[sebcrozet]

Spec concern

Task: — (engine maintenance; follow-up to ADR-67 / ADR-68) / SPEC 020, SPEC 030 (engine realization, unchanged contract)

Moves the optional Nexus and rapier engines from source-built wheels to the published PyPI releases, locked in uv.lock, and turns on Nexus's same-machine determinism.

• Engines from PyPI, inside the lock (ADR-70). dimforge-nexus3d==0.2.1 and rapier3d==0.36.1 join the sim extra, limited to the platforms with Nexus wheels (macOS arm64, Linux x86_64/aarch64, Windows x64). uv sync --extra sim installs them; no separate install step.
• Source-build machinery removed: engine-runtime.json, tools/engine_sources.py, tools/nexus_runtime.py, tools/rapier_runtime.py and their build receipts.
• Attestation: tools/env_hash.py --sim-engine keeps the engine digest but no longer reads or requires a build receipt; the lock and the dist attestation identify the engine wheels, as for Genesis. Nexus/rapier runs are now attested (env_attested: true). Every engine's sim_engine_hash value changes, Genesis included, because the receipt is no longer hashed in.
• Backends: Nexus uses native Metal on macOS and WebGPU elsewhere, selected through the new NexusViewer.with_backend(name). A backend the wheel lacks (e.g. cuda) fails at the first scene build with the wheel's own error.
• Determinism: nexus_physics.toml sets deterministic = true. Same seed and commands replay bit for bit on one machine, wheel and backend; a Metal run is not expected to match a WebGPU run.

Results, S1 seed 1, all success, all attested:

Engine (backend)	Episode end (sim time)	Steady tick	Steady rtf
Genesis (Metal)	99.43 s	14.6 ms	0.69×
Nexus 0.2.1 (Metal)	99.50 s	6.3 ms	1.58×
rapier (CPU)	99.53 s	1.9 ms	5.3×

Two Nexus S1 runs produced bit-identical traces (2988 oracle_state, 9955 joint_state, 4977 base_pose messages).

Requirement IDs implemented or affected

• CON-5: Nexus deterministic mode; tests/sim/test_nexus_scene.py::test_stepping_is_reproducible
• HAR-2 / ADR-24: env gate and dist attestation now cover the locked engine wheels; tests/unit/test_env_hash.py, tests/unit/test_rollout_engine_attestation.py
• BRG-4 / TC-6: test_zeroing_velocities_brings_the_arm_to_rest now also passes on WebGPU (fixed in nexus 0.2.1)
• SCN-2: the determinism switch lives in nexus_physics.toml

Gates run

• /review on the first commit; /simplify not run (small diffs, reviewed by hand)
• ruff format --check && ruff check
• pytest -m unit (+ tests/sim/test_nexus_scene.py, tests/sim/test_rapier_scene.py: 54 passed, 1 pre-existing xfail; S1 accept run on all three engines)
• trace_check, docs_inventory --check, claim_evidence --check
• review follow-up (CON-16): successor registrations bnd v16, cse v28, pilot v14; treatment table regenerated; extras contract test covers ADR-70's sim-only engines

Campaign registrations

BND v16, CSE v28 and pilot v14 supersede v15, v27 and pilot v13: the lock (and for CSE also pyproject.toml, rollout.py and the treatment table) moved with ADR-70. Seed commitments are inherited unverified and every pending gate is preserved; FLT v7 does not bind the lock and stays current.

ADRs added (if any)

• ADR-70: engine wheels from PyPI inside the lock (amends ADR-67 and ADR-68)

Note: this edits tools/env_hash.py, so trusted runs refuse on this branch until it merges; land it as an env-change PR, not mid-campaign.

[teleworksai]

Review of head 472c5dabb87e2de6ea08ff8c580c1639afa28bd2 (CON-16 cross-review; no branch edits).

1. [P2] Supersede the campaign registrations affected by the dependency change — uv.lock:230–234. Changing the lock without successor registrations leaves bnd-task-band-calibration-v15, cse-causal-study-pilot-v13, and cse-causal-study-v27 failing check_manifest(..., require_seed_sources=False). The two CSE registrations also drift on pyproject.toml and src/aisle/harness/rollout.py. These checks pass on base 24c35a0, so the dependency update invalidates the current registrations and fails test_committed_registrations_check_clean_with_withheld_seeds on both CI platforms. Follow analysis/freeze/README.md: retain the existing records and add properly linked successors with their pending gates preserved, including any further artifact changes needed below.

2. [P2] Regenerate the treatment table after changing its hashed rollout source — src/aisle/harness/rollout.py:768–771. Even these comment changes alter a source artifact hashed by the monolithic treatment table. table_report(root, write=False) now reports both docs/monolithic/treatment-table.md and analysis/monolithic-control/treatment-table-v1.json stale; both are clean on the base commit. Regenerate via harness monolith table --write and account for the regenerated records in the successor registrations. Otherwise MON-1/MON-14 evidence is stale and test_treatment_table_is_complete_and_rendered fails.

3. [P2] Update the extras contract test for ADR-70's intentional asymmetry — pyproject.toml:65–66. ADR-70 explicitly keeps the published engines out of the CUDA extra, but test_sim_and_cuda_extras_route_linux_torch_to_disjoint_indexes still asserts exact equality of the two dependency sets. It now fails deterministically on both CI platforms. Update that assertion to cover the common simulation stack and separately pin the intended engine-only difference, while retaining the CPU/CUDA torch-index checks; also align the adjacent “same sim stack” comment. This preserves the stated design without leaving the required unit gate red.

Validation: focused unit run covering env hashing, engine attestation/selection, bootstrap, and the two integrity checks: 62 passed, 3 failed (the same three failures as macOS/Linux CI). Base-commit checks confirm all three regressions. Ruff formatting and lint pass. GPU simulation/acceptance tests and the full unit suite were not rerun locally; the full CI jobs already report these failures. Head SHA rechecked before posting.