Refactor: carry host callbacks and launch identity per native run

[ChaoWao]

Summary

Make each prepared native run self-contained instead of recovering mutable runner selection from thread-local state.

• Replace ambient runner, slot, bank, identity, and acceptance setters with a per-run HostApi value backed by one complete HostApiOps table.
• Placement-construct one NativeRunContext in caller-owned storage. It owns the copied descriptor, bound HostApi, runtime implementation, launch signal, and compatibility executor through finalize.
• Capture the launch-acceptance sink during prepare and publish it only at the real kernel-launch marker.
• Validate lease generation during admission, then use process-unique run_epoch as the authoritative phase-token identity.
• Preserve the enqueue, poll, and drain lifecycle introduced by Refactor: split device enqueue from completion drain #1683.
• Clear the existing HBG host-access bridge on every exit path so it cannot retain a completed run HostApi pointer.

This removes thread identity from native-run resource selection while preserving Worker-visible execution behavior.

Contract decisions

• simpler_init is unchanged.
• All eight host-runtime DSOs (a2a3/a5 × onboard/sim × HBG/TRB) are rebuilt together and implement the same complete callback contract.
• There is no optional-symbol loading, feature-bit negotiation, descriptor versioning, or runtime ABI negotiation.
• PTO_PIPELINE_CONTRACT_ABI_VERSION remains 1.

Scope

This PR does not add the direct-L2 asynchronous lane or remove the compatibility executor. It also does not perform the later HBG process-global ownership redesign; the HBG change here is limited to making the existing temporary binding lifetime-safe.

Validation

• .venv/bin/pre-commit run --files ...: all hooks passed.
• .venv/bin/python -m pip install --no-build-isolation -e .: rebuilt successfully.
• Focused C++ tests: 4/4 passed (HostApi, launch signal, TRB retained buffer, HBG tensor access).
• Focused Python tests: 31 passed, 4 onboard-marker skips, 189 deselected.
• Direct symbol inspection verified all eight DSOs export the required pipeline symbols and none export the four removed ambient-selection setters.

[coderabbitai]

Warning

Review limit reached

@ChaoWao, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 3 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a89d2932-9ba4-494e-b9e3-09285a43d187

📥 Commits

Reviewing files that changed from the base of the PR and between 06fbd42 and fd8c500.

📒 Files selected for processing (49)

• docs/chip-level-arch.md
• docs/dynamic-linking.md
• python/bindings/task_interface.cpp
• python/simpler/task_interface.py
• python/simpler/worker.py
• src/a2a3/platform/onboard/host/device_runner.cpp
• src/a2a3/platform/onboard/host/device_runner.h
• src/a2a3/platform/sim/host/device_runner.cpp
• src/a2a3/platform/sim/host/device_runner.h
• src/a2a3/runtime/host_build_graph/host/host_tensor_access.cpp
• src/a2a3/runtime/host_build_graph/host/runtime_maker.cpp
• src/a2a3/runtime/host_build_graph/runtime/host_tensor_access.h
• src/a2a3/runtime/host_build_graph/runtime/runtime.h
• src/a2a3/runtime/host_build_graph/runtime/shared/runtime.cpp
• src/a2a3/runtime/tensormap_and_ringbuffer/docs/RUNTIME_LOGIC.md
• src/a2a3/runtime/tensormap_and_ringbuffer/host/runtime_maker.cpp
• src/a5/platform/onboard/host/device_runner.cpp
• src/a5/platform/onboard/host/device_runner.h
• src/a5/platform/sim/host/device_runner.cpp
• src/a5/platform/sim/host/device_runner.h
• src/a5/runtime/host_build_graph/host/host_tensor_access.cpp
• src/a5/runtime/host_build_graph/host/runtime_maker.cpp
• src/a5/runtime/host_build_graph/runtime/host_tensor_access.h
• src/a5/runtime/host_build_graph/runtime/runtime.h
• src/a5/runtime/host_build_graph/runtime/shared/runtime.cpp
• src/a5/runtime/tensormap_and_ringbuffer/docs/RUNTIME_LOGIC.md
• src/a5/runtime/tensormap_and_ringbuffer/host/runtime_maker.cpp
• src/common/platform/include/common/host_api.h
• src/common/platform/onboard/host/c_api_shared.cpp
• src/common/platform/onboard/host/device_runner_base.cpp
• src/common/platform/onboard/host/device_runner_base.h
• src/common/platform/sim/host/c_api_shared.cpp
• src/common/platform/sim/host/device_runner_base.cpp
• src/common/platform/sim/host/device_runner_base.h
• src/common/task_interface/prepare_callable_common.h
• src/common/worker/chip_worker.cpp
• src/common/worker/chip_worker.h
• src/common/worker/native_run_context.h
• src/common/worker/native_run_launch_signal.h
• src/common/worker/pto_runtime_c_api.h
• tests/st/a2a3/host_build_graph/native_run_lifecycle/test_native_run_lifecycle.py
• tests/st/a2a3/tensormap_and_ringbuffer/test_l3_launch_acceptance.py
• tests/ut/cpp/CMakeLists.txt
• tests/ut/cpp/a2a3/test_hbg_tensor_access.cpp
• tests/ut/cpp/common/test_host_api.cpp
• tests/ut/cpp/common/test_native_run_launch_signal.cpp
• tests/ut/cpp/common/test_trb_runtime_temp_buffer.cpp
• tests/ut/py/test_host_runtime_abi.py
• tests/ut/py/test_worker/test_host_worker.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ChaoWao]

