zeekayandHanzo Dev
c03b78648a
ns kubeflow runs ghcr.io/kubeflow/* images — upstream, and on :latest — even though this fork exists and carries our commits. It runs them because nothing here ever published an alternative: the repo has upstream .github/workflows (which do not run on our estate) and no .hanzo lane at all, so there was no hanzo image to point at. Builds exactly the images the cluster consumes, no more. Building artifacts nothing deploys is how a pipeline rots unnoticed. ⚠️ The hanzo-ml ORG HAS NO ACTIONS SECRETS — hanzoai carries GHCR_USER, GHCR_TOKEN, GH_PAT, OCI_*, KMS_*; hanzo-ml carries none. So this BUILDS unconditionally (which proves the fork still compiles — the thing most worth knowing) and PUSHES only when a token is present, emitting a ::warning:: when it is not. Until the org gets credentials the run is honestly green with "built but not published" in the log, rather than the cluster silently serving upstream forever. To finish: give hanzo-ml GHCR_USER/GHCR_TOKEN (KMS-sourced, per policy), then repoint the ns kubeflow deployments at ghcr.io/hanzoai/<image>:sha-<sha7>. Also note the repo is a PULL MIRROR on the forge, so Actions were off entirely (has_actions=false); enabled now, and the sync interval cut 8h -> 10m so a push is picked up in minutes. Co-authored-by: Hanzo Dev <[email protected]>
Sweep (HPO/AutoML)
Hyperparameter tuning, AutoML, early stopping, neural architecture search.
A brand-neutral fork in the hanzo-ml
organization — the open-source ML lifecycle estate. Branding is
consumed at runtime from a brand package via the
@<org>/brand contract; the same code deploys under
any white-label brand with zero source changes.
Brand package
This fork imports brand configuration from a runtime brand package
following the contract used across the open-source ML estate. Set
BRAND_PACKAGE to the npm package name; the fork's frontend (where
applicable) calls loadBrand() at boot to hydrate the singleton from
that package's brand.json.
Available brand packages:
| Package | Brand |
|---|---|
@hanzo/brand |
default / Hanzo AI |
@luxfi/brand |
Lux Finance |
@zooai/brand |
Zoo Labs |
@osage/brand |
Osage |
@parsdao/brand |
Pars DAO |
@cyrusdao/brand |
Cyrus DAO |
@migaprotocol/brand |
Miga Protocol |
@vccross/brand |
VC Cross |
@mlc/brand |
MLC |
@zenlm/brand |
Zen LM |
Or any custom reseller package conforming to the same schema.
Multi-tenant via IAM
Every request carries a JWT. The brand package's iam block specifies:
issuer— JWT issuer URLjwksUrl— JWKS endpointtenantClaim— JWT claim with the org/tenant ID (defaultorg_id)tenantHeader— HTTP header that propagates the validated tenant ID (defaultX-Org-Id)
The tenant ID scopes all storage, queries, and resource ownership. Cross-tenant access is forbidden by default.
Quick start (reseller deployment)
export BRAND_PACKAGE="@<your-org>/brand" # e.g. @luxfi/brand
The frontend (this fork's case: pipelines ships the React DAG UI;
the other 7 are read-only reference forks) loads the brand at boot.
The backend reads the brand package's iam block for JWKS + tenant
configuration.
Role
Read-only reference for the Rust operator's Sweep CRD reconciler.
The canonical control plane for the ML lifecycle estate is the Rust
operator at hanzoai/operator.
See HIP-0109
for the lifecycle CRD set.
Upstream sync
This fork stays current with upstream via the GitHub merge-upstream API. No upstream code is modified in this fork; only the 5 markdown files at root are added.
gh api -X POST /repos/hanzo-ml/katib/merge-upstream \
-f branch=master
See UPSTREAM_README.md for the original project documentation.
License
Apache-2.0. See NOTICE for attribution.
See also
- DESIGN.md — design system reference (mirrors the brand package's design spec)
- BRAND.md — brand package contract and reseller guide
- MULTI_TENANT.md — tenant isolation contract
- HANZO_CHANGES.md — divergence from upstream
- HIP-0109 Hanzo ML Cloud Toolkit