# Runtime and artifact pins

`config.yaml` is authoritative. This page explains why the values are fixed.

## Checkpoint

- Repository: `Qwen/Qwen3-Coder-Next-FP8`
- Revision: `da6e2ed27304dd39abadd9c82ef50e8de67bdd4c`
- Files verified: 52 (the complete pinned upstream snapshot, including all 40 shards)
- Manifest: `results/SHA256SUMS.fp8`
- Manifest SHA-256: `d7269c078ec614ae57792ec63da00b3e13cf88e61f421ef4bcf4bdaac54b0190`

The pull script will not accept an alternate repository, revision, manifest digest,
missing shard, duplicate/incomplete marker, or partial verification. It also
requires the `hf` executable's absolute path and independently reviewed SHA-256,
uses a private staging directory, and never overwrites an existing model tree.

## Runtime

- vLLM: `0.25.1`
- Commit: `752a3a504485790a2e8491cacbb35c137339ad34`
- OCI-index image reference: `vllm/vllm-openai@sha256:e4f88a835143cd22aee2397a26ec6bb80b3a4a6fe0c882bcbc63822904766089`
- Selected platform: `linux/arm64`
- arm64 platform manifest: `sha256:2cc49b81319f7a66a33dd8bd63a7bfddae079122b33ce51989b6828a1f038c37`
- Image config / Docker image ID: `sha256:30a38a1d74a17365eca400e83ffd885b250e0c8c0d3c5b508afa8c412d2ddf95`
- Native tool parser: `qwen3_coder`
- Trust-remote-code: not enabled

The digest is embedded in `scripts/serve_vllm_fp8.sh`; environment variables cannot
silently replace it with a floating image. The launcher verifies Docker's local
`default` context, then executes every daemon operation in a clean client
environment with `DOCKER_HOST` fixed to the root-owned local Unix socket. It
checks the local image ID and arm64 platform and uses `--pull never`.

## Pack-source binding

The runtime scripts require both `QWEN_ALLOWED_PACK_ROOT` and an independently
recorded `QWEN_EXPECT_PACK_REVISION`. The checkout must have the canonical GitHub
origin, the exact 40-hex commit, and no tracked changes. `main`, a moving tag,
or computing the authorization value from an unreviewed checkout is not a pin.
The launcher, internal runtime library, and checksum manifest must also be
tracked by that authorized commit.

Pack, allowed model root, model files, checksum manifest, runtime library,
downloader, Docker client, and relevant parent chains are checked for canonical
paths, ownership, write modes, symlinks, and hard links before use.

## DGX Spark profile

- One GB10: tensor parallel size 1
- Maximum model length: 32,768 tokens
- Maximum active sequences: 1
- GPU/unified-memory utilization ceiling: 0.80
- Pre-load available-memory minimum: 96 GiB
- Active swap: forbidden at launch
- Single-model residency: required
- Automated residency screen: known model-server processes/containers plus memory and swap
- Full GPU compute-process attestation: not implemented; freeze operator confirmation required
- Complete snapshot SHA-256 pass: repeated after both runtime locks are held
- Docker socket, context, daemon, image ID, and platform: repeated after both locks are held
- Qwen pull/serve serialization: `/run/user/<uid>/saqs-qwen3-coder-next-model-operation.lock.d`
- Shared host residency lock: `/run/lock/saqs-dgx-spark-model-residency.lock.d`

These are conservative launch controls, not performance claims. In particular,
32K is a configured ceiling until an effective-context receipt is published.

## Network and authentication limits

Docker publishes port 8001 on host loopback through the verified local daemon.
The launcher requires a random `VLLM_API_KEY`; vLLM applies it to requests whose
paths start with `/v1`, `/v2`, or `/inference`. Other paths are not authenticated
by that mechanism. This is a trusted single-user-loopback profile: loopback is
reachable by local processes/users and is not a sandbox or firewall. The key is
passed through the Docker environment and is inspectable by root or Docker
administrators. Remote users should use an authenticated SSH tunnel, or a
separately reviewed TLS proxy that protects the entire service.

## Unsupported day-0 paths

GGUF and NVFP4 are not supported by this Preview runtime. Historical helper files
do not change the canonical FP8 path, and `scripts/serve_spark.sh` is only an alias
for `scripts/serve_vllm_fp8.sh`.