Merge features-ha: two control planes, a fast failover, ctl upgrade in waves

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -39,6 +39,16 @@ jobs:
       - name: Build
         run: go build ./...
 
+      # The Terraform provider is a module of its own, which ./... above does
+      # not reach. Its tests check its client against docs/admin-api.openapi.json,
+      # so a change to the admin API that breaks the provider fails here. The
+      # acceptance tests (TF_ACC=1) are left out: they need Terraform itself.
+      - name: Test the Terraform provider
+        working-directory: terraform-provider-llmgw
+        run: |
+          go vet ./...
+          go test ./...
+
       # The NVML backend needs cgo and cannot run without a driver, but it must
       # at least keep compiling: it is the only source of NVLink topology and a
       # break would otherwise surface on a GPU node, far from here.

.gitea/workflows/release.yml

@@ -93,6 +93,31 @@ jobs:
           ./dist/llmgw-${version}-linux-amd64 --version
           cat dist/checksums.txt
 
+      # Signed, so a machine that trusts the key built into it installs
+      # nothing the server alone could have put there. `release sign` checks
+      # the signature against that key before writing it, so a secret that
+      # does not match trusted.pub stops the release too.
+      - name: Sign the checksums
+        env:
+          RELEASE_SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME:-$(git describe --tags --always)}"
+          if [ -z "${RELEASE_SIGNING_KEY:-}" ]; then
+            # Builds that carry a trusted key install only signed releases:
+            # publishing an unsigned one would be a release no upgraded
+            # machine accepts, so it stops here instead.
+            if [ -s internal/release/trusted.pub ]; then
+              echo "internal/release/trusted.pub holds a key, and the RELEASE_SIGNING_KEY secret is not set:"
+              echo "add it under Settings -> Secrets, or this release could not be installed anywhere."
+              exit 1
+            fi
+            echo "no RELEASE_SIGNING_KEY secret and no trusted key; releases are not signed"
+            exit 0
+          fi
+          ./dist/llmgw-${version}-linux-amd64 release sign dist/checksums.txt
+          echo "signed: dist/checksums.txt.sig"
+
       - name: Attach to the release
         env:
           TOKEN: ${{ secrets.GITEA_TOKEN }}

.gitignore

@@ -5,3 +5,7 @@
 *.db-shm
 .DS_Store
 coverage.out
+# The provider built in place, and what Terraform leaves beside an example.
+/terraform-provider-llmgw/terraform-provider-llmgw
+/terraform-provider-llmgw/examples/.terraform*
+/terraform-provider-llmgw/examples/terraform.tfstate*

