feat(hp): cloud-only enforcement + cloud iters/frames reach the Run Inspector

[Rchari1]

Six commits, one thread: make the paid tier actually run in the cloud, and make what it produces actually reach the Run Inspector. 18 files, +673/−116.

---

1. Piccolissimo + Altissimo is cloud-only, and now enforced

Selecting the HP tier was supposed to mean "runs in Harmoniqs Cloud." In practice the agent kept dispatching it locally, where the laptop precompiled the whole HP stack (IPOPT included) until amico-run's process-group timeout SIGTERMed julia mid-precompile.

The API-key prompt and entitlement flip were already built and work (amicode#200/#167) — untouched here. Three other things allowed local dispatch:

1. Nothing refused a local HP launch. The tier="hpc" gate is solid but only fires on a spec that saystier="hpc", and runGate only runs for --spec launches. A bare amico-run script.jl never reached it.
2. The entitlement that unlocks the tier unlocked the failure — HP grants issimo, so the import scan admitted a local using Piccolissimo.
3. The agent got contradictory orders — solverModeSection() said "launch in the cloud" while the routing section beside it said "routing is PER-SOLVE and EXPLICIT, default to local." Given a cloud-only tier and an instruction to default local, it defaulted local.

Fix, in the two-layer shape the tier already uses:

• Enforcement — launch.ts refuses --executor local while HP is selected, at the one choke point every run passes through, before the gate, so it covers spec and no-spec runs alike. Reads solver mode as status only, never a token, and fails safe to piccolo on a missing or corrupt file: this value can only ever refuse a run, so a bad read must never invent hp and block ordinary free-tier work.
• Guidance — the routing section states the cloud-only contract instead of asking a routing question, and AGENTS.md step 5 makes the injected section authoritative over its local default. Piccolo sessions stay byte-identical (the section is still "" unless mode is hpand the cloud is connected).

The estimate keeps its reporting role and loses its deciding role: an estimate that fits in local RAM does not make an HP solve local.

Service is named Harmoniqs Cloud in every user-visible string. Wire id stays company-compute — renaming breaks the credential route, status cache, and CONNECTION_IDS for no visible gain.

---

2. Cloud iters and frames reach the Run Inspector

The client chain was fully built — poll the cloud, synthesize AMICODE_ITER into run.log, write frames, touch mtime for the stall logic. It read the wrong fields:

	client read	service returns
stats	body.iters	{task_id, **stats**[], submitter}
frames	png_base64	{task_id, iter, key, **url**, submitter}

Both reads sit in best-effort try/catch ("stats are advisory"), so it failed silently — undefined ?? [] iterated zero times and run.log stayed 0 bytes. Confirmed on task 419a57e6: 60 IPOPT iterations and 11 frames banked to S3, empty inspector.

Why nobody caught it:fake_cloud.ts served the shapes the client read, not the shapes the service returns. Every test passed against a fake that agreed with the bug. So the fake is corrected first, and two tests pin the live payloads by exact key set — including that the presigned URL is fetchable with no auth header, because the signature is the credential.

Frame filenames also went 3-digit → 5-digit: iter_00007.png is what both the S3 layout and the local julia solve write. The old name matched neither, so cloud and local frames landed under two schemes in one run dir.

A third drift, found while proving the above: the poller only json.loads an AMICODE_ITER payload starting with {, so template-emitted key=value lines come back as {raw: "iter=7 f=…"}. The client keyed on it.iter and skipped every one as NaN — invisible because the smoke test seeds JSON. Now reconstructs from either shape and drops malformed records rather than emitting NaN.

---

3. The cloud can finally populate /stats

/solves/<id>/stats parses AMICODE_ITER out of run.log in the artifact prefix, and the runner's sidecar populates that prefix with aws s3 sync . — whatever is in the solve cwd. But julia's stdout on the runner goes to the SSM command stream, so run.log was never written there: nothing to sync, stats: [], empty inspector. The template's own comment ("AMICODE_PULSE lines on stdout (→ run.log)") was true locally and false in the cloud.

Telemetry now routes through emit(), which also appends to run.log — only when TASK_ID is set (the runner exports it). Locally amico-run's executor already writes run.log from stdout, so appending unconditionally would double every line and the inspector would count each iteration twice.

No terraform change and no AMI rebake: the solve script is uploaded per submission (<task_id>-solve.jl), so this ships immediately.

---

4. Altissimo streams like IPOPT

Both channels were bolted to IPOPT — frames off IpoptOptions.intermediate_callback, the iter line off a callback reading IpoptOptimizerState. Altissimo has neither; its only hook is callback on optimize!, arriving as (x, info). So an Altissimo solve lost the frames too, leaving the inspector completely dark rather than merely numberless.

SOLVER = :ipopt | :altissimo re-hangs both channels. xis the primal, so pulse_emit's solver-agnostic (primal, iter) contract takes it unchanged — same frames, same AMICODE_PULSE, same cooperative STOP (returning false stops an Altissimo solve exactly as it stops an Ipopt one). inf_pr/inf_du come from the callback tuple when present (Altissimo#414, merged) and are otherwise derived from eq_viol/ineq_viol/kkt_error, so it works on an older Altissimo instead of emitting NaN.

Two traps verified against Piccolissimo main and handled:

• the qcp-level solve! forwards kwargs... to the prob-level method, which takes callback explicitly — so the wiring does reach optimize!;
• but max_iter lands in that kwargs... and is silently dropped, so the budget now rides AltissimoOptions(max_outer_iter = max_iter). Left alone it would have quietly run Altissimo's default 20 outer iterations while the FILL-IN block said 60.

The guidance names SOLVER = :altissimo as the one-line switch and forbids hand-rolling the solve call, stating each trap so the instruction carries its own justification.

---

Testing

• amico-run: 938 passed, 12 skipped.
• extension: 778 passed, 3 skipped (the full CI set, --exclude '**/slow/**').
• tsc --noEmit clean in both packages.
• Live, against the real staging service: frames fetched from a presigned URL and landed locally with 5-digit names (task 0fccbbf9); template runs green end to end (fidelity 0.99997, 60 iterations); local run writes norun.log (no duplication), and with TASK_ID set run.log appears with iter lines in exactly the format the poller parses.
• One incidental fix that matters for CI: the CLI tests were inheriting the developer's~/.amico/amicode/solver-mode.json. On an hp machine nine local-solve tests failed — on correct behaviour. They now spawn with a hermetic ops dir.

CI caught the one consumer I missed on the frame rename (the Δ9 remote state-machine test); the assertion above it — run.log contains iter=7 — passed, which is independent confirmation in a second harness that the stats fix delivers iters end to end.

---

What this does NOT fix

• Altissimo on the cloud. The runner AMI bakes a Piccolissimo/Altissimo predating callback support, so it emits nothing there until Altissimo#414 is released and the image rebuilt. The template is ready for that moment.
• The Altissimo code path has never been executed. It is written against the verified contract and parses, but the local checkouts here are 287/324 commits behind and cannot run it. Worth exercising on a current env before anyone demos it.
• Cold start. ~9–10 min from submit to first frame, for ~55s of compute. Real, and unaddressed here.
• Existing agent-authored scripts in ~/.amico/problems/ predate emit(), so they still show frames and no numbers until re-authored from the updated template.

solverModeSection is exported to make the guidance testable (matching its already-exported sibling routingSection). The same one-line export is on #225 — identical change, so either merge order is fine.

Reviewer note

This narrows behaviour: a local Piccolissimo run that "worked" before — slowly, usually fatally — is now refused outright. That is the intent of a cloud-only paid tier, but it is a real change for anyone relying on the local path, and the way out is one click on the solver control.

