Smoke-test the bundle the way Dikte starts it

The CPU run passed -ng, which tells whisper.cpp not to look for a
backend at all, so the claim the bundle rests on, that it starts and
transcribes where Vulkan cannot, was never tested. Dikte passes -ng only
when its GPU setting is off; every other run goes through the backend
registry.

Both runs lose the flag, and a third one is added between them: the
loader installed, nothing behind it. That is a real machine, libvulkan
pulled in by something else with no driver to go with it, and it is the
one whose answer nobody knew.

.github/workflows/whisper-vulkan.yml

@@ -110,6 +110,9 @@ jobs:
       - name: CPU fallback smoke test (no Vulkan loader)
         run: OUT_DIR=dist packaging/whisper-vulkan/smoke-runtime.sh cpu
 
+      - name: Vulkan loader present, no device smoke test
+        run: OUT_DIR=dist packaging/whisper-vulkan/smoke-runtime.sh noicd
+
       - name: Vulkan plugin-load smoke test (Mesa llvmpipe)
         run: OUT_DIR=dist packaging/whisper-vulkan/smoke-runtime.sh vulkan
 

packaging/whisper-vulkan/Dockerfile.runtime-noicd

@@ -0,0 +1,9 @@
+FROM ubuntu@sha256:2edbbc5dc405e9612ba3584ce95480277e3eb374407b5505fe26f17df77c7dbc
+ARG DEBIAN_FRONTEND=noninteractive
+# The loader and nothing behind it: the machine that has libvulkan because
+# something else pulled it in, and no driver to go with it.
+RUN apt-get update \
+ && apt-get install --no-install-recommends -y \
+      ca-certificates curl libstdc++6 libvulkan1 \
+ && rm -rf /var/lib/apt/lists/*
+WORKDIR /bundle

packaging/whisper-vulkan/smoke-runtime.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-mode=${1:?usage: smoke-runtime.sh cpu|vulkan}
+mode=${1:?usage: smoke-runtime.sh cpu|noicd|vulkan}
 : "${OUT_DIR:=work/out}"
 : "${FIXTURE_SOURCE:=vendor/whisper.cpp}"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -10,6 +10,7 @@ FIXTURE_SOURCE="$(realpath "$FIXTURE_SOURCE")"
 asset=whisper-bin-ubuntu-vulkan-x64
 case "$mode" in
   cpu) dockerfile=Dockerfile.runtime-cpu; image=dikte-whisper-runtime-cpu:spike ;;
+  noicd) dockerfile=Dockerfile.runtime-noicd; image=dikte-whisper-runtime-noicd:spike ;;
   vulkan) dockerfile=Dockerfile.runtime-vulkan; image=dikte-whisper-runtime-vulkan:spike ;;
   *) echo "unknown mode: $mode" >&2; exit 2 ;;
 esac
@@ -23,9 +24,10 @@ args=("/bundle/$asset/whisper-server" -m /fixtures/model.bin
       --host 127.0.0.1 --port 8080
       --inference-path /v1/audio/transcriptions -l auto -sns -nlp)
 env_args=()
-if [[ "$mode" == cpu ]]; then
-  args+=(-ng)
-else
+# No -ng anywhere: Dikte passes it only when its GPU setting is off, so the
+# run that has to survive a missing loader or a missing device is this one,
+# where the backend registry actually goes looking for them.
+if [[ "$mode" == vulkan ]]; then
   env_args=(-e LIBGL_ALWAYS_SOFTWARE=1
             -e VK_ICD_FILENAMES=/usr/share/vulkan/icd.d/lvp_icd.x86_64.json)
 fi
@@ -41,6 +43,16 @@ docker run --rm --name "dikte-whisper-$mode-smoke" \
       echo "CPU smoke image unexpectedly has a Vulkan loader" >&2
       exit 1
     fi
+    if [ "$SMOKE_MODE" = noicd ]; then
+      if ! ldconfig -p | grep -q libvulkan.so.1; then
+        echo "no-ICD smoke image has no Vulkan loader to load" >&2
+        exit 1
+      fi
+      if compgen -G "/usr/share/vulkan/icd.d/*.json" >/dev/null; then
+        echo "no-ICD smoke image has a driver after all" >&2
+        exit 1
+      fi
+    fi
     "$@" >/tmp/server.log 2>&1 &
     pid=$!
     trap "kill $pid 2>/dev/null || true" EXIT

tests/test_packaging.py

@@ -39,6 +39,7 @@ class WhisperVulkanPackaging(unittest.TestCase):
                      "Verify reviewed archive digest",
                      "Validate archive and ELF contract",
                      "CPU fallback smoke test (no Vulkan loader)",
+                     "Vulkan loader present, no device smoke test",
                      "Vulkan plugin-load smoke test (Mesa llvmpipe)",
                      "Publish dependency release"):
             self.assertIn(step, workflow)
@@ -71,6 +72,19 @@ class WhisperVulkanPackaging(unittest.TestCase):
                      "tests/test_packaging.py", "README.md", "README.tr.md"):
             self.assertNotIn(f"- {path}", trigger)
 
+    def test_the_smoke_tests_run_what_dikte_runs(self):
+        """-ng is what Dikte passes when its GPU setting is off, and a run
+        with it never asks for a backend at all. The three runs that have to
+        hold are the ones without it: no loader, a loader with nothing behind
+        it, and a working device."""
+        script = (PACKAGING / "smoke-runtime.sh").read_text(encoding="utf-8")
+        code = "\n".join(line for line in script.splitlines()
+                         if not line.lstrip().startswith("#"))
+        self.assertNotIn("-ng", code)
+        for mode in ("cpu)", "noicd)", "vulkan)"):
+            self.assertIn(mode, script)
+        self.assertTrue((PACKAGING / "Dockerfile.runtime-noicd").is_file())
+
     def test_the_validator_checks_tar_links_before_extraction(self):
         validator = (PACKAGING / "validate-package.sh").read_text(
             encoding="utf-8")