BACKLOG.md

@@ -0,0 +1,778 @@
+# Backlog
+
+What a review of the code on 2026-10-04 (commit c2238ab) found should be done
+next: security fixes first, then guardrails, then features. Written for
+whoever implements it — a person or a model — without the review in hand.
+Every item names the files it touches and what "done" is. Paths are relative
+to the repository root. Sizes: S about a week, M two to four weeks, L more.
+
+Conventions this codebase keeps, which every item here must keep too:
+- A change is refused before anything is written (validate, then persist).
+- Nothing on the serving path logs prompt text, keys or passwords.
+- Each item gets unit tests beside the code (`*_test.go`), and the TUI
+  (`internal/cli/tui_*.go`), `docs/console.md` and `CHANGELOG.md` are
+  updated when behaviour an operator sees changes.
+- `go test ./...`, `go vet ./...` and `govulncheck ./...` pass. No release is
+  cut and nothing is deployed to the PoC cluster without being told to.
+
+---
+
+## A. Security — do first
+
+**Status (2026-10-04): done and merged.** A1–A9, A6b included — etcd and
+Patroni's API on TLS, the PoC moved in maintenance mode without a failover.
+Deliberately narrower than written: the admin API is a token on loopback
+rather than a unix socket (A5); thread ids are bounded and documented as
+project-wide rather than scoped per user (A8); Python engines resolve with an
+explicit PyTorch index and a PEP 751 lock rather than locks shipped per engine
+version (A8). All of A is live on the PoC.
+
+### A1. Toolchain (S, hours)
+`govulncheck` finds 11 standard-library vulnerabilities reachable from this
+code at Go 1.26.3 (net/http, crypto/x509, os.Root, net/textproto). Raise the
+`go` directive in `go.mod` to 1.26.6 or later, rebuild, run `govulncheck
+./...` until it reports none reachable. Add `govulncheck` to the Makefile's
+check target.
+
+### A2. Release signing is effectively off (S)
+- `internal/release/trusted.pub` is empty, so `TrustedKey()` returns "" and
+  `release.go:103` skips signature verification. Ship a real public key;
+  make a missing or invalid signature fatal. Drop the `LLMGW_RELEASE_KEY`
+  environment override, or honour it only in `-tags dev` builds.
+- `internal/onboard/onboard.go:365`: the node-side download checks only a
+  same-origin `checksums.txt`. Verify the signature there too (simplest:
+  have the node run `llmgw` itself to fetch and verify once it has any
+  binary), and `shellQuote` the `Releases` URL, which is interpolated into
+  single quotes unescaped.
+- `internal/agent/upgrade.go:44`: accept only `https://` release bases.
+- Done when: a tampered binary or checksums file is refused by self-upgrade,
+  node onboarding and agent upgrade, with a test for each.
+
+### A3. Agent port without TLS is anonymous and plaintext (S)
+`internal/cli/server.go:423` serves h2c on `:7443` when `agent_tls` is not
+configured; `agentsvc` then accepts any node id. Refuse to start control
+mode without TLS unless `agent_tls.insecure: true` is set explicitly; when
+insecure, bind `agent_listen` to 127.0.0.1 and log a warning at startup and
+in `llmgw doctor`. Keep `server init` writing TLS as it does.
+
+### A4. Model profiles reach root on every node (M)
+Profile `args` and `env` from a model definition are appended to the engine
+command unchecked (`internal/agent/engines/llamacpp.go:170`, `vllm.go:151`,
+`sglang.go:98`); `internal/agent/engines/unsafeenv.go` is a denylist that
+misses `NCCL_NET_PLUGIN`, `NCCL_TUNER_PLUGIN`, `NCCL_PROFILER_PLUGIN`,
+`CUDA_INJECTION64_PATH`, `NVTX_INJECTION64_PATH`, `TRITON_*` paths; engines
+run as root.
+- Replace the env denylist with an allowlist (CUDA_/NCCL_ tuning keys minus
+  anything ending in `_PLUGIN` or containing `INJECTION`, `VLLM_*`,
+  `HF_*` minus path keys, `OMP_*`, `GGML_*`). Apply at catalog validation
+  (`internal/control/catalog/catalog.go`, where `UnsafeEnv` is called) and
+  again in the agent.
+- Deny engine flags that write files or run code: `--trust-remote-code`,
+  `--log-file`, `--slot-save-path`, `--chat-template` with a path,
+  `--host`, `--api-key`, `--port`; vLLM/SGLang equivalents. Allowlist is
+  better than denylist if the flag set is enumerable per engine.
+- Run engines as an unprivileged user with the video/render groups
+  (`internal/agent/supervisor`, systemd unit in
+  `internal/cli/serverinit_cluster.go:52`). Weights cache must be readable
+  by it.
+- Done when: a profile with `--trust-remote-code` or `NCCL_NET_PLUGIN` is
+  refused at `ctl model add` and at the agent; `ps` shows engines not as
+  root.
+
+### A5. Admin API trusts any local process (M)
+`internal/cli/server.go:357` serves the admin API and pprof on
+`127.0.0.1:9090` with no authentication; `adminapi.actorOf`
+(`internal/control/adminapi/api.go:1613`) takes the actor from the
+client-sent `X-Llmgw-Actor` header.
+- Serve the admin API on a unix socket (`/run/llmgw/admin.sock`, 0660,
+  group `llmgw-admin`) by default, keeping TCP as an option that requires
+  a bearer token read from a root-only file (`/etc/llmgw/secrets/admin-token`).
+- Take the actor from `SO_PEERCRED` (uid → username) on the socket, or from
+  the token's name; ignore the header.
+- Refuse `admin_listen` on a non-loopback address unless `admin_insecure:
+  true`.
+- Put pprof behind its own `debug.pprof: true` setting, off by default.
+- `ctlClient` (`internal/cli/ctl.go`), the console and `node add` must work
+  over the socket; `sudo llmgw` already runs as root.
+
+### A6. Patroni REST and etcd are unauthenticated and plaintext (M)
+`internal/pgha/config.go:99` writes a `restapi:` with no `authentication`
+and `:54` etcd over `http://` with no client auth; `hba.go:56` PATCHes
+Patroni's config unauthenticated. Anyone reaching :8008 or :2379 owns the
+store.
+- Generate a Patroni REST username/password at setup, store it in
+  `/etc/llmgw/secrets/`, write `restapi.authentication` and
+  `restapi.certfile/cafile` from the cluster CA; send it from
+  `internal/pgha/hba.go` and `status.go`.
+- etcd: client and peer TLS from the cluster CA with `--client-cert-auth`.
+- Document, and have `server init` write, nftables rules limiting
+  2379/2380/8008/5432 to member addresses (see A9).
+- Done when: an unauthenticated `curl :8008/config` is refused and the
+  store status in the console still works.
+
+### A7. PostgreSQL traffic is plaintext (S)
+`internal/pgha/config.go:168` and `internal/cli/serverinit_postgres.go:330`
+use `sslmode=disable`; HBA lines are `host`. Enable server TLS in Patroni's
+postgresql parameters with a certificate from the cluster CA, write
+`hostssl` lines, use `sslmode=verify-full&sslrootcert=/etc/llmgw/ca.pem`.
+Existing clusters: `llmgw server` must keep working against a store that
+has not been migrated, with a warning.
+
+### A8. Smaller fixes, each S or less
+- **Capacity fallback skips the allowlist.** `internal/router/router.go:700`
+  builds `[canonical]+entry.Fallbacks` without `permits`. Filter the chain
+  with `r.permits(p, model)`; price against the model that served.
+- **Suspended users keep working API keys.** `store.(*DB).Resolve`
+  (`internal/store/memberships.go`) never joins `users.state`;
+  `Authenticator.Invalidate()` is never called. Reject keys whose owner is
+  not active; call `Invalidate` on revoke, suspend, limit change.
+- **Join codes never expire server-side.** `internal/join/join.go:103`
+  checks expiry only in `Parse`; `admit` (`:212`) does not. Check it there;
+  bind the listener to the chosen address, not `:7444` on all interfaces;
+  use the peer's address rather than the claimed `hello.Addr`, and show the
+  joiner's address for the operator to confirm before secrets are sent.
+- **Leftover sudoers grant.** `internal/onboard/gossh.go:248` writes
+  `NOPASSWD:ALL` and removes it only in `Close()` (`:271`). Write the grant
+  with a self-removal (`at`/systemd-run timer, 30 min) so a crash leaves
+  nothing; wipe password buffers after use. In `ssh.go:39` pass `--` before
+  the target.
+- **Auth cache and pre-auth DoS.** `internal/auth/auth.go:127`: unbounded
+  map, one DB query per bogus well-formed key. Bounded LRU, negative cache
+  with short TTL, per-IP token bucket before the DB.
+- **HTTP server hardening.** `server.go:351-360`, the h2c agent server,
+  both mirror servers: set `ReadHeaderTimeout` (exists), `IdleTimeout`,
+  `MaxHeaderBytes`, a body-read deadline, `netutil.LimitListener`; connect
+  `WithReadMaxBytes` on the agent stream.
+- **Login/signup abuse.** Default `signup_open: false`; per-IP token buckets
+  on `/login` and `/signup`; bounded wait for argon2 slots; CSRF token on
+  the login form; the per-address throttle must not lock the real owner
+  out (use IP+address pairs).
+- **Trusted proxies.** `internal/web/account.go:557`, `landing.go:60` honour
+  `X-Forwarded-Proto/Host` from anyone; add `router.trusted_proxies` and
+  only then trust them; `Cache-Control: no-store` on `/setup/*`.
+- **Certificate revocation.** `DELETE /api/v1/nodes/{id}` only drops
+  inventory; add a revoked-CN/serial list in the store checked in
+  `agentsvc` `Connect` and mirror `onlyClients`; `serverinit_cluster`
+  always passes `--api-client`.
+- **Engine exposure.** Engines bind `0.0.0.0` (`llamacpp.go:102`,
+  `vllm.go:109`): bind the management address. SGLang receives its key on
+  the command line (`sglang.go:102`): pass it by env or file.
+- **Backups.** `internal/cli/backup.go`: encrypt archives to an `age`
+  recipient from `backup.recipient` in server.yaml; keep the directory 0700.
+- **Python dependency confusion.** `internal/agent/provision/python.go:121`
+  uses `--extra-index-url` with `unsafe-best-match`. Pin torch to the
+  PyTorch index explicitly (uv `[[index]] explicit = true`), `first-index`,
+  hash-pinned lockfiles per engine version.
+- **Control-plane SSRF.** `internal/sourcecheck/sourcecheck.go:39` and
+  `gguf.FromURL` use the default client; reuse the mirror's
+  `fetchClient(false)` (private-address filter) and refuse a proxy unless
+  configured; block NAT64/6to4-embedded private addresses in
+  `internal/mirror/safefetch.go`.
+- **Low:** `agentsvc/service.go:430` indexes `n.GPUs[0]` without a length
+  check (CPU-only node panics the handler); thread ids are client-chosen
+  with no length cap and shared per project (`router/threads.go`) — cap
+  length, document, offer per-user scoping; `/v1/models` lists models the
+  key may not use (`handlers.go:799`); sessions have no idle timeout and
+  `PurgeSessions`/`PurgeClaims` are never called — add a janitor; add a CSP
+  header and set `htmx.config.allowEval=false`; cap GGUF array nesting
+  depth in `internal/gguf/gguf.go`; mirror `.source` sidecars are served by
+  the public file server — exclude dotfiles from `:8081`; prune
+  `modelserve.jobs` and the mirror `running` map; KaTeX → 0.16.21+.
+
+### A9. Firewall (S)
+No machine in a default install has a firewall. Have `server init`, `node
+add` and `server add` write an nftables ruleset: ssh open; `:8080` open;
+`:7443` and `:9091` open to the cluster's networks; `:9100` to the
+monitoring host; `:2379/2380/8008/5432` to store members and control
+planes; mirror `:8081` to the cluster, `:8082` to control planes; `:9090`
+Prometheus and `:3000` Grafana to operators. `llmgw doctor` reports a
+missing ruleset. Make it skippable with `--no-firewall`.
+
+---
+
+## B. Guardrails (M–L, build in this order)
+
+**Status (2026-10-04, branch `guardrails-b`):** B1–B4 done, and tried live on
+the PoC. That found four bugs, all fixed with tests:
+- a shadow default merged with an attached policy of unwritten mode left it
+  in shadow;
+- a streamed word held back at one release was dropped at the next;
+- llama.cpp continues a conversation ending on the answer, so Llama Guard's
+  verdict on answers is now asked with its own prompt as a completion;
+- a judge model was named in a client's "no endpoint" error.
+
+The PoC runs `observe` (shadow) for everyone, and Llama Guard 3 1B
+(`llama-guard-3-1b`, CPU, on cuda01) as a judge, which blocks a harmful
+request in ~0.7s and a harmful answer in ~1.4s there. Still left: see each
+item.
+
+Today nothing on the request path reads, classifies, redacts or filters
+message text in either direction (confirmed; the only "moderation" hit is a
+comment in `internal/router/budget_fallback.go:20`). Existing controls are
+about who, how much and how fast: allowlists (`router/handlers.go:450`),
+RPM/TPM/budget (`internal/accounting`), context precheck
+(`router/context_limit.go`), admission bands (`router/admission`),
+timeouts (`router/proxy/proxy.go:26-57`). Gaps to close on the way: no
+default output cap when the client omits `max_tokens`; `catalog.Capabilities`
+is advertised but never enforced; tool results are trusted input.
+
+### B1. Hooks in the proxy and router (S)
+**Done (branch `guardrails-b`):** `internal/guard` holds the interface;
+proxy `Filter`/`StreamFilter`; the input hook runs after `loadThread` (the
+simpler choice); error codes, headers, Responses `incomplete`, usage columns
+`guard_*`. Moved to B2: holding `delta.tool_calls` until they are whole and
+reading their arguments — that is the tool policy's filter, not the proxy's.
+
+- `internal/router/proxy/proxy.go`: add optional `InputRewrite func(body
+  []byte) ([]byte, Verdict)` on the request and two output hooks: `Filter`
+  for `relayBuffered` (between `ReadAll` and `WriteHeader`) and
+  `StreamFilter{OnEvent(data) (emit []string, stop bool); OnEnd()}` for
+  `relayStream`, called where each whole SSE event is assembled
+  (`eventBuffer`, before `io.WriteString` at `:343`). Nil hooks cost
+  nothing.
+- `internal/router/handlers.go`: call the input policy after the allowlist
+  and limits and before admission (around `:395`); the principal, scopes
+  and the model that will serve are known there. Thread history is spliced
+  later (`:416`): scan stored turns when written, or move the hook after
+  `loadThread` (decide; the second is simpler).
+- Blocking conventions: input → 400 `invalid_request_error` with
+  `code: "content_policy_violation"` (today `writeError` always sends
+  `code: null`); output non-stream → 200 with `finish_reason:
+  "content_filter"` and empty/redacted content; output stream → a final
+  chunk `{"choices":[{"index":0,"delta":{},"finish_reason":"content_filter"}]}`,
+  then `data: [DONE]`, then cancel upstream. Headers `x-llmgw-guard:
+  blocked|redacted|flagged` and `x-llmgw-guard-policy` set before the proxy
+  writes headers.
+- `internal/router/responses.go`: map `content_filter` to
+  `response.incomplete` with `incomplete_details.reason: "content_filter"`
+  (today it always emits `response.completed`, `:525`).
+- Tool calls: hold `delta.tool_calls` until `finish_reason: "tool_calls"`,
+  then validate; `replyDelta` (`reply.go:33`) must also read
+  `tool_calls[].function.arguments`.
+- Accounting: a blocked input is recorded like `RecordRefused` (nothing
+  charged); a blocked output is charged (the GPU was used). `store.Usage`
+  gains `GuardAction`, `GuardPolicy`, `GuardCategory`, `GuardMs`.
+
+### B2. Package `internal/guard` (M)
+**Mostly done (branch `guardrails-b`):** policies in server.yaml with
+attachments in the store (`ctl guard attach`), narrowed by the limits' rule;
+`guard/detect` (validated PII, secrets, injection through normalisation and
+decoding); redaction with consistent placeholders before prefix routing;
+tool allow/deny/strip, call count and argument schemas; capabilities and
+structured output (opt-in); default `max_tokens`; pinned system prompt and
+dropping the client's; `no_store` (threads, notes, prefix tree, external
+models); shadow mode. **Left:** a `guard_events` table — the usage row's
+`guard_*` columns carry action/policy/category/time, not rule and stage;
+language identification; the re-identification map that restores
+redacted values in answers.
+
+- `Policy`, `Effective` resolution over the tenancy tree with the same
+  narrowing rule as limits (`internal/store/sqlite.go:383-416` `tighten`):
+  deny sets union, allow sets intersect, `mode` takes the strictest of
+  `enforce > shadow > off`, `fail` takes `closed > open`, `no_store` at any
+  level wins, thresholds take the minimum.
+- Store: `guard_policies(scope, scope_id, policy json)` and
+  `guard_events(request_id, scopes, policy, rule, category, action, stage,
+  score, judge_ms, shadow)` — ids, categories, offsets and lengths only,
+  never text. Migrations for sqlite and postgres. Pruned with
+  `usage_retention`.
+- `guard/detect`: regex/keyword sets; PII with validators — email, phone,
+  IBAN (mod-97), card (Luhn), TCKN (checksum), IP, secrets (`sk-`, AWS,
+  JWT, PEM); normaliser (NFKC, strip zero-width/bidi, homoglyph fold,
+  base64/hex/URL decode to depth 2); injection heuristics (role-switch
+  phrases, fake chat-template tokens, long base64, invisible Unicode) —
+  default action `flag`; language id.
+- Redaction rewrites `messages[].content` in the upstream body with
+  placeholders (`[EMAIL_1]`) via the same `map[string]json.RawMessage`
+  round-trip `withModel`/`spliceThread` use; an optional re-identification
+  map lives only in request memory and restores originals in the output.
+  Redact before prefix routing so `PromptPrefix` hashes the redacted text.
+- `guard/toolpolicy`: tool name allow/deny (strip or 400), JSON-Schema
+  validation of assembled arguments against the declared `parameters`,
+  argument regex rules, `max_calls_per_turn`. Enforce
+  `Capabilities.Tools`/`Vision` here: a `tools` array or image parts to a
+  model without the capability → 400.
+- `guard/structured`: validate `response_format.json_schema` on the final
+  text → `content_filter`, or flag in shadow.
+- Output constraints: inject a default `max_tokens` when absent (from the
+  policy or `MaxOutput`), language check, structured check.
+- System-prompt pinning per project: prepend before `checkContextFits` and
+  before `spliceThread`; optionally drop client `system`/`developer`
+  roles; exclude the pin from stored thread turns; apply to Responses
+  `instructions` in `toChat`.
+- `no_store`: `loadThread` and `PutNote` refuse; `captureBytes()` returns 0;
+  skip the prefix-tree observe (`router.go:840`); disable External
+  fallbacks for the scope (filter in `dispatch` and `budgetFallback`).
+
+### B3. Judge model on the cluster (M)
+**Done (branch `guardrails-b`):** `role: guard` + `guard.format`; hidden and
+refused to clients and fallbacks; critical by default, never on demand;
+`Router.Judge` past admission/accounting/guardrails; llamaguard3,
+shieldgemma and json parsers; 5-minute cache; latency budget then
+fail open/closed; streamed answers read every 600 characters, or held with
+buffer_all. Simpler than written: the input judge runs after admission, not
+alongside it, and shadow mode judges synchronously within the budget rather
+than after the response. Not enforced: two replicas on different nodes —
+documented, left to `scaling.min`.
+
+- `catalog.Model.Role: "guard"` plus `Guard{Format: llamaguard3 |
+  shieldgemma | json, Categories}`. Guard models are hidden from
+  `/v1/models`, the chat picker and allowlists; placed like any model,
+  class `critical`, `scaling.min ≥ 1`, at least 2 replicas on different
+  nodes.
+- `guard/judge`: calls the guard model through the router's own `dispatch`
+  with an internal principal and its own admission band (never the
+  tenant's queue); parsers per format (Llama Guard `safe`/`unsafe\nS1,S10`;
+  ShieldGemma yes/no probability → per-tenant thresholds; generic JSON
+  verdict); verdict cache keyed by hash of normalised new turns (5 min);
+  `latency_budget` (default 250 ms) then `fail` open/closed; input judge
+  runs in parallel with admission queueing.
+- Streaming strategy: default sentence-buffered scanning (regex/PII per
+  sentence or ~200 chars before release; judge every 400–800 chars on the
+  cumulative tail; final judge at end); `buffer_all` for `fail: closed`
+  scopes. Document that released text cannot be retracted.
+- Shadow mode runs everything asynchronously after the response
+  (`context.WithoutCancel`, like `saveThread`) and only records.
+
+### B4. Config, metrics, UI (S)
+**Done (branch `guardrails-b`):** library in server.yaml, attachments via
+`ctl guard`, the console's **Guardrails…** with "applies from" marks, and
+the portal's `/admin/guard`; the metrics and alerts below (judge latency
+labelled by model only at the judge; the check latency by stage); `ctl
+request` shows the verdict; the chat page says "stopped by policy"; the
+profile lists effective policies; docs/guardrails.md and data.md written;
+the access log carries action, stage and policy only. Attaching from the
+portal is not done — the page shows; the console and ctl change.
+
+- Gateway-level policy library in `server.yaml` under `guard:` (see the
+  YAML in the review, reproduced in `docs/guardrails.md` to be written);
+  attachments to scopes in the store via `llmgw keys guard`, the console
+  ("Guardrails…" beside "Limits…" in `internal/cli/tui_people.go`, with
+  "inherited from team:X" badges) and the portal.
+- Metrics in `router/metrics.go` style:
+  `llmgw_guard_checks_total{stage,policy,action,category,mode}`,
+  `llmgw_guard_latency_seconds{stage,judge_model}`,
+  `llmgw_guard_judge_errors_total{reason}`, `llmgw_guard_fail_open_total`,
+  `llmgw_guard_stream_stops_total`, `llmgw_guard_redactions_total{kind}`,
+  `llmgw_tenant_guard_blocks_total{tenant}`. Alerts: fail-open > 1% for 5m,
+  judge p95 over budget, judge has no ready replicas, per-tenant block rate
+  > 3× its 7-day baseline, any `secret` detected in output.
+- Portal `/admin/guard`: violations by tenant/category/policy over time,
+  shadow vs enforce, judge health, recent events by request id; `ctl
+  request <id>` shows the verdict; chat page renders `content_filter` as
+  "stopped by policy X"; `/me` lists effective policies.
+- Update `docs/data.md`: the judge sees all text but in-cluster; External
+  fallbacks send prompts outside the cluster (the current "nothing leaves
+  the cluster" is wrong); `no_store` semantics.
+- Never log: prompt/completion text, PII values, the re-identification
+  map, judge inputs or rationale that quotes input. Check `accessLog`'s
+  `err` field and span errors.
+
+---
+
+## C. Features, ranked by value × feasibility
+
+1. **Done (branch `features-c`):** `audit_events`, written by the admin
+   API middleware and the /admin pages (with each change's result), `ctl
+   audit`, the console's Audit view; staff roles viewer / operator /
+   billing / admin. Left: before/after values (the request's fields are
+   recorded, not the state they replaced); a tenant-admin role that changes
+   its own organization (managers still only view it); hiding the forms a
+   viewer cannot submit. **Audit log and roles (M).** Today "audit" is slog lines
+   (`internal/web/admin_users.go:403-480`) and roles are the `IsAdmin` flag
+   plus an org "manager" who can view. Add `audit_events` (who, what,
+   before/after, source) written by the `adminAction`/`tenancyAction`
+   wrappers and by every admin-API mutation; roles viewer / operator /
+   tenant-admin / billing; `ctl audit`. Depends on A5 for a real actor.
+2. **Done (branch `features-c`):** OIDC sign-in (`auth.oidc`, PKCE,
+   verified email, roles and memberships from groups, `no_passwords`) and
+   SCIM 2.0 (`/scim/v2` Users and Groups). Left: the sign-in cookie is
+   signed with a per-process key, so with two control planes behind a
+   balancer the callback must reach the one that started it (sticky
+   sessions) until the key comes from the store. **OIDC/SSO login (M), then SCIM (M).** `internal/account/service.go`,
+   `internal/web/account.go`; map IdP groups to org/team/admin.
+3. **Done (branch `features-c`):** key lifetime limits (gateway, org, team,
+   project), `keys rotate --overlap`, kinds and expiry in `keys list`.
+   **Service accounts and key lifecycle (S).** Per-org maximum key TTL,
+   `keys rotate` with overlap, last-used shown, project-owned service keys
+   listed apart. `internal/cli/keys.go`, `internal/store/keys.go`,
+   `internal/auth/auth.go`.
+4. **Done (branch `features-c`):** CSV export from the rollups (API, ctl,
+   console). Left: Parquet, and a scheduled push to S3/SFTP. **Usage export (S).** CSV/Parquet by org/team/project/model/period from
+   the rollups (`internal/store/usageseries.go`), `GET
+   /api/v1/usage/export`, optional scheduled push to S3/SFTP.
+5. **Done (branch `features-c`):** `notify.webhooks` (model parked, node
+   lost, budget spent, update available; signed JSON or Slack; retries,
+   hourly de-duplication), `ctl notify test`, Alertmanager receiver
+   templates. Left: `server init` and the console do not yet ask for a
+   receiver — the templates are filled in by hand; each control plane sends
+   budget events on its own, so two behind a balancer may both send one.
+   **Alerting out of the box (S).** `deploy/monitoring/alertmanager.yml`
+   ships `receiver: none`; add Slack/email/webhook/PagerDuty receiver
+   templates driven by `server init` or the console; llmgw-native webhooks