[Rchari1]

Six commits, one thread: make the paid tier actually run in the cloud, and make what it produces actually reach the Run Inspector. 18 files, +673/−116.

---

1. Piccolissimo + Altissimo is cloud-only, and now enforced

Selecting the HP tier was supposed to mean "runs in Harmoniqs Cloud." In practice the agent kept dispatching it locally, where the laptop precompiled the whole HP stack (IPOPT included) until amico-run's process-group timeout SIGTERMed julia mid-precompile.

The API-key prompt and entitlement flip were already built and work (amicode#200/#167) — untouched here. Three other things allowed local dispatch:

1. Nothing refused a local HP launch. The tier="hpc" gate is solid but only fires on a spec that saystier="hpc", and runGate only runs for --spec launches. A bare amico-run script.jl never reached it.
2. The entitlement that unlocks the tier unlocked the failure — HP grants issimo, so the import scan admitted a local using Piccolissimo.
3. The agent got contradictory orders — solverModeSection() said "launch in the cloud" while the routing section beside it said "routing is PER-SOLVE and EXPLICIT, default to local." Given a cloud-only tier and an instruction to default local, it defaulted local.

Fix, in the two-layer shape the tier already uses:

• Enforcement — launch.ts refuses --executor local while HP is selected, at the one choke point every run passes through, before the gate, so it covers spec and no-spec runs alike. Reads solver mode as status only, never a token, and fails safe to piccolo on a missing or corrupt file: this value can only ever refuse a run, so a bad read must never invent hp and block ordinary free-tier work.
• Guidance — the routing section states the cloud-only contract instead of asking a routing question, and AGENTS.md step 5 makes the injected section authoritative over its local default. Piccolo sessions stay byte-identical (the section is still "" unless mode is hpand the cloud is connected).

The estimate keeps its reporting role and loses its deciding role: an estimate that fits in local RAM does not make an HP solve local.

Service is named Harmoniqs Cloud in every user-visible string. Wire id stays company-compute — renaming breaks the credential route, status cache, and CONNECTION_IDS for no visible gain.

---

2. Cloud iters and frames reach the Run Inspector

The client chain was fully built — poll the cloud, synthesize AMICODE_ITER into run.log, write frames, touch mtime for the stall logic. It read the wrong fields:

	client read	service returns
stats	body.iters	{task_id, **stats**[], submitter}
frames	png_base64	{task_id, iter, key, **url**, submitter}

Both reads sit in best-effort try/catch ("stats are advisory"), so it failed silently — undefined ?? [] iterated zero times and run.log stayed 0 bytes. Confirmed on task 419a57e6: 60 IPOPT iterations and 11 frames banked to S3, empty inspector.

Why nobody caught it:fake_cloud.ts served the shapes the client read, not the shapes the service returns. Every test passed against a fake that agreed with the bug. So the fake is corrected first, and two tests pin the live payloads by exact key set — including that the presigned URL is fetchable with no auth header, because the signature is the credential.

Frame filenames also went 3-digit → 5-digit: iter_00007.png is what both the S3 layout and the local julia solve write. The old name matched neither, so cloud and local frames landed under two schemes in one run dir.

A third drift, found while proving the above: the poller only json.loads an AMICODE_ITER payload starting with {, so template-emitted key=value lines come back as {raw: "iter=7 f=…"}. The client keyed on it.iter and skipped every one as NaN — invisible because the smoke test seeds JSON. Now reconstructs from either shape and drops malformed records rather than emitting NaN.

---

3. The cloud can finally populate /stats

/solves/<id>/stats parses AMICODE_ITER out of run.log in the artifact prefix, and the runner's sidecar populates that prefix with aws s3 sync . — whatever is in the solve cwd. But julia's stdout on the runner goes to the SSM command stream, so run.log was never written there: nothing to sync, stats: [], empty inspector. The template's own comment ("AMICODE_PULSE lines on stdout (→ run.log)") was true locally and false in the cloud.

Telemetry now routes through emit(), which also appends to run.log — only when TASK_ID is set (the runner exports it). Locally amico-run's executor already writes run.log from stdout, so appending unconditionally would double every line and the inspector would count each iteration twice.

No terraform change and no AMI rebake: the solve script is uploaded per submission (<task_id>-solve.jl), so this ships immediately.

---

4. Altissimo streams like IPOPT

Both channels were bolted to IPOPT — frames off IpoptOptions.intermediate_callback, the iter line off a callback reading IpoptOptimizerState. Altissimo has neither; its only hook is callback on optimize!, arriving as (x, info). So an Altissimo solve lost the frames too, leaving the inspector completely dark rather than merely numberless.

SOLVER = :ipopt | :altissimo re-hangs both channels. xis the primal, so pulse_emit's solver-agnostic (primal, iter) contract takes it unchanged — same frames, same AMICODE_PULSE, same cooperative STOP (returning false stops an Altissimo solve exactly as it stops an Ipopt one). inf_pr/inf_du come from the callback tuple when present (Altissimo#414, merged) and are otherwise derived from eq_viol/ineq_viol/kkt_error, so it works on an older Altissimo instead of emitting NaN.

Two traps verified against Piccolissimo main and handled:

• the qcp-level solve! forwards kwargs... to the prob-level method, which takes callback explicitly — so the wiring does reach optimize!;
• but max_iter lands in that kwargs... and is silently dropped, so the budget now rides AltissimoOptions(max_outer_iter = max_iter). Left alone it would have quietly run Altissimo's default 20 outer iterations while the FILL-IN block said 60.

The guidance names SOLVER = :altissimo as the one-line switch and forbids hand-rolling the solve call, stating each trap so the instruction carries its own justification.

---

Testing

• amico-run: 938 passed, 12 skipped.
• extension: 778 passed, 3 skipped (the full CI set, --exclude '**/slow/**').
• tsc --noEmit clean in both packages.
• Live, against the real staging service: frames fetched from a presigned URL and landed locally with 5-digit names (task 0fccbbf9); template runs green end to end (fidelity 0.99997, 60 iterations); local run writes norun.log (no duplication), and with TASK_ID set run.log appears with iter lines in exactly the format the poller parses.
• One incidental fix that matters for CI: the CLI tests were inheriting the developer's~/.amico/amicode/solver-mode.json. On an hp machine nine local-solve tests failed — on correct behaviour. They now spawn with a hermetic ops dir.

CI caught the one consumer I missed on the frame rename (the Δ9 remote state-machine test); the assertion above it — run.log contains iter=7 — passed, which is independent confirmation in a second harness that the stats fix delivers iters end to end.

---

What this does NOT fix

• Altissimo on the cloud. The runner AMI bakes a Piccolissimo/Altissimo predating callback support, so it emits nothing there until Altissimo#414 is released and the image rebuilt. The template is ready for that moment.
• The Altissimo code path has never been executed. It is written against the verified contract and parses, but the local checkouts here are 287/324 commits behind and cannot run it. Worth exercising on a current env before anyone demos it.
• Cold start. ~9–10 min from submit to first frame, for ~55s of compute. Real, and unaddressed here.
• Existing agent-authored scripts in ~/.amico/problems/ predate emit(), so they still show frames and no numbers until re-authored from the updated template.

solverModeSection is exported to make the guidance testable (matching its already-exported sibling routingSection). The same one-line export is on #225 — identical change, so either merge order is fine.

Reviewer note

This narrows behaviour: a local Piccolissimo run that "worked" before — slowly, usually fatally — is now refused outright. That is the intent of a cloud-only paid tier, but it is a real change for anyone relying on the local path, and the way out is one click on the solver control.

