Runtime and artifact pins
config.yaml is authoritative. This page explains why the values are fixed.
Checkpoint
- Repository:
Qwen/Qwen3-Coder-Next-FP8 - Revision:
da6e2ed27304dd39abadd9c82ef50e8de67bdd4c - Files verified: 52 (the complete pinned upstream snapshot, including all 40 shards)
- Manifest:
results/SHA256SUMS.fp8 - Manifest SHA-256:
d7269c078ec614ae57792ec63da00b3e13cf88e61f421ef4bcf4bdaac54b0190
The pull script will not accept an alternate repository, revision, manifest digest,
missing shard, duplicate/incomplete marker, or partial verification. It also
requires the hf executable's absolute path and independently reviewed SHA-256,
uses a private staging directory, and never overwrites an existing model tree.
Runtime
- vLLM:
0.25.1 - Commit:
752a3a504485790a2e8491cacbb35c137339ad34 - OCI-index image reference:
vllm/vllm-openai@sha256:e4f88a835143cd22aee2397a26ec6bb80b3a4a6fe0c882bcbc63822904766089 - Selected platform:
linux/arm64 - arm64 platform manifest:
sha256:2cc49b81319f7a66a33dd8bd63a7bfddae079122b33ce51989b6828a1f038c37 - Image config / Docker image ID:
sha256:30a38a1d74a17365eca400e83ffd885b250e0c8c0d3c5b508afa8c412d2ddf95 - Native tool parser:
qwen3_coder - Trust-remote-code: not enabled
The digest is embedded in scripts/serve_vllm_fp8.sh; environment variables cannot
silently replace it with a floating image. The launcher verifies Docker's local
default context, then executes every daemon operation in a clean client
environment with DOCKER_HOST fixed to the root-owned local Unix socket. It
checks the local image ID and arm64 platform and uses --pull never.
Pack-source binding
The runtime scripts require both QWEN_ALLOWED_PACK_ROOT and an independently
recorded QWEN_EXPECT_PACK_REVISION. The checkout must have the canonical GitHub
origin, the exact 40-hex commit, and no tracked changes. main, a moving tag,
or computing the authorization value from an unreviewed checkout is not a pin.
The launcher, internal runtime library, and checksum manifest must also be
tracked by that authorized commit.
Pack, allowed model root, model files, checksum manifest, runtime library, downloader, Docker client, and relevant parent chains are checked for canonical paths, ownership, write modes, symlinks, and hard links before use.
DGX Spark profile
- One GB10: tensor parallel size 1
- Maximum model length: 32,768 tokens
- Maximum active sequences: 1
- GPU/unified-memory utilization ceiling: 0.80
- Pre-load available-memory minimum: 96 GiB
- Active swap: forbidden at launch
- Single-model residency: required
- Automated residency screen: known model-server processes/containers plus memory and swap
- Full GPU compute-process attestation: not implemented; freeze operator confirmation required
- Complete snapshot SHA-256 pass: repeated after both runtime locks are held
- Docker socket, context, daemon, image ID, and platform: repeated after both locks are held
- Qwen pull/serve serialization:
/run/user/<uid>/saqs-qwen3-coder-next-model-operation.lock.d - Shared host residency lock:
/run/lock/saqs-dgx-spark-model-residency.lock.d
These are conservative launch controls, not performance claims. In particular, 32K is a configured ceiling until an effective-context receipt is published.
Network and authentication limits
Docker publishes port 8001 on host loopback through the verified local daemon.
The launcher requires a random VLLM_API_KEY; vLLM applies it to requests whose
paths start with /v1, /v2, or /inference. Other paths are not authenticated
by that mechanism. This is a trusted single-user-loopback profile: loopback is
reachable by local processes/users and is not a sandbox or firewall. The key is
passed through the Docker environment and is inspectable by root or Docker
administrators. Remote users should use an authenticated SSH tunnel, or a
separately reviewed TLS proxy that protects the entire service.
Unsupported day-0 paths
GGUF and NVFP4 are not supported by this Preview runtime. Historical helper files
do not change the canonical FP8 path, and scripts/serve_spark.sh is only an alias
for scripts/serve_vllm_fp8.sh.