Package and operate an authenticated model runner

ALYT keeps inference in a separate Linux process and image so the deterministic home-agent, routines, and resident radio keep their existing ownership. The optional runner uses the existing home-agent source and build dependencies, has its own bounded entry, private provisioning file, and durable state directory, and receives model context for bounded interpretation or reasoning. It has no platform, MQTT, actuator, execution, or provider credential.

Negotiate the structured Reasoning companion explicitly

The private tokenize and reason RPCs keep the legacy 0.1 manifest checks, receipt 0.2 history, and frozen reply handling, while the native graph path preserves the strict old graph 1.0 literal schema and uses the separate declared graph 1.1 schema only at the negotiated runner boundary. The graph records current state as COMPLETE, PARTIAL, or UNKNOWN, and it can carry an optional declared goal with goalId, per-record recordRevision, createdAt, expiresAt, the rooms involved, the entities involved, and selectedDeclaredGoalId, which must match the currently declared goal exactly. Missing older metadata stays unknown rather than zeroed, summarized, or assigned a global revision. Each RPC checks the original source, enrollment, evidence, and expiry at call time, and the existing PENDING_APPROVAL ledger remains mandatory; suggestions enter PENDING_APPROVAL and cannot approve or execute.

The companion retains the canonical context plus typed projection within24KiB, 32KiB request,16KiB response,4096 input/1024 output tokens, two reads, four controller steps and30-second absolute deadline. Both roles retain one shared inference slot and the existing lifecycle/cancellation owner. The shorter original context/projection expiry also bounds decoding; ALYT rechecks expiry after tokenization and before releasing output. Tokenization is measured by the installed adapter, not inferred from a remote admission receipt.

Returned findings cite only supplied observation refs and exact typed-goal ID/revision pairs, with selectedDeclaredGoalId correlation preserved and summaries or zero values never used for that linkage. Queries retain two bounded original query receipts, original context pins and bounded expiry; retries cite only FAILED/TIMED_OUT prior attempts. Duplicate/used query refs, unknown evidence/goals, expired reads and wrong-version replies are refused. These RPC checks do not grant permissions, perform context reads or confirm an effect. The original interactive shadow entry retains its legacy contract and refuses a companion placement; trusted consumers negotiate the private boundary explicitly. A fake/native test executable qualifies plumbing, not model quality.

Package shape and placement

Keep the existing Docker package behavior: build the home-agent image from the workspace, then build the runner image from that immutable home-agent image, and record both image digests. The current pinned base identity is Qwen/Qwen3-0.6B revision c1899de289a04d12100db370d81485cdf75e47ca together with openai/whisper-large-v3-turbo revision 41f01f3fe87f28c78e2fbf8b568835947dd65ed9; the retained incumbents are Smol and Small35. These training bases are not approved installed artifacts, and existing services ownership remains unchanged.

The target budget is 2 GiB total, allocated as 256 MiB for Linux, 96 MiB for HomeAgent with 48 MiB for V8, 64 MiB for the supervisor, 1536 MiB for both resident models, and 96 MiB for context reserve. The optional model unit is 1600 MiB, which equals 1536 + 64, and it remains private and inactive until reviewed provision. Keep CPU and PID caps finite, keep the unified cgroup subtree actual, and use loopback access without platform environment credentials or activation claims. These are installation limits rather than measured model performance, and the original Docker preflight range of 64 through 128 tasks remains distinct from the target unit’s 96-task admission.

Artifacts and manifest requirements

Pre-stage artifacts as regular files named by their SHA-256 digest in the read-only artifact mount. A manifest declares exact byte length, model, tokenizer, runner, and adapter revisions, contract and context versions, languages, quantization, target, and finite resources. ALYT hashes the installed file; it never downloads an RPC-supplied URL or opens a model-selected path. The installed adapter rejects unsupported contract versions. Voice and Reasoning share one active inference slot and a joint memory and storage allowance.

