Repository navigation
LA-02: Enforce conversation and answer limits #96
Description
Part of #84.
Owner: Anders (@andersalm).
Depends on LA-01 (#95). Runtime supplies the effective context and output limits, and Assistant packs the conversation against them.
Done means
Release acceptance: Each exposed feature works clearly from start to end, including recovery. Keep unfinished or confusing features hidden until their complete journey passes. Hiding a feature does not complete its task; source checks alone do not establish installed acceptance.
- Hard enforcement includes template tokens, special tokens and space for the answer.
- Tiny contexts, long chats, Unicode, excessive output and incomplete capability data produce a bounded request or a clear refusal before generation.
- Transport byte limits remain separate from token limits; counting uses a verified engine path or proven overflow rejection.
LA-02 is complete. PR #80 merged into feat/0.7.1-models as 0df365e228f5487cf9db63a602905f64afb1af71. The reviewed head 07d525c4 passed all eight required checks in run 36708851550. It includes Irzhy’s F1 correction: hosted offers reject max_output_tokens before dispatch; the option is local only.
The installed Mac proof remains bound to 0fa32099. The later correction changes hosted refusal only and passed the hosted no-dispatch regression and independent review. Next: LA-03 (#97), with the approved parallel Mac/Linux work in LA-04 (#98).
Activity
andersalm commentedon Sep 29, 2026
LA-02 source candidate is commit
0fa320992626753f1f28caef16954f371ab43491(tree49d5895746709ec4670667029f742aec73d71fbf) in draft PR #80, based onfeat/0.7.1-modelsat501b411c11d5e38e424077a03d99476172a1a77f.Assistant now packs a turn from the selected local offer's per-slot context and answer limits. The provider counts the exact templated chat request through its owned llama engine before generation, and Runtime admits the exact count route. The count and generation share one deadline; Stop also covers the count response. The input hash binds the requested answer limit, while byte bounds remain separate.
Source proof: model provider 232 unit tests and 6 process tests passed; model contract 9 tests passed; Runtime 297 unit, 36 HTTP, and 13 integration tests passed. The Assistant shell smoke and all 43 cancellation tests passed. The checked-in
just lintgate and relevant source checks passed. Independent read-only review found no remaining source issues. GitHub run 36571606116 completed successfully at this exact head: source gate, custody smoke, Linux amd64 and arm64, macOS, lint, elastos tests, and capsule tests all passed.Installed-engine token count and the complete Home chat journey still need target proof. This issue remains open until those checks establish clear refusal and recovery with the installed route.
andersalm commentedon Sep 29, 2026
Local AI now proceeds from this issue, the lowest-numbered open task after #95. PR #80 has passing current-head source checks. The next proof is installed-engine token counting and the complete Home chat journey. Keep this issue active until its Done means is proven; then close it and select the next unblocked Local AI issue.
andersalm commentedon Sep 29, 2026
Installed target proof for draft PR #80 is complete at commit
0fa320992626753f1f28caef16954f371ab43491(tree49d5895746709ec4670667029f742aec73d71fbf). A clean source-home install on macOS arm64 bound that commit and tree in its installation receipt. The built and installed Runtime hashes matched (2197a6ec…d6a8b3), as did the built and installed model provider hashes (13a6bce7…fdbc90).scripts/installed-provider-verify.sh model-providerpassed. The source, installed, and served Assistant context script all hashed toe415f5f9…01e17.The installed model provider completed a SmolLM2 request through Runtime's confined broker. The pinned llama b10516 engine hash was
d0878274…22d713; the model hash wasc4a3dd03…6ce66a. The live llama child used--ctx-size 4096 --no-context-shift. Its/v1/chat/completions/input_tokensroute counted 3,700 templated input tokens for a 4,650-byte prompt. Through the installed Home API, that exact prompt was rejected with a 1,024-token answer reserve and completed with a 16-token reserve. This shows that answer space is enforced with the engine's templated count. A 61-message conversation and a tiny 128-token context each ended incontext_rejected. A 2,048-token output request ended incontext_rejected; an 8,300-byte input ended inpolicy_limit, separate from token limits.The passkey Home round trip passed. In the visible Assistant, a normal local reply completed, a tiny-context prompt showed a capacity refusal with zero
runs_createcalls, and a later Unicode prompt completed after selecting the normal offer. When an offer response omitted context limits, Assistant showed “Selected local model has incomplete context limits” with zeroruns_createcalls. The installed Home served HTTP 200 with source, installed, and served artifact parity during the test. The isolated Home and its child services are now stopped; its private test data is retained for audit. Source checks, independent review, and all required CI checks had already passed at this exact commit in run 36571606116.All three Done means items are proven on the installed path. PR #80 remains draft for review.
