Add marimo MNIST + W&B Registry example

[johndmulhausen]

Summary

Adds the first marimo notebook to this repo at examples/marimo/mnist-registry/. It trains a small PyTorch CNN on MNIST, produces a rich Weights & Biases run, saves the model as an Artifact, links it into a W&B Registry collection, and then consumes the registered model to classify held-out digits. Two small GitHub Actions workflows support the example.

Dependencies are declared in a PEP 723 inline block, so uvx marimo edit mnist_registry.py --sandbox self-installs them. No new top-level deps for the repo.

What the notebook demonstrates

• Form-driven hyperparameters. A marimo mo.ui.form collects hyperparameters and W&B targets; training runs only when you submit it with Train model (editing a field never kicks off a run).
• A single "Training" W&B section: loss and accuracy charts, a confusion matrix, a per-digit PR curve, a predictions table (with images), and penultimate-layer embeddings for W&B's 2D projector (one cluster per digit). Final/best accuracy and parameter count are set on the run summary.
• Model Artifact + cross-org Registry link. run.link_artifact(target_path="wandb-registry-<registry>/<collection>"), with logged.wait() before linking and a try/except that surfaces inline remediation (e.g. view-only-seat guidance) instead of crashing — the run and artifact still succeed.
• Consume the model. The Evaluation cell downloads the model (registered version first, run artifact as fallback) into a fresh network and classifies ten test digits.
• Team entity. The run must target a team entity (personal entities were removed for accounts created after May 2024); the notebook surfaces a friendly error if it isn't set.
• Defensive run lifecycle. A guard finishes any prior run before wandb.init, so re-submitting the form never nests runs.

The notebook is organized into helper functions via marimo's @app.function for readability.

Metrics use W&B's default step x-axis (per-batch Training/loss, per-epoch Training/accuracy); there is no wandb.define_metric/epoch-axis setup.

Supporting CI

• .github/workflows/marimo_export_md.yml — on push, exports each marimo notebook to a peer Markdown file and commits it, so the notebook renders as a reviewable diff on GitHub.
• .github/workflows/marimo_molab.yml — posts a PR comment linking each modified marimo notebook to molab to run it in a hosted environment.

Files

• examples/marimo/mnist-registry/mnist_registry.py — the notebook
• examples/marimo/mnist-registry/mnist_registry.md — its exported Markdown peer (kept in sync by CI)
• examples/marimo/mnist-registry/README.md — prereqs, how to run, design notes
• examples/marimo/mnist-registry/requirements.txt — pip mirror of the PEP 723 block
• .github/workflows/marimo_export_md.yml, .github/workflows/marimo_molab.yml

Test plan

• uvx marimo edit examples/marimo/mnist-registry/mnist_registry.py --sandbox opens with all cells rendering; the form is interactive and does not train until Train model is submitted.
• Submitting with defaults (3 epochs) trains in ~2 min on CPU, reaching >97% test accuracy; the run shows the Training section (loss, accuracy, confusion matrix, PR curve, predictions table, embeddings) and run-summary headline metrics.
• The mnist-cnn-<run-id> model Artifact is logged and linked to wandb-registry-model/MNIST Classifiers; the Evaluation cell classifies 10 test digits.
• A view-only seat / missing Registry surfaces inline remediation instead of crashing; unchecking Link artifact to Registry still logs the Artifact.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​marimo@​0.23.15

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[johndmulhausen]

▶️ Run the marimo notebook(s) in this PR

molab launches any public marimo notebook on GitHub in a hosted environment — no local setup required.

Notebook	molab
examples/marimo/mnist-registry/mnist_registry.py

Links track the head of jmulhausen/marimo-mnist-registry-example.

[johndmulhausen]

Triage: Socket license alerts on marimo@0.23.9

Both alerts (sdist + wheel) are license-policy warnings (licenseSpdxDisj) — not vulnerability or malware findings — and the Socket checks themselves pass, so they're non-blocking.

marimo publishes under Apache-2.0, declared via the PEP 639 license_expression field with the legacy license field left null (verified on PyPI). Apache-2.0 is a permissive, OSI-approved license. The alert is an artifact of the license being expressed in the newer metadata format rather than a real licensing risk, so accepting it for this PR is appropriate.

