LA-03: Install the Jetson engine through Runtime

@andersalm

Part of #84.

Owner: Anders (@andersalm).

Task base and PR target: develop, under the standing 0.7.1 rule. Anders approved starting this task while the predecessor PR is in review. Final integration must include any required predecessor changes.

Depends on LA-00 (#94) and the accepted LA-01 (#95) preparation comparison repair for Runtime integration. Source is merged: Runtime installs the pinned Jetson engine (#133) and normal CI builds it from the pinned ARM recipe scripts/build/build-llama-server-bundle.sh (#200). The earlier #73 bundle is history.

Status: QA / Review for the prepared packet; hardware acceptance pending. The fresh isolated Jetson packet passes independent artifact, layout, development and Opus review under Anders's 8 October instruction. The consumed 2 October slot stays closed. The fresh attempt remains unused while the operator confirms availability for the normal Home passkey prompt. Anders restored #98 as the active Local AI source task on 8 October; this pending target gate stays open. Repeat target preflight immediately before the run.

Done means

Release acceptance: Each exposed feature works clearly from start to end, including recovery. Keep unfinished or confusing features hidden until their complete journey passes. Hiding a feature does not complete its task; source checks alone do not establish installed acceptance.

Normal component installation supplies the pinned engine and libraries without a compiler on the user's device.
Runtime checks hashes, architecture and library compatibility and selects the correct profile.
SmolLM2 loads and replies through Runtime on the authorized Jetson target. Existing Mac and Linux x86 bundles remain valid.

Current parallel acceptance work

Current Home setup selects the model provider and installs the engine on demand. The checked-in Home profile excludes engine and model weights; explicit Local AI profiles retain compatibility checks. Source commits f424c47e and 95f5937a establish this behavior.
Recover and repair the private Jetson guard. The exact original is preserved; current descriptor-race and whole-thread-group cleanup corrections pass 38 regressions, eight self-checks, independent development review and Opus review.
Assemble and independently accept the current hash-bound launch bundle, verified prebuilt inputs and required private directory layout for the authorized fresh slot.
Complete the installed SmolLM2 reply through Runtime and Assistant under the recorded hardware-test conditions.

Current preparation uses PR #153 head 3495ddf4200005571d3df7f05f8fb1952eda1e29, tree 07fa63c97a5d55a30e1f61e7e2b9b0e4f83a1187. This candidate contains fetched develop at d430a1330e2b2e07afe0db3c13a13563b149ac3f; comparison is 0 commits behind and 51 ahead. PR #153 remains in QA / Review under #150. Full current CI passes; required human acceptance and merge remain open. This candidate binds the shared baseline and Jetson proof without another source branch. The earlier unsupported-ARM Home setup finding predates the current on-demand profile and needs no new default-Home source patch.

Local AI plan reconciliation — 2026-10-08

The current source review uses the exact candidate and fetched develop recorded below. Reuse the merged #133 engine installation and #200 normal ARM recipe; the unsupported default-Home finding predates the current on-demand profile.

Bind the launch bundle to its exact Runtime, provider, guard, engine/library and signed SmolLM2 closure hashes; independently verify the required private directory layout.
On the actual Jetson Orin Nano, normal Runtime engine preparation and ordinary Assistant use produce a SmolLM2 reply; engine refusal leaves Home usable and explains the capacity/platform cause.
Stop the owned target processes and record final descendant cleanup. Carry this exact target receipt into G5 Private Browser: Jetson support #90/LA-09: Verify the local model journey on all targets #103.

The target window is one attempt, with a 1,620-second cleanup deadline and 1,800-second hard limit from first target creation. Existing Homes and shared trust keep their owners. The parent estimate is in #84; CI ARM proof and optional DGX measurements retain their separate scope.