Lifecycle operations

Use the dedicated x-alyt-runner-key on JSON POST operations:

• /internal/physical-ai/runner/tokenize and /reason preserve the nonce, invocation, model, and binding revision of the prepared Reasoning interface.
• /internal/physical-ai/runner/lifecycle accepts the versioned installed identity and STATUS, STAGE, LOAD, UNLOAD, ACCEPT, ROLLBACK, or CANCEL operation.

STAGE verifies an artifact. LOAD checks backend health. Neither accepts a model into service. ACCEPT durably records the exact healthy staged manifest and prior accepted pair with an atomic private-file replacement. ROLLBACK loads the prior pair before recording it; a partial rollback unloads inference. Old and candidate weights are unloaded in order so updates do not double the model memory allowance. Inference failure does not replace the deterministic controller.

Failure, repair, and qualification

Fake uses the existing isolated worker. Real native adapters are selected only from private operator-provisioned installedAdapters (max 4, unique; alyt.fake/1 cannot be overridden). Each entry carries adapterId, role (VOICE or REASONING), contractVersion, contextVersion, executable, executableSha256, fixed args, and argumentFiles; every argument file records index, path, and sha256, and each absolute argv path must be pinned. Checked regular non-symlink files are not group- or other-writable; hashes are verified; retained descriptors bind the executable and argument files at spawn; supporting libraries come from the reviewed immutable image; no shell or inherited platform credentials are used. Draft JSON-lines IPC is alyt.native-runner-request/draft-0.1.0 and alyt.native-runner-reply/draft-0.1.0, sharing requestId and operation; replies are ok/result. Operations are load, tokenize, reason, speech-compile, and speech; load identity matches model, tokenizer, and adapter. Later replies must satisfy ALYT schemas and token caps. Only one active call is allowed; bytes and deadlines are finite; malformed or unsolicited replies fail closed. unload and cancel kill only the owned process group, including descendants after leader exit. Model-owner feasibility acknowledgment precedes shared freeze. Fake/native test bridge proves plumbing only: LOAD and lifecycle ACCEPT validate wiring and authenticated lifecycle repair, but they do not prove model quality, inference availability, or production activation; production activation is a separate step after ACCEPT. Reasoning requests and native frames additionally enforce 32KiB requests and 16KiB replies, with 24KiB context, 4KiB query history, 4096 input tokens, and 1024 output tokens. The original context must already exist and remain unexpired; its expiry cancels decoding even if the invocation deadline is later. The loaded contract and returned context ID/source revision must match the invocation, and no wrapper renews stale context or treats a successful token count as execution authority. Voice compile and lifecycle keep their separate 64KiB transport allowance, while bounded PCM speech requests keep their separate 800,000-byte allowance; these are distinct payloads, not an expanded Reasoning budget.

Register the healthy installed Reasoning identity, model, tokenizer, and binding in the existing trusted placement registry. Geography states where inference actually runs; application SELF hosting alone does not prove property-local inference. Background context comes only from ALYT’s existing authenticated projection and shadow owners. Run the private package preflight after setting the explicit deployment inputs; it validates the package without printing the private configuration. Qualify exact artifacts, shared memory, latency, and hardware separately; a successful fake lifecycle is not model or physical qualification. Disable or remove only the optional runner package for rollback; preserve ordinary ALYT control, voice, cloud routes, and durable state.

Read retained physical history

The verified ALYT retained-history path keeps the original internal service authentication, current actor, and context pin for POST /internal/physical-ai/properties/:propertyId/reasoning-history?tenantId=.... The query uses the exact physicalAiReasoningSemanticQuery fields with kind HISTORY, 1–4 current entity/control refs, maxEvents up to 16, maxNodes up to 4, positive historyWindowMs up to 30000, and the original expiresAt/retryOf; no schemaVersion field is present. The window is anchored to the original context createdAt and does not renew expiry.

The existing EnvironmentEvent journal is the source of record, scoped by tenant/home/current native bindings, with at most 64 records plus one overflow sentinel. Recorded journal entries are not latest state. Current inventory, actor, source, and expiry are checked before release. Missing records are returned as actual empty rows; recorded gaps, malformed records, unknown physical occurrence times, or overflow yield TRUNCATED. Exceeding maxEvents or 24KiB refuses the read rather than trimming. Findings remain non-authoritative, and receipt0.2 may cite only supplied observations or successful ALYT history receipts. Supported budgets stay two-call/four-step with 4KiB receipt history; rollback uses the accepted runtime and disabled companion binding.

