From ee35fcd0a97ad3c8f05a0e538a5b58875dadd5df Mon Sep 17 00:00:00 2001
From: Vuong Hoang <vh@phasefinal.com>
Date: Tue, 28 Apr 2026 01:17:05 -0700
Subject: [PATCH] fish-cpp: add CUDA stubs to build linker path; fix verify
 step's masked failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two issues from the first deploy attempt:

1) Build failure (real): linker errors on s2.cpp's CUDA build —
   undefined references to cuMemSetAccess, cuDeviceGet, etc. These
   are CUDA Driver API symbols (in libcuda.so), not Runtime API
   (libcudart.so). The driver lib is provided by NVIDIA's container
   runtime at RUN time, not BUILD time.

   Fix: nvidia/cuda:devel images ship a stubs library at
   /usr/local/cuda/lib64/stubs/libcuda.so that provides the symbols
   for linking but is non-runnable. Adding that path via
   LIBRARY_PATH + CMAKE_LIBRARY_PATH lets the linker resolve while
   leaving runtime unchanged (real libcuda.so comes from the
   driver mount).

2) Verify false positive: the /v1/tts verify step's last command was
   `rm -f "$out"` — which always exits 0. This made the shell's
   final exit code 0 regardless of whether curl/file/grep succeeded,
   so verify reported OK even when nothing was running on host_port.

   Fix: `set -e` at top + trap-based cleanup. Failures now propagate;
   the rm still runs on either path via EXIT trap.
---
 playbooks/deploy-fish-cpp.yaml | 8 +++++++-
 stacks/fish-cpp/Dockerfile     | 8 ++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/playbooks/deploy-fish-cpp.yaml b/playbooks/deploy-fish-cpp.yaml
index 72832fb..8c50aaf 100644
--- a/playbooks/deploy-fish-cpp.yaml
+++ b/playbooks/deploy-fish-cpp.yaml
@@ -115,14 +115,20 @@ verify:
     changed_when: "false"
 
   - name: /v1/tts returns a real WAV (POST with text body)
+    # `set -e` so curl/file/grep failures actually propagate. The
+    # previous version put `rm -f` as the last command, which always
+    # exits 0 — masking real failures (verify reported OK even when
+    # nothing was running on host_port). Trap-based cleanup runs the
+    # rm even on failure.
     shell: |
+      set -e
       out=$(mktemp --suffix=.wav)
+      trap 'rm -f "$out"' EXIT
       curl -sf -X POST http://localhost:{{ host_port }}/v1/tts \
         -H 'Content-Type: application/json' \
         -d '{"text":"Verify."}' \
         -o "$out" --max-time 60
       file -b "$out" | grep -q '^RIFF.*WAVE'
-      rm -f "$out"
     changed_when: "false"
 
   - name: Container is running
diff --git a/stacks/fish-cpp/Dockerfile b/stacks/fish-cpp/Dockerfile
index 9bb88a1..f8d1007 100644
--- a/stacks/fish-cpp/Dockerfile
+++ b/stacks/fish-cpp/Dockerfile
@@ -26,7 +26,15 @@ RUN git clone --recurse-submodules https://github.com/rodrigomatta/s2.cpp.git \
     && git submodule update --init --recursive
 
 WORKDIR /src/s2.cpp
+# CUDA Driver API symbols (cuMemSetAccess, cuDeviceGet, etc.) live in
+# libcuda.so which the NVIDIA driver provides at RUNTIME via --gpus
+# mount. At build time there's no GPU, so we use the stubs library
+# at /usr/local/cuda/lib64/stubs/ which provides the symbols for
+# linking but is NOT runnable. The runtime image uses the real
+# driver-provided libcuda.so via NVIDIA's container runtime.
+ENV LIBRARY_PATH=/usr/local/cuda/lib64/stubs:${LIBRARY_PATH}
 RUN cmake -G Ninja -B build -DCMAKE_BUILD_TYPE=Release -DS2_CUDA=ON \
+      -DCMAKE_LIBRARY_PATH=/usr/local/cuda/lib64/stubs \
     && cmake --build build --parallel $(nproc) --target s2
 
 # ── Stage 2: runtime — slim image with the binary + python shim ────────