@SocketSecurity ignore pypi/marimo@0.23.9

[johndmulhausen]

Socket re-scan 8a2c0e64 — same marimo@0.23.9 license alert, re-affirming

This is the already-triaged licenseSpdxDisj warning, re-posted by a fresh scan on the latest push — not a new finding. marimo is Apache-2.0 (permissive, OSI-approved; verified on PyPI); the alert is about SPDX license-expression formatting, not a vulnerability or malware; and both Socket checks pass (non-blocking). No code change applies here — marimo is the notebook's runtime dependency and requirements.txt is a mirror of its PEP 723 block.

Re-affirming PR-scoped acceptance for this scan:

@SocketSecurity ignore pypi/marimo@0.23.9

Durable fix (so this stops re-nagging on every push): allowlist Apache-2.0 for the org in the Socket dashboard — an admin/security-team action, outside what I can do from a PR.

[Copilot]

Pull request overview

Adds a new examples/marimo/ MNIST notebook demonstrating training a small PyTorch CNN, logging to W&B, and linking a logged model artifact into a W&B Registry collection, plus GitHub Actions automation for exporting marimo notebooks to Markdown and for posting molab “run this notebook” PR links.

Changes:

• Add a self-contained marimo MNIST → W&B Artifact → W&B Registry notebook (+ exported Markdown peer) under examples/marimo/mnist-registry/.
• Add docs and a requirements.txt mirror for the notebook’s PEP 723 dependency block.
• Add GitHub Actions workflows to (a) auto-export marimo notebooks to Markdown on push and (b) comment molab links on PRs.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
examples/marimo/mnist-registry/mnist_registry.py	New marimo notebook implementing training, W&B logging, artifact creation, and registry linking.
examples/marimo/mnist-registry/mnist_registry.md	Exported Markdown version of the notebook for static rendering.
examples/marimo/mnist-registry/README.md	Run instructions, prerequisites, and design notes for the example.
examples/marimo/mnist-registry/requirements.txt	Pip requirements mirroring the PEP 723 dependency block.
.github/workflows/marimo_export_md.yml	Workflow to export examples/marimo/**/*.py notebooks to peer .md files and commit updates.
.github/workflows/marimo_molab.yml	Workflow to post/update PR comments with molab links for modified marimo notebooks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[w-b-hivemind]

HiveMind Sessions

1 session · 45m · $41

Session	Agent	Duration	Tokens	Cost	Lines
Improve W&B Dashboard Training Visualizations 8bf6cd13-9203-4c2d-a1c2-35499359d19c	claude	45m	165.8K	$41	+146 -81
Total		45m	165.8K	$41	+146 -81

View all sessions in HiveMind →

Run claude --resume 8bf6cd13-9203-4c2d-a1c2-35499359d19c to pickup where you left off.

[thedriftofwords]

Note: I was just having my agent extract Marimo-specific constraints and style choices from this PR, and it flagged something:

I flagged that the README has drifted from the code (still describes wandb.watch gradient histograms and a 16-image prediction gallery that were removed a few commits later). Worth pinging the PR author, since it'll confuse anyone using this as a template.

Worth running a final agent check to ensure the README caught up with all the changes made and that it's internally consistent; you can ping me for a re-review if you end up changing anything.

[ngrayluna]

The clean notebooks check is probably not relevant here. It is supposed to clear metadata, cells outputs from a notebook. (But we're converting to a Py script.)

[johndmulhausen]

@thedriftofwords good catch — fixed the README drift in 9c104aa. Dropped the stale wandb.watch gradient-histogram and 16-image-gallery claims and rewrote What you get to the actual W&B report (Training loss/accuracy, confusion matrix, PR curve, predictions table, 2D-projector embeddings, run-overview headline metrics). Also added the team-entity prerequisite, documented the in-notebook Evaluation step, and reworded the gating note for the marimo form. I ran an independent agent audit of README↔notebook afterward and it reports full consistency. Ready for a re-review whenever you like.