+   for model parked, budget spent, update available (from the reconciler
+   and `modelserve`).
+6. **Done (branch `features-c2`):** `metadata`, `x-llmgw-tags` and `user`
+   on the usage record (migration 0023), `ctl request` shows them,
+   `router.tag_labels` metrics with 100 values per tag. Left: export and
+   `ctl usage` by tag or end user (the hourly and daily sums do not carry
+   tags; it would read the request records, within their retention).
+   **Request metadata and tags (S).** Accept `metadata`/`user` from the
+   body or `x-llmgw-tags`; store on the usage row; tenant metric labels
+   behind an allowlist. `router/handlers.go` parse, `accounting/recorder.go`.
+7. **Done (branch `features-c2`):** `ctl model canary/promote/canaries`,
+   session-sticky split with `x-llmgw-variant` pins, rollback on error rate
+   or TTFT, `canary_rolled_back` notification, console menu. Left: A/B
+   between two different models (the split is between a model and its
+   newer weights); the comparison is per control plane and lives in memory,
+   so a restart begins it again; a key-level pin.
+   **Canary and weighted A/B between model revisions (M).**
+   `control/modelserve/updates.go` `replace` swaps every replica; add
+   weighted routing across two revisions/aliases (scheduler filter, alias
+   resolution in `router/router.go:569`), a header/key pin, automatic
+   rollback on error-rate or TTFT regression from per-replica metrics.
+8. **Done (branch `features-c2`):** `/v1/files` and `/v1/batches`
+   (OpenAI's shape), worker under a store lease, lines kept as served,
+   lowest band, usage tagged `batch=<id>`, output and error files with
+   retention, `no_store` refused. Left: the Responses API (`/v1/responses`)
+   as a batch endpoint; the console and `ctl` do not list batches (an
+   operator sees them through usage tags); a file is one row in the store,
+   so a store backup carries batch files with it.
+   **Batch API and Files (M–L).** `/v1/files`, `/v1/batches`, JSONL
+   storage, a worker feeding the bronze band, accounting. New
+   `internal/router/batch`.
+9. **Done (branch `features-c2`):** `keys requests` (retention, sample),
+   kept after redaction, `ctl request --body/--replay`, console, pruning.
+   Left: a streamed answer is kept as its text, not its chunks; replay is
+   one request at a time (a set of them against a model is item 21's eval).
+   **Request/response logging and replay (M).** Opt-in per project with
+   retention like threads; sampled or full; redaction hooks from B;
+   `ctl request <id> --body`; replay against another model.
+10. **Done (branch `features-c2`):** Responses `text.format`,
+    `input_image`, `previous_response_id` (thread in the id); rerank and
+    score passthrough; transcription and translation as multipart;
+    `/v1/moderations` by the judge. Left: audio is charged no tokens (an
+    engine's duration usage is not read); `input_image` by `file_id`;
+    moderation scores are 0 or 1, as a judge says yes or no.
+    **OpenAI compatibility gaps (S–M each).** Responses: `text.format` →
+    `response_format`, `input_image`, `previous_response_id` via threads
+    (`router/responses.go`). Rerank/score passthrough for vLLM,
+    `/v1/audio/transcriptions` for a whisper engine, `/v1/moderations`
+    mapped to the guard model.
+11. **Done (branch `features-c2`):** `/v1/messages` and `count_tokens`,
+    streamed and not, tools, images, `x-api-key`, Anthropic error shape.
+    Left: extended thinking (a reasoning model's thoughts are not mapped to
+    thinking blocks); prompt caching; the account page's "Connect your
+    editor" does not offer Claude Code yet.
+    **Anthropic `/v1/messages` (M).** Translate like `responses.go`.
+12. **Done (branch `features-c2`):** `server restore` (dry run, version
+    check, decryption, modes and owners, SQLite and PostgreSQL),
+    `backup_copy_to` (directory or ssh), the drill in docs/install.md.
+    Left: restoring a replicated store's members (restore into the primary;
+    Patroni replicates it); the console's Back up now does not offer
+    restore; an ssh copy holds the archive in memory while it sends it.
+    **`server restore` (S).** Restore is manual shell today
+    (`docs/install.md:1187`); add the command with version check, dry run,
+    off-host copy target; a documented DR drill.
+13. **Done (branch `features-c2`):** TPOT, inter-token and tokens/s
+    histograms by model, pool and tenant; `slo` pressure in admission's
+    saturation; `llmgw_model_slo_seconds` and `llmgw-slo` alerts. Left: the
+    p99 is per control plane, from its own requests; an SLO per band or per
+    tenant; placement does not yet add replicas for an SLO (item 14).
+    **SLO-based admission and token-level metrics (S–M).** TPOT and
+    inter-token histograms, output tokens/s per model and tenant in
+    `router/metrics.go`; use `catalog.SLO` in `admission/saturation.go`.
+14. **Done (branch `features-c2`):** `scaling.schedule` (days, from, to,
+    min, max; past midnight), `scaling.prewarm`, `control.timezone`;
+    queue-depth scaling was there already. Left: `ctl scale` sets min and
+    max only (a schedule is set in the definition); scaling for an SLO
+    rather than for queue depth.
+    **Scheduled and warm-pool autoscaling (S–M).** Time-of-day min/max,
+    pre-warm, queue-depth scaling in `catalog.Scaling`,
+    `control/reconciler/demand.go`, `headroom.go`.
+15. **Done (branch `features-c2`):** `env:` and `vault:` references
+    wherever a secret file is named (store address, api_key_file, OIDC,
+    SCIM, webhooks), Vault KV with token or AppRole, `secrets.master_key`
+    sealing cluster_secrets (Vault transit or a local key). Left: the
+    certificate authority's key is still a file in /etc/llmgw (signing in
+    Vault's PKI engine instead is its own change); rotating the master key;
+    `backup_copy_key` and `admin_token_file` are files only.
+    **Secrets management (S–M).** Vault/KMS for `api_key_file`, the DSN, the
+    CA key, `cluster_secrets` (`store/secrets.go`, `store/seal.go`);
+    envelope-encrypt them in backups (with A8 backups).
+16. **Done (branch `features-c2`):** `users forget` (pseudonymised usage
+    and sums, kept requests, files, batches, limits and audit names), `keys
+    residency --in-cluster` (asked-for, fallback and canary). Left: an
+    export of everything held about a person (article 15); residency by
+    region between several clusters; backups keep what was forgotten until
+    they age out.
+    **GDPR and residency (S).** "Forget user" anonymises `user_id` in usage
+    and rollups and erases threads/memory (`store/hierarchy.go:241` leaves
+    it today); per-project "never route to an External provider".
+17. **Done (branch `features-c2`):** exact-match answer cache per project (`keys
+    cache --ttl/--any/--off`, console **Cache answers…**, `projects`
+    columns, 30-second setting cache), reproducible answers only unless
+    `--any`, LRU in memory bounded by `router.cache.max_bytes` and
+    `max_entry_bytes`, streamed answers kept and replayed as chunks,
+    `x-llmgw-cache` and `Cache-Control: no-cache`, guardrails before a hit
+    and the output policy on it, `no_store` and threads bypass, a hit
+    recorded as `cache_hit` with no tokens and no cost (migration 0027),
+    metrics, docs. Left: semantic (embedding-similarity) caching through the
+    embeddings models; a cache shared across control planes (each process
+    keeps its own, deliberately: a shared one would write every answer to
+    the store); a hit still waits its turn in admission, because the
+    guardrails judge the request after admission and the key is the request
+    they let through; logprobs in a streamed answer leave it unkept; `users
+    forget` does not reach into the cache (answers age out by the TTL); no
+    listing or flushing of what is cached (`--off` stops it being served at
+    once, the memory is freed by TTL and LRU).
+    **Response/semantic cache (M).** Exact-match first, per project,
+    opt-in, TTL; semantic via the embeddings models later. Before
+    `dispatch` in `router/handlers.go`.
+18. **Done (branch `features-c2`):** offline bundles — `llmgw bundle create`
+    (releases with signed checksums, every llama.cpp build per arch/variant
+    with GitHub's checksums, starter/judge and named Hugging Face model
+    files pinned and checked; directory or tar; manifest sha256), `bundle
+    import` (checked, all-or-nothing, into the mirror under `_llmgw/`),
+    `bundle trust`, `bundle show --verify`;
+    `offline.mirror`/`offline.checksums` in server.yaml, with nodes
+    installing llama.cpp from the mirror against checksums the control plane
+    sends over the agent stream (proto `EngineWant.offline_*`), releases
+    defaulting to the mirror for `node add`, `ctl upgrade` and agent
+    upgrades, update checks off; `server init --bundle` and the setup form's
+    bundle fields; docs/data.md's offline claim corrected; install.md
+    "Offline sites". A Helm chart for the control plane
+    (`deploy/helm/llmgw`, one replica, SQLite PVC or external PostgreSQL,
+    Secrets, Services, Ingress, ServiceMonitor) with
+    `deploy/container/Dockerfile` and docs/kubernetes.md; GPU nodes stay
+    outside Kubernetes by design. Left: vLLM/SGLang offline (a wheelhouse of
+    several GB per CUDA build and a uv `--find-links` install path); the
+    NVML release binary and uv in bundles; the setup wizard's preflight
+    still fails a machine without internet; `join`'s printed `curl` from the
+    mirror checks nothing; models in a bundle are single files (no whole-
+    repository safetensors sets yet); the chart runs one replica (a standby
+    is never ready, so HA in Kubernetes needs a different readiness design),
+    has not been installed on a real cluster, and ships no agent DaemonSet;
+    no published container image.
+    **Kubernetes/Helm and an air-gapped bundle (M).** `deploy/`,
+    `agent/provision`; `docs/data.md` claims offline operation but install
+    assumes the internet.
+19. **Done (branch `features-c2`):** `adminapi.Routes` and
+    `internal/docgen/openapi` generating `docs/admin-api.openapi.json` (3.1,
+    bearer security, every route, query parameters, schemas from the Go
+    types with their comments), served embedded at `GET
+    /api/v1/openapi.json`, kept true by a route-table test and a staleness
+    test; validated with openapi-spec-validator and openapi-generator-cli.
+    `GET /api/v1/models/{name}`. `docs/admin-api.md`. `terraform-provider-
+    llmgw/` (terraform-plugin-framework): `llmgw_model`, `llmgw_quota`,
+    `llmgw_guard_attachment`, data sources `llmgw_models` and `llmgw_nodes`;
+    client tests against a fake admin API and the OpenAPI document;
+    acceptance tests with Terraform and OpenTofu against the fake; one
+    apply, empty plan, in-place change and destroy against a real `llmgw
+    server` run by hand. Left: organizations, teams, projects, people and
+    keys are not in the admin API (they are `llmgw org`/`users`/`keys`
+    against the store), so not in the provider; a model's definition beyond
+    scaling, class, owner and adapters is changed by replacing it (the API
+    has no edit, and `resources` is not used yet); `canary`, `slo`,
+    `scaling.schedule` and `prewarm`, `guard` role and `origin` are not in
+    `llmgw_model`; models cannot be imported; the provider is not published
+    to a registry and has no release build; the acceptance tests are not run
+    in CI (they need Terraform); the document's schemas mark nothing
+    required and give no enums; `catalog.SLO`'s fields have no JSON tags, so
+    they are `TTFTp99` and `TPOTp99` on the wire.
+    **OpenAPI for the admin API, Terraform provider (M).** Generate from
+    `adminapi/api.go` routes via `docgen`.
+20. **Done (branch `features-c2`):** spans for the reconcile pass (begun only
+    when a pass does something), placement with its answer or rejections,
+    scale-up/down, drain, stop, eviction, preemption, reaping, restarts and
+    lost nodes; a `replica start` span from placement to serving whose
+    context travels to the agent in the start command
+    (`ControlMessage.trace`), where weights fetch, engine launch, rendezvous
+    and readiness wait continue the trace; stops, drains, adoption and
+    engine installs; modelserve jobs as a trace with a span per step linked
+    to the replica's start; an agent `tracing` block; docs in install.md's
+    "Tracing". Left: the router's span for a request does not link to the
+    replica it was sent to's start; heartbeats, fabric scans, logs and agent
+    upgrades are not traced; the supervisor has no restart span because it
+    never restarts an engine itself (a restart is the reconciler's `restart
+    replica` and reaches a node as a stop and a start); canary and promote
+    jobs, which landed on `features-c2` after this was branched, are traced
+    only through the shared step recording (as `<kind> model`), unchecked by
+    a test.
+    **Tracing beyond the router (S).** Spans for reconciler, placement,
+    agent start (`obs/trace.go`, `control/reconciler`, `agent/supervisor`).
+21. **Done (branch `features-c2`):** `internal/bench/eval` (suites in YAML or
+    JSON lines; exact, contains, regex, number, a JSON Schema subset, and a
+    judge model with a rubric; weights and a threshold), run on the control
+    plane through `Router.Replay`; `llmgw ctl eval MODEL --suite FILE|NAME`,
+    `--history`, `--run`, `--suites`; runs and their cases kept (migration
+    0028, `eval_runs` and `eval_cases`); `model update`/`promote --eval
+    SUITE --min-score N`, a model's standing gate (`ctl model gate`, `eval:`
+    in the catalog) — a promote asks the canary first, an update tries the
+    new weights as a 0% canary and promotes or removes it; the console's
+    model menu; `arithmetic` and `json-format` in `deploy/eval/`, carried in
+    the binary. Left: the suite of a model's standing gate is read by name
+    on the control plane at the time of the update, so two control planes
+    need the same `control.eval_dir`; a gated update needs room for one more
+    replica while it runs (there is no in-place gate, and a declared model
+    in server.yaml cannot be updated at all); no comparison against the old
+    weights' score (the gate is an absolute threshold, not "no worse than
+    before"); a run is not stopped once started (Esc in the console only
+    stops watching it), and the in-memory progress of a run lives on the
+    control plane that started it; runs are never pruned; the JSON Schema
+    support is a subset (no `$ref`, `oneOf`, `not`, `uniqueItems`); judge
+    cases go through the same concurrency as the model's, and a judge's
+    answers are not kept, only its score and reason; a gateway without a
+    control plane cannot run suites (there is no mode that asks through the
+    client API with a key).
+    **Eval harness (M).** `llmgw eval` extending `internal/bench` with
+    quality suites gating `model update`.
+22. **Done (branch `features-c2`):** MIG instances discovered on both paths
+    (nvidia-smi `-L` + `-q -x`; NVML through an interface with a faithful
+    fake) and reported instead of their card, each with its MIG UUID, own
+    memory and class `<card class>-mig-<profile>`; device numbers 1000 + 100
+    × card + instance, shown as `card/migN`; placement on MIG classes;
+    tp/pp/gpus/nodes above 1 on a MIG class refused in catalog validation
+    and again in placement; `CUDA_VISIBLE_DEVICES=MIG-<uuid>` for vLLM and
+    llama.cpp (no Vulkan device variable on MIG); per-instance memory and
+    processes in heartbeats and the GPU check, card sensors under each
+    instance, utilisation absent rather than zero; doctor MIG findings (`mig
+    -lgi`/`-lci` parsed); `ctl nodes`, console, `ctl status`, `ctl model
+    plan`/`serve` by class; docs/install.md MIG section. Written and tested
+    against fakes only — untested on real MIG hardware. Left: run it on an
+    A100/H100 in MIG mode (check `-L`/`-q -x`/`mig -lgi`/`-lci` and NVML MIG
+    device names against the parsers, and that `CUDA_VISIBLE_DEVICES=MIG-…`
+    reaches vLLM's workers through Ray); instances changed while the agent
+    runs are only seen when it restarts (no rescan); llmgw does not create
+    or reshape instances (no mig-parted integration); quotas count an
+    instance as one GPU, the same as a whole card; SGLang on MIG not
+    checked; device numbers assume fewer than 100 instances per card and
+    that instance numbers stay put while shards run on them.
+    **MIG (M–L).** Treat a MIG slice as a GPU class in
+    `agent/discovery/gpu_nvml.go` and `control/placement`.
+23. **Done (branch `features-c2`):** engine `trtllm`
+    (`internal/agent/engines/trtllm.go`): `trtllm-serve` through a launcher
+    of llmgw's that demands the replica's key (trtllm-serve has none) and
+    writes the options file that turns on `/prometheus/metrics` and the
+    iteration statistics; the scrape contract for it
+    (`scrape.TRTLLMMapping`, with a per-engine metrics path); found, not
+    installed — `engines.trtllm.python` in `agent.yaml`, probed from the
+    package's metadata; catalog validation (GPU class, one node, no GGUF
+    source, the flags a profile may not give); `ctl engine-check trtllm`,
+    which asks `trtllm-serve serve --help` through its module. Ollama/GGUF
+    import: `mirror import-ollama` (manifest parsing, blob digest check,
+    projector beside the model, all or nothing, a model definition printed),
+    `mirror import` for any local file, and the console's **I** on the
+    Mirror view. Left: TensorRT-LLM has not run on real hardware — the first
+    node with one should run `engine-check` and serve a model before anyone
+    relies on it; no installer for it; no multi-node TensorRT-LLM replica
+    (it needs an MPI or Slurm launch from one node); Triton Inference Server
+    as an engine is not done; trtllm's queue gauges are set per iteration,
+    so an idle engine shows its last batch until the next request;
+    `--num_serve_frontends` is refused because extra front ends would not
+    demand the key. The Ollama import runs on the mirror machine only — the
+    mirror's API takes no files, so an Ollama elsewhere means copying the
+    blob or running the import there; Ollama models kept as separate tensors
+    or as several weight layers, and its LoRA adapters, are refused or left
+    with a sentence; files an import run with `sudo` writes are root's, as
+    `mirror add`'s are.
+    **More engines (M each).** TensorRT-LLM/Triton adapter; Ollama/GGUF
+    import. `agent/engines/engine.go` interface and the metric contract in
+    `router/scrape`.
+24. **Done (branch `features-c2`), all six parts.** Lower: precise KV-index routing (plan phase 6), LoRA affinity for
+    vLLM, multi-cluster federation via External providers, facility-aware
+    placement (`docs/facility-aware-placement.md`), portal i18n, SDK/docs
+    portal.
+    What was built, and what is left:
+    - 24 (portal i18n): built — English/Turkish catalogue with fallback, per-
+      language templates, cookie/Accept-Language/`landing.language` choice
+      and a footer switcher, Turkish numbers and dates, every template and
+      handler message translated, tests that no template text stays English;
+      left — errors built with fmt.Errorf in other packages (store, catalog,
+      mirror, adminapi) still English on Turkish pages, percent sign
+      placement is mixed (%50 on limits, 93% on cluster pages), RFC3339
+      footer timestamps and plain-text http.Error bodies untranslated, the
+      /docs documents themselves English, a per-person language column
+      (cookie only today).
+    - 24 (SDK/docs portal): built — /docs renders the embedded manual (goldmark,
+      GFM, heading anchors, links rewritten, no script; public,
+      `landing.docs_sign_in` to require a session), and docs/clients.md
+      shows the official OpenAI/Anthropic SDKs against llmgw. Left: the
+      console's generated "Commands" page is not in the portal (it is built
+      from the cobra tree, which internal/web cannot see); no search across
+      documents.
+    - [~] 24. Precise KV index (tier 2) — built: vLLM KV events via the agent
+      (loopback ZMQ, pure-Go zmq4, msgpack in both of vLLM's encodings)
+      forwarded as net block-hash changes over the agent stream; router
+      index, tokenize via the replica's `/tokenize`, sha256_cbor block-hash
+      chain checked against cbor2/hashlib golden values; scorer by leading-
+      block share with tier 1 fallback; opt-in `kv_events` per profile;
+      metrics; docs. Left: validation against a real vLLM (event shape, hash
+      agreement, `/tokenize` matching the served prompt, cost of
+      tokenizing); vLLM's replay endpoint instead of resetting on a gap;
+      data-parallel ranks (one publisher each, ports offset); hybrid models'
+      cache groups and CPU-offloaded blocks; LoRA/multimodal/cache_salt
+      requests (extra keys); a router-only deployment (no agents)
+      subscribing directly; standby control planes have no index until they
+      lead; a per-replica fallback when only some candidates have an index;
+      caching tokenizations of repeated prompts.
+    - **24 LoRA affinity (branch `features-c2`):** built `max_loaded_adapters`
+      (catalog), vLLM adapter support at start and on demand
+      (`engines/lora.go`, `vllm.go`), the agent linking fetched adapters as
+      `llmgw-lora/<name>` in the engines' working directory, the router's
+      adapter tracker (`router/lora.go`: loads/unloads with the engine key,
+      LRU eviction never of an adapter in use, one load per adapter per
+      replica, `/v1/models` sync, 404 reload) and the `adapter-affinity`
+      scheduler filter in the chat, batch and long-context profiles, with
+      metrics and docs; tested against a fake of vLLM's HTTP interface.
+      **Left:** never run against a real vLLM — in particular that vLLM
+      resolves the relative `llmgw-lora/<name>` path against its working
+      directory on every node (multi-node too) and that unloading an adapter
+      mid-request is harmless; the agent still fetches every adapter at
+      replica start, so a new adapter needs a restart (fetching on first
+      load would need an agent command and a proto change); load timeout and
+      resync interval are constants, not config; SGLang's runtime LoRA API
+      is not driven; no per-replica "adapters held" view in the console or
+      admin API; the debug profile has no affinity.
+    - 24. Multi-cluster federation — built: peers via `ctl federation` kept in
+      the store, their models as PEER/MODEL synced from /v1/models
+      (withdrawn-while-referenced), /ready health with latency and routing
+      withdrawal, `ctl model fallbacks` for overflow, hop header loop
+      refusal, residency/no_store hold, optional attribution tags, console
+      view, metrics, docs. Left: server.yaml-declared models cannot name a
+      peer model as a fallback (config catalog is validated before peers are
+      read); per-peer CA / mTLS for peers behind a private CA; transitive
+      federation (A→B→C models) deliberately not offered; latency is /ready
+      RTT only (no per-request peer TTFT used in routing or weighting); the
+      peer's adapters are not imported (listed as aliases); no console form
+      to add/remove peers (CLI only); key file must exist on every control
+      plane.
+    - 24 (facility) — built: location labels (`ctl label`, agent.yaml),
+      spreading across racks/PDUs, `keep_within`, held domains with drain
+      (`ctl facility hold/release`, kept in the store), power caps from
+      `facility.budgets` against declared/derived/measured draw, shown in
+      explain-placement, `ctl nodes`, `ctl facility`, the console and the
+      API. Left: temperature conditions with hysteresis and their
+      enforcement (steps 3–4), a Prometheus/DCIM source, power headroom as a
+      rack-levelling score, spreading multi-node replicas across racks,
+      `llmgw_domain_*` metrics and alerts (near cap, over cap, stale data),
+      shedding and tokens per watt (step 5), and a drained node's state
+      surviving a restart.
+
+---
+
+## D. Facts worth knowing before starting
+
+- Admin API: `127.0.0.1:9090`, no auth, `ctlClient` in `internal/cli/ctl.go`.
+  Metrics on `:9091` with `/prometheus/targets` beside them.
+- Store: `internal/store`, migrations under `internal/store/migrations/{sqlite,postgres}`;
+  the PoC runs PostgreSQL under Patroni.
+- The console (`sudo llmgw`) is `internal/cli/tui_console.go` with actions
+  in `tui_actions.go`; every operator-visible change needs a row action or
+  a form there, and a line in `docs/console.md`.
+- Tests of the console use a fake admin API (`internal/cli/tui_actions_test.go`,
+  `adminStub`); tests of serving use fakes in
+  `internal/control/modelserve/modelserve_test.go`.
+- `go generate ./...` regenerates `docs/reference.md` and
+  `internal/docgen/reference_gen.go` whenever a config struct changes; the
+  docgen test fails otherwise.

