seed 42. Both paths used flash attention, CPU text encoding, and CPU offloading options. Timings below compare the earlier GGML baseline with the final Core ML v6 run; each is one measured run.

Phase	GGML Metal	Core ML v6	Speedup
Denoiser, four calls	132.356 s	44.06 s	3.00×
Sampling	132.60 s	44.18 s	3.00×
Generation	154.99 s	68.39 s	2.27×

The complete Core ML benchmark command took 147.24 s, including startup/loading and the benchmark wrapper. The reported maximum resident set size was 10.91 GiB. Generation speedup above does not describe total process wall time.

Numerical comparisons use captured GGML inputs and outputs:

Comparison	Normalized RMSE	Mean absolute error	Maximum absolute error
Traced PyTorch, call 1	0.006081 (0.608%)	0.004080	0.179153
FP16 weights / FP32 residuals in PyTorch, call 2	0.012769 (1.277%)	0.007603	0.638916
Compiled Core ML v6, call 2	0.032656 (3.266%)	0.021399	0.745601

The final Core ML image and GGML reference were visually inspected at 1024×1024. Composition, lighting, fur detail, and background closely match, with no obvious corruption. Pixel comparison across the supplied PNGs:

Image metric	Core ML v6 vs. GGML Metal
Mean absolute pixel error, 0–255 scale	0.93
Pixel RMSE, 0–255 scale	1.75

• On the prior branch, the M4 build, trace, conversion, compilation, and full four-step engine generation completed successfully.
• The port builds locally with Core ML + Metal enabled (Release, CLI and server).
• Local Python test discovery: 9 passed, 8 skipped. Model-dependent and hardware-dependent checks require external artifacts; the automated M4 integration suite was not run locally.
• Changed-line C++ formatting and published diff whitespace checks passed.
• The engine translation unit also passes a C++ syntax check with Core ML disabled.

Validation covers this prompt, seed, and fixed shape. The sidecar supports text-to-image without reference latents, LoRA, or skipped layers; changing image dimensions or text length requires a matching export. Core ML is configured to allow all compute units; these results do not establish Neural Engine placement.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	numpy@​2.3.5
	torch@​2.7.0
	coremltools@​9.0
	einops@​0.8.2
	safetensors@​0.8.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Dynamic code execution: pypi cattrs Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/coremltools@9.0 → pypi/cattrs@26.2.1 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/cattrs@26.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	System shell access: pypi coremltools Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/coremltools@9.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/coremltools@9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Dynamic code execution: pypi coremltools Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/coremltools@9.0 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/coremltools@9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	System shell access: pypi einops Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/einops@0.8.2 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/einops@0.8.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Dynamic code execution: pypi einops Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/einops@0.8.2 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/einops@0.8.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	System shell access: pypi filelock Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/torch@2.7.0 → pypi/filelock@4.0.12 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/filelock@4.0.12. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	System shell access: pypi fsspec Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/torch@2.7.0 → pypi/fsspec@2026.9.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/fsspec@2026.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Dynamic code execution: pypi jinja2 Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/torch@2.7.0 → pypi/jinja2@3.1.6 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/jinja2@3.1.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	System shell access: pypi networkx Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/torch@2.7.0 → pypi/networkx@3.7 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/networkx@3.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Dynamic code execution: pypi networkx Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/torch@2.7.0 → pypi/networkx@3.7 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/networkx@3.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	System shell access: pypi numpy Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/numpy@2.3.5 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.3.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Dynamic code execution: pypi numpy Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/numpy@2.3.5 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.3.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	System shell access: pypi packaging Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/coremltools@9.0 → pypi/packaging@26.3 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/packaging@26.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Dynamic code execution: pypi packaging Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/coremltools@9.0 → pypi/packaging@26.3 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/packaging@26.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	System shell access: pypi safetensors Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/safetensors@0.8.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/safetensors@0.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Dynamic code execution: pypi safetensors Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/safetensors@0.8.0 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/safetensors@0.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	System shell access: pypi sympy Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/coremltools@9.0 → pypi/sympy@1.14.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/sympy@1.14.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Dynamic code execution: pypi sympy Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/coremltools@9.0 → pypi/sympy@1.14.0 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/sympy@1.14.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	System shell access: pypi torch Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/torch@2.7.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/torch@2.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Dynamic code execution: pypi torch Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/torch@2.7.0 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/torch@2.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	System shell access: pypi tqdm Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/coremltools@9.0 → pypi/tqdm@4.70.1 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/tqdm@4.70.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Dynamic code execution: pypi tqdm Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/coremltools@9.0 → pypi/tqdm@4.70.1 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/tqdm@4.70.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Dynamic code execution: pypi pyyaml Location: Package overview From: script/requirements-flux2-coreml.txt → pypi/coremltools@9.0 → pypi/pyyaml@6.0.3 ℹ Read more on: This package | This alert | What is dynamic code execution? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Avoid packages that use dynamic code execution like eval(), since this could potentially execute any code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/pyyaml@6.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[github-actions]

Review Status

Current Status: ❌ PENDING
Approvals so far: none

Pending reviews: Needs 1 Management or Team Lead, and 1 more from Management, Team Lead, or Member.