@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-24.04
     permissions:
       contents: read
-      actions: read # Download the pinned upstream build artifact.
+      actions: read # Reuse the pinned prepared runtime artifact.
       packages: write # Publish the verified image to the repository-linked GHCR package.
     timeout-minutes: 30
     env:
@@ -28,8 +28,9 @@ jobs:
       GPU_AGENT_SHA: bcae57f9b395363f3340ad0b7393659b7df13f37
       ARCHIVE_NAME: device-metrics-exporter-v1.5.4-10.2.0a20261001.tar.gz
       ARCHIVE_SHA256: 0ba397bc31abc1c538e24f8d7264fb421cc5fb8dd59b2e1c493a8efec404c2ba
-      BASE_IMAGE: rocm/device-metrics-exporter:10.2.0a20261001
+      BASE_IMAGE: powerx-amd-recovered:runtime-36985488002
       BASE_CONFIG_ID: sha256:aa151c70573fd5d3f94538c73adac6b235f052bb7dc9a8681ad2bfd0a8417929
+      RECOVERY_SQUASH_SHA256: 0f2cbb4e2c41c1506db74c6653ea09ec5e7d42236d9532e2bc38fb9e0be5879e
       IMAGE_REF: ghcr.io/semianalysisai/amd-device-metrics-exporter:powerx-9d0eb8c-cache-${{ github.sha }}
       ENROOT_PACKAGE: enroot_4.2.0-1_amd64.deb
       ENROOT_PACKAGE_SHA256: 50bfcf8336bfe1a5d19481081d7800ae80300a27795595757f7d20957e079a62
@@ -50,12 +51,12 @@ jobs:
         with:
           go-version: 1.25.13
           cache: false
-      - name: Download exact official runtime image
+      - name: Download the retained prepared runtime
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          repository: ROCm/device-metrics-exporter
-          run-id: 36867107435
-          name: build-dme-10.2.0a20261001
+          repository: SemiAnalysisAI/InferenceX
+          run-id: 36985488002
+          artifact-ids: 11217112734
           github-token: ${{ github.token }}
           path: ${{ runner.temp }}/amd-exporter-image
       - name: Apply cache patch and test the exporter
@@ -80,11 +81,19 @@ jobs:
         run: |
           set -eo pipefail
           source inferencex-e2e/benchmarks/benchmark_lib.sh --validation-only
-          check_env_vars IMAGE_DIR OUTPUT_DIR ARCHIVE_NAME ARCHIVE_SHA256 BASE_IMAGE BASE_CONFIG_ID IMAGE_REF \
-            SOURCE_SHA PATCH_SHA256 GITHUB_REPOSITORY GITHUB_SHA
-          printf '%s  %s\n' "$ARCHIVE_SHA256" "$IMAGE_DIR/$ARCHIVE_NAME" | sha256sum --check -
-          docker image load --input "$IMAGE_DIR/$ARCHIVE_NAME"
-          test "$(docker image inspect "$BASE_IMAGE" --format '{{.Id}}')" = "$BASE_CONFIG_ID"
+          check_env_vars IMAGE_DIR OUTPUT_DIR RECOVERY_SQUASH_SHA256 BASE_IMAGE IMAGE_REF \
+            ENROOT_PACKAGE ENROOT_PACKAGE_SHA256 SOURCE_SHA PATCH_SHA256 GITHUB_REPOSITORY GITHUB_SHA
+          printf '%s  %s\n' "$RECOVERY_SQUASH_SHA256" "$IMAGE_DIR/amd-exporter.sqsh" | sha256sum --check -
+          curl --fail --location --output "$IMAGE_DIR/$ENROOT_PACKAGE" \
+            "https://github.com/NVIDIA/enroot/releases/download/v4.2.0/$ENROOT_PACKAGE"
+          printf '%s  %s\n' "$ENROOT_PACKAGE_SHA256" "$IMAGE_DIR/$ENROOT_PACKAGE" | sha256sum --check -
+          sudo apt-get update
+          sudo apt-get install --yes squashfs-tools "$IMAGE_DIR/$ENROOT_PACKAGE"
+          sudo unsquashfs -d "$IMAGE_DIR/rootfs" "$IMAGE_DIR/amd-exporter.sqsh"
+          mkdir -p "$OUTPUT_DIR"
+          sudo python3 tools/amd-exporter/recover-base.py "$IMAGE_DIR/rootfs" \
+            "$IMAGE_DIR/provenance.json" tools/amd-exporter/base-runtime.json \
+            "$BASE_IMAGE" "$OUTPUT_DIR/base-recovery.json"
           docker build --pull=false --build-arg "BASE_IMAGE=$BASE_IMAGE" \
             --label "org.opencontainers.image.source=https://github.com/$GITHUB_REPOSITORY" \
             --label "org.opencontainers.image.revision=$GITHUB_SHA" \
@@ -120,11 +129,6 @@ jobs:
           check_env_vars IMAGE_DIR OUTPUT_DIR IMAGE_REF ENROOT_PACKAGE ENROOT_PACKAGE_SHA256 SOURCE_SHA \
             PATCH_SHA256 GPU_AGENT_SHA ARCHIVE_NAME ARCHIVE_SHA256 BASE_CONFIG_ID GITHUB_REPOSITORY \
             GITHUB_RUN_ID GITHUB_RUN_ATTEMPT GITHUB_SHA
-          curl --fail --location --output "$IMAGE_DIR/$ENROOT_PACKAGE" \
-            "https://github.com/NVIDIA/enroot/releases/download/v4.2.0/$ENROOT_PACKAGE"
-          printf '%s  %s\n' "$ENROOT_PACKAGE_SHA256" "$IMAGE_DIR/$ENROOT_PACKAGE" | sha256sum --check -
-          sudo apt-get update
-          sudo apt-get install --yes "$IMAGE_DIR/$ENROOT_PACKAGE"
           enroot import --output "$OUTPUT_DIR/amd-exporter.sqsh" "dockerd://$IMAGE_REF"
           unsquashfs -s "$OUTPUT_DIR/amd-exporter.sqsh"
           cp tools/amd-exporter/cache.patch "$OUTPUT_DIR/cache.patch"
 