Makefile

@@ -2,7 +2,7 @@ MODULE  := gitea.mynodes.xyz/ilker/llmgw
 VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 LDFLAGS := -X '$(MODULE)/internal/version.Version=$(VERSION)'
 
-.PHONY: build test race lint fmt clean rename proto proto-tools
+.PHONY: build test race lint fmt vuln check clean rename proto proto-tools
 
 build:
 	go build -ldflags "$(LDFLAGS)" -o bin/llmgw ./cmd/llmgw
@@ -20,6 +20,17 @@ fmt:
 	go fmt ./...
 	go vet ./...
 
+# Known vulnerabilities reachable from this code, in the standard library and
+# in dependencies. A toolchain left behind is the commonest cause: the go
+# directive in go.mod is what fixes it.
+vuln:
+	go run golang.org/x/vuln/cmd/govulncheck@latest ./...
+
+# What has to pass before a change is merged.
+check: test
+	go vet ./...
+	$(MAKE) vuln
+
 # Regenerate the agent protocol. Generated code is committed, so this only
 # needs running when api/proto changes.
 proto: proto-tools

README.md

@@ -1,22 +1,24 @@
 # llmgw
 
-A single-binary LLM gateway for clusters with multiple InfiniBand fabrics and
-heterogeneous GPUs.
+A single-binary LLM gateway for clusters with multiple InfiniBand fabrics,
+NVLink domains and heterogeneous GPUs.
 
 It serves LLMs running on your own GPU servers (vLLM / SGLang) behind one
 OpenAI-compatible endpoint. Design document: [llmgw-plan.md](llmgw-plan.md).
 
 ## Getting started
 
-Starting from nothing — no packages installed, no drivers, no nodes — follow
-[docs/install.md](docs/install.md): it builds a control plane, adds a node and
-serves a model, and says plainly which parts llmgw does not install for you.
+On the machine that will be the control plane, with the release binary
+installed:
 
-| Guide | For |
-|---|---|
-| [docs/install.md](docs/install.md) | Standing up a cluster from scratch |
-| [docs/node-onboarding.md](docs/node-onboarding.md) | Adding nodes to one that exists |
-| [docs/onboarding.md](docs/onboarding.md) | Giving people accounts and keys |
+```sh
+sudo llmgw
+```
+
+The setup screens install one machine or three (high availability), check
+them first, and leave a model answering. After that the same command opens
+the console. [docs/quick-install.md](docs/quick-install.md) has the six steps
+from empty servers to a first request; everything else is below.
 
 ## Status
 
@@ -32,6 +34,9 @@ Releases track the roadmap phases; see [CHANGELOG.md](CHANGELOG.md).
 | v0.6.0 | 4 | Multi-node placement and fabric awareness | released |
 | v0.7.0 | — | Conversations, agent memory, disk management | released |
 | v0.8.0 | — | PostgreSQL, leader election, agent failover | released |
+| v0.9.0 | — | Managing people and the tenancy tree | released |
+| v0.10.0 | — | InfiniBand fabrics and NVLink, doctor, node add, engines installed by the nodes | released |
+| v0.11.0 | — | High availability from setup, the setup and console screens, usage sums and per-tenant alerts | released |
 | v1.0.0 | 5 | Tenancy, prefix affinity, benchmarking | planned |
 
 As of v0.6.0 a cluster runs unattended: agents report their hardware, the
@@ -39,39 +44,110 @@ control plane places replicas — including ones larger than a single machine
 models load when someone asks for them and stop when nobody does, and keys,
 budgets and rate limits decide who may use any of it.
 
-Before v1.0.0: tracing, reference documentation, and filtering on `ctl nodes`
-and `ctl replicas` for fleets too large to read a whole table of. Two items
-that were on this list are not gaps: a model falls through to its fallbacks
-when there is no capacity as well as when a budget is spent, and routing
-profiles are chosen by the key rather than by a request header on purpose —
-a header would let any client promote itself into the top priority band.
+Since v0.11.0, not yet released (see [CHANGELOG.md](CHANGELOG.md),
+"Unreleased"):
+
+- **Security hardening** — signed releases only, a token on the admin API,
+  engines not run as root, TLS for the agent port, etcd and Patroni, a
+  firewall for llmgw's internal ports, encrypted backups, bounded
+  connections, sign-in throttling, a Content-Security-Policy.
+- **Guardrails** — policies that check requests and answers (PII, secrets,
+  prompt injection, deny patterns, a judge model such as Llama Guard), in
+  observe or enforce mode, attached to any part of the tenancy tree:
+  [docs/guardrails.md](docs/guardrails.md).
+- **Administration** — an audit log of every change (`ctl audit`), staff
+  roles (viewer, operator, billing, admin), single sign-on through OpenID
+  Connect and provisioning through SCIM 2.0, key lifetime limits and
+  rotation with overlap (`keys ttl`, `keys rotate`), usage export as CSV
+  (`ctl usage export`).
+- **Notifications** — webhooks, signed or Slack-shaped, for a model parked,
+  a node lost, a budget spent and new weights published (`notify.webhooks`,
+  `ctl notify test`), and Alertmanager receiver templates.
+- **Traffic and models** — request tags, canaries of new weights with
+  automatic rollback, quality suites gating updates, a response cache,
+  kept and replayed requests, batches, Anthropic's Messages API, more of
+  OpenAI's (structured output, images, rerank, audio, moderations),
+  scaling by the clock, SLO-aware admission, TensorRT-LLM, MIG, models
+  imported from Ollama, routing by what each vLLM replica's cache holds,
+  LoRA adapters loaded on demand, other llmgw clusters as providers, and
+  placement that knows racks, PDUs and power caps.
+- **Operations** — `server restore` and off-machine backup copies, secrets
+  in Vault, forgetting a person and keeping a project's requests in the
+  cluster, offline installs from a bundle, a Helm chart, tracing from the
+  control plane to the engines, the admin API in OpenAPI with a Terraform
+  provider, and the portal in English and Turkish with its docs at /docs.
+
+Every one of these is in the console as well as on the command line:
+[docs/console.md](docs/console.md).
+
+What is still ahead is in [BACKLOG.md](BACKLOG.md). Two things that look like
+gaps are not: a model falls through to its fallbacks when there is no
+capacity as well as when a budget is spent, and routing profiles are chosen
+by the key rather than by a request header on purpose — a header would let
+any client promote itself into the top priority band.
 
 One thing is worth saying plainly:
 multi-node replicas are proven on a simulated cluster and on real hardware
-without a fabric. The InfiniBand, NVML and NCCL paths are written against the
-formats and failure modes those tools actually have, but they have not yet run
-on a machine that has them.
+without a fabric. The InfiniBand, NVLink and NCCL paths — telling fabrics apart
+by their subnet managers, mapping them, finding NVLink domains, launching across
+nodes — are written against the formats and failure modes those tools actually
+have and tested against them, but they have not yet run on a machine that has
+them. On such a machine, run `llmgw doctor --json` first and keep the report;
+[docs/fabrics.md](docs/fabrics.md) says what to look at after that.
 
 ## Documentation
 
-- [docs/install.md](docs/install.md) — installing from nothing: control plane,
-  nodes, engines, weights, first request
-- [docs/quickstart.md](docs/quickstart.md) — the short path
+Every page is also in the binary: `llmgw docs`, or **Manual** in the console.
+
+**Installing**
+
+- [docs/quick-install.md](docs/quick-install.md) — from empty servers to a
+  first request, in six steps: start here
+- [docs/install.md](docs/install.md) — the same with every option explained,
+  and running the cluster after: monitoring, notifications, single sign-on,
+  the firewall, upgrades, backups
+- [docs/node-onboarding.md](docs/node-onboarding.md) — adding nodes to a
+  cluster that exists
+- [docs/kubernetes.md](docs/kubernetes.md) — the control plane on
+  Kubernetes with the Helm chart, and why GPU nodes stay outside it
+- [docs/fabrics.md](docs/fabrics.md) — InfiniBand fabrics and NVLink: what
+  llmgw needs of them, checking a node with `llmgw doctor`, and what to look at
+  when a replica spanning nodes will not run
+
+**Running it**
+
+- [docs/console.md](docs/console.md) — the console that bare `llmgw` opens:
+  every view, and the command each of its actions runs
+- [docs/onboarding.md](docs/onboarding.md) — accounts, keys, limits, staff
+  roles and single sign-on
+- [docs/clients.md](docs/clients.md) — using the gateway from code with the
+  official OpenAI and Anthropic SDKs, and llmgw's extensions
+- [docs/guardrails.md](docs/guardrails.md) — checking requests and answers:
+  policies, detectors, a judge model, and where each applies
 - [docs/choosing-models.md](docs/choosing-models.md) — which models to run,
   how many of each, and where the weights should live
-- [docs/data.md](docs/data.md) — what llmgw stores, what it does not, and
-  what leaves the machine; written for a security review
+
+**Reference**
+
 - [docs/reference.md](docs/reference.md) — every configuration key, generated
   from the structs and checked by a test, so it cannot describe a setting that
   does not exist or miss one that does
-- [deploy/mirror/](deploy/mirror/) — a model mirror, which is the cheapest
-  and most useful thing to build around llmgw
-- [deploy/proxy/](deploy/proxy/) — Caddy and nginx in front of the client
-  port, with streaming and the forwarded headers right
-- [deploy/ha/](deploy/ha/) — running two control planes, and the one health
-  check that has to be right
-- [docs/node-onboarding.md](docs/node-onboarding.md),
-  [docs/onboarding.md](docs/onboarding.md) — adding machines, and adding people
+- [docs/data.md](docs/data.md) — what llmgw stores, what it does not, and
+  what leaves the machine; written for a security review
+- [docs/admin-api.md](docs/admin-api.md) and its OpenAPI document — the
+  admin API, for scripts; [terraform-provider-llmgw/](terraform-provider-llmgw/)
+  manages models, quotas and guardrails with Terraform or OpenTofu
+- [deploy/](deploy/) — [a mirror](deploy/mirror/) on its own machine,
+  [Caddy and nginx](deploy/proxy/) in front of the client port, [two control
+  planes](deploy/ha/) behind a balancer, and [Prometheus, Alertmanager and
+  Grafana](deploy/monitoring/)
+
+**Working on llmgw**
+
+- [docs/development.md](docs/development.md) — built from source on one
+  workstation, no systemd and no `sudo`
+- [llmgw-plan.md](llmgw-plan.md) — the design; [BACKLOG.md](BACKLOG.md) —
+  what is next
 
