phrugsa-limbunlom/deltaflow

Review signals: 38 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. 3 distinct locations. 38 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Every probability path returns the interpolated state x_t and its conditional target velocity u_t (interpolant example prints x_t and u_t and passes boundary checks): Real input produced the expected result: Boundary conditions OK.

  Source: Every path returns the interpolated state $x_t$ and its conditional target velocity $u_t$.

  Input: examples/00-foundations/01-linear-interpolant/main.py

  Expected: x_t and u_t printed for each t, boundary conditions OK

  Command: /tmp/dfvenv/bin/python examples/00-foundations/01-linear-interpolant/main.py

  Observed: Boundary conditions OK.

• The examples tree is a runnable curriculum (linear interpolant example runs): Real input produced the expected result: t=1.00 x_t[0]=[1.5409960746765137, -0.293428897857666]

  Source: The [`examples/`](https://github.com/phrugsa-limbunlom/deltaflow/tree/main/examples) tree is a tiered, runnable curriculum.

  Input: examples/00-foundations/01-linear-interpolant/main.py

  Expected: t=1.00 row printed with x_t endpoint equal to x1

  Command: /tmp/dfvenv/bin/python examples/00-foundations/01-linear-interpolant/main.py

  Observed: t=1.00 x_t[0]=[1.5409960746765137, -0.293428897857666] u_t[0]=[2.260253667831421, 0.109914630651474] Boundary conditions OK.

• Flow matching regresses a velocity field onto the conditional velocity of the path (training example runs and reports loss): Real input produced the expected result: final loss: 4.1941

  Source: Regress a velocity field onto the conditional velocity of a probability path.

  Input: examples/20-training/01-flow-matching/main.py

  Expected: final loss printed

  Command: /tmp/dfvenv/bin/python examples/20-training/01-flow-matching/main.py

  Observed: final loss: 4.1941

• A learned field is integrated with a simple Euler or Heun solver to produce samples: Real input produced the expected result: sample mean: [0.019584309309720993, 0.05306430160999298]

  Source: transporting the whole source density onto the data density with a simple Euler or Heun solver.

  Input: examples/10-sampling/01-euler-flow/main.py

  Expected: sample mean and std printed

  Command: /tmp/dfvenv/bin/python examples/10-sampling/01-euler-flow/main.py

  Observed: sample mean: [0.019584309309720993, 0.05306430160999298] sample std: [1.97209894657135, 0.18536506593227386]

• Posterior sampling for an inverse problem reuses the pretrained field and reports observed-region MSE: Real input produced the expected result: observed-region MSE, independent-coupled model: 0.0633

  Source: posterior sampling for an inverse problem, reusing the very same pretrained field.

  Input: examples/30-inverse/01-posterior/main.py

  Expected: observed-region MSE printed for independent-coupled model

  Command: /tmp/dfvenv/bin/python examples/30-inverse/01-posterior/main.py

  Observed: …observed-region MSE, independent-coupled model: 0.0633 observed-region MSE, OT-coupled model: 0.0710 Note: this toy setup is not tuned; it demonstrates the API wiring, not SOTA quality.

Examples

• Posterior sampling example runs with a pretrained field: command completed successfully

  Source: examples/30-inverse/01-posterior/main.py

  Input: none

  Expected: observed-region MSE printed

  Command: /tmp/dfvenv/bin/python examples/30-inverse/01-posterior/main.py

  Observed: / 100 steps [deltaflow.trainer] step 300 | loss 0.1096 | 2.1s / 100 steps [deltaflow.trainer] step 100 | loss 0.1989 | 2.8s / 100 steps [deltaflow.trainer] step 200 | loss 0.0747 | 2.1s / 100 steps [deltaflow.trainer] step 300 | loss 0.0625 | 2.0s / 100 steps [2/3] Unconditional Euler sampling (sanity check)... [3/3] Posterior sampling under a centre-mask inpainting measurement... observed-region MSE, independent-coupled model: 0.0633 observed-region MSE, OT-coupled model: 0.0710 Note: this toy setup is not tuned; it demonstrates the API wiring, not SOTA quality.