@@ -4,10 +4,10 @@
 
 The CPU-only `AMD exporter image` workflow builds a fresh-sample exporter and publishes a unique tag to `ghcr.io/semianalysisai/amd-device-metrics-exporter`. It does not start a GPU benchmark or change production data.
 
-The base is the official ROCm nightly artifact from run `36867107435`, source `9d0eb8c88af99f1dbe2914d803382092671456d9`. Its archive checksum and image config digest are verified before use. The runtime includes the upstream 255 W sentinel correction. `cache.patch` applies the configurable GPUGet cache change from [functionstackx/device-metrics-exporter#1](https://github.com/functionstackx/device-metrics-exporter/pull/1), with a default-cache regression and concurrent zero-cache tests.
+The official ROCm nightly artifact from run `36867107435` has been deleted upstream. Reuse the retained Enroot conversion from InferenceX run `36985488002`, artifact `11217112734`, verified against squash SHA256 `0f2cbb4e2c41c1506db74c6653ea09ec5e7d42236d9532e2bc38fb9e0be5879e` and its original provenance. It contains source `9d0eb8c88af99f1dbe2914d803382092671456d9`. The runtime includes the upstream 255 W sentinel correction. `cache.patch` applies the configurable GPUGet cache change from [functionstackx/device-metrics-exporter#1](https://github.com/functionstackx/device-metrics-exporter/pull/1), with a default-cache regression and concurrent zero-cache tests.
 
-Only `/home/amd/bin/server` is replaced. The original ROCm and GPUAgent layers and entrypoint are retained. `AMD_GPU_GET_CACHE_TTL=0s` forces each exporter request to issue a new GPUGet RPC. This removes exporter response reuse; actual hardware freshness, overhead and one-second benchmark collection still require live validation.
+`base-runtime.json` records the original Docker configuration and hashes/symlink targets for 61 critical paths, extracted from the retained official OCI archive. Recovery verifies GPUAgent, entrypoint, AMD-SMI, ROCm sysdeps and companion binaries before importing the root filesystem with the original environment, entrypoint, labels and working directory. Enroot flattened layers, normalized ownership/permissions and generated its `/etc` startup files; the reconstructed base has a new identity and is not the original OCI image. Only `/home/amd/bin/server` is replaced in the subsequent overlay. `AMD_GPU_GET_CACHE_TTL=0s` forces each exporter request to issue a new GPUGet RPC. This removes exporter response reuse; actual hardware freshness, overhead and one-second benchmark collection still require live validation.
 
-The workflow verifies the patch checksum, runs focused cache race tests, builds Linux/amd64, checks the image's version and invalid-setting rejection, and verifies the unchanged base layers and runtime configuration. It then publishes a commit-specific tag and saves an Enroot squash with `SHA256SUMS` and `provenance.json` in `amd-dme-cache-squash`. Consumers must record the published registry digest and the squash checksum. The source commit, patch hash, GPUAgent commit and workflow revision are separate provenance fields; the embedded ROCm commit is explicitly unknown.
+The workflow verifies the patch checksum, runs focused cache race tests, builds Linux/amd64, checks the image's version and invalid-setting rejection, and verifies the unchanged reconstructed base layers and runtime configuration. It then publishes a commit-specific tag and saves an Enroot squash with `SHA256SUMS` and `provenance.json` in `amd-dme-cache-squash`. Consumers must record the published registry digest and the squash checksum. `base-recovery.json` records the recovery run/artifact, source receipt, runtime manifest hash, verified-file count and reconstructed image identity. The source commit, patch hash, GPUAgent commit and workflow revision are separate provenance fields; the embedded ROCm commit is explicitly unknown.
 