The result is a physicalAiReasoningToolResult with kind HISTORY, not model-generated history or a new state store. Opaque observation refs stay stable in the original snapshot and remain separate from current-state refs; the reference cache is capped at 256 entries. The semantic controller places the typed historical result into receipt-input0.2. When data are missing, the system preserves explicit no-data or gap handling instead of inventing state. Supported budgets remain the original two-call/four-step limit and 4KiB receipt history limit; disabling the selected companion cohort/binding or restoring the accepted runtime provides rollback.

Read current permission, consent and original outcomes

The new flow captures the current household permission or verified device authority, the tenant cloud-inference flag, and the latest tenant.cloud_inference_consent audit record in the same transaction as inventory. ALLOWED now requires both a positive tenant flag and a latest audited enabled=true record; DENIED follows a negative flag or audit, and missing or inconsistent positive proof stays UNKNOWN. This is consent evidence only; it does not become export permission, frontier readiness, or execution authority.

The policy adapter computes proposal eligibility from current control permission, verified device control scope, descriptor bindings, and a representative valid value produced only for validator checking. That metadata proves control-proposal capability, not acceptance of arbitrary values, approval, or execution. It also keeps security mode, external readiness, missing routine proof, and other undeclared facts explicitly UNKNOWN. The shadow cohort remains the only proposal-exposed control surface, and writable permission alone is insufficient.

The outcome reader still requires the home to be selected for outcome rows and remains limited to tenant, property, client, and original actor scope. It reads at most eight effects plus one overflow sentinel and verifies the immutable parent proposal snapshot, effect snapshot, and digest before rebinding only current controls. Correlation handling remains strict: malformed, unmapped, compound, or mismatched correlation is TRUNCATED rather than confirmed. Empty original correlation yields only current proposal lifecycle status, and expiry cannot create AUTHORIZED.

The ledger adapter remains constrained to existing ledger and outcome cohorts and reads only the home selected for those rows. It verifies the original immutable proposal snapshot and digest, then compares each stored effect snapshot to the current rebounded control. It accepts only fresh physical event/command/readback references when they are exact and current; retained, replayed, stale, or replaced observations cannot substitute. Unknown newer manual-change evidence stays null. The adapter also enforces the no-physical-effects rule: it does not execute, reconcile, or modify outcomes, and it preserves zero physical effects and zero execution authority.

Installation-facing checks now align source revisioning with current tenant consent and the verified device or household authority already present in the database snapshot. The service captures the current permission state and latest consent audit record together, then derives a source-pinned environment revision. If the source or consent changes, the original source pin becomes invalid and release must recheck the same actor, source, and shorter original expiry. This keeps old or unknown measurements from being promoted by an event envelope and prevents stale facts from being rewritten into fresh physical history.

The historical field-time repair is preserved: a stale or older physical measurement cannot be made fresh by a newer event envelope. A valid original execution record can supply physical outcome status, but SQL status and transport ACK are not proof of completion.

Overflow handling is bounded: up to eight effects are returned, with a sentinel/overflow condition causing TRUNCATED. Combined results remain under the existing 24KiB budget. Rollback remains default-off, with existing cloud, voice, routines, and device controls continuing their prior behavior.

Updating or creating an ALYT effect ledger record does not change the canonical physical context pin, so it does not self-invalidate approval of an immutable proposal. The canonical source still pins physical inventory and observations, plus the current permission or consent state. Exact own-actor ledger records change the companion policy revision, and the Tenant owner rechecks the complete captured ledger at final release while the semantic controller checks the exact companion. Pending approval metadata keeps its shorter original expiry. Any changed or revoked actor, permission, or physical source still refuses, and there is no new authority, refresh, lifetime extension, or physical send; existing approval, execution, and fence owners remain.