Acceptance record

Candidate and divergence. PR #153 head 3495ddf4200005571d3df7f05f8fb1952eda1e29, tree 07fa63c97a5d55a30e1f61e7e2b9b0e4f83a1187, includes fetched develop d430a1330e2b2e07afe0db3c13a13563b149ac3f. The clean candidate is 0 behind / 0 ahead its published PR branch and 0 behind / 51 ahead develop. #97 adds a private hardware fixture; this preparation adds no source branch, commit or local build.

Current packet. Independent admission passes all 56 inputs (401,519,205 bytes), component/artifact paths, regular-file ownership/modes, real ancestors and bounds. Descriptor SHA-256 is 6a5e5d5070e324db96082aec94428b22520befcc922840f584fe58ef93161b68. Its pure validation command passes and leaves the target unchanged. Current native artifact 11569875569 / run 37815765347 is admitted from exact candidate source: ZIP d155bd1ca1a5f431d55b95326a972aa2d91ac160c4bee016d9e0369553db0abd, native archive c352ae98dcc57c6b4e7ad93a85a37398a354c0318545f072b4a921b88cb4f979, recomputed receipt 010b3b73698f89f24e0010230019feb53e004faa42abdbe19b863e93d8bf97f8. All 20 native executables are AArch64 with GLIBC requirements at most 2.35. Runtime SHA-256 is df494a384a368c2c60fab0a534b2d88ab178307d87742d759e0df5099e52c15a; model provider is b8388754a1d92204092e34c61086a266903b4a7056ce6ada78a1746ebea7bff9. Both require at most GLIBC 2.34. Runtime and all 11 selected native components use current bytes. The qualified d430 support package keeps its original receipts; only the two current Marketplace/System scripts overlay its portable capsule assets.

Engine and model bindings. The canonical ARM engine archive from run 37812288984 is 6,665,019 bytes, SHA-256 a92e404708feae91cbede43322e445971450de8a204f4ff51502a7f42f5df8b8; its cached source identity matches the current pinned recipe. The complete licensed installation archive is cea0e983ea8e5f0e685623a784a14843234967560ec9074ef720dceaa644343c, with 32 independently checked entries and executable da88cc0a679c80cdf699fe368c4d2f772e5bce4280ad9316c30ed4c09e9d2cde. The expected installed receipt is dd8a1fba64bdf5fc80d605f8e89ce424bdee87b62787535cfb0216e306cab4fe. The fixture catalogue signature, canonical catalogue CID, separate trust and Runtime-derived disposable identities pass independent checks. The complete pinned SmolLM2 package CID is bafybeifkud7srv6pik3mrss22jdqitxtsqxzsptbpezerjbdl3ju5j3inu; Q8_0 weights are 144,811,072 bytes, SHA-256 c4a3dd037301b6ecea31d6da37f5cd793ead920dd5ddfe6d589294628d6ce66a.

Safety and source checks. The exact current guard is f46764856f9c3a4ed07e979f0eb22ee82d5d5d21948a4d8ce7758e9f1e250710, controller 0af96b3e3a5574d92d3852a9101cb2621c62d17dbf71d5ea74725fb1e8e49d87, launcher ea64e5073ac7c82e412fff89e588c77a4749cf85933e0c00bf4f538e83284548 and final verifier c8074df808e0f9a77418b6e5a58383f715c6f0ac21c2d3bd531352e440b4c0bc. Independent development and Opus review pass these hashes. Thirty-eight guard regressions, eight self-checks, five syntax checks and helper/hash parity pass. The corrections handle a descriptor that closes during inspection, prove whole-thread-group exit through the Linux pidfd and capture the exact final-verifier bytes before launch. Unknown ownership or cleanup observations retain the process gate. Basic source checks pass: diff check, both Cargo format checks, current product-data gate and 102 contract tests. The historical Home entropy script is retired; the current product-data gate covers this surface.

Read-only target facts. The actual Orin Nano target passes nonroot ownership, Linux 5.15/glibc 2.35, dotprod/FP16, absent fixture, clear reserved ports and pidfd API checks. At observation, it has 4.72 GB available RAM and 15.12% free disk after a 2 GiB allowance. Immediate preflight will recheck these changing facts. Existing Homes and shared trust keep their owners.

