# Production status

This file answers the seven diligence questions directly. `DONE` means the
repository contains a tested implementation. `PARTIAL` means a real boundary
exists but production proof remains. `OPEN` means external evidence or work is
still required.

| # | Requirement | State | Current receipt | Remaining proof |
|---|---|---|---|---|
| 1 | Request and tenant isolation | **DONE (control plane)** | Hashed tenant keys, SQLite tenant namespaces, scoped card assignments and receipts, body/rate/concurrency limits, no traceback disclosure | Adversarial multi-process and distributed-store testing |
| 2 | Batching, KV cache, latency, throughput, GPU metrics | **PARTIAL** | Compatibility-aware microbatcher; Transformers backend uses `use_cache=True`; benchmark and GPU peak metrics exist | Sustained 7B/14B load test on a production GPU |
| 3 | vLLM integration | **PARTIAL** | OpenAI-compatible vLLM backend and signed-card per-request LoRA model routing | Native worker plugin for residual/activation cards |
| 4 | Signed packages and sandbox | **DONE (declarative cards)** | Reproducible Ed25519 `.bpcard` archives; strict allowlist; checksums; optional signer trust set; no executable members | Out-of-process/WASM ABI before third-party executable cards |
| 5 | Real workloads and larger models | **PARTIAL** | Prior Qwen3-1.7B and Ministral-3-3B receipts are preserved; clean backend supports arbitrary compatible HF models | Re-run packaged benchmarks on 7B/14B models and customer data |
| 6 | Direct comparisons | **PARTIAL** | Reproducible control-plane benchmark with explicit scope; research baselines retained | Cost/latency/quality study versus RAG, prompt policy, tools, and per-request LoRA on the same workload |
| 7 | Design partner | **PILOT READY** | Three-tenant support/operations/research pilot, API, receipts, deployment templates | A real external design partner and success criterion |

## Current public-demo boundary

The public website calls the same API contract and exercises tenant routing,
policy, memory, exact compute, telemetry input, scheduling, and receipts. Its
backend is deterministic so the demo can run safely on a small public server.
It is labeled **control-plane sandbox**, not neural inference.

The Hugging Face backend is the real local-model execution path. It supports
operator-registered, artifact-hash-bound PEFT adapters with caller-owned
metadata activation; adapter paths never enter signed packages. The vLLM
backend maps the same signed adapter card to a governed served-model name.
Residual cards remain unsupported in vLLM HTTP mode until a worker plugin can
enforce their lifecycle inside the inference engine.

## 2026-07-25 local GPU closure receipt

The Transformers backend loaded a private PEFT adapter over a 4-bit
FastContext-1.0-4B-RL base on an NVIDIA GeForce RTX 5060. A strict
caller-owned envelope armed the signed card, and the execution receipt recorded
measured latency plus a roughly 2.77 GB peak GPU allocation. The same prompt
with the card inactive reproduced the Whetstone frozen-base output; the active
request reproduced the admitted candidate output.

This is a one-prompt deployment replay attached to a 38-item paired Whetstone
evaluation, not a sustained throughput or 7B/14B load test. The path-free
execution, admission, and adoption receipts live in Foundry's
`evidence/gpu_cycle_20260725/` bundle.

