feat: move runtime check rule zips to external repo

Remove zip files from git tracking and host them in
gim-home/ModelKitArtifacts. Add download script and README
with setup instructions for developers.

- .gitignore: exclude runtime_check_rules/*.zip
- scripts/download_rules.py: sparse checkout from source repo
- runtime_check_rules/README.md: setup and manual copy instructions
- runtime_checker_query.py: improved warning when zips are missing

Author: timenick

.gitignore

@@ -261,3 +261,6 @@ specs/
 /settings.local.json
 .claude/settings.local.json
 /sa_eval_results/
+
+# Runtime check rule zips (hosted in external repo)
+src/winml/modelkit/analyze/rules/runtime_check_rules/*.zip

pyproject.toml

@@ -256,6 +256,8 @@ lint.per-file-ignores."__init__.py" = [ "D104", "E402", "F401", "F403" ]
 lint.per-file-ignores."examples/**" = [ "ANN", "D100", "D103", "S101", "T20" ]
 # E2E eval scripts: Allow print, long lines in HTML templates, try-except in loops
 lint.per-file-ignores."scripts/e2e_eval/**" = [ "ANN", "D103", "E501", "PERF203", "T20" ]
+# Download scripts: Allow subprocess, print, missing docstrings
+lint.per-file-ignores."scripts/download_rules.py" = [ "D103", "E501", "PERF401", "S603", "S607", "SIM108", "T20" ]
 # CLI: Allow print statements
 lint.per-file-ignores."src/winml/modelkit/cli.py" = [ "T20", "T201" ]
 lint.per-file-ignores."src/winml/modelkit/commands/**" = [ "T20", "T201" ]

scripts/download_rules.py

@@ -0,0 +1,102 @@
+# -------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+# --------------------------------------------------------------------------
+"""Download runtime check rule zips from gim-home/ModelKitArtifacts.
+
+Usage:
+    uv run python scripts/download_rules.py          # download missing zips
+    uv run python scripts/download_rules.py --force   # re-download all zips
+"""
+
+import argparse
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+
+SOURCE_REPO = "gim-home/ModelKitArtifacts"
+SOURCE_URL = f"https://github.com/{SOURCE_REPO}.git"
+SOURCE_PATH = "op_check_results/rules"
+RULES_DIR = (
+    Path(__file__).resolve().parent.parent
+    / "src"
+    / "winml"
+    / "modelkit"
+    / "analyze"
+    / "rules"
+    / "runtime_check_rules"
+)
+
+
+def _sparse_clone(clone_url: str, dest: Path) -> bool:
+    """Sparse-clone only the rules folder. Returns True on success."""
+    result = subprocess.run(
+        [
+            "git",
+            "clone",
+            "--depth",
+            "1",
+            "--filter=blob:none",
+            "--sparse",
+            clone_url,
+            str(dest),
+        ],
+        capture_output=True,
+        text=True,
+    )
+    if result.returncode != 0:
+        return False
+    result = subprocess.run(
+        ["git", "sparse-checkout", "set", SOURCE_PATH],
+        cwd=dest,
+        capture_output=True,
+        text=True,
+    )
+    return result.returncode == 0
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="Download runtime check rule zips")
+    parser.add_argument("--force", action="store_true", help="Re-download all zips")
+    args = parser.parse_args()
+
+    existing = set() if args.force else {f.name for f in RULES_DIR.glob("*.zip")}
+
+    with tempfile.TemporaryDirectory() as tmp:
+        tmp_path = Path(tmp) / "repo"
+        print(f"Cloning {SOURCE_REPO} (sparse: {SOURCE_PATH})...")
+
+        if not _sparse_clone(SOURCE_URL, tmp_path):
+            print(
+                f"ERROR: Failed to clone {SOURCE_REPO}.\n"
+                "Make sure git credentials are configured for the gim-home org.",
+                file=sys.stderr,
+            )
+            sys.exit(1)
+
+        src_dir = tmp_path / SOURCE_PATH
+        zips = list(src_dir.glob("*.zip"))
+
+        if not zips:
+            print(f"No zip files found in {SOURCE_REPO}/{SOURCE_PATH}")
+            sys.exit(1)
+
+        RULES_DIR.mkdir(parents=True, exist_ok=True)
+        copied = 0
+        for zip_file in zips:
+            if zip_file.name in existing:
+                continue
+            shutil.copy2(zip_file, RULES_DIR / zip_file.name)
+            copied += 1
+
+        total = len(zips)
+        skipped = total - copied
+        size_mb = sum((RULES_DIR / z.name).stat().st_size for z in zips) / 1024 / 1024
+        print(f"Done. Copied: {copied}, skipped: {skipped}, total: {total} ({size_mb:.0f} MB)")
+
+
+if __name__ == "__main__":
+    main()

src/winml/modelkit/analyze/core/runtime_checker_query.py

@@ -138,6 +138,10 @@ def _ensure_loaded(self) -> None:
         import zipfile
 
         if not self._zip_path.exists():
+            logger.debug(
+                "Rule zip not found: %s. Copy rule zips from gim-home/ModelKitArtifacts.",
+                self._zip_path,
+            )
             return
         try:
             with zipfile.ZipFile(self._zip_path, "r") as zf:
@@ -211,7 +215,12 @@ def _load(self) -> None:
             if self._set_error_on_missing:
                 self[EG_RULE_ERROR_KEY] = "rules_zip_not_found"
                 self[EG_RULE_DEBUG_DETAILS_KEY] = str(self._zip_path)
-                logger.warning(f"Rule zip file not found: {self._zip_path}")
+                logger.warning(
+                    "Rule zip file not found: %s. "
+                    "Copy rule zips from gim-home/ModelKitArtifacts to "
+                    "src/winml/modelkit/analyze/rules/runtime_check_rules/",
+                    self._zip_path,
+                )
             return
 
         with zipfile.ZipFile(self._zip_path, "r") as zf:

src/winml/modelkit/analyze/rules/runtime_check_rules/README.md

@@ -0,0 +1,25 @@
+# Runtime Check Rules
+
+This directory contains zip files with runtime check rules (negative rules and tables) used by the static analyzer. Each zip corresponds to a specific `{EP}_{Device}_{Domain}_opset{N}` combination.
+
+The zip files are **not tracked by git**. They are hosted in a separate repo.
+
+## Setup
+
+### Option 1: Download script (recommended)
+
+```bash
+uv run python scripts/download_rules.py
+```
+
+The script does a sparse checkout (downloads only the zip folder, not the full repo) and copies files here. Requires git credentials configured for the `gim-home` org.
+
+Use `--force` to re-download all files even if they already exist locally.
+
+### Option 2: Manual copy
+
+Copy all `*.zip` files from [`gim-home/ModelKitArtifacts/op_check_results/rules/`](https://github.com/gim-home/ModelKitArtifacts/tree/main/op_check_results/rules) into this directory.
+
+## What happens if zips are missing
+
+The analyzer will log a warning and treat affected operators as unknown. Analysis results will be incomplete but will not crash.