[Rchari1]

Six commits, one thread: make the paid tier actually run in the cloud, and make what it produces actually reach the Run Inspector. 18 files, +673/−116.

---

1. Piccolissimo + Altissimo is cloud-only, and now enforced

Selecting the HP tier was supposed to mean "runs in Harmoniqs Cloud." In practice the agent kept dispatching it locally, where the laptop precompiled the whole HP stack (IPOPT included) until amico-run's process-group timeout SIGTERMed julia mid-precompile.

The API-key prompt and entitlement flip were already built and work (amicode#200/#167) — untouched here. Three other things allowed local dispatch:

1. Nothing refused a local HP launch. The tier="hpc" gate is solid but only fires on a spec that saystier="hpc", and runGate only runs for --spec launches. A bare amico-run script.jl never reached it.
2. The entitlement that unlocks the tier unlocked the failure — HP grants issimo, so the import scan admitted a local using Piccolissimo.
3. The agent got contradictory orders — solverModeSection() said "launch in the cloud" while the routing section beside it said "routing is PER-SOLVE and EXPLICIT, default to local." Given a cloud-only tier and an instruction to default local, it defaulted local.

Fix, in the two-layer shape the tier already uses:

• Enforcement — launch.ts refuses --executor local while HP is selected, at the one choke point every run passes through, before the gate, so it covers spec and no-spec runs alike. Reads solver mode as status only, never a token, and fails safe to piccolo on a missing or corrupt file: this value can only ever refuse a run, so a bad read must never invent hp and block ordinary free-tier work.
• Guidance — the routing section states the cloud-only contract instead of asking a routing question, and AGENTS.md step 5 makes the injected section authoritative over its local default. Piccolo sessions stay byte-identical (the section is still "" unless mode is hpand the cloud is connected).

The estimate keeps its reporting role and loses its deciding role: an estimate that fits in local RAM does not make an HP solve local.

Service is named Harmoniqs Cloud in every user-visible string. Wire id stays company-compute — renaming breaks the credential route, status cache, and CONNECTION_IDS for no visible gain.

---

2. Cloud iters and frames reach the Run Inspector

The client chain was fully built — poll the cloud, synthesize AMICODE_ITER into run.log, write frames, touch mtime for the stall logic. It read the wrong fields:

	client read	service returns
stats	body.iters	{task_id, **stats**[], submitter}
frames	png_base64	{task_id, iter, key, **url**, submitter}

Both reads sit in best-effort try/catch ("stats are advisory"), so it failed silently — undefined ?? [] iterated zero times and run.log stayed 0 bytes. Confirmed on task 419a57e6: 60 IPOPT iterations and 11 frames banked to S3, empty inspector.

Why nobody caught it:fake_cloud.ts served the shapes the client read, not the shapes the service returns. Every test passed against a fake that agreed with the bug. So the fake is corrected first, and two tests pin the live payloads by exact key set — including that the presigned URL is fetchable with no auth header, because the signature is the credential.

Frame filenames also went 3-digit → 5-digit: iter_00007.png is what both the S3 layout and the local julia solve write. The old name matched neither, so cloud and local frames landed under two schemes in one run dir.

A third drift, found while proving the above: the poller only json.loads an AMICODE_ITER payload starting with {, so template-emitted key=value lines come back as {raw: "iter=7 f=…"}. The client keyed on it.iter and skipped every one as NaN — invisible because the smoke test seeds JSON. Now reconstructs from either shape and drops malformed records rather than emitting NaN.

---

3. The cloud can finally populate /stats

/solves/<id>/stats parses AMICODE_ITER out of run.log in the artifact prefix, and the runner's sidecar populates that prefix with aws s3 sync . — whatever is in the solve cwd. But julia's stdout on the runner goes to the SSM command stream, so run.log was never written there: nothing to sync, stats: [], empty inspector. The template's own comment ("AMICODE_PULSE lines on stdout (→ run.log)") was true locally and false in the cloud.

Telemetry now routes through emit(), which also appends to run.log — only when TASK_ID is set (the runner exports it). Locally amico-run's executor already writes run.log from stdout, so appending unconditionally would double every line and the inspector would count each iteration twice.

No terraform change and no AMI rebake: the solve script is uploaded per submission (<task_id>-solve.jl), so this ships immediately.

---

4. Altissimo streams like IPOPT

Both channels were bolted to IPOPT — frames off IpoptOptions.intermediate_callback, the iter line off a callback reading IpoptOptimizerState. Altissimo has neither; its only hook is callback on optimize!, arriving as (x, info). So an Altissimo solve lost the frames too, leaving the inspector completely dark rather than merely numberless.

SOLVER = :ipopt | :altissimo re-hangs both channels. xis the primal, so pulse_emit's solver-agnostic (primal, iter) contract takes it unchanged — same frames, same AMICODE_PULSE, same cooperative STOP (returning false stops an Altissimo solve exactly as it stops an Ipopt one). inf_pr/inf_du come from the callback tuple when present (Altissimo#414, merged) and are otherwise derived from eq_viol/ineq_viol/kkt_error, so it works on an older Altissimo instead of emitting NaN.

Two traps verified against Piccolissimo main and handled:

• the qcp-level solve! forwards kwargs... to the prob-level method, which takes callback explicitly — so the wiring does reach optimize!;
• but max_iter lands in that kwargs... and is silently dropped, so the budget now rides AltissimoOptions(max_outer_iter = max_iter). Left alone it would have quietly run Altissimo's default 20 outer iterations while the FILL-IN block said 60.

The guidance names SOLVER = :altissimo as the one-line switch and forbids hand-rolling the solve call, stating each trap so the instruction carries its own justification.

---

Testing

• amico-run: 938 passed, 12 skipped.
• extension: 778 passed, 3 skipped (the full CI set, --exclude '**/slow/**').
• tsc --noEmit clean in both packages.
• Live, against the real staging service: frames fetched from a presigned URL and landed locally with 5-digit names (task 0fccbbf9); template runs green end to end (fidelity 0.99997, 60 iterations); local run writes norun.log (no duplication), and with TASK_ID set run.log appears with iter lines in exactly the format the poller parses.
• One incidental fix that matters for CI: the CLI tests were inheriting the developer's~/.amico/amicode/solver-mode.json. On an hp machine nine local-solve tests failed — on correct behaviour. They now spawn with a hermetic ops dir.

CI caught the one consumer I missed on the frame rename (the Δ9 remote state-machine test); the assertion above it — run.log contains iter=7 — passed, which is independent confirmation in a second harness that the stats fix delivers iters end to end.

---

What this does NOT fix

• Altissimo on the cloud. The runner AMI bakes a Piccolissimo/Altissimo predating callback support, so it emits nothing there until Altissimo#414 is released and the image rebuilt. The template is ready for that moment.
• The Altissimo code path has never been executed. It is written against the verified contract and parses, but the local checkouts here are 287/324 commits behind and cannot run it. Worth exercising on a current env before anyone demos it.
• Cold start. ~9–10 min from submit to first frame, for ~55s of compute. Real, and unaddressed here.
• Existing agent-authored scripts in ~/.amico/problems/ predate emit(), so they still show frames and no numbers until re-authored from the updated template.

solverModeSection is exported to make the guidance testable (matching its already-exported sibling routingSection). The same one-line export is on #225 — identical change, so either merge order is fine.

Reviewer note

This narrows behaviour: a local Piccolissimo run that "worked" before — slowly, usually fatally — is now refused outright. That is the intent of a cloud-only paid tier, but it is a real change for anyone relying on the local path, and the way out is one click on the solver control.

