deploy thoxfast 058d0e08b664

Deploy the production-validated provider payload from ThoxRoute main 058d0e08b66487267a9f9389e6d0679f1b2361a7 (PR #69). Preserves existing .gitattributes.

Dockerfile

@@ -35,6 +35,7 @@ RUN python -c "from huggingface_hub import hf_hub_download; hf_hub_download('Qwe
 
 WORKDIR /app
 COPY --chown=$MAMBA_USER:$MAMBA_USER app.py /app/app.py
+COPY --chown=$MAMBA_USER:$MAMBA_USER THOXROUTE_GITHUB_SHA /app/THOXROUTE_GITHUB_SHA
 
 EXPOSE 7860
 CMD ["python", "/app/app.py"]

README.md

@@ -22,7 +22,10 @@ that request the full measured container CPU quota. A bounded six-second queue
 absorbs overlap; operators can still opt into at most two contexts with
 `THOX_FAST_POOL_SIZE` when throughput is more important than the 15-second cold
 turn contract. CPU allocation comes from the cgroup quota, so it does not repeat
-the historical host-count oversubscription regression. Streaming sends a role chunk before model
+the historical host-count oversubscription regression. The same quota is passed
+to llama.cpp's generation and prompt-evaluation thread pools; the batch pool is
+never allowed to infer a larger host CPU count and oversubscribe the constrained
+Space during a cold persona prefix. Streaming sends a role chunk before model
 evaluation so upstream time-to-first-byte watchdogs do not abandon healthy CPU
 work; two-second SSE comments keep the stream live during synchronous prompt
 evaluation. The interactive provider itself caps every request at 16 output
@@ -34,3 +37,24 @@ across otherwise unrelated personas without replacing caller instructions; the
 provider does not add this fast-chat prefix to specialist requests.
 The interactive model is pinned to immutable model revision
 `9217f5db79a29953eb74d5343926648285ec7e67` and baked into the image.
+The health response also reports the exact 40-character ThoxRoute Git revision
+baked into the Space image. Production acceptance must match this value rather
+than inferring deployment identity from a RUNNING stage alone.
+
+## Atomic production release
+
+From a clean checkout at the exact validated commit, supply a newly issued
+fine-grained token scoped to write only `Thox-ai/thoxrustcoder`:
+
+```bash
+export THOX_FAST_HF_DEPLOY_TOKEN='set-in-protected-shell-environment'
+python ops/deploy_thoxfast_space.py \
+  --expected-source "$(git rev-parse HEAD)" \
+  --expected-parent 45b26461379624b63430c7c3477eff63868cfaac
+```
+
+The helper ignores generic cached credentials, validates token metadata,
+rejects the known compromised token name, stages only the runtime allowlist,
+injects the owning Git SHA, and refuses to upload if either source cleanliness
+or the exact Space parent has changed. Never place the token in the repository,
+command arguments, logs, or a generic `HF_TOKEN` variable.

THOXROUTE_GITHUB_SHA

@@ -0,0 +1 @@
+058d0e08b66487267a9f9389e6d0679f1b2361a7

app.py

@@ -17,6 +17,7 @@ import uuid
 from contextlib import asynccontextmanager
 from collections.abc import Iterator
 from dataclasses import dataclass
+from pathlib import Path
 from typing import Any
 
 from fastapi import FastAPI, HTTPException
@@ -71,6 +72,20 @@ DEFAULT_SYSTEM = (
     "ran locally or on-device."
 )
 
+SOURCE_REVISION_FILE = Path(
+    os.environ.get("THOX_SOURCE_REVISION_FILE", "/app/THOXROUTE_GITHUB_SHA")
+)
+
+
+def _source_revision() -> str:
+    """Return the exact owning Git revision baked into the Space image."""
+
+    try:
+        revision = SOURCE_REVISION_FILE.read_text(encoding="utf-8").strip()
+    except OSError:
+        return "unknown"
+    return revision if len(revision) == 40 and all(c in "0123456789abcdef" for c in revision) else "unknown"
+
 
 def _usable_cpus() -> int:
     """Return the container CPU quota instead of the misleading host count."""
@@ -114,6 +129,11 @@ def _new_llama(path: str, *, threads: int):
         model_path=path,
         n_ctx=N_CTX,
         n_threads=threads,
+        # llama.cpp uses the batch pool for prompt evaluation and may derive
+        # its default from the host CPU count. Spaces expose more host CPUs
+        # than the container quota, so leaving this unset oversubscribes the
+        # exact cold-prefix phase that owns the interactive latency budget.
+        n_threads_batch=threads,
         n_gpu_layers=int(os.environ.get("THOX_GPU_LAYERS", "-1")),
         verbose=False,
     )
@@ -275,6 +295,8 @@ def healthz() -> dict[str, Any]:
         "max_output_tokens": MAX_OUTPUT_TOKENS,
         "n_ctx": N_CTX,
         "threads": _usable_cpus(),
+        "prompt_threads": _usable_cpus(),
+        "source_revision": _source_revision(),
     }