CI status — two red checks are self-hosted-runner infra, not this change

Everything that actually executes this change's code is green:

check	result
build (8 DSOs incl. onboard cross-compile)	✅
pre-commit (clang-format / markdownlint / check-headers / check-english-only)	✅
profiling-flags-smoke, packaging-matrix (linux+mac)	✅
ut (linux+mac, no-hw), ut-a2a3 (a2a3 hw unit)	✅
st-sim-a2a3 (linux+mac), st-sim-a5 (linux+mac)	✅
st-onboard-a5 (a5 hardware scene tests)	✅
st-onboard-a2a3	❌ (infra — see below)
ut-a5	❌ (infra — see below)

ut-a5 — persistent a5-runner network failure

Fails at actions download / git fetch with OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to github.com:443 / Failed to resolve action download info … SSL connection could not be established. It dies before checkout, so none of this change's code runs. It reproduced identically across two reruns — a self-hosted a5 runner network problem, independent of this PR.

st-onboard-a2a3 — a2a3-runner / device-state failures

• 1st run: simpler_init → ensure_binaries_loaded → LoadAicpuOp::BootstrapDispatcher: aclrtSynchronizeStream failed: 507018 on dev=8 and dev=11, for every test. That is the dispatcher bootstrap (device bring-up) in load_aicpu_op.cpp / ensure_binaries_loaded — not in this diff (this PR's device_runner_base.cpp hunks are at lines 27–413 and 1504+, leaving the 413–1578 range that contains ensure_binaries_loaded/ensure_device_initialized byte-unchanged) and it references none of what this PR removes (no HostApi/TLS/selection). It's the poisoned/hung-device signature.
• Rerun 1: job cancelled (no log).
• Rerun 2: failure, but the job log is unretrievable (blob 404, no failed step recorded, no 507018/SSL/FAILED tests//assert signature) — i.e. no test assertion fired; consistent with another runner-level/device failure.

The same code path this PR changes is covered green elsewhere: st-onboard-a5 (a5 hardware — same simpler_init + per-run HostApi + launch-acceptance path), st-sim-a2a3 (a2a3 ChipWorker/HostApi/NativeRunDescriptor path on sim), ut-a2a3 (a2a3 hardware units), and build (a2a3 onboard compiles).

Ask: this needs a re-run on a healthy a2a3 device (dev=8/11 were poisoned) and the a5 runner's network looked at. I don't think either red check reflects a defect in this change — if a re-run on healthy runners still fails, please ping me and I'll dig into the device log. (run 30902344820)