andersalm commentedon Sep 29, 2026
PR #80 is ready for human review at
0fa32099, with passing source checks, independent source review, current-head CI and the installed proof recorded above. Irzhy must review the broker route; Anders contacts him. The issue is closed on its proved criteria; PR integration still needs that review. The next Local AI task is #97.andersalm commentedon Sep 29, 2026
Reopened as QA / Review. The recorded proof is retained. This issue closes only after its Done means remains proven and PR #80 has the required review and is merged. Irzhy is already requested on #80. The earlier closure was premature under the corrected completion rule.
andersalm commentedon Sep 30, 2026
LA-02 remains in QA / Review while PR #80 applies Irzhy's Low F1.
The correction will reject
max_output_tokensfor hosted offers, add the hosted rejection test, and state that the option is local only.Current candidate:
0fa320992626753f1f28caef16954f371ab43491; fetched target:feat/0.7.1-modelsat77c83c56dd13fdbdca65db37232114cbd9883a6c.Irzhy's written verdict approves the security review; GitHub records the review as COMMENTED. His comment asks for the Low fix before integration.
Next gate: focused provider tests, the basic source gate, independent review, current-head CI, and current-base compatibility. The installed proof above remains tied to its recorded candidate.
Next Local AI issue: #97; #98 follows this correction.
andersalm commentedon Sep 30, 2026
PR #80 correction candidate is
07d525c46158c166417dea32e82afbd88276e9d5(tree4a5e1dc37513017ef421134857a89d950ec4c070).Hosted Chat v1/v2 and Responses v1 inputs with
max_output_tokensnow end incontext_rejectedbefore any upstream request; the option remains local only indocs/MODEL_PROVIDER.md.The hosted regression failed before the guard and passed after it.
cargo test --manifest-path capsules/model-provider/Cargo.toml -- --nocapturepassed: 233 unit tests and 6 process tests; 2 existing tests are ignored.git diff --check, Home entropy, workspace formatting, chain-provider formatting, and model-provider formatting passed.git merge-tree --write-tree origin/feat/0.7.1-models HEADpassed against base77c83c56dd13fdbdca65db37232114cbd9883a6c; base changes affect instructions and media build scripts.The branch is one commit ahead of
origin/feat/0.7.1-model-contextand zero behind. This candidate is ready for a fast-forward push to that review branch.Independent review and new CI remain before merge. The earlier installed local-path proof stays bound to
0fa32099; this correction changes hosted refusal only.Next Local AI issue: #97, with #98 following LA-02 integration.
andersalm commentedon Sep 30, 2026
Independent review of the F1 correction on PR #80, commit 07d525c4: passed, no findings.
The guard rejects max_output_tokens before text worker dispatch for every non-local text adapter.
The regression covers hosted Chat v1/v2 and Responses v1, checks context_rejected and confirms zero upstream requests. The documentation states local-only support.
This matches Irzhy’s requested fail-closed correction; the remaining merge gate is the corrected head’s completed required checks.
andersalm commentedon Sep 30, 2026
PR #80 merged as 0df365e2 into
feat/0.7.1-models.Head
07d525c4passed all eight required checks in run 36708851550.Irzhy’s security approval and Low F1 are resolved; the exact correction passed independent review, 233 unit tests and 6 process tests.
The normal merge was checked against base
77c83c56; the task branch is clean and matches its remote (0/0).The recorded installed local journey remains accepted on
0fa32099; the correction adds hosted refusal with zero dispatch.Done means is proven and the reviewed PR is merged. LA-02 closes; next is #97, with #98’s approved parallel platform work.