 ## Building
 
@@ -90,8 +166,13 @@ llmgw ctl replicas --model llama     # replicas and their shards
 llmgw ctl explain-placement llama    # why a model has not been placed
 llmgw ctl drain gpu-a-01             # move work off a node, one replica at a time
 llmgw ctl cordon gpu-a-01            # stop new placement, leave what runs
+sudo llmgw doctor                    # on a node: what its GPUs, NVLink and fabric need
+llmgw ctl audit --since 24h          # who changed what
+llmgw ctl usage export --from 2026-09-01 --to 2026-10-01 --by project,model
 ```
 
+Bare `llmgw` opens the console, which does all of this from one screen.
+
 `ctl` talks to the admin port (`:9090` by default), not the client-facing one.
 Add `--json` to any command for machine-readable output.
 

api/proto/llmgw/v1/agent.proto

@@ -24,9 +24,39 @@ message AgentMessage {
     Heartbeat heartbeat = 2;
     ShardStatus shard = 3;
     LogsReply logs = 4;
+    FabricScanReply fabric_scan = 5;
+    FabricTestReply fabric_test = 6;
+    UpgradeReply upgrade = 7;
+    KVEvents kv_events = 8;
   }
 }
 
+// KVEvents is a change to what one vLLM replica's prefix cache holds, read
+// by the agent from the engine's KV cache events and sent on for the router's
+// precise index (plan §7.5 tier 2).
+//
+// A net effect since the last one, not the events themselves: a block stored
+// and evicted between two sends is not worth the bytes. On every new stream
+// the agent first sends each replica in full, with clear_first set, because a
+// control plane that has just started or taken over knows nothing.
+message KVEvents {
+  string replica_id = 1;
+  // block_size is how many tokens make one of the replica's blocks.
+  int32 block_size = 2;
+  // clear_first says to forget what was known of the replica before applying the
+  // rest: its cache was cleared, its engine restarted, events were lost, or
+  // this is the first piece of a full copy.
+  bool clear_first = 3;
+  // stored and removed are block hashes as vLLM publishes them: the low 64
+  // bits of the sha256_cbor digest.
+  repeated fixed64 stored = 4;
+  repeated fixed64 removed = 5;
+  // problem, when set, is why the replica's events cannot be used — most
+  // likely an engine hashing another way than llmgw configured. Its index is
+  // empty while it stands.
+  string problem = 6;
+}
+
 // ControlMessage is anything the control plane tells a node.
 message ControlMessage {
   oneof msg {
@@ -37,7 +67,25 @@ message ControlMessage {
     RemoveWeights remove_weights = 5;
     Provision provision = 6;
     LogsRequest logs = 7;
+    FabricScanRequest fabric_scan = 8;
+    FabricTestRequest fabric_test = 9;
+    UpgradeAgent upgrade = 10;
+    ControlPlanes control_planes = 11;
   }
+  // trace is the W3C trace context (traceparent, and tracestate when there
+  // is one) of the control plane's span that sent this command, so what the
+  // agent does for it — fetching weights, launching the engine, waiting for
+  // it to answer — lands in the same trace. Empty when the control plane is
+  // not tracing, and ignored by an agent that is not.
+  map<string, string> trace = 12;
+}
+
+// ControlPlanes is every control plane an agent may dial, sent by the leader
+// when an agent registers and whenever the list changes. The agent keeps it
+// beside its configuration, so a second control plane added after the node
+// was onboarded is one it fails over to without anybody editing the node.
+message ControlPlanes {
+  repeated string servers = 1;
 }
 
 // Register is the first message on every stream. It carries the node's full
@@ -114,6 +162,25 @@ message Register {
   // meant "an agent too old to say" and constrained nothing — so a freshly
   // built node with no engine installed yet was a candidate for every model.
   bool engines_probed = 14;
+  // cpu_count is the CPUs the agent may run on. Placement reserves cores
+  // for CPU replicas out of it, the way it reserves memory out of
+  // memory_total_mb; zero, from an older agent, reserves nothing.
+  int32 cpu_count = 18;
+  // imex is the service that lets a multi-node NVLink domain share memory.
+  IMEX imex = 15;
+
+  // installable_engines are the engines this agent knows how to install
+  // itself. The control plane asks it for no others. Empty is an agent older
+  // than the field, which could install llama.cpp and nothing else: asked for
+  // vLLM, it answered "unsupported", and every node of a cluster half way
+  // through an upgrade showed as failing.
+  repeated string installable_engines = 16;
+
+  // features are the requests this agent answers beyond the ones every agent
+  // does: "fabric-test". An agent that does not know a request ignores it, so
+  // without this the control plane would wait minutes for an answer that is
+  // never coming.
+  repeated string features = 17;
 }
 
 // Host describes the operating system and processor of a node.
@@ -207,6 +274,36 @@ message GPU {
   // Zero when the driver is too old to report it, which is not the same as
   // idle: the metric is simply absent rather than wrong.
   int32 utilization_percent = 15;
+  // nic_paths is how far each network adapter is from this card, by HCA
+  // name: PIX, PXB, PHB, NODE or SYS, from nvidia-smi topo.
+  map<string, string> nic_paths = 16;
+  // The card's multi-node NVLink membership, from nvidia-smi -q: state is
+  // Completed once the fabric manager has joined it; cluster_uuid and
+  // clique_id name the domain it joined.
+  string fabric_state = 17;
+  string fabric_status = 18;
+  string cluster_uuid = 19;
+  string clique_id = 20;
+  string fabric_bandwidth = 21;
+  // mig is set when this is a MIG instance rather than a whole card. index
+  // is then 1000 + 100 × card + device, uuid the instance's (MIG-…), and
+  // memory the instance's share; utilization_percent stays zero, because no
+  // driver measures it per instance.
+  MIGDevice mig = 22;
+}
+
+// MIGDevice is which card a MIG instance is carved from, and how.
+message MIGDevice {
+  int32 parent_index = 1;
+  string parent_uuid = 2;
+  // parent_memory_total_mb is the whole card's: the class is named from it.
+  int32 parent_memory_total_mb = 3;
+  // device is the instance's number on its card, as nvidia-smi -L lists it.
+  int32 device = 4;
+  // profile is NVIDIA's name for the slice, like 3g.40gb.
+  string profile = 5;
+  int32 gpu_instance = 6;
+  int32 compute_instance = 7;
 }
 
 message FabricAttachment {
@@ -231,6 +328,150 @@ message LocalWeights {
   bool shared = 3;
 }
 
+// NodeLoad is a node's use of its own CPU and memory, and each engine's share.
+//
+// Carried on the heartbeat rather than scraped from the node: the control
+// plane already exports the fleet from one place, and a node exporter per
+// machine would be a scrape target, a port and a firewall rule each.
+message NodeLoad {
+  // cpu_percent is the whole machine, 0 to 100 however many cores it has.
+  double cpu_percent = 1;
+  int32 cpu_count = 2;
+  // The kernel's run-queue averages over 1, 5 and 15 minutes.
+  double load1 = 3;
+  double load5 = 4;
+  double load15 = 5;
+  // memory_used_bytes is total less available: what the machine could not
+  // hand to a new process without evicting something.
+  int64 memory_used_bytes = 6;
+  int64 memory_available_bytes = 7;
+  repeated ShardLoad shards = 8;
+  // What the machine's own sensors say; zero is not measured. cpu_temp_c is
+  // the hottest CPU sensor, cpu_power_w the CPU packages' draw from RAPL,
+  // inlet_temp_c the board's inlet or ambient sensor where it has one.
+  double cpu_temp_c = 9;
+  double cpu_power_w = 10;
+  double inlet_temp_c = 11;
+  repeated GPUSensor gpus = 12;
+}
+
+// GPUSensor is one card's heat, power, and what is holding it back.
+message GPUSensor {
+  int32 index = 1;
+  double temp_c = 2;
+  double memory_temp_c = 3;
+  double power_w = 4;
+  double power_limit_w = 5;
+  // throttle names what is holding the clocks down now: sw_power_cap,
+  // hw_slowdown, sw_thermal, hw_thermal, power_brake.
+  repeated string throttle = 6;
+  // How busy the card is, sampled with the rest, rather than read once at
+  // registration. -1 is not reported by the driver. memory_total_mb is set
+  // by every agent that sends these, so zero there is an older agent.
+  double utilization_percent = 7;
+  double memory_utilization_percent = 8;
+  double memory_used_mb = 9;
+  double memory_total_mb = 10;
+  double sm_clock_mhz = 11;
+  // ecc_uncorrected counts uncorrected ECC errors since the driver loaded.
+  double ecc_uncorrected = 12;
+  // What wears the card out, read every minute; has_wear says these are
+  // present. Counts of -1 are not reported for this card.
+  bool has_wear = 13;
+  int64 pcie_replays = 14;
+  int64 retired_pages_sbe = 15;
+  int64 retired_pages_dbe = 16;
+  bool retirement_pending = 17;
+  int64 remapped_rows_correctable = 18;
+  int64 remapped_rows_uncorrectable = 19;
+  bool remap_pending = 20;
+  bool remap_failure = 21;
+  int64 nvlink_crc_errors = 22;
+  int64 nvlink_replay_errors = 23;
+  int64 nvlink_recovery_errors = 24;
+  // xid_errors are the driver's error events since the agent started.
+  int64 xid_errors = 25;
+  int32 last_xid = 26;
+  string last_xid_text = 27;
+  int64 last_xid_unix = 28;
+}
+
+// ShardLoad is one engine process group's use.
+message ShardLoad {
+  string shard_id = 1;
+  // cpu_cores is in cores, the way top counts a process: 2.5 is two and a
+  // half cores busy, which a percentage of the machine would hide on a large
+  // one.
+  double cpu_cores = 2;
+  int64 memory_rss_bytes = 3;
+}
+
+// IBPort is one InfiniBand or RoCE port's state and counters.
+message IBPort {
+  string hca = 1;
+  int32 port = 2;
+  // state is ACTIVE, INIT, DOWN...; phys_state tells a cable unplugged
+  // (Polling, Disabled) from a link up with no subnet manager (LinkUp and INIT).
+  string state = 3;
+  string phys_state = 4;
+  int32 rate_gbps = 5;
+  // link_layer is InfiniBand or Ethernet (RoCE).
+  string link_layer = 6;
+  // counters are cumulative, by sysfs name; data counters in bytes.
+  map<string, uint64> counters = 7;
+
+  // Identity: the adapter's node GUID and the port's own, as the fabric
+  // knows them.
+  string node_guid = 8;
+  string port_guid = 9;
+  // The subnet manager this port sees as master, on InfiniBand. Every port on
+  // one physical fabric sees the same one, which is what tells separate
+  // fabrics apart when their names are only what somebody typed.
+  string sm_guid = 10;
+  int32 sm_lid = 11;
+  int32 sm_priority = 12;
+  string sm_state = 13;
+  // sm_error says why sm_guid is empty on an active InfiniBand port:
+  // infiniband-diags missing, or no subnet manager answering.
+  string sm_error = 14;
+  // network is, on RoCE, the IP network of the RoCE v2 address: RoCE has no
+  // subnet manager, and the network is what its fabric is.
+  string network = 15;
+  string gid_prefix = 16;
+  // subnet_managers is every subnet manager the fabric's subnet
+  // administrator lists — master and standbys — asked through one port per
+  // fabric, so it is on that port only. It is what keeps a fabric one fabric
+  // through a failover: the master changes, the list does not.
+  repeated SubnetManager subnet_managers = 17;
+  string subnet_managers_error = 18;
+}
+
+// SubnetManager is one subnet manager on a fabric.
+message SubnetManager {
+  string guid = 1;
+  int32 lid = 2;
+  int32 priority = 3;
+  // state is master, standby, discovering or not active.
+  string state = 4;
+}
+
+// IMEX is the nvidia-imex service and its channels.
+message IMEX {
+  // state is systemd's word for it, empty where it is not installed.
+  string state = 1;
+  int32 channels = 2;
+}
+
+// GPUFabricState is one GPU's NVLink domain membership.
+message GPUFabricState {
+  int32 index = 1;
+  string state = 2;
+  string status = 3;
+  string cluster_uuid = 4;
+  string clique_id = 5;
+  string bandwidth = 6;
+}
+
 message Heartbeat {
   string node_id = 1;
   // gpu_memory_used_mb, indexed by GPU, catches a foreign process appearing on
@@ -271,6 +512,38 @@ message Heartbeat {
   // than "nothing to say", as for weights.
   bool provision_changed = 10;
   repeated ProvisionStatus provision = 11;
+
+  // load is how busy the machine is, sampled over the interval since the
+  // previous heartbeat. Absent on the first one, which has nothing to take a
+  // difference from, and from an agent on a system without /proc.
+  NodeLoad load = 12;
+
+  // ib_ports is every InfiniBand or RoCE port as it stands now, re-read on
+  // each heartbeat: a port that goes down after the agent started used to go
+  // unnoticed until the agent restarted.
+  repeated IBPort ib_ports = 13;
+  // fabrics is the fabrics this node can now carry traffic on, sent only when
+  // that changed since registration or the last heartbeat that said so — a
+  // port going down takes its fabric away, and one coming back returns it.
+  bool fabrics_changed = 14;
+  repeated FabricAttachment fabrics = 15;
+
+  // gpu_fabric is each GPU's NVLink domain membership as it stands now, sent
+  // once a minute: a fabric manager restarting drops every card out of its
+  // domain, and the node has to stop being offered work that spans it.
+  repeated GPUFabricState gpu_fabric = 16;
+  IMEX imex = 17;
+  // cpu_count as in Register, for a VM given more CPUs while it runs.
+  int32 cpu_count = 18;
+
+  // gpu_foreign_memory_mb, indexed by GPU, is what processes that are not
+  // this agent's shards hold on each card, read afresh every heartbeat. What
+  // keeps a card out of placement for another tenant is decided from this
+  // rather than from registration: a card that had something else on it when
+  // the agent started is not taken forever, and one that gains a tenant later
+  // is not handed out. Empty from an agent that does not measure it, or from
+  // one that could not this time.
+  repeated int32 gpu_foreign_memory_mb = 19;
 }
 
 // Provision is the software a node should have: which engines, at which
@@ -291,6 +564,18 @@ message Provision {
 message EngineWant {
   string engine = 1;  // "llamacpp"
   string version = 2; // "b10991"
+  // variant is the build to install, when one is chosen for the node rather
+  // than left to its hardware: "cu13", "cu129". Empty is the agent's choice.
+  string variant = 3;
+  // offline_base, on a cluster with no way to the internet, is where this
+  // engine version's files are on its mirror:
+  // http://mirror:8081/_llmgw/engines/llamacpp/b10991. Set, the node never
+  // asks the engine's publisher.
+  string offline_base = 4;
+  // offline_sha256 is each of those files' checksum by name, from the
+  // bundle the control plane trusts — not from the mirror, which serves
+  // every node over plain HTTP.
+  map<string, string> offline_sha256 = 5;
 }
 
 // ProvisionStatus is where one engine's installation stands on a node.
@@ -377,6 +662,13 @@ message StartShard {
   // profile_fp identifies the version of the profile, so the agent can say
   // which one a running shard was started from. The agent never interprets it.
   string profile_fp = 15;
+  // api_key is what the engine demands of every request, derived by the
+  // control plane from the replica id. The router sends it; nothing else
+  // that can reach the node's ports has it.
+  string api_key = 16;
+  // cpu_threads is how many CPU threads a shard with no GPU computes on:
+  // the cores placement reserved for it. Zero leaves it to the agent.
+  int32 cpu_threads = 17;
 }
 
 message EngineProfile {
@@ -391,6 +683,12 @@ message EngineProfile {
   map<string, string> env = 9;
   string model_path = 10;
   string served_model_name = 11;
+  // adapters are LoRA adapters loaded beside the model, in order: the index
+  // is the id a request applies one by.
+  repeated LoraAdapter adapters = 12;
+  // kv_events has a vLLM engine publish its KV cache events to the agent, for
+  // the router's precise index.
+  bool kv_events = 13;
 }
 
 // RemoveWeights deletes cached model files a node no longer needs.
@@ -446,3 +744,87 @@ message LogsReply {
   // error says why the lines are absent: an unknown source, say.
   string error = 4;
 }
+
+// FabricScanRequest asks a node to map the fabric one of its ports is on,
+// with ibnetdiscover: every switch, every adapter and every link between
+// them. One node per fabric is asked, every few minutes; a fabric looks the
+// same from all of its ports.
+message FabricScanRequest {
+  string request_id = 1;
+  string hca = 2;
+  int32 port = 3;
+}
+
+// FabricScanReply is ibnetdiscover's output as it printed it. Parsed by the
+// control plane, so a format the parser does not yet know is a control plane
+// upgrade rather than one on every node.
+message FabricScanReply {
+  string request_id = 1;
+  string output = 2;
+  string error = 3;
+  int64 took_ms = 4;
+}
+
+// FabricTestRequest asks a node for one side of an RDMA bandwidth test
+// between two nodes: ib_write_bw, from perftest, over one adapter. The
+// server side is asked first and answers when the test is over; the client
+// dials it. What it proves is what a replica spanning nodes needs and nothing
+// on one node can show: that these two adapters reach each other through the
+// fabric, and how fast.
+message FabricTestRequest {
+  string request_id = 1;
+  // role is "server" or "client".
+  string role = 2;
+  string hca = 3;
+  int32 port = 4;
+  // peer is the server's management address, for the client. perftest
+  // exchanges its connection details over TCP before any RDMA.
+  string peer = 5;
+  // tcp_port is that exchange's port, the same on both sides.
+  int32 tcp_port = 6;
+  int32 seconds = 7;
+}
+
+// FabricTestReply is what one side measured.
+message FabricTestReply {
+  string request_id = 1;
+  // gbps is the average bandwidth, in gigabits a second.
+  double gbps = 2;
+  // output is the end of the tool's output, for when the number is not
+  // enough.
+  string output = 3;
+  string error = 4;
+  int64 took_ms = 5;
+}
+
+// UpgradeAgent tells an agent to replace its own binary with a release and
+// restart.
+//
+// The agent fetches the release for its own platform and checks it against
+// the release's checksums before replacing anything, keeps the old binary
+// beside the new, then exits so systemd starts the new one. Engines keep
+// running throughout, as for any agent restart, and are adopted on the way
+// back. Over the stream the agent already holds, so upgrading a fleet needs
+// no ssh into it.
+message UpgradeAgent {
+  string request_id = 1;
+  // version must be a release: v0.10.4 or v0.10.4-rc.2.
+  string version = 2;
+  // releases is the base URL release files are downloaded from.
+  string releases = 3;
+}
+
+// UpgradeReply says whether the new binary is in place. Sent before the
+// agent exits; an empty error means it will be back on the new version.
+message UpgradeReply {
+  string request_id = 1;
+  string version = 2;
+  string error = 3;
+}
+
+// LoraAdapter is one adapter: the name clients ask for it by, and its source,
+// which the agent fetches as it does the model's weights.
+message LoraAdapter {
+  string name = 1;
+  string source = 2;
+}

cmd/llmgw/main.go

@@ -5,6 +5,8 @@ package main
 import (
 	"fmt"
 	"os"
+	// Time zones for scaling schedules, on a machine without the tz database.
+	_ "time/tzdata"
 
 	"gitea.mynodes.xyz/ilker/llmgw/internal/cli"
 )

deploy/bootstrap/onboard-node.sh

@@ -35,8 +35,9 @@ usage: $0 --node ID --addr HOST --server URL [options]
   --mgmt-if NAME    interface NCCL bootstraps over (default: the one holding
                     that address)
   --llamacpp-bin P  use this llama-server instead of the one the agent installs
-  --vllm-bin P      path to the vllm entry point (not yet installed by the agent)
-  --sglang-python P python interpreter of the SGLang virtualenv
+  --vllm-bin P      use this vllm instead of the one the agent installs on a
+                    GPU node (also set engines.vllm: "" in server.yaml)
+  --sglang-python P python interpreter of an SGLang virtualenv you installed
   --nvidia-smi PATH where nvidia-smi lives, when it is not on PATH. Containerized
                     driver installs routinely put it somewhere else.
   --ib-root DIR     the sysfs InfiniBand directory (default /sys/class/infiniband)
@@ -121,9 +122,10 @@ TMP="$(mktemp -d)"
 trap 'rm -rf "$TMP"' EXIT
 "$BINARY" ctl cert issue-client "$NODE" --dir "$PKI" --out "$TMP" >/dev/null
 
-# 2 and 3. Identity, and trusting the root so future tooling on that machine
-#    does not treat our certificates as strangers.
-say "installing the certificate and trusting the root"
+# 2 and 3. Identity. The root is trusted by the agent's configuration only,
+#    never system-wide: it signs whatever the control plane asks, and every
+#    TLS client on the machine would take it for any site.
+say "installing the certificate"
 scp -q $SSHOPTS "$PKI/ca.pem" "$TMP/$NODE.pem" "$TMP/$NODE-key.pem" "$SSH_USER@$ADDR:/tmp/"
 $SSH "set -e
   sudo install -d -m 0755 /etc/llmgw
@@ -131,8 +133,10 @@ $SSH "set -e
   sudo install -m 0644 /tmp/$NODE.pem /etc/llmgw/agent.pem
   sudo install -m 0600 /tmp/$NODE-key.pem /etc/llmgw/agent-key.pem
   sudo chown root:root /etc/llmgw/*
-  sudo install -m 0644 /tmp/ca.pem /usr/local/share/ca-certificates/llmgw-ca.crt
-  sudo update-ca-certificates >/dev/null 2>&1 || true
+  if [ -f /usr/local/share/ca-certificates/llmgw-ca.crt ]; then
+    sudo rm -f /usr/local/share/ca-certificates/llmgw-ca.crt
+    sudo update-ca-certificates --fresh >/dev/null 2>&1 || true
+  fi
   rm -f /tmp/ca.pem /tmp/$NODE.pem /tmp/$NODE-key.pem"
 
 # 4. The binary, the configuration and the unit.
@@ -142,7 +146,7 @@ $SSH "set -e
 # that is not a release (a developer's, with commits past the tag) has no such
 # file, and is copied as before.
 TAG="$("$BINARY" --version 2>/dev/null | awk '{print $NF}')"
-if printf '%s' "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+if printf '%s' "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$'; then
   say "installing llmgw $TAG from the release"
   $SSH "set -e
     arch=\$(dpkg --print-architecture)
@@ -226,6 +230,10 @@ ExecStart=/usr/local/bin/llmgw agent --config /etc/llmgw/agent.yaml
 KillMode=process
 Restart=on-failure
 RestartSec=2s
+# RDMA pins the buffers it registers, and NCCL registers a great deal: with
+# systemd's default 8 MB lock limit, an engine that drops the capability that
+# lets root ignore it fails its first collective over InfiniBand.
+LimitMEMLOCK=infinity
 StateDirectory=llmgw-agent
 
 [Install]

deploy/container/Dockerfile

@@ -0,0 +1,40 @@
+# The llmgw control plane as a container image, for deploy/helm/llmgw.
+#
+# The project publishes binaries, not an image, so this is built where the
+# image is to live:
+#
+#   docker build -f deploy/container/Dockerfile --build-arg VERSION=v0.11.1 \
+#     -t registry.internal/llmgw:v0.11.1 .
+#   docker push registry.internal/llmgw:v0.11.1
+#
+# The binary is static (CGO_ENABLED=0, as every release is), so the image is
+# that one file on a base with nothing else in it: no shell, no package
+# manager. `kubectl exec ... -- llmgw ctl status` still works, because it
+# runs the binary rather than a shell.
+#
+# Only the control plane runs from it. An agent installs engines on its
+# machine, manages its GPUs and supervises processes there as root, which is
+# what a container is built to prevent: docs/kubernetes.md.
+
+FROM golang:1.26 AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+ARG VERSION=dev
+RUN CGO_ENABLED=0 go build -trimpath \
+      -ldflags "-s -w -X gitea.mynodes.xyz/ilker/llmgw/internal/version.Version=${VERSION}" \
+      -o /out/llmgw ./cmd/llmgw && \
+    mkdir -p /out/state
+
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /out/llmgw /usr/local/bin/llmgw
+# The chart mounts server.yaml, the certificates and the token under
+# /etc/llmgw, and the SQLite store, when it is one, under /var/lib/llmgw —
+# owned by the user the server runs as, so a volume Docker fills from the
+# image is writable without Kubernetes' fsGroup.
+COPY --from=build --chown=65532:65532 /out/state /var/lib/llmgw
+USER 65532:65532
+EXPOSE 8080 7443 9091
+ENTRYPOINT ["/usr/local/bin/llmgw"]
+CMD ["server", "--config", "/etc/llmgw/server.yaml"]

deploy/eval/arithmetic.yaml

@@ -0,0 +1,58 @@
+# Arithmetic a small instruction model gets right: sums, products and a
+# little reading, each answer scored by the last number in it. A quantisation
+# that has gone wrong, or a chat template that no longer matches the
+# weights, shows up here as a falling score long before anyone notices it in
+# conversation.
+#
+#   llmgw ctl eval MODEL --suite arithmetic
+#   llmgw ctl model update MODEL --eval arithmetic --min-score 0.8
+#
+# Copy it into control.eval_dir (/etc/llmgw/eval) to change it; a suite
+# there of the same name replaces this one.
+name: arithmetic
+description: Sums, products and word problems, each scored by the number in its answer.
+threshold: 0.7
+system: You are a careful calculator. Answer with the number only, without words or units.
+max_tokens: 64
+cases:
+  - id: add-small
+    prompt: What is 17 + 25?
+    number: 42
+  - id: add-carry
+    prompt: What is 389 + 476?
+    number: 865
+  - id: subtract
+    prompt: What is 1000 - 357?
+    number: 643
+  - id: subtract-negative
+    prompt: What is 12 - 30?
+    number: -18
+  - id: multiply
+    prompt: What is 12 * 12?
+    number: 144
+  - id: multiply-larger
+    prompt: What is 23 * 17?
+    number: 391
+    weight: 2
+  - id: divide
+    prompt: What is 144 / 6?
+    number: 24
+  - id: decimal
+    prompt: What is 2.5 * 4?
+    number: 10
+  - id: percent
+    prompt: What is 15% of 200?
+    number: 30
+  - id: words-apples
+    prompt: Ana has 7 apples and buys 5 more, then gives 3 away. How many apples does she have?
+    number: 9
+    weight: 2
+  - id: words-time
+    prompt: A train leaves at 14:00 and the trip takes 150 minutes. How many hours does the trip take?
+    number: 2.5
+    tolerance: 0.01
+    weight: 2
+  - id: order-of-operations
+    prompt: What is 2 + 3 * 4?
+    number: 14
+    weight: 2

deploy/eval/json-format.yaml

@@ -0,0 +1,94 @@
+# Following a format: asked for JSON of a given shape, does the model give
+# it — the thing an application parsing its answers depends on, and the
+# first to go when a chat template drifts. Each answer is read as JSON (a
+# code fence or a sentence around it is forgiven) and held to a schema.
+#
+#   llmgw ctl eval MODEL --suite json-format
+#
+# Copy it into control.eval_dir (/etc/llmgw/eval) to change it; a suite
+# there of the same name replaces this one.
+name: json-format
+description: Answers asked for as JSON of a given shape, held to a schema.
+threshold: 0.7
+system: You answer with a single JSON value and nothing else.
+max_tokens: 200
+cases:
+  - id: person
+    prompt: >-
+      Give a JSON object for a person named Ada Lovelace, born in 1815, with the
+      keys "name" (a string) and "born" (a number).
+    json_schema:
+      type: object
+      required: [name, born]
+      properties:
+        name: {type: string, pattern: "Ada"}
+        born: {type: integer, minimum: 1815, maximum: 1815}
+
+  - id: list-of-colours
+    prompt: Give a JSON array of exactly three colour names, as strings.
+    json_schema:
+      type: array
+      minItems: 3
+      maxItems: 3
+      items: {type: string, minLength: 1}
+
+  - id: boolean-answer
+    prompt: >-
+      Is water wet? Answer as a JSON object with one key, "answer", whose
+      value is true or false.
+    json_schema:
+      type: object
+      required: [answer]
+      properties:
+        answer: {type: boolean}
+
+  - id: nested
+    prompt: >-
+      Give a JSON object describing a book: "title" (a string), "author" (an
+      object with "first" and "last", both strings) and "pages" (a whole number
+      above zero). Use any book.
+    json_schema:
+      type: object
+      required: [title, author, pages]
+      properties:
+        title: {type: string, minLength: 1}
+        author:
+          type: object
+          required: [first, last]
+          properties:
+            first: {type: string}
+            last: {type: string}
+        pages: {type: integer, exclusiveMinimum: 0}
+    weight: 2
+
+  - id: enum-choice
+    prompt: >-
+      Classify the sentence "I love this product!" as positive, negative or
+      neutral. Answer as a JSON object {"sentiment": "..."} using one of those
+      three words in lower case.
+    json_schema:
+      type: object
+      required: [sentiment]
+      properties:
+        sentiment: {enum: [positive]}
+    weight: 2
+
+  - id: numbers
+    prompt: 'Give a JSON object {"sum": N} where N is the sum of 4, 5 and 6.'
+    json_schema:
+      type: object
+      required: [sum]
+      properties:
+        sum: {const: 15}
+
+  - id: no-extra-keys