Read proven routine eligibility

The current read path stays present-tense and read-only: the original ProposalShadowService routine-policy reader is reused, and the same deterministic graph validator continues to govern eligibility. The controller now forwards a bounded routine-reader into the existing reasoningContext flow, so the service can read proof, selected refs, and the current context before any response is released. The existing shadow cohort and current household or explicit voice control grants remain the only authority gates used. RoutineInstallationEvidence is still tied to the actual packed graph, selected hub, installed version, byte count, execution protocol, and runnable roots; missing, expired, changed, disabled, or mismatched proof remains UNKNOWN or ineligible. The companion revision is separate from the canonical physical pin and never renews it. The final proof read is followed by a current source and actor recheck, and changed proof or revoked authority refuses the read. The documentation impact is limited to the controller and environment service because ordinary saved routines and homeowner workflows do not change.

Read durable local typed reasoning context

These changes finish the durable shadow and runner-side lifecycle for typed reasoning without changing ordinary user workflows. The shared shadow schema now carries optional findings records, and the home-agent shadow queue persists them in existing durable receipts. Findings remain zero-effect and non-authoritative: they are stored as model claims, not commands, approvals, or physical confirmation. The queue still uses the same bounded file and receipt structure, with no second database, no firmware change, and no new RAM allocation in hub SRAM/PSRAM.

The event adapter now supports the exact typed goal binding and the alyt.reasoning-semantic-input/draft-0.2.0 input path while preserving the legacy runner input/body behavior. When the typed binding is present, it reads the actual current companion, verifies the declared goal against it, and refuses implicit escalation, tool use, or authority relocation. For the negotiated alyt.reasoning-graph-input/1.1.0 profile, selectedDeclaredGoalId may correlate a non-authoritative findings.goalResults entry to the supplied declared goal record revision while the typed-goal projection remains unknown; the original decimal revision, declaration expiry, and visible room/entity scope still have to line up, and missing metadata, another goal, changed revision, expired evidence, duplicate results, or a changed context are refused. Existing typed-goal revision, observation evidence, and query-identity checks still apply, version1.0 and the frozen qualified contracts retain their original behavior, and ALYT creates no typed target from model text. If the reply produces FINDINGS, the adapter returns them as shadow processing only; DONE remains a shadow receipt outcome and never physical completion, with physicalConfirmation:false throughout.

Rollback is explicit: disabling the typed flag or binding withdraws this additional read path and leaves cloud, voice, routines, and controls under their original owners. Original authority and execution ownership remain unchanged, and the existing durable shadow receipt file continues to hold finished findings without affecting physical state or requiring migration. The negotiated alyt.reasoning-graph-input/1.1.0 correlation stays additive only, so selectedDeclaredGoalId can be read as a declared-goal finding link without changing authoritative goals, while the typed target remains unknown and physicalConfirmation:false still applies.

Identify source-qualified manual overrides

Validate the original immutable parent/effect digest and exact execution correlation before reading any current-home endpoint history. Use the original deterministic checker, with no more than 8 effects and 16 hub commands. A later differing user-issued UUID command without reserved Physical AI markers establishes newerManualChange=true. Service, connector, unknown, or malformed provenance with no positive evidence remains null, never false. A request proves changed intent, never physical movement. Companion release rereads current facts; the immutable physical approval pin excludes mutable ledger or manual rows.

model-runner-lifecycle

The frozen alyt.physical-ai-qualified-interface/1.0.0 release preserves the pinned Voice and negotiated Reasoning contracts with explicit version selection, immutable fixture pins, and canonical validation before use. The model runner keeps finite resource and lifetime limits, retains one accepted rollback pair, and never auto-upgrades an installed manifest. Unsupported native facts are refused safely, FAILED or TIMED_OUT prior attempts are the only retryable cases, and EXPIRED retries are refused. Receipt-aware history handling requires actual ALYT receipts plus canonical validation; otherwise the case is refused. This release freezes interface feasibility and immutable pins only, not trained-model quality, acoustic measurements, hardware qualification, or activation.