🤖 Addressed by Claude Code

[johndmulhausen]

Agreed, @ngrayluna — that check runs nb_helpers.fix_nbs ./colabs/ to strip .ipynb metadata/outputs, and this PR adds only a marimo .py, so it doesn't apply. The failure itself is unrelated dependency rot: nb_helpers imports Param from fastcore.script, which fastcore ≥ 1.8 removed (verified: 1.7.29 still has it). No change needed on this PR — a fastcore<1.8 pin in cleanup.yml would green it repo-wide if the team wants that.

🤖 Addressed by Claude Code

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (8)

examples/marimo/mnist-registry/mnist_registry.py:582

• wandb.define_metric("epoch") (and epoch-based charts) only work if each wandb.log call includes an epoch value. Right now loss logs omit epoch, so the x-axis will remain W&B's default step counter.

        if batch_idx % 50 == 0:
            wandb.log({"Training/loss": loss.item()})

examples/marimo/mnist-registry/mnist_registry.py:683

• Accuracy logs also need to include the current epoch value; otherwise wandb.define_metric(... step_metric="epoch") won’t affect the chart x-axis.

        wandb.log({"Training/accuracy": test_acc})

examples/marimo/mnist-registry/mnist_registry.py:289

• The notebook claims (in the PR description) to use wandb.define_metric with epoch as the x-axis, but the run initialization never calls wandb.define_metric. Add metric definitions right after wandb.init() so subsequent logs can attach to epoch.

This issue also appears in the following locations of the same file:

• line 581
• line 683

        run = wandb.init(
            project=cfg["project"] or None,
            entity=cfg["entity"] or None,
            name=cfg["run_name"] or None,
            config=config,
            job_type="train",
        )

examples/marimo/mnist-registry/mnist_registry.py:4

• The inline dependency block declares marimo>=0.9, but this notebook was generated with marimo 0.23.11 (__generated_with) and the repo workflow pins 0.23.9 for exports. The minimum marimo version should be aligned to the generated/pinned version so users don’t end up installing an older incompatible marimo release.

#     "marimo>=0.9",

examples/marimo/mnist-registry/requirements.txt:3

• requirements.txt should stay in sync with the PEP 723 dependency block; marimo>=0.9 is much lower than the marimo version this notebook was generated/exported with. Bump the minimum marimo version to match the notebook’s __generated_with / export pin.

marimo>=0.9

examples/marimo/mnist-registry/mnist_registry.md:3

• This exported Markdown front matter records marimo-version: 0.23.9, but the source notebook advertises __generated_with = "0.23.11". Align the export version with the notebook’s generated version (by bumping the exporter pin and re-exporting) so the repo stays byte-deterministic and version-consistent.

marimo-version: 0.23.9

.github/workflows/marimo_molab.yml:107

• This workflow builds a Markdown table row using untrusted PR-controlled values (path, headRef). Unescaped backticks/pipes can break the table or inject unintended Markdown, and unencoded characters (e.g., #, spaces) can produce broken molab URLs. Escape Markdown metacharacters in the rendered path and URL-encode ref/path components when constructing the molab link.

            const rows = notebooks.map((path) => {
              // The `/server` suffix opens the notebook in a hosted runtime;
              // without it molab shows a static, non-runnable preview.
              const url = `https://molab.marimo.io/github/${headOwner}/${headRepo}/blob/${headRef}/${path}/server`;
              return `| \`${path}\` | [![Open in molab](https://marimo.io/molab-shield.svg)](${url}) |`;

.github/workflows/marimo_export_md.yml:31

• MARIMO_VERSION is pinned to 0.23.9, but the notebook being exported declares __generated_with = "0.23.11". Pinning the exporter to the same version avoids version skew and reduces the chance that a future export changes output formatting unexpectedly.

  MARIMO_VERSION: "0.23.9"