[Rchari1]

Six commits, one thread: make the paid tier actually run in the cloud, and make what it produces actually reach the Run Inspector. 18 files, +673/−116.

---

1. Piccolissimo + Altissimo is cloud-only, and now enforced

Selecting the HP tier was supposed to mean "runs in Harmoniqs Cloud." In practice the agent kept dispatching it locally, where the laptop precompiled the whole HP stack (IPOPT included) until amico-run's process-group timeout SIGTERMed julia mid-precompile.

The API-key prompt and entitlement flip were already built and work (amicode#200/#167) — untouched here. Three other things allowed local dispatch:

1. Nothing refused a local HP launch. The tier="hpc" gate is solid but only fires on a spec that saystier="hpc", and runGate only runs for --spec launches. A bare amico-run script.jl never reached it.
2. The entitlement that unlocks the tier unlocked the failure — HP grants issimo, so the import scan admitted a local using Piccolissimo.
3. The agent got contradictory orders — solverModeSection() said "launch in the cloud" while the routing section beside it said "routing is PER-SOLVE and EXPLICIT, default to local." Given a cloud-only tier and an instruction to default local, it defaulted local.

Fix, in the two-layer shape the tier already uses:

• Enforcement — launch.ts refuses --executor local while HP is selected, at the one choke point every run passes through, before the gate, so it covers spec and no-spec runs alike. Reads solver mode as status only, never a token, and fails safe to piccolo on a missing or corrupt file: this value can only ever refuse a run, so a bad read must never invent hp and block ordinary free-tier work.
• Guidance — the routing section states the cloud-only contract instead of asking a routing question, and AGENTS.md step 5 makes the injected section authoritative over its local default. Piccolo sessions stay byte-identical (the section is still "" unless mode is hpand the cloud is connected).

The estimate keeps its reporting role and loses its deciding role: an estimate that fits in local RAM does not make an HP solve local.

Service is named Harmoniqs Cloud in every user-visible string. Wire id stays company-compute — renaming breaks the credential route, status cache, and CONNECTION_IDS for no visible gain.

---

2. Cloud iters and frames reach the Run Inspector

The client chain was fully built — poll the cloud, synthesize AMICODE_ITER into run.log, write frames, touch mtime for the stall logic. It read the wrong fields:

	client read	service returns
stats	body.iters	{task_id, **stats**[], submitter}
frames	png_base64	{task_id, iter, key, **url**, submitter}

Both reads sit in best-effort try/catch ("stats are advisory"), so it failed silently — undefined ?? [] iterated zero times and run.log stayed 0 bytes. Confirmed on task 419a57e6: 60 IPOPT iterations and 11 frames banked to S3, empty inspector.

Why nobody caught it:fake_cloud.ts served the shapes the client read, not the shapes the service returns. Every test passed against a fake that agreed with the bug. So the fake is corrected first, and two tests pin the live payloads by exact key set — including that the presigned URL is fetchable with no auth header, because the signature is the credential.

Frame filenames also went 3-digit → 5-digit: iter_00007.png is what both the S3 layout and the local julia solve write. The old name matched neither, so cloud and local frames landed under two schemes in one run dir.

A third drift, found while proving the above: the poller only json.loads an AMICODE_ITER payload starting with {, so template-emitted key=value lines come back as {raw: "iter=7 f=…"}. The client keyed on it.iter and skipped every one as NaN — invisible because the smoke test seeds JSON. Now reconstructs from either shape and drops malformed records rather than emitting NaN.

---

3. The cloud can finally populate /stats

/solves/<id>/stats parses AMICODE_ITER out of run.log in the artifact prefix, and the runner's sidecar populates that prefix with aws s3 sync . — whatever is in the solve cwd. But julia's stdout on the runner goes to the SSM command stream, so run.log was never written there: nothing to sync, stats: [], empty inspector. The template's own comment ("AMICODE_PULSE lines on stdout (→ run.log)") was true locally and false in the cloud.

Telemetry now routes through emit(), which also appends to run.log — only when TASK_ID is set (the runner exports it). Locally amico-run's executor already writes run.log from stdout, so appending unconditionally would double every line and the inspector would count each iteration twice.

No terraform change and no AMI rebake: the solve script is uploaded per submission (<task_id>-solve.jl), so this ships immediately.

---

4. Altissimo streams like IPOPT

Both channels were bolted to IPOPT — frames off IpoptOptions.intermediate_callback, the iter line off a callback reading IpoptOptimizerState. Altissimo has neither; its only hook is callback on optimize!, arriving as (x, info). So an Altissimo solve lost the frames too, leaving the inspector completely dark rather than merely numberless.

SOLVER = :ipopt | :altissimo re-hangs both channels. xis the primal, so pulse_emit's solver-agnostic (primal, iter) contract takes it unchanged — same frames, same AMICODE_PULSE, same cooperative STOP (returning false stops an Altissimo solve exactly as it stops an Ipopt one). inf_pr/inf_du come from the callback tuple when present (Altissimo#414, merged) and are otherwise derived from eq_viol/ineq_viol/kkt_error, so it works on an older Altissimo instead of emitting NaN.

Two traps verified against Piccolissimo main and handled:

• the qcp-level solve! forwards kwargs... to the prob-level method, which takes callback explicitly — so the wiring does reach optimize!;
• but max_iter lands in that kwargs... and is silently dropped, so the budget now rides AltissimoOptions(max_outer_iter = max_iter). Left alone it would have quietly run Altissimo's default 20 outer iterations while the FILL-IN block said 60.

The guidance names SOLVER = :altissimo as the one-line switch and forbids hand-rolling the solve call, stating each trap so the instruction carries its own justification.

---

Testing

• amico-run: 938 passed, 12 skipped.
• extension: 778 passed, 3 skipped (the full CI set, --exclude '**/slow/**').
• tsc --noEmit clean in both packages.
• Live, against the real staging service: frames fetched from a presigned URL and landed locally with 5-digit names (task 0fccbbf9); template runs green end to end (fidelity 0.99997, 60 iterations); local run writes norun.log (no duplication), and with TASK_ID set run.log appears with iter lines in exactly the format the poller parses.
• One incidental fix that matters for CI: the CLI tests were inheriting the developer's~/.amico/amicode/solver-mode.json. On an hp machine nine local-solve tests failed — on correct behaviour. They now spawn with a hermetic ops dir.

CI caught the one consumer I missed on the frame rename (the Δ9 remote state-machine test); the assertion above it — run.log contains iter=7 — passed, which is independent confirmation in a second harness that the stats fix delivers iters end to end.

---

What this does NOT fix

• Altissimo on the cloud. The runner AMI bakes a Piccolissimo/Altissimo predating callback support, so it emits nothing there until Altissimo#414 is released and the image rebuilt. The template is ready for that moment.
• The Altissimo code path has never been executed. It is written against the verified contract and parses, but the local checkouts here are 287/324 commits behind and cannot run it. Worth exercising on a current env before anyone demos it.
• Cold start. ~9–10 min from submit to first frame, for ~55s of compute. Real, and unaddressed here.
• Existing agent-authored scripts in ~/.amico/problems/ predate emit(), so they still show frames and no numbers until re-authored from the updated template.

solverModeSection is exported to make the guidance testable (matching its already-exported sibling routingSection). The same one-line export is on #225 — identical change, so either merge order is fine.

Reviewer note

This narrows behaviour: a local Piccolissimo run that "worked" before — slowly, usually fatally — is now refused outright. That is the intent of a cloud-only paid tier, but it is a real change for anyone relying on the local path, and the way out is one click on the solver control.