• Development test suite from README Development section passes: command completed successfully

  Source: README.md Development

  Input: pytest

  Expected: tests pass

  Command: /tmp/dfvenv/bin/pytest -q

  Observed: .............................. [ 85%] ............ [100%] =============================== warnings summary =============================== tests/test_trainer.py::test_train_loop_runs_and_checkpoints /tmp/dfvenv/lib/python3.12/site-packages/torch/utils/data/dataloader.py:759: UserWarning: 'pin_memory' argument is set as true but no accelerator is found, then device pinned memory won't be used. super().__init__(loader) -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html 81 passed, 3 skipped, 1 warning in 6.46s

Local or hosted: local

Install DeltaFlow from source per README 'Install' and run the documented Usage/Examples: linear interpolant, Euler sampling, flow-matching training, and posterior sampling examples, plus the README Development pytest suite.

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; python3 --version; cat README.md 2>/dev/null | head -c 7000
ls /inputs 2>&1; echo "CDP=$CDP_URL"; curl -s -m 10 -w '\nHTTP %{http_code}\n' "$CDP_URL/json/version"
cd <guest-path> && grep -n '^#' README.md; grep -n -i 'pip install\|python_requires\|requires-python\|Python 3' README.md | head -30; grep -n requires-python pyproject.toml
cd <guest-path> && sed -n '113,150p;326,345p' README.md
cd <guest-path> && sed -n '/dependencies/,/^\]/p' pyproject.toml | head -40; cat requirements.txt; python3 -m venv --help >/dev/null && echo VENV_OK || (sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y python3.12-venv 2>&1 | tail -3)
cd /tmp && python3 -m venv /tmp/dfvenv && /tmp/dfvenv/bin/pip install -q --upgrade pip 2>&1 | tail -2; cd <guest-path> && timeout 7000 /tmp/dfvenv/bin/pip install --index-url https://download.pytorch.org/whl/cpu torch 2>&1 | tail -3
cd <guest-path> && timeout 7000 /tmp/dfvenv/bin/pip install -e ".[dev]" 2>&1 | tail -4
cd <guest-path> && find examples -maxdepth 2 | head -60; ls tests | head -30
cd <guest-path> && ls examples/00-foundations/01-linear-interpolant examples/10-sampling/01-euler-flow examples/20-training/01-flow-matching; cat examples/20-training/01-flow-matching/README.md 2>/dev/null | head -60
cd <guest-path> && cat examples/00-foundations/01-linear-interpolant/main.py | head -80
cd <guest-path> && /tmp/dfvenv/bin/python examples/00-foundations/01-linear-interpolant/main.py; echo EXIT=$?
ls -la <guest-path> <guest-path> 2>&1; ls <guest-path>; grep -n 'python_api\|python_example\|probe_kind' <guest-path> | head -40
sed -n '1057,1110p' <guest-path>; sed -n '1185,1200p' <guest-path>
sed -n '915,960p' <guest-path>; grep -n 'PYTHON_EXAMPLE_RUNNER\s*=' -A3 <guest-path> | head -8
cd <guest-path> && /tmp/dfvenv/bin/python -c "import deltaflow.interpolants as i, deltaflow.losses as l, deltaflow.samplers as s, deltaflow.solvers as so; print(i.__all__ if hasattr(i,'__all__') else dir(i)); print(getattr(l,'__all__',dir(l))); print(getattr(s,'__all__',dir(s))); print(getattr(so,'__all__',dir(so)))" 2>&1 | head -30; ls deltaflow
cd <guest-path> && ls deltaflow/utils; grep -rn '^def ' deltaflow/utils deltaflow/interpolants deltaflow/losses | head -30; grep -n 'def decode' -A6 <guest-path> | head -12
cd <guest-path> && grep -c '>>>' README.md; grep -n 'api_expectations\s*+=\|api_expectations =\|expectation' <guest-path> | head -12; grep -rn '>>>' examples/*/*/main.py | head -3
cd <guest-path> && time (timeout 900 /tmp/dfvenv/bin/python examples/20-training/01-flow-matching/main.py > /tmp/fm.out 2>&1; echo EXIT=$?); tail -15 /tmp/fm.out
cd <guest-path> && timeout 900 /tmp/dfvenv/bin/python examples/10-sampling/01-euler-flow/main.py; echo EXIT=$?; timeout 900 /tmp/dfvenv/bin/python examples/30-inverse/01-posterior/main.py 2>&1 | tail -5; echo EXIT=$?
