NM dispatcher plus a boot oneshot keep the AX9L (mt7921u) primary and
bring up the on-box iwlwifi profile if the dongle is gone. Connection
PSKs stay on-box; this only selects the radio.
Pin follows approved CLI fail-closed for non-default HERMES_HOME.
Does not switch straylight or orion. ~/.local/bin/sift (e36da19)
still shadows until that binary is removed after the switch.
The unit package is not in systemPackages, so `sift keys` is only
reachable via the store path. Track services.sift.package so it
follows the pin. Lands on the next orion switch.
Sift P3 ships with sources off. SearXNG engine WARNING lines include
q=; LogLevelMax=err keeps those out of the journal. Brave scraper
stays disabled. Do not enable search sources in this commit.
Prefill ran in 2048-token scheduler steps of ~2.4 s; each decoding slot
gets one token per step, so guardian calls (16 tokens) waited behind
Honcho's 10-28k-token prompts: p90 10 s, max 14 s under two sift
digests (2026-09-23 05:50). ubatch is already 512, so prefill
throughput is unchanged; steps drop to ~0.6 s.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The unified 96k pool overflowed ~every 2-3 min under Honcho load
(39 events 2026-09-23 00:50-04:28). Each overflow fails every in-flight
slot with 'Context size has been exceeded', so Honcho retries and the
guardians' calls die with it. KV is ~20 KB/token on this model; 128k
costs ~0.65 GB of the ~2.5 GB free.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Add the sift flake input at fac1462e7b3deb2082c9f6ae8dc4676fddf8d089
(git+ssh; git+https cannot auth on orion) and enable services.sift on
orion: loopback :8890, tailscale serve :8443 from the module, static
home WAN /32 in denyPrefixes. Keys stay on-box.
0.4.1 dropped the no-mmap option (router refused to start: "option 'no-mmap'
not recognized in preset '*'"); --load-mode none is the equivalent. All other
preset keys checked against 0.4.1's option list.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Kyle 2026-09-22: the shared CA was only for Metacircular services (system
trust store + the MCR podman registry cert). No host should still depend on
it; anything that does should fail loudly rather than keep trusting it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Kyle 2026-09-22: tear down MCP across the fleet. Drops the mcp/mcpkg imports
(agent, mcp user, packages), the unikernel-host agent overrides and kvm group,
the mcp-br0 bridge + FORWARD drop, the low-port sysctl (only MCNS/mc-proxy
needed it; Mattermost binds 8065), MCP firewall ports (53, 8443, 9443, 9444,
9555; keeps 443 for tailscale serve and 8080 for open-webui) and the MCNS
nameservers/~mcp.metacircular.net domain. State under /srv/mcp is kept.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A Honcho catch-up wave (48 deriver batches + 11 dreams + dialectic prefetches)
held all 6 slots with long thinking generations; tiny aux calls (title,
approval guardian) queued behind them and title_generation timed out at 60 s.
Two spare slots plus a bigger shared KV pool (so 6 long prompts can't exhaust
it). VRAM 9.7 GB.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
searx-init loads EnvironmentFile at spawn, so the secret must exist
before systemd starts that unit. Drop the racing oneshot. Make
tailscale-serve restart on NoState during switch.
SearXNG binds 127.0.0.1:8888 (json+html, limiter off). Secret is
/var/lib/searx/secret.env, generated on-box. TLS via `tailscale serve`.
MCP agent, packages, extra firewall ports, and MCP DNS removed from this
host only.
Room for the deriver, dialectic prefetches from three agents and their approval
guardians at once. Under full load (deriver + dialectic + guardian probes):
guardian p50 0.4 s / max 10 s, no KV-space failures. VRAM 8.9 GB.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Dialectic benchmark (8 hermes-fleet questions): Qwen3-4B answered in 2-12 s but
often wrongly (invented facts, 'no information' on things memory holds); the 9B
answered correctly. All Honcho dialectic levels now use the 9B (rift .env). Its
VRAM goes to the 9B's KV pool: at 2 x 16k, concurrent deriver + dialectic hit
'failed to find free space in the KV cache'. 9B 6.3 GB + embed 2.2 GB = 8.4 GB.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The stock Ornith template raises 'No user query found in messages.' when a request
has no plain user turn, which Honcho's dialectic tool loop sends on later
iterations: 6 of 8 'low'-level dialectic calls failed with HTTP 500 when routed to
the 9B. The patched copy treats the last message as the query instead.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
kv-unified lets one request use a model's whole 16k (split slots capped each at
8k and every Honcho dialectic prompt of 11-17k tokens failed). 9B gets temp 0.6 /
top-p 0.95 / top-k 20 / min-p 0: in a 20-batch replay of Honcho's deriver the
0.8 default dropped 7 batches (empty or wrong-shape output); with these, 3,
and 1 with a format instruction on rift. VRAM unchanged at 11.5 GB.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
8192/slot (previous commit) cost 6.6 GB of compute buffers and the 9B then
failed to load; 4096/slot did not fit beside the 9B and dialectic either.
2048/slot with batch-size set explicitly; long inputs are handled on rift
instead (EMBEDDING_MAX_INPUT_TOKENS=1536 makes Honcho chunk). All three
models resident at 11.5 GB.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
batch-size defaulted to 2048 (capping ubatch) and ctx 8192 over 4 slots left
2048 per slot, so Honcho inputs over 2048 tokens failed with 'input is too
large to process'. Now batch/ubatch 8192, ctx 16384 over 2 slots = 8192/slot,
matching Honcho's EMBEDDING.MAX_INPUT_TOKENS. Verified a 6191-token input.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Alienware Aurora R11 (i7-10700, 64 GB, one RTX 3060 12 GB today; second card
when its fans are replaced). Headless, Wi-Fi only, unencrypted root by
decision (always-on box that must come back from a power cut unattended).
- llama.cpp router (CUDA, from unstable) on :11434 with the three helper
models resident (--models-max 3): ornith 9B for the Hermes approval guardian
/ title / web_extract and Honcho deriver, qwen3-4b for Honcho dialectic,
Qwen3-Embedding-0.6B for Honcho embeddings. Vision (qwen3-vl-8b) on its own
on-demand server on :11433 since it does not fit beside them in 12 GB.
- Both servers tailnet-only (tailscale0 firewall); GPUs capped at 140 W
(thermal hour 2026-09-21: 75 C plateau, no throttling).
- Model weights on the USB cache stick (ext4 label dixie-cache) bind-mounted
into /var/lib/llama-server/models; filled from straylight with dixie-push.
- 6.12 LTS kernel (mt7921u for the AX9L USB Wi-Fi arriving 2026-09-24).
- SSH keys baked in: no console after install to add them from.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
kyle