[Rchari1]

Six commits, one thread: make the paid tier actually run in the cloud, and make what it produces actually reach the Run Inspector. 18 files, +673/−116.

---

1. Piccolissimo + Altissimo is cloud-only, and now enforced

Selecting the HP tier was supposed to mean "runs in Harmoniqs Cloud." In practice the agent kept dispatching it locally, where the laptop precompiled the whole HP stack (IPOPT included) until amico-run's process-group timeout SIGTERMed julia mid-precompile.

The API-key prompt and entitlement flip were already built and work (amicode#200/#167) — untouched here. Three other things allowed local dispatch:

1. Nothing refused a local HP launch. The tier="hpc" gate is solid but only fires on a spec that saystier="hpc", and runGate only runs for --spec launches. A bare amico-run script.jl never reached it.
2. The entitlement that unlocks the tier unlocked the failure — HP grants issimo, so the import scan admitted a local using Piccolissimo.
3. The agent got contradictory orders — solverModeSection() said "launch in the cloud" while the routing section beside it said "routing is PER-SOLVE and EXPLICIT, default to local." Given a cloud-only tier and an instruction to default local, it defaulted local.

Fix, in the two-layer shape the tier already uses:

• Enforcement — launch.ts refuses --executor local while HP is selected, at the one choke point every run passes through, before the gate, so it covers spec and no-spec runs alike. Reads solver mode as status only, never a token, and fails safe to piccolo on a missing or corrupt file: this value can only ever refuse a run, so a bad read must never invent hp and block ordinary free-tier work.
• Guidance — the routing section states the cloud-only contract instead of asking a routing question, and AGENTS.md step 5 makes the injected section authoritative over its local default. Piccolo sessions stay byte-identical (the section is still "" unless mode is hpand the cloud is connected).

The estimate keeps its reporting role and loses its deciding role: an estimate that fits in local RAM does not make an HP solve local.

Service is named Harmoniqs Cloud in every user-visible string. Wire id stays company-compute — renaming breaks the credential route, status cache, and CONNECTION_IDS for no visible gain.

---

2. Cloud iters and frames reach the Run Inspector

The client chain was fully built — poll the cloud, synthesize AMICODE_ITER into run.log, write frames, touch mtime for the stall logic. It read the wrong fields:

	client read	service returns
stats	body.iters	{task_id, **stats**[], submitter}
frames	png_base64	{task_id, iter, key, **url**, submitter}

Both reads sit in best-effort try/catch ("stats are advisory"), so it failed silently — undefined ?? [] iterated zero times and run.log stayed 0 bytes. Confirmed on task 419a57e6: 60 IPOPT iterations and 11 frames banked to S3, empty inspector.

Why nobody caught it:fake_cloud.ts served the shapes the client read, not the shapes the service returns. Every test passed against a fake that agreed with the bug. So the fake is corrected first, and two tests pin the live payloads by exact key set — including that the presigned URL is fetchable with no auth header, because the signature is the credential.

Frame filenames also went 3-digit → 5-digit: iter_00007.png is what both the S3 layout and the local julia solve write. The old name matched neither, so cloud and local frames landed under two schemes in one run dir.

A third drift, found while proving the above: the poller only json.loads an AMICODE_ITER payload starting with {, so template-emitted key=value lines come back as {raw: "iter=7 f=…"}. The client keyed on it.iter and skipped every one as NaN — invisible because the smoke test seeds JSON. Now reconstructs from either shape and drops malformed records rather than emitting NaN.

---

3. The cloud can finally populate /stats

/solves/<id>/stats parses AMICODE_ITER out of run.log in the artifact prefix, and the runner's sidecar populates that prefix with aws s3 sync . — whatever is in the solve cwd. But julia's stdout on the runner goes to the SSM command stream, so run.log was never written there: nothing to sync, stats: [], empty inspector. The template's own comment ("AMICODE_PULSE lines on stdout (→ run.log)") was true locally and false in the cloud.

Telemetry now routes through emit(), which also appends to run.log — only when TASK_ID is set (the runner exports it). Locally amico-run's executor already writes run.log from stdout, so appending unconditionally would double every line and the inspector would count each iteration twice.

No terraform change and no AMI rebake: the solve script is uploaded per submission (<task_id>-solve.jl), so this ships immediately.

---

4. Altissimo streams like IPOPT

Both channels were bolted to IPOPT — frames off IpoptOptions.intermediate_callback, the iter line off a callback reading IpoptOptimizerState. Altissimo has neither; its only hook is callback on optimize!, arriving as (x, info). So an Altissimo solve lost the frames too, leaving the inspector completely dark rather than merely numberless.

SOLVER = :ipopt | :altissimo re-hangs both channels. xis the primal, so pulse_emit's solver-agnostic (primal, iter) contract takes it unchanged — same frames, same AMICODE_PULSE, same cooperative STOP (returning false stops an Altissimo solve exactly as it stops an Ipopt one). inf_pr/inf_du come from the callback tuple when present (Altissimo#414, merged) and are otherwise derived from eq_viol/ineq_viol/kkt_error, so it works on an older Altissimo instead of emitting NaN.

Two traps verified against Piccolissimo main and handled:

• the qcp-level solve! forwards kwargs... to the prob-level method, which takes callback explicitly — so the wiring does reach optimize!;
• but max_iter lands in that kwargs... and is silently dropped, so the budget now rides AltissimoOptions(max_outer_iter = max_iter). Left alone it would have quietly run Altissimo's default 20 outer iterations while the FILL-IN block said 60.

The guidance names SOLVER = :altissimo as the one-line switch and forbids hand-rolling the solve call, stating each trap so the instruction carries its own justification.

---

Testing

• amico-run: 938 passed, 12 skipped.
• extension: 778 passed, 3 skipped (the full CI set, --exclude '**/slow/**').
• tsc --noEmit clean in both packages.
• Live, against the real staging service: frames fetched from a presigned URL and landed locally with 5-digit names (task 0fccbbf9); template runs green end to end (fidelity 0.99997, 60 iterations); local run writes norun.log (no duplication), and with TASK_ID set run.log appears with iter lines in exactly the format the poller parses.
• One incidental fix that matters for CI: the CLI tests were inheriting the developer's~/.amico/amicode/solver-mode.json. On an hp machine nine local-solve tests failed — on correct behaviour. They now spawn with a hermetic ops dir.

CI caught the one consumer I missed on the frame rename (the Δ9 remote state-machine test); the assertion above it — run.log contains iter=7 — passed, which is independent confirmation in a second harness that the stats fix delivers iters end to end.

---

What this does NOT fix

• Altissimo on the cloud. The runner AMI bakes a Piccolissimo/Altissimo predating callback support, so it emits nothing there until Altissimo#414 is released and the image rebuilt. The template is ready for that moment.
• The Altissimo code path has never been executed. It is written against the verified contract and parses, but the local checkouts here are 287/324 commits behind and cannot run it. Worth exercising on a current env before anyone demos it.
• Cold start. ~9–10 min from submit to first frame, for ~55s of compute. Real, and unaddressed here.
• Existing agent-authored scripts in ~/.amico/problems/ predate emit(), so they still show frames and no numbers until re-authored from the updated template.

solverModeSection is exported to make the guidance testable (matching its already-exported sibling routingSection). The same one-line export is on #225 — identical change, so either merge order is fine.

Reviewer note

This narrows behaviour: a local Piccolissimo run that "worked" before — slowly, usually fatally — is now refused outright. That is the intent of a cloud-only paid tier, but it is a real change for anyone relying on the local path, and the way out is one click on the solver control.

