From 1506062ab25d4fbc54d2c20abae7040e4944e110 Mon Sep 17 00:00:00 2001
From: "russell@unturf.com" <russell@unturf.com>
Date: Wed, 20 May 2026 15:19:24 -0400
Subject: [PATCH] =?UTF-8?q?feat(#000057):=20`make=20rapl-access`=20?=
 =?UTF-8?q?=E2=80=94=20installs=20CPU-energy=20read=20perm=20for=20watt=5F?=
 =?UTF-8?q?bench?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fox's call: capture the RAPL permission as a Makefile target run with
sudo, not an ad-hoc chmod. `sudo make rapl-access` on each GPU box
installs a udev rule (/etc/udev/rules.d/99-rapl-readable.rules) that
makes intel-rapl energy_uj world-readable on every powercap add event
(survives reboot), and applies chmod immediately so no reboot is
needed. Idempotent; reversible via `sudo make rapl-access-revoke`.

energy_uj is root-only by default (PLATYPUS side-channel mitigation,
CVE-2020-8694) — that's why bench/watt_bench.py's CpuSampler read null
CPU watts as fox during recon. After this target runs, watt_bench
reads CPU package energy directly (no --cpu-energy-cmd needed). GPU
watts via nvidia-smi never needed special perm.

Non-root guard + help entries verified; Makefile parses clean.
---
 Makefile | 35 ++++++++++++++++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 430744f..4bffde1 100644
--- a/Makefile
+++ b/Makefile
@@ -37,7 +37,7 @@ SEARCH_Q     ?= computer
         prometheus-trigger-probe bench-5f-threshold-calibration \
         bench-5f-selfmodel-snapshot bench-5f-finetuning-shardchain \
         bench-5f-falsification-hard bench-fork-baseline-hard bench-5f-formulate-hard \
-        bootstrap-math bootstrap-nli bootstrap-nli-only bench-nli-shadow export-nli-onnx bench-nli-backends judge-self-test control-ab control-sweep clean clean-db clean-data help \
+        bootstrap-math bootstrap-nli bootstrap-nli-only bench-nli-shadow export-nli-onnx bench-nli-backends judge-self-test control-ab control-sweep rapl-access rapl-access-revoke clean clean-db clean-data help \
         textbooks-summary textbooks-urls fetch-textbooks textbooks-stats textbooks-verify \
         crawl-textbooks crawl-textbooks-stats textbook textbook-list
 
@@ -1215,6 +1215,39 @@ BENCH_DIR  := /tmp/arborist-bench
 bench: bootstrap fetch-cur ## benchmark serial vs parallel-shared vs attached at $(BENCH_DOCS) docs
 	@bash bench/run.sh $(BENCH_DOCS)
 
+# --- GPU/CPU wattage benchmark (#000057 cost axis) ---------------------------
+# RAPL CPU-energy counters (/sys/class/powercap/intel-rapl:*/energy_uj) are
+# root-only by default (the PLATYPUS side-channel mitigation, CVE-2020-8694),
+# so bench/watt_bench.py reads null CPU watts without this. GPU watts via
+# nvidia-smi need no special perm. Run ONCE per GPU box AS ROOT:
+#     sudo make rapl-access
+# Installs a udev rule that makes energy_uj world-readable on every powercap
+# add event (survives reboot), and applies it immediately so no reboot is
+# needed. Idempotent. Reverse with `sudo make rapl-access-revoke`.
+RAPL_UDEV_RULE := /etc/udev/rules.d/99-rapl-readable.rules
+rapl-access: ## [root] make Intel RAPL energy_uj readable for watt_bench CPU power
+	@test "$$(id -u)" = "0" || { echo "run as root: sudo make rapl-access"; exit 1; }
+	@printf '%s\n' \
+	  '# arborist #000057 — let bench/watt_bench.py read CPU package energy.' \
+	  '# RAPL energy_uj is root-only by default (PLATYPUS/CVE-2020-8694).' \
+	  'SUBSYSTEM=="powercap", ACTION=="add", RUN+="/bin/sh -c '\''chmod a+r /sys/class/powercap/%k/energy_uj 2>/dev/null || true'\''"' \
+	  > $(RAPL_UDEV_RULE)
+	udevadm control --reload-rules
+	@# apply now so a reboot isn't required
+	@for f in /sys/class/powercap/intel-rapl:*/energy_uj; do \
+	  [ -e "$$f" ] && chmod a+r "$$f" && echo "readable: $$f"; \
+	done
+	@echo "RAPL access installed. Verify: cat /sys/class/powercap/intel-rapl:0/energy_uj"
+
+rapl-access-revoke: ## [root] remove the RAPL read-access udev rule
+	@test "$$(id -u)" = "0" || { echo "run as root: sudo make rapl-access-revoke"; exit 1; }
+	rm -f $(RAPL_UDEV_RULE)
+	udevadm control --reload-rules
+	@for f in /sys/class/powercap/intel-rapl:*/energy_uj; do \
+	  [ -e "$$f" ] && chmod 400 "$$f"; \
+	done
+	@echo "RAPL access revoked (energy_uj back to root-only on next add; reset to 400 now)."
+
 clean: ## remove venv + caches (keeps fetched data and db)
 	rm -rf $(VENV) .pytest_cache **/__pycache__ arborist.egg-info
 	find . -type d -name __pycache__ -prune -exec rm -rf {} +