Repository navigation
LA-04: Bound memory and local execution #98
Description
Part of #84. Release: 0.8.0. Owner: Codex, assigned by Anders on 11 Oct.
Done means
- Admission accounts for model weights, context, scratch and Home headroom. Memory observation fails closed when required host/cgroup files are unreadable.
- Run journals have bounded record size, count and aggregate work while active and uncertain bindings remain recoverable.
- Installed CI proves 1 GiB refusal before engine start and the 4 GiB reply, busy, idle, crash and recovery lifecycle.
- The local execution boundary across Runtime data roots is explicit and tested.
- Anders accepts the memory/recovery journeys on Mac, Linux and Jetson on the release that carries Local AI for 0.8.0: reliable Stop and switch, engine updates keep models, plain refusals, bounded journals (#84) #348 (alpha.16).
Current scope
Follow #84's 11 Oct ordered audit. Item 5 supplies journal bounds and fail-closed memory observation; item 7 supplies finite installed CI; item 8 defines execution ownership. #100's Stop and activation repair comes first. The existing alpha.15 page-cache fix remains part of the fetched base and needs released-device acceptance.
After 0.8.0, #99 owns hostile provider confinement and #104 owns Qwen3.5 qualification. Existing historical #136 and 8 Oct packet evidence remains in their prior issue history; current source acceptance uses the candidate below.
Acceptance record
Candidate and checks: see #84.
Metadata
Metadata
Assignees
Labels
No labels
Activity
andersalm commentedon Sep 30, 2026
LA-04 source work starts on
feat/0.7.1-model-resources, based onorigin/feat/0.7.1-modelscommit77c83c56dd13fdbdca65db37232114cbd9883a6c(tree3b5ec0c43569027fd40f680f35350bda5888f5f6). The worktree is clean and the local lifecycle record names #98. Mac and Linux x86-64 are the active scope; Jetson and full acceptance retain the #97 and #96 gates. The next step is to inspect existing admission, queue, and engine ownership controls before choosing the smallest repair.andersalm commentedon Sep 30, 2026
Source review found an existing 10% preparation disk reserve and guarded child cleanup. Execution still needs observed-memory admission and ownership across Runtime roots. The first working slice adds one active local run, at most eight waiting runs, cancellation before engine startup, cleanup after interrupted generation, and a 60-second idle release. Focused model-provider tests now run in the shared build slot. This is source work on base 77c83c5; installed proof, required reviews, #96, and Jetson/#97 remain open.
andersalm commentedon Sep 30, 2026
Candidate ef1495c adds the bounded local queue, startup cancellation, model-switch cleanup, and idle release. All 232 model-provider unit tests and the four basic repo gates passed; two installed-model tests remain opt-in. The next working slice adds the account-wide empty-file lease and observed-memory admission. Guard/process cleanup tests passed after lease inheritance was added. New process fixtures now check cross-root busy/recovery and refusal before engine startup. PR and installed Mac/Linux proof remain pending; Jetson/full acceptance still depend on #97 and #96.
andersalm commentedon Sep 30, 2026
Candidate 6da5d73 (tree ac0b4db4b7cca3914bb8db4ed87806ed73182c20) adds host memory admission and the account-wide engine lease. Mac checks passed: 239 unit tests, 9 production process tests, and all four basic repo gates. Process proof includes cross-root busy and crash recovery, one active plus eight waiting runs, waiting cancellation, and low-memory refusal before spawn. The queue/idle slice has independent agent review; full-slice review is underway. Before review publication, origin/feat/0.7.1-models is 0 commits ahead and this branch is 2 commits ahead. A standalone optional clippy check reports existing argument-count warnings; required repo gates passed. Installed Home proof, unsupported memory-layout profiles, required human review, #96 and Jetson/#97 remain open.
andersalm commentedon Sep 30, 2026
Draft PR #136 now carries candidate 6da5d73, pushed to origin/feat/0.7.1-model-resources. Local and remote task refs match (0/0 divergence). Source proof is 239 unit tests, 9 production process tests, and the four basic gates. The PR targets feat/0.7.1-models. I am checking the installed provider with the pinned Mac SmolLM2 engine in two isolated data roots; installed Home and Linux x86 proof remain open. Required review and Jetson/#97 gates are unchanged.
andersalm commentedon Sep 30, 2026
PR #136 now has the installed-provider proof in progress on macOS arm64. The fixture uses candidate 6da5d73 with matching built/installed provider SHA-256 3c4e591730089cb2c43806c5fc12dab1a6ae134b569ed2a0d82f98626473d280, verified SmolLM2 bytes, and the pinned b10516 engine. It uses two new private data roots and tests reply, busy, idle release, crash cleanup, and reuse. Existing Homes stay under their current owners. This provider proof is separate from Home UX and Linux installed acceptance.
andersalm commentedon Sep 30, 2026
PR #136 CI run 36710078594 passed source-gate and custody-harness-smoke; the other jobs are running. The isolated Mac installed-provider test has a completed real SmolLM2 reply and an exact model_busy result from the second data root. It is testing the 60-second idle release next, then crash cleanup and reuse. The first proof attempt stopped at the fixture's five-second polling limit; the harness now allows the configured generation deadline and preserves that first attempt. Full-source review is checking memory estimates and Linux cgroup failures before this draft can leave review.
