Repo brief: verl-project/verl

Generated by RepoPilot · document generated 2026-09-16 · concise human review Evidence snapshot · analyzed 2026-09-16T19:35:56.700Z · commit 10db40d0da4d

Verdict

Healthy — Healthy across all four use cases

• Last commit today
• 57+ active contributors
• Distributed ownership (top contributor 16% of recent commits)
• Apache-2.0 licensed
• 2 more receipts on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against dependency CVEs from deps.dev and OpenSSF Scorecard

What it is

verl is a production-ready reinforcement learning training library for large language models (LLMs) that implements HybridFlow, a flexible post-training framework. It enables efficient execution of RL algorithms like GRPO and PPO through a hybrid-controller programming model, with seamless integration into existing LLM infrastructure (vLLM, SGLang, Megatron-LM, FSDP) and support for sophisticated device mapping strategies across multi-GPU clusters. Monolithic repo with Python codebase (7.1M lines); Docker directory contains 40+ production Dockerfiles organized by hardware platform (docker/ascend/ for Ascend NPU, docker/rocm/ for AMD, docker/verl0.4-cu124-torch2.6-fa2.7.4/ for NVIDIA stacks…

Start here

Open these first:

• verl/__init__.py — Package initialization exposing public APIs for the RL training library framework.
• verl/base_config.py — Core configuration schema that all components and experiments inherit from, defining the baseline contract.
• pyproject.toml — Project metadata, build system, and development dependencies specification for installation and testing.
• verl/checkpoint_engine/base.py — Abstract checkpoint engine interface that all distributed storage backends (NCCL, HCCL, etc.) implement.
• requirements.txt — Full development dependency set including Ray, Hydra, transformers, and liger-kernel for RL training workflows.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Repository provides no setup.py or pyproject.toml in the file list; infer using pip from requirements.txt: git clone https://github.com/verl-project/verl.git && cd verl && pip install -r requirements.txt. Verify the a…

Daily commands:

No Makefile or runnable entry point visible in file list. Consult README.md for scripts or examples/. Docker approach is primary: `docker build -f docker/verl0.5-cu126-torch2.7-fa2.7.4/Dockerfile.app.vllm.mcore0.13 -t v…

…shortened for this brief.

Key cautions & unknowns

• Scorecard: known vulnerabilities detected (scored 0/10 by OpenSSF)
• 1. transformers version is highly constrained (>=5.5.3,!=5.6.0,<5.11) due to a known flash-attention crash (huggingface/transformers#45588); upgrading without testing breaks training. 2) tensordict range is fragmented…
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.