Supporting CI. Exact-source ARM run 37815765347 uses the same Runtime/provider hashes as the packet and passes signed Get, a real visible 16-token-cap reply, engine-absent source-prerequisite refusal/Retry, accepted eight PNGs and zero final owned processes in 106.42 seconds. PR CI 37812288984 also completes successfully; its tested merge commit e39193b48ae79bcc7bae5c65f1dead332378bbea has the exact published tree. Independently accepted ARM/x86/Mac model receipts cover eight isolated Homes. Hosted ARM CI supports hardware proof; actual Jetson acceptance remains separate.

Hardware slot and remaining gate. The fresh slot remains 0/1 attempts. The operator's availability for the normal passkey prompt is pending. After immediate preflight, one isolated run has a 1,620-second cleanup deadline and a 1,800-second hard limit from first target creation. It first proves the actual source-prerequisite cause, Retry and return to Home with the engine physically absent. It then stops the exact consumer processes, uses ordinary Runtime component setup to install the engine and restarts the same Home. Normal Marketplace/Assistant controls must show a real 16-token-cap reply and return to Home. Independently compare installed/runtime/provider/engine/model receipts, then prove all owned descendants, listeners, tunnel and fixture paths are cleaned up. The consumed 2 October transfer refusal installed no Runtime and passed cleanup twice; it remains historical evidence.

The capacity/platform-cause acceptance clause remains open until its own installed proof passes. A source-prerequisite refusal proves its named cause. Current source CPU/ELF/capacity/disk tests cover their own source or CI environment. A configured cache quota below the complete Smol preparation charge, or a supported model-memory grant below the signed model minimum, currently produces a generic unconfirmed-action UI message before a preparation record exists. Independent source review confirms that neither budget control yields the required typed capacity cause. #98 records the budget/refusal follow-up; a real model-busy refusal has its separate concurrency meaning. A compatible Jetson keeps its real CPU facts. Signed-release on-demand acquisition retains its separate proof scope.

Reviews, integration and next owner. Merged #133 engine installation and #200 ARM recipe supply the implementation. #150 owns PR #153's passed independent source reviews and CI evidence, required irzhywau current-head approval, compatibility recheck and normal merge into develop. The authorized #97 agent performs the hardware run when the operator is available and carries its accepted exact-target receipt into #90/#103. Keep #97 open until its complete Done means and integration gates pass.

Preparation and proof carried into LA-03:

PR #73 builds the CPU engine from llama.cpp b10516, commit b95502ba9aa0eb73a2f4fc8878d7fbe6a847a0b9. Build run 36501810782 passed. The engine archive is 6,670,788 bytes, SHA-256 da2b1e87fd7ffb90e540a6ded7a725994594e9bc260bf539858392d5fc96b205; the engine binary SHA-256 is da88cc0a679c80cdf699fe368c4d2f772e5bce4280ad9316c30ed4c09e9d2cde. The downloadable CI artifact expires 6 October; a retained local copy and raw target receipts remain available to the task.

The same bundle passed a standalone Jetson check: required CPU instructions present; observed ELF maxima GLIBC 2.34, GLIBCXX 3.4.30, CXXABI 1.3.13; SmolLM2 ready in 3.840 seconds; 16 tokens in 0.274 seconds; peak RSS 352.5 MiB. An initial harness double-signal failure was corrected by a shutdown-only check with zero additional chat requests and exit 0. Task processes and files were removed, with the disk reserve preserved.

This proves standalone compatibility, not Runtime/Assistant installation or provider containment. Runtime integration must check Armv8.2 dot-product and FP16 before bundle selection, preserve $ORIGIN library loading under the cleared provider environment, reject changed libraries and wrong checksums, and run ARM64 startup-binding tests. Reuse the accepted bundle; keep PR #73's source/base proof separate from the integrated model candidate.