[Rchari1]

Six commits, one thread: make the paid tier actually run in the cloud, and make what it produces actually reach the Run Inspector. 18 files, +673/−116.

---

1. Piccolissimo + Altissimo is cloud-only, and now enforced

Selecting the HP tier was supposed to mean "runs in Harmoniqs Cloud." In practice the agent kept dispatching it locally, where the laptop precompiled the whole HP stack (IPOPT included) until amico-run's process-group timeout SIGTERMed julia mid-precompile.

The API-key prompt and entitlement flip were already built and work (amicode#200/#167) — untouched here. Three other things allowed local dispatch:

1. Nothing refused a local HP launch. The tier="hpc" gate is solid but only fires on a spec that saystier="hpc", and runGate only runs for --spec launches. A bare amico-run script.jl never reached it.
2. The entitlement that unlocks the tier unlocked the failure — HP grants issimo, so the import scan admitted a local using Piccolissimo.
3. The agent got contradictory orders — solverModeSection() said "launch in the cloud" while the routing section beside it said "routing is PER-SOLVE and EXPLICIT, default to local." Given a cloud-only tier and an instruction to default local, it defaulted local.

Fix, in the two-layer shape the tier already uses:

• Enforcement — launch.ts refuses --executor local while HP is selected, at the one choke point every run passes through, before the gate, so it covers spec and no-spec runs alike. Reads solver mode as status only, never a token, and fails safe to piccolo on a missing or corrupt file: this value can only ever refuse a run, so a bad read must never invent hp and block ordinary free-tier work.
• Guidance — the routing section states the cloud-only contract instead of asking a routing question, and AGENTS.md step 5 makes the injected section authoritative over its local default. Piccolo sessions stay byte-identical (the section is still "" unless mode is hpand the cloud is connected).

The estimate keeps its reporting role and loses its deciding role: an estimate that fits in local RAM does not make an HP solve local.

Service is named Harmoniqs Cloud in every user-visible string. Wire id stays company-compute — renaming breaks the credential route, status cache, and CONNECTION_IDS for no visible gain.

---

2. Cloud iters and frames reach the Run Inspector

The client chain was fully built — poll the cloud, synthesize AMICODE_ITER into run.log, write frames, touch mtime for the stall logic. It read the wrong fields:

	client read	service returns
stats	body.iters	{task_id, **stats**[], submitter}
frames	png_base64	{task_id, iter, key, **url**, submitter}

Both reads sit in best-effort try/catch ("stats are advisory"), so it failed silently — undefined ?? [] iterated zero times and run.log stayed 0 bytes. Confirmed on task 419a57e6: 60 IPOPT iterations and 11 frames banked to S3, empty inspector.

Why nobody caught it:fake_cloud.ts served the shapes the client read, not the shapes the service returns. Every test passed against a fake that agreed with the bug. So the fake is corrected first, and two tests pin the live payloads by exact key set — including that the presigned URL is fetchable with no auth header, because the signature is the credential.

Frame filenames also went 3-digit → 5-digit: iter_00007.png is what both the S3 layout and the local julia solve write. The old name matched neither, so cloud and local frames landed under two schemes in one run dir.

A third drift, found while proving the above: the poller only json.loads an AMICODE_ITER payload starting with {, so template-emitted key=value lines come back as {raw: "iter=7 f=…"}. The client keyed on it.iter and skipped every one as NaN — invisible because the smoke test seeds JSON. Now reconstructs from either shape and drops malformed records rather than emitting NaN.

---

3. The cloud can finally populate /stats

/solves/<id>/stats parses AMICODE_ITER out of run.log in the artifact prefix, and the runner's sidecar populates that prefix with aws s3 sync . — whatever is in the solve cwd. But julia's stdout on the runner goes to the SSM command stream, so run.log was never written there: nothing to sync, stats: [], empty inspector. The template's own comment ("AMICODE_PULSE lines on stdout (→ run.log)") was true locally and false in the cloud.

Telemetry now routes through emit(), which also appends to run.log — only when TASK_ID is set (the runner exports it). Locally amico-run's executor already writes run.log from stdout, so appending unconditionally would double every line and the inspector would count each iteration twice.

No terraform change and no AMI rebake: the solve script is uploaded per submission (<task_id>-solve.jl), so this ships immediately.

---

4. Altissimo streams like IPOPT

Both channels were bolted to IPOPT — frames off IpoptOptions.intermediate_callback, the iter line off a callback reading IpoptOptimizerState. Altissimo has neither; its only hook is callback on optimize!, arriving as (x, info). So an Altissimo solve lost the frames too, leaving the inspector completely dark rather than merely numberless.

SOLVER = :ipopt | :altissimo re-hangs both channels. xis the primal, so pulse_emit's solver-agnostic (primal, iter) contract takes it unchanged — same frames, same AMICODE_PULSE, same cooperative STOP (returning false stops an Altissimo solve exactly as it stops an Ipopt one). inf_pr/inf_du come from the callback tuple when present (Altissimo#414, merged) and are otherwise derived from eq_viol/ineq_viol/kkt_error, so it works on an older Altissimo instead of emitting NaN.

Two traps verified against Piccolissimo main and handled:

• the qcp-level solve! forwards kwargs... to the prob-level method, which takes callback explicitly — so the wiring does reach optimize!;
• but max_iter lands in that kwargs... and is silently dropped, so the budget now rides AltissimoOptions(max_outer_iter = max_iter). Left alone it would have quietly run Altissimo's default 20 outer iterations while the FILL-IN block said 60.

The guidance names SOLVER = :altissimo as the one-line switch and forbids hand-rolling the solve call, stating each trap so the instruction carries its own justification.

---

Testing

• amico-run: 938 passed, 12 skipped.
• extension: 778 passed, 3 skipped (the full CI set, --exclude '**/slow/**').
• tsc --noEmit clean in both packages.
• Live, against the real staging service: frames fetched from a presigned URL and landed locally with 5-digit names (task 0fccbbf9); template runs green end to end (fidelity 0.99997, 60 iterations); local run writes norun.log (no duplication), and with TASK_ID set run.log appears with iter lines in exactly the format the poller parses.
• One incidental fix that matters for CI: the CLI tests were inheriting the developer's~/.amico/amicode/solver-mode.json. On an hp machine nine local-solve tests failed — on correct behaviour. They now spawn with a hermetic ops dir.

CI caught the one consumer I missed on the frame rename (the Δ9 remote state-machine test); the assertion above it — run.log contains iter=7 — passed, which is independent confirmation in a second harness that the stats fix delivers iters end to end.

---

What this does NOT fix

• Altissimo on the cloud. The runner AMI bakes a Piccolissimo/Altissimo predating callback support, so it emits nothing there until Altissimo#414 is released and the image rebuilt. The template is ready for that moment.
• The Altissimo code path has never been executed. It is written against the verified contract and parses, but the local checkouts here are 287/324 commits behind and cannot run it. Worth exercising on a current env before anyone demos it.
• Cold start. ~9–10 min from submit to first frame, for ~55s of compute. Real, and unaddressed here.
• Existing agent-authored scripts in ~/.amico/problems/ predate emit(), so they still show frames and no numbers until re-authored from the updated template.

solverModeSection is exported to make the guidance testable (matching its already-exported sibling routingSection). The same one-line export is on #225 — identical change, so either merge order is fine.

Reviewer note

This narrows behaviour: a local Piccolissimo run that "worked" before — slowly, usually fatally — is now refused outright. That is the intent of a cloud-only paid tier, but it is a real change for anyone relying on the local path, and the way out is one click on the solver control.