+    prompt: >-
+      Give a JSON object with exactly two keys, "city" and "country", for
+      Paris. No other keys.
+    json_schema:
+      type: object
+      required: [city, country]
+      additionalProperties: false
+      properties:
+        city: {type: string}
+        country: {type: string}

deploy/examples/agent.yaml

@@ -47,26 +47,24 @@ heartbeat_interval: 5s
 reconnect_base: 1s
 reconnect_max: 30s
 
-# Fabric labelling is explicit and there is no way around it. OpenSM's default
-# subnet prefix is fe80:: on every fabric, so a matching prefix proves nothing
-# and a wrong guess produces a replica that starts, passes health checks and
-# then hangs on its first all-reduce (plan §5.2).
+# Each fabric this node's adapters are on, by name. The name is checked against
+# what the adapters report — the subnet managers every port on one fabric sees —
+# so two independent fabrics given one name are placed as two and the cluster
+# page says so; give each its own. The rate is measured, not read from here.
 #
 # A node with no fabrics is its own single-node island: it can host single-node
-# replicas and will never be given a multi-node one.
+# replicas and will never be given a multi-node one. docs/fabrics.md has more.
 fabrics:
   - name: ib-a
     hcas: [mlx5_0, mlx5_1, mlx5_2, mlx5_3]
-    rate_gbps: 200
 
 discovery:
   # Worth setting where the driver lives outside the default paths, which
   # containerized driver installs often do.
   nvidia_smi: ""
   ib_root: /sys/class/infiniband
-  # NVML is the only source of NVLink topology, which is what keeps a
-  # tensor-parallel group off the PCIe path inside a node. It needs a binary
-  # built with `-tags nvml`; otherwise this silently falls back to nvidia-smi.
+  # NVLink topology comes from `nvidia-smi topo -m` on every build; a binary
+  # built with `-tags nvml` reads it from NVML instead, when this is set.
   prefer_nvml: true
 
 # Where this node keeps model weights besides /var/lib/llmgw-weights, which is
@@ -96,10 +94,11 @@ discovery:
 engines:
   vllm:
     bin: /opt/venvs/vllm/bin/vllm
-    # Which multi-node mechanism works depends on the vLLM version, and the
-    # flags have changed more than once. Check the version you deploy.
-    launch_mode: ray      # "ray" or "mp"
-    ray_bin: /opt/venvs/vllm/bin/ray
+    # How a replica spanning nodes is launched. mp, the default, is what vLLM
+    # documents today and needs nothing but vLLM; ray is for a vLLM too old
+    # for mp's multi-node flags, and needs Ray on every node.
+    launch_mode: mp       # "mp" or "ray"
+    # ray_bin: /opt/venvs/vllm/bin/ray
   sglang:
     # SGLang is launched as a module, which is its documented entry point.
     python: /opt/venvs/sglang/bin/python

deploy/examples/server.yaml

@@ -17,8 +17,10 @@ agent_listen: ":7443"
 
 # Mutual TLS on the agent port (plan §5.6). With it, a node's identity is taken
 # from its certificate's common name and an agent claiming a different node id
-# is refused. Without it the port is plaintext HTTP/2 and anyone who can reach
-# it can claim to be any node, so it must stay on a trusted network.
+# is refused. Without it the port would be plaintext HTTP/2 and anyone who can
+# reach it could claim to be any node, so the control plane refuses to start
+# unless `agent_insecure: true` is set — and then listens on loopback unless
+# agent_listen names an address. That is for one machine or a test.
 #
 # These certificates come from llmgw's own authority, not a public one: public
 # authorities stopped issuing the clientAuth usage, so no Let's Encrypt
@@ -92,6 +94,11 @@ agent_listen: ":7443"
 #   flush_interval: 200ms
 #   batch_size: 500
 #   buffer_size: 8192
+#
+#   # How long the record of each request is kept (what `ctl request` reads).
+#   # Charts, totals and budgets come from five-minute sums that are kept, so
+#   # this only bounds the table that grows by a row a request. 0 keeps all.
+#   usage_retention: 2160h   # 90 days
 
 router:
   scrape_interval: 2s
@@ -152,6 +159,12 @@ router:
   # back to a client that did not ask for it.
   inject_usage: true
   max_body_bytes: 33554432
+  # Memory for the answers of projects that reuse them (llmgw keys cache),
+  # all together; the least recently used go first. Nothing is reused until a
+  # project turns it on.
+  # cache:
+  #   max_bytes: 134217728     # 128 MB
+  #   max_entry_bytes: 1048576 # 1 MB
 
   timeouts:
     dial: 5s

deploy/ha/README.md

@@ -85,3 +85,63 @@ auth:
 
 See [docs/install.md](../../docs/install.md) for moving an existing
 installation onto PostgreSQL without reissuing every key.
+
+## The store itself: PostgreSQL under Patroni
+
+Two control planes on one PostgreSQL have moved the single point of failure,
+not removed it. Patroni keeps PostgreSQL on two machines, one streaming to the
+other, and promotes the standby when the primary is lost. It keeps its leader
+lock in etcd, and etcd decides only with a majority — so three members, not
+two: two machines that lose sight of each other must not both decide they are
+the primary. The third member can be any machine that is up; it holds a vote,
+not data.
+
+On the reference cluster:
+
+| machine | etcd | PostgreSQL |
+|---|---|---|
+| llmgw-ctl (control plane) | member | — |
+| llmgw-pg01 | member | Patroni |
+| llmgw-ctl02 (second control plane) | member | Patroni |
+
+`llmgw server init --patroni user@host --patroni user@host` sets all of it up
+over ssh and moves the store in — see [install.md](../../docs/install.md).
+It looks before it acts at every step, so it is also how an existing cluster
+is checked: run against one that is up, it changes nothing. What it writes
+is in `etcd.default.example` (one member's `/etc/default/etcd`) and
+`patroni.yml.example` (one node's `/etc/patroni/config.yml`), for anyone
+doing it by hand; passwords are generated into `/root/llmgw-pg` on each
+database machine.
+
+**Give llmgw every member, and ask for the writable one:**
+
+```
+postgres://llmgw:…@10.0.0.149:5432,10.0.0.150:5432/llmgw?sslmode=disable&target_session_attrs=read-write
+```
+
+The driver connects to whichever member accepts writes, and reconnects to the
+new one after a failover. No floating address or HAProxy is needed for that.
+`llmgw server backup` reads the same address and dumps from a standby when
+there is one.
+
+Measured on the reference cluster, with the gateway serving throughout:
+
+- **Planned switchover** (`patronictl switchover`): the control plane logged
+  one failed lease renewal, reconnected to the new primary, and kept its
+  leadership; nothing else noticed.
+- **The primary's machine switched off**: the standby was promoted 24 seconds
+  later — the 30-second TTL in `patroni.yml` — and the control plane rode it
+  out without losing leadership or a replica. Started again, the old primary
+  rejoined as a standby by itself.
+
+**Watching it.** For a store of several hosts the control plane reads the
+cluster from each member's Patroni (port 8008) and publishes
+`llmgw_store_member{member,host,role,state}`, `llmgw_store_replica_lag_bytes`
+and `llmgw_store_patroni_up`; a host of the address that the cluster no longer
+lists is a member in state `missing`. `llmgw ctl status` prints it as one
+line, and `deploy/monitoring/llmgw-rules.yml` alerts on no leader, a member
+not streaming or missing, and a standby too far behind to be promoted.
+
+Not done here, and worth doing in production: a watchdog (`softdog`) so a
+primary that has lost the lock but not died cannot keep accepting writes, TLS
+on etcd and between PostgreSQL members, and more than one standby.

deploy/ha/etcd.default.example

@@ -0,0 +1,10 @@
+# llmgw: one member of the three that hold Patroni's leader lock (140, 149, 150).
+ETCD_NAME=llmgw-pg01
+ETCD_DATA_DIR=/var/lib/etcd/default
+ETCD_LISTEN_PEER_URLS=http://10.0.0.149:2380
+ETCD_LISTEN_CLIENT_URLS=http://10.0.0.149:2379,http://127.0.0.1:2379
+ETCD_INITIAL_ADVERTISE_PEER_URLS=http://10.0.0.149:2380
+ETCD_ADVERTISE_CLIENT_URLS=http://10.0.0.149:2379
+ETCD_INITIAL_CLUSTER=llmgw-ctl=http://10.0.0.140:2380,llmgw-pg01=http://10.0.0.149:2380,llmgw-ctl02=http://10.0.0.150:2380
+ETCD_INITIAL_CLUSTER_STATE=new
+ETCD_INITIAL_CLUSTER_TOKEN=llmgw-patroni

deploy/ha/patroni.yml.example

@@ -0,0 +1,68 @@
+# llmgw: the control planes' store, kept by Patroni on llmgw-pg01 and
+# llmgw-ctl02, with the leader lock in etcd on 140, 149 and 150.
+scope: llmgw
+namespace: /service/
+name: llmgw-pg01
+
+restapi:
+  listen: 10.0.0.149:8008
+  connect_address: 10.0.0.149:8008
+
+etcd3:
+  hosts: 10.0.0.140:2379,10.0.0.149:2379,10.0.0.150:2379
+
+bootstrap:
+  dcs:
+    ttl: 30
+    loop_wait: 10
+    retry_timeout: 10
+    maximum_lag_on_failover: 1048576
+    postgresql:
+      use_pg_rewind: true
+      use_slots: true
+      parameters:
+        wal_level: replica
+        hot_standby: "on"
+        max_wal_senders: 10
+        max_replication_slots: 10
+        wal_keep_size: 1GB
+        wal_log_hints: "on"
+        password_encryption: scram-sha-256
+  initdb:
+    - encoding: UTF8
+    - data-checksums
+
+postgresql:
+  listen: 127.0.0.1,10.0.0.149:5432
+  connect_address: 10.0.0.149:5432
+  data_dir: /var/lib/postgresql/16/llmgw
+  bin_dir: /usr/lib/postgresql/16/bin
+  pgpass: /var/lib/postgresql/.pgpass_patroni
+  authentication:
+    superuser:
+      username: postgres
+      password: "<from /root/llmgw-pg>"
+    replication:
+      username: replicator
+      password: "<from /root/llmgw-pg>"
+    rewind:
+      username: postgres
+      password: "<from /root/llmgw-pg>"
+  parameters:
+    unix_socket_directories: /var/run/postgresql
+  pg_hba:
+    - local all all peer
+    - host all all 127.0.0.1/32 scram-sha-256
+    - host replication replicator 10.0.0.149/32 scram-sha-256
+    - host replication replicator 10.0.0.150/32 scram-sha-256
+    - host all postgres 10.0.0.149/32 scram-sha-256
+    - host all postgres 10.0.0.150/32 scram-sha-256
+    - host llmgw llmgw 10.0.0.140/32 scram-sha-256
+    - host llmgw llmgw 10.0.0.149/32 scram-sha-256
+    - host llmgw llmgw 10.0.0.150/32 scram-sha-256
+
+tags:
+  nofailover: false
+  noloadbalance: false
+  clonefrom: false
+  nosync: false

deploy/helm/llmgw/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: llmgw
+description: >-
+  The llmgw control plane — the OpenAI-compatible gateway, the router and the
+  scheduler that places models on GPU and CPU nodes. The nodes themselves run
+  outside Kubernetes; see docs/kubernetes.md.
+type: application
+# The chart's own version; appVersion is the llmgw release the image holds.
+version: 0.1.0
+appVersion: "v0.11.1"
+home: https://gitea.mynodes.xyz/ilker/llmgw
+sources:
+  - https://gitea.mynodes.xyz/ilker/llmgw
+keywords:
+  - llm
+  - gateway
+  - inference

deploy/helm/llmgw/templates/NOTES.txt

@@ -0,0 +1,27 @@
+The llmgw control plane is starting as {{ include "llmgw.fullname" . }}.
+
+The admin API listens on the pod's loopback only. To reach it from here:
+
+  kubectl -n {{ .Release.Namespace }} port-forward statefulset/{{ include "llmgw.fullname" . }} 9090:9090 &
+  export LLMGW_ADMIN_TOKEN=$(kubectl -n {{ .Release.Namespace }} get secret {{ include "llmgw.adminSecret" . }} \
+    -o jsonpath='{.data.{{ if .Values.adminToken.existingSecret }}{{ .Values.adminToken.secretKey }}{{ else }}admin-token{{ end }}}' | base64 -d)
+  llmgw ctl status
+
+The first administrator:
+
+  kubectl -n {{ .Release.Namespace }} exec -it statefulset/{{ include "llmgw.fullname" . }} -- \
+    llmgw users create you@example.com --password '<a password>'
+  kubectl -n {{ .Release.Namespace }} exec -it statefulset/{{ include "llmgw.fullname" . }} -- \
+    llmgw users role you@example.com admin
+
+Agents connect to the {{ include "llmgw.fullname" . }}-agents Service on port {{ .Values.agentService.port }}:
+
+  kubectl -n {{ .Release.Namespace }} get service {{ include "llmgw.fullname" . }}-agents
+
+Its address must be in the certificate in {{ .Values.agentTLS.existingSecret }}. Nodes join from
+the machine holding llmgw's authority:
+
+  sudo llmgw node add ubuntu@gpu01 --server https://<that address>:{{ .Values.agentService.port }} \
+    --pki ./pki --admin 127.0.0.1:9090
+
+docs/kubernetes.md has the rest, and why the nodes stay outside Kubernetes.

deploy/helm/llmgw/templates/_helpers.tpl

@@ -0,0 +1,74 @@
+{{/* The release's name for everything the chart makes. */}}
+{{- define "llmgw.fullname" -}}
+{{- if contains .Chart.Name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "llmgw.selectorLabels" -}}
+app.kubernetes.io/name: {{ .Chart.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "llmgw.labels" -}}
+{{ include "llmgw.selectorLabels" . }}
+app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }}
+{{- end -}}
+
+{{- define "llmgw.image" -}}
+{{- if not .Values.image.repository -}}
+{{- fail "image.repository: the image built from deploy/container/Dockerfile, pushed where the cluster can pull it (the project publishes binaries, not an image)" -}}
+{{- end -}}
+{{- printf "%s:%s" .Values.image.repository (.Values.image.tag | default .Chart.AppVersion) -}}
+{{- end -}}
+
+{{- define "llmgw.adminSecret" -}}
+{{- .Values.adminToken.existingSecret | default (printf "%s-admin" (include "llmgw.fullname" .)) -}}
+{{- end -}}
+
+{{/*
+server.yaml: what the chart decides — listeners, where the certificates,
+the token and the store are mounted — laid over .Values.config. The chart's
+keys win, because each names a port or a path the pod is built around.
+*/}}
+{{- define "llmgw.serverConfig" -}}
+{{- $store := "/var/lib/llmgw/llmgw.db" -}}
+{{- if eq .Values.store.type "postgres" -}}
+{{- $store = "@/etc/llmgw/store/dsn" -}}
+{{- end -}}
+{{- $base := dict
+  "listen" ":8080"
+  "admin_listen" "127.0.0.1:9090"
+  "metrics_listen" ":9091"
+  "agent_listen" ":7443"
+  "admin_token_file" "/etc/llmgw/admin/admin-token"
+  "agent_tls" (dict "ca" "/etc/llmgw/tls/ca.pem" "cert" "/etc/llmgw/tls/server.pem" "key" "/etc/llmgw/tls/server-key.pem")
+  "auth" (dict "store" $store)
+-}}
+{{- if .Values.offlineChecksums.configMap -}}
+{{- $_ := set $base "offline" (dict "checksums" "/etc/llmgw/offline/offline.sha256") -}}
+{{- end -}}
+{{- $cfg := mustMergeOverwrite (deepCopy (.Values.config | default dict)) $base -}}
+# Made by the llmgw Helm chart from its values. Every key: docs/reference.md
+{{ toYaml $cfg }}
+{{- end -}}
+
+{{/* Refuses values that would make a pod that cannot work. */}}
+{{- define "llmgw.validate" -}}
+{{- if not (has .Values.store.type (list "sqlite" "postgres")) -}}
+{{- fail (printf "store.type %q: sqlite or postgres" .Values.store.type) -}}
+{{- end -}}
+{{- if ne (int .Values.replicas) 1 -}}
+{{- fail "replicas: this chart runs one control plane; values.yaml says why" -}}
+{{- end -}}
+{{- if and (eq .Values.store.type "postgres") (not .Values.store.postgres.existingSecret) -}}
+{{- fail "store.postgres.existingSecret: a Secret holding the PostgreSQL address" -}}
+{{- end -}}
+{{- if not .Values.agentTLS.existingSecret -}}
+{{- fail "agentTLS.existingSecret: a Secret with ca.pem, server.pem and server-key.pem from llmgw's authority (see values.yaml)" -}}
+{{- end -}}
+{{- end -}}

deploy/helm/llmgw/templates/configmap.yaml

@@ -0,0 +1,10 @@
+{{- include "llmgw.validate" . -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "llmgw.fullname" . }}
+  labels:
+    {{- include "llmgw.labels" . | nindent 4 }}
+data:
+  server.yaml: |
+    {{- include "llmgw.serverConfig" . | nindent 4 }}

deploy/helm/llmgw/templates/ingress.yaml

@@ -0,0 +1,37 @@
+{{- if .Values.ingress.enabled }}
+# The OpenAI-compatible API, the portal and the chat page on port 8080. Never
+# the agent port: its mutual TLS cannot pass through an HTTP proxy.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "llmgw.fullname" . }}
+  labels:
+    {{- include "llmgw.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- with .Values.ingress.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "llmgw.fullname" $ }}
+                port:
+                  name: api
+          {{- end }}
+    {{- end }}
+{{- end }}

deploy/helm/llmgw/templates/secret-admin.yaml

@@ -0,0 +1,19 @@
+{{- if not .Values.adminToken.existingSecret }}
+{{- $name := include "llmgw.adminSecret" . }}
+{{- $token := randAlphaNum 64 }}
+{{- /* Kept across upgrades: a new token on every upgrade would lock out every console holding the old one. */}}
+{{- with lookup "v1" "Secret" .Release.Namespace $name }}
+{{- $token = index .data "admin-token" | b64dec }}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  labels:
+    {{- include "llmgw.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/resource-policy: keep
+type: Opaque
+data:
+  admin-token: {{ $token | b64enc | quote }}
+{{- end }}

deploy/helm/llmgw/templates/servicemonitor.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.serviceMonitor.enabled }}
+# For the Prometheus Operator: the metrics port, which serves metrics and
+# nothing else. deploy/monitoring holds the rules and dashboards that read them.
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "llmgw.fullname" . }}
+  labels:
+    {{- include "llmgw.labels" . | nindent 4 }}
+    {{- with .Values.serviceMonitor.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "llmgw.selectorLabels" . | nindent 6 }}
+  endpoints:
+    - port: metrics
+      path: /metrics
+      interval: {{ .Values.serviceMonitor.interval }}
+{{- end }}

deploy/helm/llmgw/templates/services.yaml

@@ -0,0 +1,70 @@
+# The API and the metrics, for the cluster and an Ingress.
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "llmgw.fullname" . }}
+  labels:
+    {{- include "llmgw.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  selector:
+    {{- include "llmgw.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: api
+      port: {{ .Values.service.port }}
+      targetPort: api
+    - name: metrics
+      port: {{ .Values.service.metricsPort }}
+      targetPort: metrics
+---
+# Where agents on the nodes connect. Mutual TLS ends in the pod: whatever is
+# in between must pass TCP through untouched.
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "llmgw.fullname" . }}-agents
+  labels:
+    {{- include "llmgw.labels" . | nindent 4 }}
+  {{- with .Values.agentService.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.agentService.type }}
+  {{- if and (eq .Values.agentService.type "LoadBalancer") .Values.agentService.loadBalancerIP }}
+  loadBalancerIP: {{ .Values.agentService.loadBalancerIP }}
+  {{- end }}
+  {{- with .Values.agentService.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- if has .Values.agentService.type (list "LoadBalancer" "NodePort") }}
+  externalTrafficPolicy: {{ .Values.agentService.externalTrafficPolicy }}
+  {{- end }}
+  selector:
+    {{- include "llmgw.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: agents
+      port: {{ .Values.agentService.port }}
+      targetPort: agents
+---
+# The StatefulSet's own, giving each pod a stable name.
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "llmgw.fullname" . }}-headless
+  labels:
+    {{- include "llmgw.labels" . | nindent 4 }}
+spec:
+  clusterIP: None
+  publishNotReadyAddresses: true
+  selector:
+    {{- include "llmgw.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: api
+      port: 8080
+      targetPort: api

deploy/helm/llmgw/templates/statefulset.yaml

@@ -0,0 +1,181 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "llmgw.fullname" . }}
+  labels:
+    {{- include "llmgw.labels" . | nindent 4 }}
+spec:
+  # One control plane: Kubernetes replaces it within seconds when it goes,
+  # and the agents reconnect on their own. See replicas in values.yaml.
+  replicas: 1
+  serviceName: {{ include "llmgw.fullname" . }}-headless
+  selector:
+    matchLabels:
+      {{- include "llmgw.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "llmgw.selectorLabels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      annotations:
+        # server.yaml is read at start: a changed one restarts the pod.
+        checksum/config: {{ include "llmgw.serverConfig" . | sha256sum }}
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      # Agents reconnect within seconds of a control plane going; a long
+      # grace period only delays the one that replaces it.
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: llmgw
+          image: {{ include "llmgw.image" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args: ["server", "--config", "/etc/llmgw/server.yaml"]
+          env:
+            # For `kubectl exec ... -- llmgw ctl`, which reads the token
+            # from here; the server reads admin_token_file.
+            - name: LLMGW_ADMIN_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "llmgw.adminSecret" . }}
+                  key: {{ if .Values.adminToken.existingSecret }}{{ .Values.adminToken.secretKey }}{{ else }}admin-token{{ end }}
+          ports:
+            - name: api
+              containerPort: 8080
+            - name: agents
+              containerPort: 7443
+            - name: metrics
+              containerPort: 9091
+          # Up is /health. Ready is /leader: a control plane holds the
+          # agents' connections and places models only once it leads — on
+          # PostgreSQL, once the lease of the one it replaced has run out. A
+          # cluster with no node yet is still ready: /ready would wait for a
+          # replica, and nodes could then never connect.
+          startupProbe:
+            httpGet: {path: /health, port: api}
+            periodSeconds: 5
+            failureThreshold: 60
+          livenessProbe:
+            httpGet: {path: /health, port: api}
+            periodSeconds: 10
+            failureThreshold: 6
+          readinessProbe:
+            httpGet: {path: /leader, port: api}
+            periodSeconds: 5
+            failureThreshold: 2
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: config
+              mountPath: /etc/llmgw/server.yaml
+              subPath: server.yaml
+              readOnly: true
+            - name: agent-tls
+              mountPath: /etc/llmgw/tls
+              readOnly: true
+            - name: admin-token
+              mountPath: /etc/llmgw/admin
+              readOnly: true
+            {{- if eq .Values.store.type "postgres" }}
+            - name: store
+              mountPath: /etc/llmgw/store
+              readOnly: true
+            {{- end }}
+            {{- if .Values.offlineChecksums.configMap }}
+            - name: offline
+              mountPath: /etc/llmgw/offline
+              readOnly: true
+            {{- end }}
+            - name: data
+              mountPath: /var/lib/llmgw
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: config
+          configMap:
+            name: {{ include "llmgw.fullname" . }}
+        - name: agent-tls
+          secret:
+            secretName: {{ .Values.agentTLS.existingSecret }}
+            defaultMode: 0440
+            items:
+              - {key: ca.pem, path: ca.pem}
+              - {key: server.pem, path: server.pem}
+              - {key: server-key.pem, path: server-key.pem}
+        - name: admin-token
+          secret:
+            secretName: {{ include "llmgw.adminSecret" . }}
+            defaultMode: 0440
+            items:
+              - key: {{ if .Values.adminToken.existingSecret }}{{ .Values.adminToken.secretKey }}{{ else }}admin-token{{ end }}
+                path: admin-token
+        {{- if eq .Values.store.type "postgres" }}
+        - name: store
+          secret:
+            secretName: {{ .Values.store.postgres.existingSecret }}
+            defaultMode: 0440
+            items:
+              - key: {{ .Values.store.postgres.secretKey }}
+                path: dsn
+        {{- end }}
+        {{- if .Values.offlineChecksums.configMap }}
+        - name: offline
+          configMap:
+            name: {{ .Values.offlineChecksums.configMap }}
+            items:
+              - key: {{ .Values.offlineChecksums.key }}
+                path: offline.sha256
+        {{- end }}
+        - name: tmp
+          emptyDir: {}
+        {{- if eq .Values.store.type "postgres" }}
+        # The store is PostgreSQL; nothing here outlives the pod.
+        - name: data
+          emptyDir: {}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  {{- if eq .Values.store.type "sqlite" }}
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+        labels:
+          {{- include "llmgw.selectorLabels" . | nindent 10 }}
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        {{- with .Values.store.sqlite.storageClass }}
+        storageClassName: {{ . }}
+        {{- end }}
+        resources:
+          requests:
+            storage: {{ .Values.store.sqlite.size }}
+  {{- end }}

deploy/helm/llmgw/values.yaml

@@ -0,0 +1,132 @@
+# The llmgw control plane in Kubernetes. docs/kubernetes.md says what this
+# runs, what it does not, and how nodes outside the cluster join it.
+
+image:
+  # Where you pushed the image built from deploy/container/Dockerfile. The
+  # project publishes binaries, not an image, so this has no default.
+  repository: ""
+  # Empty takes the chart's appVersion.
+  tag: ""
+  pullPolicy: IfNotPresent
+imagePullSecrets: []
+
+# One control plane, always. Two against PostgreSQL would elect a leader and
+# keep a standby, but a standby serves nothing and is never ready, so a
+# rollout would wait on it for ever. Until the chart handles that, it runs
+# one: Kubernetes replaces it within seconds when it goes, and the agents
+# reconnect on their own.
+replicas: 1
+
+store:
+  # sqlite: a file on a PersistentVolumeClaim, for one replica.
+  # postgres: a PostgreSQL you run, its address in a Secret.
+  type: sqlite
+  sqlite:
+    size: 10Gi
+    storageClass: ""
+  postgres:
+    # A Secret holding the address, postgres://user:password@host:5432/llmgw?sslmode=verify-full
+    existingSecret: ""
+    secretKey: dsn
+
+# The agent port's certificate. It comes from llmgw's own authority, not a
+# public one — agents present certificates from the same authority — so it
+# is made outside the cluster, where the authority's key stays:
+#
+#   llmgw ctl cert init-ca --dir ./pki
+#   llmgw ctl cert issue-server llmgw-ctl --host <agent address> --dir ./pki --out ./pki
+#   kubectl create secret generic llmgw-agent-tls \
+#     --from-file=ca.pem=pki/ca.pem \
+#     --from-file=server.pem=pki/server.pem \
+#     --from-file=server-key.pem=pki/server-key.pem
+#
+# --host is every address agents dial: agentService's load balancer address
+# or DNS name.
+agentTLS:
+  existingSecret: ""
+
+# The admin API's token (llmgw ctl, the console). Empty makes one, kept in a
+# Secret across upgrades.
+adminToken:
+  existingSecret: ""
+  secretKey: admin-token
+
+# server.yaml beyond what the chart sets (listeners, TLS, store, admin
+# token): any key of docs/reference.md, laid over the chart's. An offline
+# cluster sets offline.mirror here, and offlineChecksums below.
+config:
+  control:
+    enabled: true
+  auth:
+    enabled: true
+    signup_open: false
+    default_rpm: 60
+    default_tpm: 200000
+    default_price:
+      prompt_per_1k: 1000
+      completion_per_1k: 1000
+    max_key_ttl: 2160h
+  # mirror:
+  #   api: https://models.internal:8082
+  # offline:
+  #   mirror: http://models.internal:8081
+  # firewall_networks: ["10.42.0.0/16"]   # the pods' network, so nodes' engines answer the router
+
+# On an offline cluster, a ConfigMap or Secret holding the engine checksums
+# 'llmgw bundle trust' writes (offline.sha256), mounted where offline.checksums
+# points. Empty mounts none.
+offlineChecksums:
+  configMap: ""
+  key: offline.sha256
+
+# The OpenAI-compatible API and the metrics, inside the cluster.
+service:
+  type: ClusterIP
+  port: 8080
+  metricsPort: 9091
+  annotations: {}
+
+# Where agents connect, with mutual TLS. Nodes run outside the cluster, so
+# this is a load balancer by default; the TLS ends in the pod, never at a
+# proxy in between.
+agentService:
+  type: LoadBalancer
+  port: 7443
+  annotations: {}
+  loadBalancerIP: ""
+  loadBalancerSourceRanges: []
+  # Keeps the agents' addresses as they are, which the node's identity does
+  # not need but the logs and the audit read better with.
+  externalTrafficPolicy: Local
+
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  hosts:
+    - host: llm.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []
+  #  - secretName: llm-example-com
+  #    hosts: [llm.example.com]
+
+# A ServiceMonitor for the Prometheus Operator, scraping the metrics port.
+serviceMonitor:
+  enabled: false
+  interval: 30s
+  labels: {}
+
+resources:
+  requests:
+    cpu: 500m
+    memory: 512Mi
+  limits:
+    memory: 2Gi
+
+nodeSelector: {}
+tolerations: []
+affinity: {}
+podAnnotations: {}
+podLabels: {}

deploy/mirror/README.md

@@ -25,6 +25,13 @@ An HTTP server serving a directory. That is the whole design.
       model.safetensors
 ```
 