Selected as the next Local AI task after #96 closed. Reuse the accepted PR #73 engine bundle and standalone Jetson receipt. The next work is Runtime component selection, hash and library checks, then the installed Assistant journey on an approved isolated Jetson target. Keep this as the only active task in the lane. Branch-base choice is pending with Anders; read-only preparation can identify the smallest integration and tests. Existing Homes remain outside the experiment until the exact installed test scope is approved.

Read-only integration map against the approved models source, origin/feat/0.7.1-models at b1a22a6e, and PR #73 at 4726b0c6: components.json still marks llama-server on linux-arm64 as source-build. Normal elastos setup skips that strategy, so it cannot install the accepted bundle yet. The existing download path checks the archive checksum. The local engine receipt records the installed engine, libraries and relative symlinks, and verified_local_model_engine checks that inventory before activation. The narrow integration can use these existing paths with a pinned ARM64 manifest entry. The CI review artifact expires on 6 October, so normal installation needs an approved durable artifact source before that entry can be enabled.

detect_platform currently selects by OS and architecture only. Add the Jetson CPU feature and host library compatibility gate before choosing this ARM64 profile, then check the installed ELF and library closure before launch. The guarded model process clears its environment; the installed check must show that the bundle's $ORIGIN library loading still works there. ARM64 tests should cover a missing CPU feature, an incompatible library or ELF, a changed bundled library, a wrong archive checksum, and a valid receipt. Existing Mac and Linux x86 selections should stay covered by their current manifest entries.

After the branch base and isolated target scope are approved, the target proof can run normal component setup on the authorized Jetson without a compiler, record the exact source tree and installed bundle hashes, and complete a SmolLM2 reply through Runtime and the visible Assistant. The test receipt should also record the selected profile, resource use, child-process cleanup, and at least 10% free disk space. This preparation changed no source or target state.

One additional admission gate needs to move with the ARM64 installer entry. In the current models source, local_model_startup_profile in api/capsule_inventory/preparation.rs returns an error for linux-arm64, so a verified bundle alone still cannot create a Runtime model offer on Jetson. The startup-binding test module is compiled only for macOS ARM64 and Linux x86-64, and the pinned native-process proof lists engine hashes only for those two hosts.

The narrow source change needs a CPU-only Linux ARM64 profile tied to the accepted Jetson engine identity, plus ARM64 startup-binding and native-process tests. Keep the current refusal for unsupported hosts. The installed Jetson proof should check that the new offer appears and completes through Runtime and Assistant after normal component setup. This is a read-only finding; no code or target state changed.

Starting implementation from the fetched feat/0.7.1-models base, as Anders approved. The worker will record its exact branch and commit here. Keep one In progress task in this lane. Reuse the existing source findings, share the single heavy local build slot, and keep status and proof in this issue. The predecessor stays in QA / Review until reviewed and merged.

Implementation branch feat/0.7.1-jetson-runtime-install now starts from freshly fetched origin/feat/0.7.1-models at commit b1a22a6ec0c0aed2a8df44cc4cdf98618eadd61b (tree 05f614b7b4941bdddbd0d8306dc32b6e9b5e8fd3). The new branch is clean and has no task commit yet. The separate PR #80 branch remains preserved at 0fa32099 for review.

This task branch depends on the models working line. It will merge after or with that parent; a parent move may require a rebase. I am implementing the ARM64 install and admission path from the accepted PR #73 bundle, then I will bind the source checks and authorized isolated Jetson proof to exact artifacts.

Source candidate for LA-03 is on feat/0.7.1-jetson-runtime-install at commit 0d59a962f9d3c93c3ff6d536a8982a280af7e380 (tree ea6290d545655556f5e49891569a9b879f4f9657). It is pushed to origin, the checkout is clean, and draft PR #133 targets feat/0.7.1-models. The branch is one commit ahead of that base and zero behind.

The source manifest now selects the accepted PR #73 ARM64 bundle for normal Runtime component setup. Release preparation requires that exact archive and stages it for the trusted Carrier release path. Runtime checks the Jetson CPU features, engine and library ELF architecture, and host library loading under the cleared engine environment before it writes the installed hash receipt. The CPU-only model profile and ARM64 startup-binding and native-process proof paths are enabled. The Mac and Linux x86 bundle entries retain their existing values.