[Rchari1]

Six commits, one thread: make the paid tier actually run in the cloud, and make what it produces actually reach the Run Inspector. 18 files, +673/−116.

---

1. Piccolissimo + Altissimo is cloud-only, and now enforced

Selecting the HP tier was supposed to mean "runs in Harmoniqs Cloud." In practice the agent kept dispatching it locally, where the laptop precompiled the whole HP stack (IPOPT included) until amico-run's process-group timeout SIGTERMed julia mid-precompile.

The API-key prompt and entitlement flip were already built and work (amicode#200/#167) — untouched here. Three other things allowed local dispatch:

1. Nothing refused a local HP launch. The tier="hpc" gate is solid but only fires on a spec that saystier="hpc", and runGate only runs for --spec launches. A bare amico-run script.jl never reached it.
2. The entitlement that unlocks the tier unlocked the failure — HP grants issimo, so the import scan admitted a local using Piccolissimo.
3. The agent got contradictory orders — solverModeSection() said "launch in the cloud" while the routing section beside it said "routing is PER-SOLVE and EXPLICIT, default to local." Given a cloud-only tier and an instruction to default local, it defaulted local.

Fix, in the two-layer shape the tier already uses:

• Enforcement — launch.ts refuses --executor local while HP is selected, at the one choke point every run passes through, before the gate, so it covers spec and no-spec runs alike. Reads solver mode as status only, never a token, and fails safe to piccolo on a missing or corrupt file: this value can only ever refuse a run, so a bad read must never invent hp and block ordinary free-tier work.
• Guidance — the routing section states the cloud-only contract instead of asking a routing question, and AGENTS.md step 5 makes the injected section authoritative over its local default. Piccolo sessions stay byte-identical (the section is still "" unless mode is hpand the cloud is connected).

The estimate keeps its reporting role and loses its deciding role: an estimate that fits in local RAM does not make an HP solve local.

Service is named Harmoniqs Cloud in every user-visible string. Wire id stays company-compute — renaming breaks the credential route, status cache, and CONNECTION_IDS for no visible gain.

---

2. Cloud iters and frames reach the Run Inspector

The client chain was fully built — poll the cloud, synthesize AMICODE_ITER into run.log, write frames, touch mtime for the stall logic. It read the wrong fields:

	client read	service returns
stats	body.iters	{task_id, **stats**[], submitter}
frames	png_base64	{task_id, iter, key, **url**, submitter}

Both reads sit in best-effort try/catch ("stats are advisory"), so it failed silently — undefined ?? [] iterated zero times and run.log stayed 0 bytes. Confirmed on task 419a57e6: 60 IPOPT iterations and 11 frames banked to S3, empty inspector.

Why nobody caught it:fake_cloud.ts served the shapes the client read, not the shapes the service returns. Every test passed against a fake that agreed with the bug. So the fake is corrected first, and two tests pin the live payloads by exact key set — including that the presigned URL is fetchable with no auth header, because the signature is the credential.

Frame filenames also went 3-digit → 5-digit: iter_00007.png is what both the S3 layout and the local julia solve write. The old name matched neither, so cloud and local frames landed under two schemes in one run dir.

A third drift, found while proving the above: the poller only json.loads an AMICODE_ITER payload starting with {, so template-emitted key=value lines come back as {raw: "iter=7 f=…"}. The client keyed on it.iter and skipped every one as NaN — invisible because the smoke test seeds JSON. Now reconstructs from either shape and drops malformed records rather than emitting NaN.

---

3. The cloud can finally populate /stats

/solves/<id>/stats parses AMICODE_ITER out of run.log in the artifact prefix, and the runner's sidecar populates that prefix with aws s3 sync . — whatever is in the solve cwd. But julia's stdout on the runner goes to the SSM command stream, so run.log was never written there: nothing to sync, stats: [], empty inspector. The template's own comment ("AMICODE_PULSE lines on stdout (→ run.log)") was true locally and false in the cloud.

Telemetry now routes through emit(), which also appends to run.log — only when TASK_ID is set (the runner exports it). Locally amico-run's executor already writes run.log from stdout, so appending unconditionally would double every line and the inspector would count each iteration twice.

No terraform change and no AMI rebake: the solve script is uploaded per submission (<task_id>-solve.jl), so this ships immediately.

---

4. Altissimo streams like IPOPT

Both channels were bolted to IPOPT — frames off IpoptOptions.intermediate_callback, the iter line off a callback reading IpoptOptimizerState. Altissimo has neither; its only hook is callback on optimize!, arriving as (x, info). So an Altissimo solve lost the frames too, leaving the inspector completely dark rather than merely numberless.

SOLVER = :ipopt | :altissimo re-hangs both channels. xis the primal, so pulse_emit's solver-agnostic (primal, iter) contract takes it unchanged — same frames, same AMICODE_PULSE, same cooperative STOP (returning false stops an Altissimo solve exactly as it stops an Ipopt one). inf_pr/inf_du come from the callback tuple when present (Altissimo#414, merged) and are otherwise derived from eq_viol/ineq_viol/kkt_error, so it works on an older Altissimo instead of emitting NaN.

Two traps verified against Piccolissimo main and handled:

• the qcp-level solve! forwards kwargs... to the prob-level method, which takes callback explicitly — so the wiring does reach optimize!;
• but max_iter lands in that kwargs... and is silently dropped, so the budget now rides AltissimoOptions(max_outer_iter = max_iter). Left alone it would have quietly run Altissimo's default 20 outer iterations while the FILL-IN block said 60.

The guidance names SOLVER = :altissimo as the one-line switch and forbids hand-rolling the solve call, stating each trap so the instruction carries its own justification.

---

Testing

• amico-run: 938 passed, 12 skipped.
• extension: 778 passed, 3 skipped (the full CI set, --exclude '**/slow/**').
• tsc --noEmit clean in both packages.
• Live, against the real staging service: frames fetched from a presigned URL and landed locally with 5-digit names (task 0fccbbf9); template runs green end to end (fidelity 0.99997, 60 iterations); local run writes norun.log (no duplication), and with TASK_ID set run.log appears with iter lines in exactly the format the poller parses.
• One incidental fix that matters for CI: the CLI tests were inheriting the developer's~/.amico/amicode/solver-mode.json. On an hp machine nine local-solve tests failed — on correct behaviour. They now spawn with a hermetic ops dir.

CI caught the one consumer I missed on the frame rename (the Δ9 remote state-machine test); the assertion above it — run.log contains iter=7 — passed, which is independent confirmation in a second harness that the stats fix delivers iters end to end.

---

What this does NOT fix

• Altissimo on the cloud. The runner AMI bakes a Piccolissimo/Altissimo predating callback support, so it emits nothing there until Altissimo#414 is released and the image rebuilt. The template is ready for that moment.
• The Altissimo code path has never been executed. It is written against the verified contract and parses, but the local checkouts here are 287/324 commits behind and cannot run it. Worth exercising on a current env before anyone demos it.
• Cold start. ~9–10 min from submit to first frame, for ~55s of compute. Real, and unaddressed here.
• Existing agent-authored scripts in ~/.amico/problems/ predate emit(), so they still show frames and no numbers until re-authored from the updated template.

solverModeSection is exported to make the guidance testable (matching its already-exported sibling routingSection). The same one-line export is on #225 — identical change, so either merge order is fine.

Reviewer note

This narrows behaviour: a local Piccolissimo run that "worked" before — slowly, usually fatally — is now refused outright. That is the intent of a cloud-only paid tier, but it is a real change for anyone relying on the local path, and the way out is one click on the solver control.

