@@ -199,8 +199,11 @@ Use `scancel` or direct process termination only with explicit approval and a co
 reason. Doing so can bypass cleanup or strand shared-cluster state. Never kill only the
 backend and leave the workflow silently occupying a runner.
 
-After a recipe/config fix, use a targeted e2e dispatch for fast feedback. Reserve another
-official full sweep for the candidate that has passed direct cluster inspection.
+After a recipe/config fix, use a targeted e2e dispatch for fast feedback. Add
+`-f agentx-fast=true` to it for one warmup request per lane and a 20-minute profile. Reserve
+another official full sweep for the candidate that has passed direct cluster inspection.
+The `agentx-fast` PR modifier gives a PR sweep the same short profile, but it needs a primary
+sweep label and blocks artifact reuse while applied, so remove it before that official sweep.
 
 ## 7. Report the live diagnosis
 
 
@@ -46,11 +46,14 @@ are the source of truth for the exact container image, mounts and benchmark comm
 
 ### 1. Trigger (or reuse) the sweep
 
-A PR's sweep is kicked by labels. The `/sweep` comment trigger was removed, so use the label:
-
-- **`full-sweep-fail-fast`** runs the full sweep and bails on the first failure per matrix for faster feedback while debugging. It is the **strongly recommended default** and the label that `/nuke` attaches.
-- **`full-sweep-enabled`** runs the full GPU sweep and lets every job complete despite failures. Use it only when a flaky job killing its matrix's in-flight results is unacceptable.
-- To re-trigger a sweep without a new commit, remove and re-add the sweep label.
+A PR's sweep is kicked by labels. The `/sweep` comment trigger was removed, so apply **exactly one** primary label. With more than one, `check-changelog` fails with `PR has multiple conflicting sweep labels. Pick exactly one.` The [sweep-label reference](../../../.github/AGENT_OPERATIONS.md#sweep-labels-and-reuse) has the full rules.
+
+- **`full-sweep-fail-fast`** runs a canary first when a point qualifies: the lowest-concurrency non-eval single-node point, else a multi-node AgentX point. Sweeps with only multi-node fixed-sequence or eval points have none and fan out at once. If the canary fails, every other matrix is skipped. Each matrix bails on its first failure for faster feedback while debugging. It is the **strongly recommended default** and the label that `/nuke` attaches.
+- **`full-sweep-enabled`** has the same canary gate but no fail-fast, so every job runs to completion despite failures. Use it only when a flaky job killing its matrix's in-flight results is unacceptable.
+- **`non-canary-full-sweep-enabled`** has neither a canary nor fail-fast, so every job runs to completion despite failures. Use it only when canary gating is also unsuitable.
+- Modifiers need a primary label; alone they start no GPU sweep (`check-changelog` still runs). `all-evals` expands eval selection to every eligible config, keeps throughput, and stays reuse-eligible. `evals-only` suppresses throughput. `agentx-fast` uses one AgentX warmup request per lane and a 20-minute profile. Reuse is rejected while the PR carries `evals-only` or `agentx-fast`.
+- No label trims concurrency. For a lowest-concurrency smoke, dispatch `e2e-tests.yml` (below) with `-f trim-conc=true`.
+- Adding or removing a primary or modifier label cancels the in-progress sweep, and a new one starts only while a primary label remains. To re-trigger a sweep without a new commit, remove and re-add the primary label.
 
 For a **single config** (tightest CI loop, skips the rest of the matrix), dispatch e2e directly:
 
 
@@ -10,9 +10,11 @@ This command modifies remote PR branches. **Pause for user confirmation** after
 
 A PR qualifies only if:
 - `headRefName` starts with `klaud/`, `klaud-cold/`, or `klaude/`
-- At least one `Run Sweep` check has conclusion `SUCCESS` **or** `FAILURE` (i.e. the sweep was enabled and produced real results, rather than all checks being skipped)
+- At least one `Run Sweep` check has conclusion `SUCCESS` **or** `FAILURE` (rather than all checks being skipped). This alone does not prove a sweep label: `check-changelog` runs, and normally succeeds, on every push.
 - At least one check has conclusion `FAILURE`, `CANCELLED`, or `TIMED_OUT`
 
+Also confirm each candidate has exactly one primary sweep label (`full-sweep-fail-fast`, `full-sweep-enabled`, or `non-canary-full-sweep-enabled`), e.g. with `gh pr view <PR> --repo SemiAnalysisAI/InferenceX --json labels --jq '.labels[].name'`. Without one, a pushed fix starts no GPU sweep. With more than one, `check-changelog` fails (see 2c). A Klaud-Cold PR's sweep labels must be exactly `full-sweep-fail-fast` (or `full-sweep-enabled` for a documented infrastructure exception), with no modifiers, or Klaud validation fails.
+
 `gh pr list --json statusCheckRollup` truncates rollups, so enumerate candidates first, then re-query each PR individually.
 
 ```bash
@@ -86,6 +88,7 @@ Inspect the PR diff (`git -C "$WT" diff origin/main...HEAD`) and the failing-log
 - New required env var or container path → patch the recipe.
 - Resource ask too high for the runner → drop concurrency or tp.
 - Flaky infra (network, runner pickup) → not a code fix. Flag and skip.
+- `check-changelog` fails with `PR has multiple conflicting sweep labels. Pick exactly one.` → not a code fix. After user confirmation, remove each extra primary label with `gh api -X DELETE repos/SemiAnalysisAI/InferenceX/issues/<PR>/labels/<name>` so exactly one remains; on a Klaud-Cold PR, keep `full-sweep-fail-fast` (or the documented `full-sweep-enabled` exception) and also remove any modifiers. Removing the last extra label starts the sweep, so push nothing.
 
 State the suspected root cause in one or two sentences before proposing any edit.
 
 
@@ -30,7 +30,7 @@ State buckets:
 - **RUNNING.** No checks have failed. At least one is `QUEUED` / `IN_PROGRESS` / `PENDING`.
 - **READY.** No checks have failed or remain pending, and at least one `Run Sweep` check is `SUCCESS`.
 - **NO_SUCCESS.** The sweep ran but never produced a `SUCCESS` (e.g. all matrix jobs got SKIPPED).
-- **NO_SWEEP.** No `Run Sweep` check exists for this head SHA at all. This usually means the sweep never triggered because the PR is missing a label such as `full-sweep-enabled` or `non-canary-full-sweep-enabled`.
+- **NO_SWEEP.** No `Run Sweep` check exists for this head SHA at all. `run-sweep.yml` triggers on pushes and label changes (not on PR open), only for PRs whose diff touches `inferencex-e2e/perf-changelog.yaml`, and GitHub skips it while the PR has merge conflicts. So this usually means the PR was opened without a primary sweep label (`full-sweep-fail-fast`, `full-sweep-enabled`, or `non-canary-full-sweep-enabled`) and has had no push or label change since, its diff does not touch the changelog, or it has merge conflicts.
 
 ```bash
 : > /tmp/klaud_pr_status.tsv
 
@@ -173,7 +173,7 @@ git add inferencex-e2e/perf-changelog.yaml && git commit -q --amend --no-edit &&
 Conventions:
 - `<PHRASE>` = `vLLM image` / `vLLM ROCm image` / `SGLang image` / `SGLang ROCm image`.
 - Title gets `(+mtp)` only when the family has an mtp sibling.
-- Every PR carries the **`full-sweep-fail-fast`** label (strongly recommended over `full-sweep-enabled` - a broken image bump burns one job per matrix, not the full fan-out) so CI kicks off.
+- Every PR carries the **`full-sweep-fail-fast`** label so CI kicks off. It is strongly recommended over `full-sweep-enabled`: both labels are gated by the same canary, so an image bump that fails the canary skips every other matrix either way. Fail-fast matters once the canary passes: a later failure then cancels the rest of its matrix instead of letting the whole fan-out run.
 - `<DESC>` = `Update <PHRASE> from <old-tag> to <TAG>` (note both tags when the
   base/mtp differ, e.g. base already on target).
 - PR body:
 
@@ -44,8 +44,13 @@ Run from a clean InferenceX checkout with authenticated `gh`, `git`, `jq`, and
   policy drift are allowed because source coverage is authoritative.
 - Preserve all historical `inferencex-e2e/perf-changelog.yaml` bytes. Append recovery entries
   only at the end.
-- Keep exactly one full-sweep label on the recovery PR and pin the source run
-  with `/reuse-sweep-run <run_id>` before pushing the changelog change.
+- Pin the source run with `/reuse-sweep-run <run_id>` before pushing the
+  changelog change. Reuse needs no sweep label. If one is applied, keep at most
+  one primary label (`full-sweep-fail-fast`, `full-sweep-enabled`, or
+  `non-canary-full-sweep-enabled`). Never add `evals-only` or `agentx-fast`:
+  they skip the PR reuse gate, so a primary label would start a GPU sweep, and
+  merge-time reuse rejects them. Reuse checks only current PR labels, so also
+  never pin a source run produced while the original PR carried either one.
 - The final recovery branch head must have the recovery commit as its first
   parent, the source run SHA as its second parent, and the recovery commit's
   file tree unchanged.
@@ -247,8 +252,9 @@ gh pr comment "$RECOVERY_PR" \
   --body "/reuse-sweep-run $SOURCE_RUN_ID"
 ```
 
-Keep exactly one of `full-sweep-enabled`,
-`non-canary-full-sweep-enabled`, or `full-sweep-fail-fast`.
+Reuse does not need this label. Keep at most one of `full-sweep-fail-fast`,
+`full-sweep-enabled`, or `non-canary-full-sweep-enabled`, and never add
+`evals-only` or `agentx-fast` (see the safety rules).
 
 ## 5. Append and validate the recovery changelog
 
 
@@ -32,19 +32,26 @@ A PR sweep requires exactly one primary label:
 - `full-sweep-enabled`: canary-gated full sweep without fail-fast. Use when a flaky job must not cancel its matrix's in-flight work.
 - `non-canary-full-sweep-enabled`: full sweep without canary or fail-fast. Use when both canary gating and fail-fast are unsuitable.
 
+`run-sweep.yml` sweeps run only on same-repository PRs that change `inferencex-e2e/perf-changelog.yaml`; the matrix comes from the appended entries. More than one primary label fails `check-changelog`, and modifiers alone start no GPU sweep (`check-changelog` still runs). Adding or removing any primary or modifier label cancels the in-progress sweep; a new one starts only while a primary label remains.
+
+Fork PRs run no `run-sweep.yml` jobs, not even changelog validation. A maintainer with `write`, `maintain`, or `admin` permission applies one primary label to an open, non-draft, conflict-free PR, and `.github/workflows/trusted-external-sweep.yml` dispatches `e2e-tests.yml` for that exact head SHA. That path runs no canary for any label, and only `full-sweep-fail-fast` sets fail-fast. Remove and re-add the primary label after each push to approve the new head.
+
+The canary is the lowest-concurrency non-eval single-node `1k1k`, `8k1k`, or AgentX entry, or a multi-node AgentX entry when there is no single-node candidate. If it fails, every other matrix is skipped. A sweep with only multi-node fixed-sequence or eval entries has no canary, so every matrix fans out at once and fail-fast is the only guard. No label trims concurrency; for a lowest-concurrency smoke run, dispatch `e2e-tests.yml` with `trim-conc: true`.
+
 Modifiers:
 
 - `all-evals` expands eval selection to every generated fixed-sequence configuration without suppressing throughput. It remains reuse-eligible; artifact reuse does not require a current sweep label.
-- `evals-only` suppresses throughput. Combining it with `all-evals` runs every eval and no throughput. It is not reuse-eligible.
-- `agentx-fast` uses one deterministic warmup request per lane and a 20-minute AgentX profile. It does not affect fixed-sequence or eval jobs and is not reuse-eligible.
+- `evals-only` suppresses throughput. Combining it with `all-evals` runs every eval and no throughput. Reuse is rejected while the PR carries it.
+- `agentx-fast` uses one deterministic warmup request per lane and a 20-minute AgentX profile. It does not affect fixed-sequence or eval jobs. Reuse is rejected while the PR carries it.
+- `all-evals` and `evals-only` fail `check-changelog` when the changelog additions include `append-only: true` or `no-evals: true` entries.
 
 Fail-fast is matrix-scoped: one matrix failure does not cancel other matrices, and completed results remain valid. The failed job remains red.
 
 Sweeps do not trigger while a PR has merge conflicts. For `inferencex-e2e/perf-changelog.yaml` conflicts, follow `inferencex-e2e/docs/KLAUD_DEBUG.md` section 1.1: merge `origin/main`, restore the file byte-for-byte from `origin/main`, then append only the PR's entry at the tail. Never 3-way merge the changelog.
 
 Pushes to `main` never run a sweep: `.github/workflows/run-sweep.yml` is PR-only. A push that changes `inferencex-e2e/perf-changelog.yaml` runs `.github/workflows/merge-ingest.yml` (Merge Ingest). Its single `ingest` job validates the merged PR's authorized `/use <run_id>` (or legacy `/reuse-sweep-run`) command and source run, then dispatches ingest of that reused PR sweep. Without valid reuse authorization the run fails, and nothing is benchmarked or ingested. `[skip-sweep]` only skips PR benchmark setup; changelog validation and reuse authorization checks still run, and Merge Ingest ignores it.
 