The accepted archive is 6,670,788 bytes with SHA-256 da2b1e87fd7ffb90e540a6ded7a725994594e9bc260bf539858392d5fc96b205; its executable SHA-256 is da88cc0a679c80cdf699fe368c4d2f772e5bce4280ad9316c30ed4c09e9d2cde. Verification passed: 32 release input tests, 11 release preparation tests, focused Rust tests for CPU/ELF checks, profile, changed-library receipt and startup binding, both Cargo format checks, git diff --check, Home entropy, component integrity self-test, and shell syntax. The accepted archive also passed the new ARM64 release checker directly. Mac free space remains above the 10% floor.

The installed Jetson proof remains. The proposed target run uses a dedicated isolated test Home and trusted release fixture, installs this pinned archive through normal elastos setup, records the installed Runtime and engine hashes and selected profile, and completes a SmolLM2 reply through Runtime and visible Assistant. It will record resource use and child cleanup, then remove its test processes and Home. Existing Homes stay outside this test. The earlier issue note requires Anders to approve this exact installed target scope before that mutation; PR #133 stays draft and issue #97 stays open until the run and review are complete.

I fetched origin/feat/0.7.1-models and read the complete merged AGENTS.md with git show origin/feat/0.7.1-models:AGENTS.md. The fetched ref is 77c83c56dd13fdbdca65db37232114cbd9883a6c (tree 3b5ec0c43569027fd40f680f35350bda5888f5f6). I acknowledge the merged process rules. The LA-03 candidate remains commit 0d59a962f9d3c93c3ff6d536a8982a280af7e380 in draft PR #133; this checkout is clean. Issue #97 retains the source proof and the pending installed Jetson journey. I will follow the bounded target instructions when they arrive.

The sole 2 October Jetson attempt FAILED before installation or visible Assistant; it used fixed guard SHA-256 2154836a02960780303d0e7d2c585198c0c4dd469ff3b35fc3ddc0492f35788b after a passing target preflight (18.05% free disk, 3.95 GB available memory).
Validated inputs bind prepared PR133 source 5963d0c7b7784a15d2d773b6f22d326237d42b45 / tree 6917ca46f73f54a9a89ce62aff5e49d757a8a7c3 and ARM package SHA-256 838923ca8bff82a3952aa41c1c43fecfcc8e79759f42032db07974998af1efb3; expected Runtime SHA-256 is 83a82b20fcc0e58ae12a76c4083df4c43bcf9371322bb44f9e7fb1a09a4dc1cd, provider d239100be13e67ac20a10d8c0438581fd650efdaba1d88bf37cf17b4a8b70d1e. Transfer stopped before installed parity could be measured.
The guard refused controller fd4 with FileNotFoundError / ENOENT / errno2, read-only flags and live sleeping tasks during input transfer. This supports a descriptor-enumeration race; an escaped writable path was not observed. The controller interruption caused the Mac driver's broken pipe.
Cleanup PASSED: fixture and created parents absent, owned processes/listeners zero, tunnel closed; the driver ended in 13.22s, within the 30-minute limit, and a second read-only check confirmed cleanup. The browser stage was never reached.
Attempt consumed 1/1; the slot and Local AI work are parked under #89. Visible SmolLM2 Runtime proof remains open; resume only with a reviewed guard correction and a separately approved future hardware slot. This prepared fixture is separate from develop 829a24ad; normal ARM engine/cache work is integrated through merged PR133/PR200, with PR73 closed as replaced.

The local AI lane is resuming the ARM setup compatibility correction from the issue-approved develop base.
Scope: keep ordinary Home setup usable when the optional model engine is unsupported; preserve explicit engine refusal and integrity checks.
The Jetson hardware journey keeps its recorded test conditions; update, release and CI candidates keep their current owners.