cd <guest-path> && grep -ln 'manual_seed' examples/10-sampling/01-euler-flow/main.py examples/20-training/01-flow-matching/main.py examples/30-inverse/01-posterior/main.py; timeout 1800 /tmp/dfvenv/bin/pytest -q 2>&1 | tail -6; echo EXIT=${PIPESTATUS[0]}
cd <guest-path> && grep -rniE 'cron|webhook|--once|--now|scheduler|while True' README.md deltaflow examples --include=*.py --include=*.md | head -10; grep -n 'scripts\|entry-points\|\[project.scripts\]' -A2 pyproject.toml | head; ls -la .coldpass
cd <guest-path> && grep -c 'Every path returns the interpolated state \$x_t\$ and its conditional target velocity \$u_t\$\.' README.md; grep -c 'tree is a tiered, runnable curriculum\.' README.md; grep -c 'Regress a velocity field onto the conditional velocity of a probability path\.' README.md; grep -c 'transporting the whole source density onto the data density with a simple Euler or Heun solver\.' README.md; grep -c 'posterior sampling for an inverse problem, reusing the very same pretrained field\.' README.md
cd <guest-path> && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/tmp/dfvenv/bin/python","examples/10-sampling/01-euler-flow/main.py"],"cwd":"<guest-path>","expected_text":"sample mean: [0.019584309309720993, 0.05306430160999298]"}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"Every probability path returns the interpolated state x_t and its conditional target velocity u_t (interpolant example prints x_t and u_t and passes boundary checks)","source":"Every path returns the interpolated state $x_t$ and its conditional target velocity $u_t$.","input":"examples/00-foundations/01-linear-interpolant/main.py","expected":"x_t and u_t printed for each t, boundary conditions OK","probe_kind":"cli","argv":["/tmp/dfvenv/bin/python","examples/00-foundations/01-linear-interpolant/main.py"],"cwd":"<guest-path>","expected_text":"Boundary conditions OK."},
{"kind":"claim","claim":"The examples tree is a runnable curriculum (linear interpolant example runs)","source":"The [`examples/`](https://github.com/phrugsa-limbunlom/deltaflow/tree/main/examples) tree is a tiered, runnable curriculum.","input":"examples/00-foundations/01-linear-interpolant/main.py","expected":"t=1.00 row printed with x_t endpoint equal to x1","probe_kind":"cli","argv":["/tmp/dfvenv/bin/python","examples/00-foundations/01-linear-interpolant/main.py"],"cwd":"<guest-path>","expected_text":"t=1.00  x_t[0]=[1.5409960746765137, -0.293428897857666]"},
{"kind":"claim","claim":"Flow matching regresses a velocity field onto the conditional velocity of the path (training example runs and reports loss)","source":"Regress a velocity field onto the conditional velocity of a probability path.","input":"examples/20-training/01-flow-matching/main.py","expected":"final loss printed","probe_kind":"cli","argv":["/tmp/dfvenv/bin/python","examples/20-training/01-flow-matching/main.py"],"cwd":"<guest-path>","expected_text":"final loss: 4.1941"},
{"kind":"claim","claim":"A learned field is integrated with a simple Euler or Heun solver to produce samples","source":"transporting the whole source density onto the data density with a simple Euler or Heun solver.","input":"examples/10-sampling/01-euler-flow/main.py","expected":"sample mean and std printed","probe_kind":"cli","argv":["/tmp/dfvenv/bin/python","examples/10-sampling/01-euler-flow/main.py"],"cwd":"<guest-path>","expected_text":"sample mean: [0.019584309309720993, 0.05306430160999298]"},
{"kind":"claim","claim":"Posterior sampling for an inverse problem reuses the pretrained field and reports observed-region MSE","source":"posterior sampling for an inverse problem, reusing the very same pretrained field.","input":"examples/30-inverse/01-posterior/main.py","expected":"observed-region MSE printed for independent-coupled model","probe_kind":"cli","argv":["/tmp/dfvenv/bin/python","examples/30-inverse/01-posterior/main.py"],"cwd":"<guest-path>","expected_text":"observed-region MSE, independent-coupled model: 0.0633"}