andersalm commentedon Sep 30, 2026
Independent review of draft PR #136 at
6da5d738f6923e868d35e7b6b18f3df8d1a139c1(treeac0b4db4b7cca3914bb8db4ed87806ed73182c20) found three source issues to resolve before acceptance.F1 / P2:
local_memory.rs:119reserves scratch from weight size alone. The pinned engine uses a default physical batch of 512 and supports a non-flash attention path; a 32,768-token context with 32 heads needs a 2 GiB float score tensor alone. Bind scratch admission to the launch batch, context, heads, and other compute buffers, then test a small-weight model at the maximum supported context. Pinned defaults and attention allocation support this estimate.F2 / P2:
local_memory.rs:291and line 312 ignore cgroup observation errors. An unreadable membership or controller file can substitute host memory totals for a constrained process. Refuse unavailable observations and test membership errors, controller errors, and parent-group limits; distinguish the valid controller-less root case.F3 / P2:
local_memory.rs:75requires the optional KV-head count. Ordinary attention models can omit it; the pinned engine defaults it to the head count. Use that default and add a missing-key regression test.The bounded GGUF reader, account lease ownership and descriptor inheritance, queue reservation, and idle/close paths had no other findings in this source review. I ran no build or test and left the worker's installed-proof changes untouched.
Qwen3.5 memory profiles remain an explicit #98/#104 gap. Installed Mac/Home and Linux proof, required human review, LA-02 integration, and Jetson proof after #97 remain acceptance gates.
29 remaining items
andersalm commentedon Oct 2, 2026
PR #136 has prepared candidate07c6f4f74d08291d0b8b8169a1d4e2b94a9091fd / treef4e049a522114ea6761e51004c298584580ff79e: normal integration of verified153f6 (f0444eb), fetched developc7cc9804 (9775d3d), then the finite-unit proof concern (07c6f4f). Current-base merge-tree returns the same tree.
Source checks passed:249 provider unit tests,10 production-process tests,15 policy tests,10 resource-harness tests, four basic gates, Node/shell syntax and YAML. Two independent gpt-6.1-sol high rounds passed exact staged diff f6d6db78b9865da6e5dc630b2d716503ae4d3804e865ad83bf52963c5656c002 and candidate diff5211b8acfe7bd46e281de7376010ea1791ffb92489d8c120233d251a35c39cc2.
Linux CI now has fresh same-account1GiB refusal/4GiB CPU lifecycle fixtures with complete global cgroup ancestry, actual limits, exact source/tree/Runtime/provider/test/engine/GGUF hashes and recursive descendant checks before service cleanup. Admission, leases, queue, batch128 and disabled caches are preserved; receipts separate full/compile/qualification time and keep raw logs private.
Fast-forward pushed origin/feat/0.7.1-model-resources from1ab6eadf to07c6f4f7; task divergence is0/0 and the own worktree is clean. The existing feature-owner worktree remains clean at1ab6eadf,71 commits behind the remote, with its local branch and history preserved.
Next: the exact-candidate installed Linux CI receipt; its new run entry is pending after the push and source checks leave that gate open. PR136 retains draft, #97/#133, reviewed155 integration, installed human acceptance, backend/Home peak-memory qualification and Irzhy's current-candidate approval gates; #100 waits for #98/#99.
andersalm commentedon Oct 2, 2026
PR #136 remains blocked on #133’s Carrier bind repair and new operator adversarial review; #155 is now integrated into develop by PR #155.
Linux resource CI 36958989636 was pending at the bounded read; its finite-cgroup installed result stays separate from ordinary reply proof.
The engine-input and Mac timing changes continue in their existing issues; LA-06: Activate and switch without restarting Home #100 keeps its LA-04: Bound memory and local execution #98/LA-05: Enforce Linux model process isolation #99 dependencies.
andersalm commentedon Oct 2, 2026
Blocked: draft PR136
77dd1c984842c33658b480b6eed38c69e67a933f/ tree6134a77ec5c570f5359696518214958aa6117a64passed source jobs, then stopped before model work in CI36964466444. Receipt merge1efbe1bebinds this head and develop6443f321; Mac Runtime SHA-2564c24b7df8bc6393e0d2595995d193f81145dac9a1798c8bebcb1796a4e893d1f, providerb7593824e259e3ed979f5073cdcc3ca7976ecf58a69a73eea49596b1ff423591. All nine images were inspected: signed-in Home renders, Marketplace is empty; Mac/ARM fail withERR_BLOCKED_BY_RESPONSEat 9.37/14.35s, x86 waits 30s (37.51s journey).Self-requested Claude Opus review now fails: the inherited unsupported ARM engine check aborts Home setup, and another account can pre-create the shared temporary lease file and block local models. The next resource candidate needs an account-owned lease directory, preserving one global same-account ownership domain and refusing foreign ownership/symlinks, plus narrow tests. Isolation owns the #202 installed correction and handoff; #98 follows green current #153, then proves 1GiB refusal before engine spawn and 4GiB shared-busy/idle/crash/recovery/final-descendant cleanup with exact source/tree/provider/test/engine/GGUF bindings. Current descendant cleanup and backend/Home peak-memory qualification remain open; #100 waits for #98/#99.
andersalm commentedon Oct 2, 2026
Parked on 2 October for #89; PR136 stays draft at
77dd1c984842c33658b480b6eed38c69e67a933f/ tree6134a77ec5c570f5359696518214958aa6117a64, published and clean, remote divergence 0/0.Done: resource admission, queue/account lease lifecycle, finite-cgroup CI harness, source/refused-case checks and development review.
Left: installed CI stops before model work; Opus review fails unsupported-ARM Home continuation and the predictable shared-tmp lease availability gap. Linux lifecycle and backend/Home peak-memory acceptance remain open.
Resume after Anders restores Local AI and current PR153 installed success: use a verified account-owned lease directory, repair refusals, integrate accepted dependencies and prove 1GiB refusal plus 4GiB busy/idle/crash/recovery/descendant cleanup in CI.
Keep the preserved original worktree, hashes and safe receipts; #100 remains paused with its #98/#99 dependencies.
Merge pull request #322 from Elacity/train/alpha13
andersalm commentedon Oct 15, 2026
Moved to After 0.8.0 (audit 15 Oct). Proof for the done parts: 1 local_memory.rs:365 and host_memory.rs:776 plus the alpha.16 container refusal (#84 6169389408); 3 develop CI job 116595929400 at 5b60f67 (its summary fails unless finite_1gib_refusal and finite_4gib_lifecycle pass); 4 host_lock.rs:552. Item 2 (recovery of uncertain runs) is in #379.
andersalm commentedon Oct 18, 2026
Sasha reports that alpha.22 SmolLM2 135M on his 48 GB Mac started after he freed memory; see #84. This supports pressure-sensitive admission, while installed hashes and numeric readings remain unverified.
Proposed follow-up: expose estimated weights/KV/scratch/reserve, available memory and the macOS pressure result, including unknown/error; calibrate the reserve against measured engine/Home peaks, then offer a smaller context when it fits safely and Retry with a fresh reading. Existing model replacement and idle release already apply.
Prove installed generation, cancellation, pressure refusal and successful retry after memory becomes available, with prompt retention, cleanup and a responsive Home. The broad After 0.8.0 disposition stays in place; the current #84 journey remains open.
andersalm commentedon Oct 19, 2026
Anders reports frequent Mac memory refusals, and OMP has started an isolated measurement of the shipped engines and models.
At local source
c40c70d53,host_memory.rs:429–473already includes file-backed and purgeable pages in available memory;local_memory.rs:18–20permits the 40% rule only at normal pressure. The free-page count andmemory_pressurepercentage measure different things from that admission value.Treat a false refusal and negligible cost from mapped weights as hypotheses until matching installed readings, engine load/generation peaks and cleanup are measured. #98 remains After 0.8.0; a proposed rule needs review, explicit scope and the current #84 installed journey.
andersalm commentedon Oct 19, 2026
macOS false refusal, measured on Anders's 24 GiB M5 (19 Oct,
/tmp/mem-measurement.md): today's rule refuses every local model under ordinarywarningpressure, even a 0-byte model.normalpressure, and the Mac reportedwarningin all 61 samples taken over 10 min.Fix for 0.8.0, macOS only (devil's advocate MODIFY applied; branch
fix/98-macos-memory-admission, Claude agent, then Codex review):Not proven: behaviour on an 8 GiB Mac. The stop at critical pressure is the guard for that case.
andersalm commentedon Oct 19, 2026
The saved study contains four direct engine runs on one 24 GiB Mac and 61 pressure samples over ten minutes. Qwen runs coincide with 276 and 231 MiB of system swap-out; these global counters include other activity. Installed Runtime admission and UI recovery remain separate checks.
OMP's revised candidate plan keeps scratch and headroom, and adds pressure monitoring during loading and generation. Simulated critical pressure can test that control flow; response on a smaller Mac and release of engine memory still need candidate evidence.
The current rule already counts free, purgeable and file-backed pages. Keep the proposed ceiling and one-second stop guarantee under exact-head review, with the accepted #84 Get, reply, Stop, recovery and retention journeys.
andersalm commentedon Oct 19, 2026
Source review PASS at
e9826802d49281efc0bb5563d504a51028bc367ecloses the held text-delta acknowledgement blocker. The review covers Stop and Critical pressure during send and acknowledgement; the older terminal acknowledgement after LocalRun drops remains a separate limit.Both completed current-head remote attempts end with a missing exit status, so the candidate still needs a completed gate verdict. Author unit checks and injected controls retain their recorded scope.
OMP has integrated the correction locally. Actual Mac Warning/Critical pressure, 8 GiB contention, installed Retry with prompt retention, engine cleanup and the full #84 journey remain open.