Source inspection at 3d3fdd9 confirms Home already excludes engine/model weights; the current profile regression covers that behavior.
The proposed default-Home patch is stopped with a clean worktree. Explicit Local AI profiles keep their compatibility refusal.
Parallel work now prepares the private Jetson descriptor-race correction; installed reply acceptance and the recorded hardware-slot gate remain open.

Recovered the exact failed-attempt guard. Candidate 060b4cd9cf1d004696917100403a5a83dcc1e8ebed1d98d5191291fabe7a9cf7 resolves descriptor paths only for writable access; the controller binds that hash.
Independent review PASS: 22 regressions and 8 self-tests pass; the original fails exactly the two read-only link-error cases. Writable refusal, process identity, task-exit and cleanup logic are unchanged.
Source repair is complete. The private launch layout and verified prebuilt inputs still need preparation; the separately approved hardware slot and installed SmolLM2 reply remain open. Targets stayed unchanged.

Real install, alpha.11, Jetson (9 Oct): Get stopped after 11 min with 'Preparation stopped. Storage capacity is unavailable.' (Retry offered); Runtime: preparation stopped phase=Capacity provider error; the Home's Kubo was defunct at the end. Diagnosis running; fix goes into alpha.12.

Root cause (reproduced on the Jetson with stock alpha.11): a User-mode ipfs-provider stops the shared Kubo after 600 s without use, and model preparation's capacity checks did not count as use, so any Get longer than 10 min fails ('Storage capacity is unavailable'). Affects every normal Home, not only Jetson; Linux passed at 534 s. Fix (branch la/jetson-capacity a6b5b373 + debee1c7): preparation marks Kubo in use and restarts a stopped one; under review, goes into alpha.12.

Fix chosen: the minimal one (d1184c6, cross-family PASS): model-download capacity checks and the final hash count as Kubo use. Jetson: Kubo survived 12.5 min (stock stopped it at 11). A broader Kubo ownership rework took 3 review rounds without converging and is parked on local branch backup/kubo-ownership; not needed for this bug.

Merge pull request #308 from Elacity/train/alpha12

0.8.0-alpha.12 published (9 Oct): source 8941d47 (PR #308; develop CI 37902075974, package 37902083409), release QmZBVQZ6TCmCUH8NYQ3q3DDY95gvtTELEiyHFbYQMxPSV4, head QmQyzH6L8hDfcaUXd7BNB3NWanJRV5Bdq3VN6G2bfC8uP9: Kubo idle-stop fix + 8 parallel part reads. Real runs follow.

alpha.14 on Jetson: the engine installed through Runtime, SmolLM2 survived the 13→14 update, Qwen2.5 1.5B Get finished in about 84 min, and replies, switching and idle stop worked; the memory refusal shows plainly.
Done; remaining Local AI work is tracked in #84 (evidence: OMP hops alpha14-20261010T062243Z).

Navigation Menu

Repository navigation

LA-03: Install the Jetson engine through Runtime #97

Done means

Current parallel acceptance work

Local AI plan reconciliation — 2026-10-08

Acceptance record

70 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

LA-03: Install the Jetson engine through Runtime #97

Description

Done means

Current parallel acceptance work

Local AI plan reconciliation — 2026-10-08

Acceptance record

Activity

andersalm commented on Sep 29, 2026

andersalm commented on Sep 29, 2026

andersalm commented on Sep 29, 2026

andersalm commented on Sep 29, 2026

andersalm commented on Sep 29, 2026

andersalm commented on Sep 29, 2026

andersalm commented on Sep 29, 2026

andersalm commented on Sep 29, 2026

70 remaining items

andersalm commented on Oct 2, 2026

andersalm commented on Oct 6, 2026

andersalm commented on Oct 6, 2026

andersalm commented on Oct 6, 2026

andersalm commented on Oct 9, 2026

andersalm commented on Oct 9, 2026

andersalm commented on Oct 9, 2026

andersalm commented on Oct 9, 2026

andersalm commented on Oct 10, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions