SAQS freeze card sync from 617c08a30546 (parent 7525c28aecc6; role Preview; gitignore-aware)
e40f52e verified | # Runtime and artifact pins | |
| `config.yaml` is authoritative. This page explains why the values are fixed. | |
| ## Checkpoint | |
| - Repository: `Qwen/Qwen3-Coder-Next-FP8` | |
| - Revision: `da6e2ed27304dd39abadd9c82ef50e8de67bdd4c` | |
| - Files verified: 52 (the complete pinned upstream snapshot, including all 40 shards) | |
| - Manifest: `results/SHA256SUMS.fp8` | |
| - Manifest SHA-256: `d7269c078ec614ae57792ec63da00b3e13cf88e61f421ef4bcf4bdaac54b0190` | |
| The pull script will not accept an alternate repository, revision, manifest digest, | |
| missing shard, duplicate/incomplete marker, or partial verification. It also | |
| requires the `hf` executable's absolute path and independently reviewed SHA-256, | |
| uses a private staging directory, and never overwrites an existing model tree. | |
| ## Runtime | |
| - vLLM: `0.25.1` | |
| - Commit: `752a3a504485790a2e8491cacbb35c137339ad34` | |
| - OCI-index image reference: `vllm/vllm-openai@sha256:e4f88a835143cd22aee2397a26ec6bb80b3a4a6fe0c882bcbc63822904766089` | |
| - Selected platform: `linux/arm64` | |
| - arm64 platform manifest: `sha256:2cc49b81319f7a66a33dd8bd63a7bfddae079122b33ce51989b6828a1f038c37` | |
| - Image config / Docker image ID: `sha256:30a38a1d74a17365eca400e83ffd885b250e0c8c0d3c5b508afa8c412d2ddf95` | |
| - Native tool parser: `qwen3_coder` | |
| - Trust-remote-code: not enabled | |
| The digest is embedded in `scripts/serve_vllm_fp8.sh`; environment variables cannot | |
| silently replace it with a floating image. The launcher verifies Docker's local | |
| `default` context, then executes every daemon operation in a clean client | |
| environment with `DOCKER_HOST` fixed to the root-owned local Unix socket. It | |
| checks the local image ID and arm64 platform and uses `--pull never`. | |
| ## Pack-source binding | |
| The runtime scripts require both `QWEN_ALLOWED_PACK_ROOT` and an independently | |
| recorded `QWEN_EXPECT_PACK_REVISION`. The checkout must have the canonical GitHub | |
| origin, the exact 40-hex commit, and no tracked changes. `main`, a moving tag, | |
| or computing the authorization value from an unreviewed checkout is not a pin. | |
| The launcher, internal runtime library, and checksum manifest must also be | |
| tracked by that authorized commit. | |
| Pack, allowed model root, model files, checksum manifest, runtime library, | |
| downloader, Docker client, and relevant parent chains are checked for canonical | |
| paths, ownership, write modes, symlinks, and hard links before use. | |
| ## DGX Spark profile | |
| - One GB10: tensor parallel size 1 | |
| - Maximum model length: 32,768 tokens | |
| - Maximum active sequences: 1 | |
| - GPU/unified-memory utilization ceiling: 0.80 | |
| - Pre-load available-memory minimum: 96 GiB | |
| - Active swap: forbidden at launch | |
| - Single-model residency: required | |
| - Automated residency screen: known model-server processes/containers plus memory and swap | |
| - Full GPU compute-process attestation: not implemented; freeze operator confirmation required | |
| - Complete snapshot SHA-256 pass: repeated after both runtime locks are held | |
| - Docker socket, context, daemon, image ID, and platform: repeated after both locks are held | |
| - Qwen pull/serve serialization: `/run/user/<uid>/saqs-qwen3-coder-next-model-operation.lock.d` | |
| - Shared host residency lock: `/run/lock/saqs-dgx-spark-model-residency.lock.d` | |
| These are conservative launch controls, not performance claims. In particular, | |
| 32K is a configured ceiling until an effective-context receipt is published. | |
| ## Network and authentication limits | |
| Docker publishes port 8001 on host loopback through the verified local daemon. | |
| The launcher requires a random `VLLM_API_KEY`; vLLM applies it to requests whose | |
| paths start with `/v1`, `/v2`, or `/inference`. Other paths are not authenticated | |
| by that mechanism. This is a trusted single-user-loopback profile: loopback is | |
| reachable by local processes/users and is not a sandbox or firewall. The key is | |
| passed through the Docker environment and is inspectable by root or Docker | |
| administrators. Remote users should use an authenticated SSH tunnel, or a | |
| separately reviewed TLS proxy that protects the entire service. | |
| ## Unsupported day-0 paths | |
| GGUF and NVFP4 are not supported by this Preview runtime. Historical helper files | |
| do not change the canonical FP8 path, and `scripts/serve_spark.sh` is only an alias | |
| for `scripts/serve_vllm_fp8.sh`. | |