 Dispatch this workflow manually on the reviewed branch, or push the dedicated `chore/powerx-amd-exporter-image` branch. The job has a 30-minute CPU limit and needs `packages: write`. It does not move a `latest` tag. A successful image build is preparation, not AMD measurement acceptance.
@@ -4,10 +4,10 @@
 
 仅使用 CPU 的 `AMD exporter image` 工作流构建可获取新读数的 exporter，并向 `ghcr.io/semianalysisai/amd-device-metrics-exporter` 发布唯一标签。它不启动 GPU 基准测试，也不修改生产数据。
 
-基础镜像来自官方 ROCm nightly 工作流 `36867107435`，源码为 `9d0eb8c88af99f1dbe2914d803382092671456d9`。使用前校验归档 SHA256 和镜像配置摘要。该运行时包含上游 255 W 哨兵值修复。`cache.patch` 基于 [functionstackx/device-metrics-exporter#1](https://github.com/functionstackx/device-metrics-exporter/pull/1) 的可配置 GPUGet 缓存修改，并补充默认缓存回归测试和零缓存并发测试。
+官方 ROCm nightly 工作流 `36867107435` 的原始产物已被上游删除。现在复用 InferenceX 工作流 `36985488002` 保留的 Enroot 转换产物 `11217112734`，校验 squash SHA256 `0f2cbb4e2c41c1506db74c6653ea09ec5e7d42236d9532e2bc38fb9e0be5879e` 及原始来源回执。其源码为 `9d0eb8c88af99f1dbe2914d803382092671456d9`。该运行时包含上游 255 W 哨兵值修复。`cache.patch` 基于 [functionstackx/device-metrics-exporter#1](https://github.com/functionstackx/device-metrics-exporter/pull/1) 的可配置 GPUGet 缓存修改，并补充默认缓存回归测试和零缓存并发测试。
 
-只替换 `/home/amd/bin/server`，保留原有 ROCm、GPUAgent 镜像层及入口。`AMD_GPU_GET_CACHE_TTL=0s` 强制每次 exporter 请求发起新的 GPUGet RPC。这消除了 exporter 响应复用；硬件实际刷新率、采集开销和基准测试中的一秒采集仍需实机验证。
+`base-runtime.json` 从保留的官方 OCI 归档提取原始 Docker 配置，以及 61 个关键路径的文件哈希和符号链接目标。恢复过程先验证 GPUAgent、入口脚本、AMD-SMI、ROCm sysdeps 和配套二进制，再使用原始环境变量、入口、标签及工作目录导入根文件系统。Enroot 已合并镜像层、规范化所有权和权限，并生成 `/etc` 启动文件，因此重建基础镜像使用新标识，不能称为原始 OCI 镜像。之后仅在新增镜像层替换 `/home/amd/bin/server`。`AMD_GPU_GET_CACHE_TTL=0s` 强制每次 exporter 请求发起新的 GPUGet RPC。这消除了 exporter 响应复用；硬件实际刷新率、采集开销和基准测试中的一秒采集仍需实机验证。
 
-工作流校验补丁摘要，运行缓存竞态测试，构建 Linux/amd64 二进制，检查版本与非法配置拒绝行为，并验证基础镜像层及运行时配置未变。随后发布提交专属标签，生成 Enroot squash，并将 `SHA256SUMS`、`provenance.json` 保存为 `amd-dme-cache-squash` 产物。使用方应记录发布的注册表摘要及 squash 校验值。源码提交、补丁哈希、GPUAgent 提交和工作流版本分别记录；二进制中的 ROCm 提交明确标记为未知。
+工作流校验补丁摘要，运行缓存竞态测试，构建 Linux/amd64 二进制，检查版本与非法配置拒绝行为，并验证重建基础镜像层及运行时配置未变。随后发布提交专属标签，生成 Enroot squash，并将 `SHA256SUMS`、`provenance.json` 保存为 `amd-dme-cache-squash` 产物。使用方应记录发布的注册表摘要及 squash 校验值。`base-recovery.json` 记录恢复工作流和产物、原始来源回执、运行时清单哈希、已验证文件数及重建镜像标识。源码提交、补丁哈希、GPUAgent 提交和工作流版本分别记录；二进制中的 ROCm 提交明确标记为未知。
 
 在已审阅分支手动触发，或推送专用分支 `chore/powerx-amd-exporter-image`。CPU 作业上限为 30 分钟，需要 `packages: write` 权限，不移动 `latest` 标签。镜像构建通过只代表准备完成，不代表 AMD 功耗测量已验收。