-Artifact reuse excludes runs with `evals-only` or `agentx-fast`. See `.github/workflows/README.md` and `uv run --project inferencex-e2e --extra workflows python -m infx.workflows.merge_with_reuse` for eligibility and merge behavior.
+Reuse is rejected while the PR currently carries `evals-only` or `agentx-fast`; this is checked when `/use` is acknowledged and at merge (and by `merge_with_reuse`). On a push these labels skip the reuse gate, so a primary label starts a fresh sweep. Source-run label history is not inspected, so pin only runs produced without those labels. Staging (`/stage-results`, also triggered by `/use <run_id>`) still requires a primary label on the PR and a source run created while one was applied. See `.github/workflows/README.md` and `uv run --project inferencex-e2e --extra workflows python -m infx.workflows.merge_with_reuse` for eligibility and merge behavior.
 
 ## Workflow dispatch and monitoring
 
@@ -78,11 +85,11 @@ The dispatch POST returns no body or run ID.
 
 Full details live in `inferencex-e2e/infx/evals/EVALS.md`.
 
-`mark_eval_entries()` in `inferencex-e2e/infx/matrix/generate.py` selects evals, which default to the 8k1k subset and run separately from throughput with `EVAL_ONLY=true`.
+`mark_eval_entries()` in `inferencex-e2e/infx/matrix/generate.py` selects evals, which default to the 8k1k subset plus AgentX GSM8K for every model, and run separately from throughput with `EVAL_ONLY=true`. Single-node AgentX GSM8K runs at the highest concurrency of each model/runner/framework/precision/spec-decoding/dp-attn/image group and uses the same `thresholds.yaml` floors as 8k1k. Kimi K3 and MiniMax M3 also run their vendor suites at every point, with GSM8K as an extra eval-only row.
 
 - `--no-evals`: skip evals.
 - `--evals-only`: run the default selected eval subset and suppress throughput.
-- `--all-evals`: expand selection to every generated fixed-sequence configuration. It composes with `--evals-only`.
+- `--all-evals`: expand selection to every generated fixed-sequence configuration. In `infx.matrix.generate`, it is eval-only even without `--evals-only`; in `infx.matrix.plan` (the PR label path), it only expands selection and composes with `--evals-only`.
 
 For multi-node configurations, `--all-evals` creates one eval job per engine topology and runs every distinct `conc-list` value sequentially against that engine. Changelog `all-evals: true` suppresses throughput for that entry. The PR `all-evals` label expands selection only, while the `evals-only` label suppresses throughput. `inferencex-e2e/infx/results/collect_eval_results.py` produces aggregated output.
 
 
@@ -30,7 +30,8 @@ Fixes #
 - [ ] I have tested my changes locally
 - [ ] I have updated documentation if necessary
 - [ ] **For every change that can affect benchmark performance and every recipe addition or modification, I have appended a new entry to the physical end of `inferencex-e2e/perf-changelog.yaml` and have not edited historical entries**
-- [ ] **Before merging via reuse, an authorized maintainer (`OWNER`/`MEMBER`/`COLLABORATOR`) has commented `/use <run_id>` (or the legacy `/reuse-sweep-run`) on this PR**. Do this **only once there is a final full sweep that is all green with evals passing**, since after this comment the sweep label will no longer automatically kick off new sweeps. Remove and re-add the label to force one.
+- [ ] **If this PR can affect benchmark performance or adds or modifies a recipe, it carries exactly one primary sweep label** (a maintainer applies it on fork PRs): `full-sweep-fail-fast` (recommended), `full-sweep-enabled`, or `non-canary-full-sweep-enabled`. Optional modifiers `all-evals`, `evals-only`, and `agentx-fast` require a primary label; the last two block reuse while applied.
+- [ ] **Before merging via reuse, an authorized maintainer (`OWNER`/`MEMBER`/`COLLABORATOR`) has commented `/use <run_id>` (or the legacy `/reuse-sweep-run`) on this PR**. Do this **only once there is a final full sweep that is all green with evals passing**, since after this comment the primary sweep label will no longer automatically kick off new sweeps. Remove and re-add the primary sweep label to force a new sweep.
 
 <details>
 <summary>中文</summary>
 
@@ -49,7 +49,7 @@ Never add or remove it yourself.
 Check capacity before edits/branch/PR creation, every targeted dispatch, the final label
 transition and capacity-related recovery: `check-capacity --cluster ID` (repeat for ALL
 actual targets). Require fresh, available telemetry and utilization strictly below 80%.
-Queue eligible work with normal scheduler controls; no skip_queue or priority overrides.
+Queue eligible work with normal scheduler controls; no priority overrides.
 If the check fails, report capacity-deferred and call finish. A utilization increase after
 dispatch never justifies cancelling healthy work. A benchmark capacity error alone is
 insufficient: recheck capacity before deciding to defer.