+At an offline site the mirror also holds what the nodes would otherwise fetch
+from the internet — llmgw's releases and the llama.cpp builds — under
+`_llmgw/releases/` and `_llmgw/engines/`, put there by `llmgw bundle import`
+(docs/install.md, "Offline sites"). They are not models: `mirror list` and
+`mirror unused` pass over them, and a node checks each against what the
+control plane says it must be, not against anything the mirror says.
+
 The date in the path is the point of the layout, not decoration. A model
 repository that changes upstream changes what you are running, and the first
 sign is a prompt that worked last week answering differently this week with
@@ -65,9 +72,13 @@ hand it certificates:
 llmgw mirror serve --dir /srv/models --base http://models.internal:8081 \
   --tls-ca /etc/llmgw/ca.pem \
   --tls-cert /etc/llmgw/mirror.pem \
-  --tls-key /etc/llmgw/mirror-key.pem
+  --tls-key /etc/llmgw/mirror-key.pem \
+  --api-client control-plane
 ```
 
+`--api-client` is required with `--tls-ca`: it names the one certificate the
+API answers, because the CA signs every node's certificate as well.
+
 That is the same CA the agents already use, so the certificates come from the
 authority you have:
 

deploy/monitoring/README.md

@@ -46,6 +46,19 @@ apt-get install prometheus prometheus-alertmanager
 install -m 0644 prometheus.yml            /etc/prometheus/prometheus.yml
 install -m 0644 llmgw-rules.yml           /etc/prometheus/rules/llmgw.yml
 install -m 0644 alertmanager.yml          /etc/prometheus/alertmanager.yml
+# Alertmanager answers on loopback only. Its API takes silences from anyone who
+# can reach it, with no login, and silencing BackupTooOld or ModelParked is how
+# something that should be noticed is not. Prometheus beside it is its only
+# client; one Alertmanager needs no cluster port.
+echo 'ARGS="--web.listen-address=127.0.0.1:9093 --cluster.listen-address="' \
+    > /etc/default/prometheus-alertmanager
+# Prometheus itself is read-only as installed: its admin and lifecycle APIs
+# stay off (no --web.enable-admin-api, no --web.enable-lifecycle). It still
+# answers any query from anyone who reaches :9090, which says which models and
+# nodes there are and how busy each is. Its readers are the control plane
+# (monitoring.prometheus) and Grafana beside it; to keep it to those, allow
+# the control plane and drop the rest, e.g. with nftables:
+#   nft add rule inet filter input tcp dport 9090 ip saddr != { 127.0.0.1, CONTROL_PLANE_IP } drop
 promtool check config /etc/prometheus/prometheus.yml
 systemctl restart prometheus prometheus-alertmanager
 
@@ -53,6 +66,8 @@ install -m 0644 grafana/datasource.yaml   /etc/grafana/provisioning/datasources/
 install -m 0644 grafana/dashboards.yaml   /etc/grafana/provisioning/dashboards/llmgw.yaml
 install -m 0644 -o grafana -g grafana grafana/llmgw-overview.json \
     /var/lib/grafana/dashboards/llmgw.json
+install -m 0644 -o grafana -g grafana grafana/llmgw-tenants.json \
+    /var/lib/grafana/dashboards/llmgw-tenants.json
 systemctl restart grafana-server
 ```
 
