A result needs
a falsifier.

01. Authoring stack

The active native graph-authoring path is SwiftMIL: Swift code emits typed MILSpec Program, Function, Block and Operation structures, serializes them as a Core ML .mlpackage with a manifest and external weights, and compiles through Apple's public coremlcompiler.

A separate ANERECore path operates on existing MIL text and weight files: parsing, printing, transactional rewrites, weight-file analysis and blob-offset audits. We distinguish new-graph authoring from surgery on an already emitted graph. Python-based conversion tools serve as external reference; they are not a required local runtime dependency.

SwiftMIL  → MILSpec protobuf → .mlpackage
                                │
                                ▼
                     xcrun coremlcompiler
                                │
                                ▼
                   .mlmodelc / MLComputePlan
                                │
                                ▼
              native Swift inference + parity

02. Placement audit

Every relevant function and per-op assignment is inspected using MLComputePlan with the expected compiled artifact identity. A device preference such as .all is not treated as proof. Operators are classified by assigned compute unit, and the result names both the computation graph and the functions examined.

On the Qwen path, FP16 four-dimensional tensor shape (1,H,1,S) is a practical lowering constraint. A standalone normalization subgraph can be sent to CPU while a normalization embedded inside a convolution/matmul-anchored block can be assigned to ANE. The surrounding graph matters as much as the operator name.

KV-state operations require their own placement audit. A failing isolated slice_update experiment did not prove state writes were inherently CPU-bound; inspecting the production state pattern falsified that inference.

03. Numerical parity

For a sealed artifact, compare on-device outputs against a pinned reference tensor fixture. Read MLMultiArray in logical stride order, reject NaN/Inf, normalize documented layout permutations, and compare each exposed output rather than a single final-token guess.

Thresholds belong to a specific test contract, not global correctness guarantees. A diagnostic graph with extra output taps may cause the compiler to lower the program differently; its numerical differences must be reported separately from production inference.

04. Performance qualification

Report input shape and what the numerator counts. For aggregate batch throughput, divide actual generated tokens across all active lanes by measured elapsed time. Avoid assigning a batch size merely by dividing a single-token dispatch latency by B or K; the compiled program must itself contain the matching dimension.

Separate cold compilation, model loading, warmup and steady-state inference. State whether a result is single-stream, aggregate batch, speculative verification or a micrograph probe; they are not interchangeable. Track thermal state and memory pressure on the 8 GB A18 Pro test machine.

05. Negative results stay visible

Early work proposed a 57.3 tok/s bandwidth ceiling inferred from a compiler-reported DRAM budget and compressed model size. A K sweep contradicted the prediction; reducing weights to LUT2 also failed to improve throughput. Later observations refined the explanation again: at shallow depth, fixed dispatch cost dominates; at 28 layers, per-layer compute becomes the larger contributor.

Such reversals are part of the result. A model should be rejected as a causal explanation when it fails a straightforward counter-experiment.

06. Authorized and bounded research

MacBrains Labs experiments on owned Apple Silicon systems and software artifacts with a lawful basis for analysis. The research includes system performance qualification, compiler output examination, binary-format inspection, native-runtime debugging, defensive code review, and validation of software and infrastructure under the operator's control. Work is conducted through public APIs and authorized userspace inspection paths; the lab does not claim privileged firmware access or unbounded authorization to assess third-party systems.

Private measurements and internal repositories are not automatically published. We publish bounded technical summaries, identify instrumentation limits, and make supporting details available for legitimate technical correspondence when shareable.