VitisAI EP leaks original-info-signature.txt / original-model-signature.txt into the working directory

Summary

Any command that compiles a model through the VitisAI EP (for example winml eval auto-selecting the AMD NPU) leaves two stray files in the process working directory — which is the repository root when commands are run from a checkout:

original-info-signature.txt    (32 bytes, MD5 hex)
original-model-signature.txt   (32 bytes, MD5 hex)

They appear as untracked files in git status and are not covered by .gitignore.

Where they come from

They are not written by winml-cli — neither filename appears anywhere in this repository. A byte scan of the EP package identifies the writer:

HIT  onnxruntime_vitisai_ep.dll  at offset 59491832    (needle: "original-model-signature")

C:\Program Files\WindowsApps\
  MicrosoftCorporationII.WinML.AMD.NPU.EP.1.8_1.8.72.0_x64__8wekyb3d8bbwe\
  ExecutionProvider\onnxruntime_vitisai_ep.dll

The same two filenames are also written — correctly — inside the VitisAI cache directory:

C:\temp\<user>\vaip\.cache\<model-hash>\original-info-signature.txt
C:\temp\<user>\vaip\.cache\<model-hash>\original-model-signature.txt
C:\temp\<user>\vaip\.cache\<model-hash>\vaiml_par_1\original-info-signature.txt
C:\temp\<user>\vaip\.cache\<model-hash>\vaiml_par_1\original-model-signature.txt

So at least one code path inside the EP resolves these paths relative to the current working directory instead of anchoring them to its own cache directory.

Repro

Host: AMD Ryzen AI 9 HX 370 (NPU), VitisAI EP 1.8.72.0, onnxruntime 1.24.5 (windowsml).

cd <repo root>
winml eval -m dslim/bert-base-NER --task token-classification --samples 10
git status --porcelain

?? original-info-signature.txt
?? original-model-signature.txt

Also reproduces through pytest tests/e2e/test_eval_e2e.py -m e2e on an NPU host, since TestEvalPerTask lets the CLI auto-select hardware.

Impact

• Pollutes git status in a developer checkout and is easy to commit by accident.
• On CI agents the files land in the sources directory.
• Same class of problem as the ORT/EP scratch files that scripts/e2e_eval/run_eval.py::_clean_stray_cwd_artifacts already sweeps up (sym_shape_infer_temp.onnx, timing_log.csv, UUID-prefixed .onnx / _ctx.onnx dumps) — that helper does not cover these two names.

Suggested actions

1. Report upstream to AMD: the EP should anchor these signature files to its cache directory, never to the caller's working directory.
2. Mitigation on our side, until the EP is fixed:
   • add both filenames to _STRAY_CWD_EXACT in scripts/e2e_eval/run_eval.py, and/or
   • add them to .gitignore.