]
EOF
/tmp/dfvenv/bin/python -c "import json;json.load(open('.coldpass/claims.json'));json.load(open('.coldpass/probe.json'));print('json ok')"
cd <guest-path> && cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"Posterior sampling example runs with a pretrained field","source":"examples/30-inverse/01-posterior/main.py","input":"none","expected":"observed-region MSE printed","argv":["/tmp/dfvenv/bin/python","examples/30-inverse/01-posterior/main.py"],"cwd":"<guest-path>","env":{},"expected_text":"observed-region MSE, independent-coupled model: 0.0633"},
{"kind":"example","claim":"Development test suite from README Development section passes","source":"README.md Development","input":"pytest","expected":"tests pass","argv":["/tmp/dfvenv/bin/pytest","-q"],"cwd":"<guest-path>","env":{},"expected_text":"81 passed, 3 skipped"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md and package entrypoints. DeltaFlow is a PyTorch library with no CLI, daemon, cron, webhook, or --once/--now scheduler. The only while True found is deltaflow/trainer/loop.py training loop, which is not a product cycle."}
EOF
/tmp/dfvenv/bin/python -c "import json;[json.load(open('.coldpass/'+f)) for f in ('examples.json','cycles.json')];print('ok')"; <env-var>=<guest-path> timeout 3000 /tmp/dfvenv/bin/python -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install DeltaFlow from source per README 'Install' and run the documented Usage/Examples: linear interpolant, Euler sampling, flow-matching training, and posterior sampling examples, plus the README Development pytest suite.","operation_scope":"Python library (torchdeltaflow / deltaflow) on CPU, Python 3.12.3 venv at /tmp/dfvenv, torch 2.14.1+cpu. No server, CLI, browser or credentials required. Shared CDP endpoint was reachable (HTTP 200) but not needed.","steps":["python3 -m venv /tmp/dfvenv","/tmp/dfvenv/bin/pip install torch (CPU wheel from download.pytorch.org)","cd <guest-path> && /tmp/dfvenv/bin/pip install -e \".[dev]\"  (README Install)","/tmp/dfvenv/bin/python examples/00-foundations/01-linear-interpolant/main.py","/tmp/dfvenv/bin/python examples/10-sampling/01-euler-flow/main.py","/tmp/dfvenv/bin/python examples/20-training/01-flow-matching/main.py","/tmp/dfvenv/bin/python examples/30-inverse/01-posterior/main.py","/tmp/dfvenv/bin/pytest -q  (README Development)"],"deviations":["Environment is WSL2-style Linux guest; python3 venv already available so no apt install was needed.","Installed torch from the PyTorch CPU index before the editable install so no CUDA wheels were pulled; the README only says pip install.","README usage snippets reference undefined model/x1 and are not runnable as-is; I ran the repository's runnable example scripts instead.","PyPI 'pip install torchdeltaflow' not run; the from-source 'pip install -e \".[dev]\"' from the README was used.","/inputs/coldpass-preflight.py does not exist in this guest; I ran the checker at <guest-path> with the same --validate --replay arguments.","No scheduler/cycle exists; cycles.json has detected=false.","python_api/python_example claims were not used: README code has no >>> outputs and public functions take tensors that cannot be passed as JSON, so claims are cli probes of the repo's example scripts."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for this operation. Optional: make README usage snippets self-contained (define model and x1) so they can be run as-is."}
EOF
/tmp/dfvenv/bin/python -c "import json;print(json.load(open('.coldpass/report.json'))['outcome'])"; ls -la .coldpass