[Rchari1]

Six commits, one thread: make the paid tier actually run in the cloud, and make what it produces actually reach the Run Inspector. 18 files, +673/−116.

---

1. Piccolissimo + Altissimo is cloud-only, and now enforced

Selecting the HP tier was supposed to mean "runs in Harmoniqs Cloud." In practice the agent kept dispatching it locally, where the laptop precompiled the whole HP stack (IPOPT included) until amico-run's process-group timeout SIGTERMed julia mid-precompile.

The API-key prompt and entitlement flip were already built and work (amicode#200/#167) — untouched here. Three other things allowed local dispatch:

1. Nothing refused a local HP launch. The tier="hpc" gate is solid but only fires on a spec that saystier="hpc", and runGate only runs for --spec launches. A bare amico-run script.jl never reached it.
2. The entitlement that unlocks the tier unlocked the failure — HP grants issimo, so the import scan admitted a local using Piccolissimo.
3. The agent got contradictory orders — solverModeSection() said "launch in the cloud" while the routing section beside it said "routing is PER-SOLVE and EXPLICIT, default to local." Given a cloud-only tier and an instruction to default local, it defaulted local.

Fix, in the two-layer shape the tier already uses:

• Enforcement — launch.ts refuses --executor local while HP is selected, at the one choke point every run passes through, before the gate, so it covers spec and no-spec runs alike. Reads solver mode as status only, never a token, and fails safe to piccolo on a missing or corrupt file: this value can only ever refuse a run, so a bad read must never invent hp and block ordinary free-tier work.
• Guidance — the routing section states the cloud-only contract instead of asking a routing question, and AGENTS.md step 5 makes the injected section authoritative over its local default. Piccolo sessions stay byte-identical (the section is still "" unless mode is hpand the cloud is connected).

The estimate keeps its reporting role and loses its deciding role: an estimate that fits in local RAM does not make an HP solve local.

Service is named Harmoniqs Cloud in every user-visible string. Wire id stays company-compute — renaming breaks the credential route, status cache, and CONNECTION_IDS for no visible gain.

---

2. Cloud iters and frames reach the Run Inspector

The client chain was fully built — poll the cloud, synthesize AMICODE_ITER into run.log, write frames, touch mtime for the stall logic. It read the wrong fields:

	client read	service returns
stats	body.iters	{task_id, **stats**[], submitter}
frames	png_base64	{task_id, iter, key, **url**, submitter}

Both reads sit in best-effort try/catch ("stats are advisory"), so it failed silently — undefined ?? [] iterated zero times and run.log stayed 0 bytes. Confirmed on task 419a57e6: 60 IPOPT iterations and 11 frames banked to S3, empty inspector.

Why nobody caught it:fake_cloud.ts served the shapes the client read, not the shapes the service returns. Every test passed against a fake that agreed with the bug. So the fake is corrected first, and two tests pin the live payloads by exact key set — including that the presigned URL is fetchable with no auth header, because the signature is the credential.

Frame filenames also went 3-digit → 5-digit: iter_00007.png is what both the S3 layout and the local julia solve write. The old name matched neither, so cloud and local frames landed under two schemes in one run dir.

A third drift, found while proving the above: the poller only json.loads an AMICODE_ITER payload starting with {, so template-emitted key=value lines come back as {raw: "iter=7 f=…"}. The client keyed on it.iter and skipped every one as NaN — invisible because the smoke test seeds JSON. Now reconstructs from either shape and drops malformed records rather than emitting NaN.

---

3. The cloud can finally populate /stats

/solves/<id>/stats parses AMICODE_ITER out of run.log in the artifact prefix, and the runner's sidecar populates that prefix with aws s3 sync . — whatever is in the solve cwd. But julia's stdout on the runner goes to the SSM command stream, so run.log was never written there: nothing to sync, stats: [], empty inspector. The template's own comment ("AMICODE_PULSE lines on stdout (→ run.log)") was true locally and false in the cloud.

Telemetry now routes through emit(), which also appends to run.log — only when TASK_ID is set (the runner exports it). Locally amico-run's executor already writes run.log from stdout, so appending unconditionally would double every line and the inspector would count each iteration twice.

No terraform change and no AMI rebake: the solve script is uploaded per submission (<task_id>-solve.jl), so this ships immediately.

---

4. Altissimo streams like IPOPT

Both channels were bolted to IPOPT — frames off IpoptOptions.intermediate_callback, the iter line off a callback reading IpoptOptimizerState. Altissimo has neither; its only hook is callback on optimize!, arriving as (x, info). So an Altissimo solve lost the frames too, leaving the inspector completely dark rather than merely numberless.

SOLVER = :ipopt | :altissimo re-hangs both channels. xis the primal, so pulse_emit's solver-agnostic (primal, iter) contract takes it unchanged — same frames, same AMICODE_PULSE, same cooperative STOP (returning false stops an Altissimo solve exactly as it stops an Ipopt one). inf_pr/inf_du come from the callback tuple when present (Altissimo#414, merged) and are otherwise derived from eq_viol/ineq_viol/kkt_error, so it works on an older Altissimo instead of emitting NaN.

Two traps verified against Piccolissimo main and handled:

• the qcp-level solve! forwards kwargs... to the prob-level method, which takes callback explicitly — so the wiring does reach optimize!;
• but max_iter lands in that kwargs... and is silently dropped, so the budget now rides AltissimoOptions(max_outer_iter = max_iter). Left alone it would have quietly run Altissimo's default 20 outer iterations while the FILL-IN block said 60.

The guidance names SOLVER = :altissimo as the one-line switch and forbids hand-rolling the solve call, stating each trap so the instruction carries its own justification.

---

Testing

• amico-run: 938 passed, 12 skipped.
• extension: 778 passed, 3 skipped (the full CI set, --exclude '**/slow/**').
• tsc --noEmit clean in both packages.
• Live, against the real staging service: frames fetched from a presigned URL and landed locally with 5-digit names (task 0fccbbf9); template runs green end to end (fidelity 0.99997, 60 iterations); local run writes norun.log (no duplication), and with TASK_ID set run.log appears with iter lines in exactly the format the poller parses.
• One incidental fix that matters for CI: the CLI tests were inheriting the developer's~/.amico/amicode/solver-mode.json. On an hp machine nine local-solve tests failed — on correct behaviour. They now spawn with a hermetic ops dir.

CI caught the one consumer I missed on the frame rename (the Δ9 remote state-machine test); the assertion above it — run.log contains iter=7 — passed, which is independent confirmation in a second harness that the stats fix delivers iters end to end.

---

What this does NOT fix

• Altissimo on the cloud. The runner AMI bakes a Piccolissimo/Altissimo predating callback support, so it emits nothing there until Altissimo#414 is released and the image rebuilt. The template is ready for that moment.
• The Altissimo code path has never been executed. It is written against the verified contract and parses, but the local checkouts here are 287/324 commits behind and cannot run it. Worth exercising on a current env before anyone demos it.
• Cold start. ~9–10 min from submit to first frame, for ~55s of compute. Real, and unaddressed here.
• Existing agent-authored scripts in ~/.amico/problems/ predate emit(), so they still show frames and no numbers until re-authored from the updated template.

solverModeSection is exported to make the guidance testable (matching its already-exported sibling routingSection). The same one-line export is on #225 — identical change, so either merge order is fine.

Reviewer note

This narrows behaviour: a local Piccolissimo run that "worked" before — slowly, usually fatally — is now refused outright. That is the intent of a cloud-only paid tier, but it is a real change for anyone relying on the local path, and the way out is one click on the solver control.