@@ -75,7 +90,8 @@ Alertmanager groups and holds alerts and has no receiver.
 Where an alert should go — an address, a Slack workspace, a webhook — is a
 decision with credentials attached, and a monitoring system that quietly starts
 mailing people is worse than one that is visibly not wired up. Alerts are
-visible at `:9093` and in Prometheus; add a receiver to `alertmanager.yml` to
+visible in Prometheus, and at `:9093` on the monitoring host itself (`ssh -L
+9093:127.0.0.1:9093 <host>` to open its page); add a receiver to `alertmanager.yml` to
 make them travel. `critical` already routes separately so it can be pointed
 somewhere else without touching the rest.
 
@@ -86,7 +102,7 @@ An alerting system nobody has seen fire is an assumption.
 ```
 llmgw ctl cordon <node>     # work already there keeps running
 # ~2 minutes later
-curl -s http://<host>:9093/api/v2/alerts | jq '.[].labels'
+ssh <host> curl -s http://127.0.0.1:9093/api/v2/alerts | jq '.[].labels'
 llmgw ctl uncordon <node>   # the alert resolves on its own
 ```
 

deploy/monitoring/alertmanager.yml

@@ -1,10 +1,11 @@
 # Alertmanager for the llmgw cluster.
 #
-# Nothing is sent anywhere yet, on purpose. Where an alert should go — an
+# Nothing is sent anywhere until a receiver is chosen, on purpose. Where an alert should go — an
 # address, a Slack workspace, a webhook — is a decision with credentials
 # attached, and a monitoring system that quietly starts mailing people is worse
 # than one that is visibly not wired up. Alerts group and fire here and are
-# visible at :9093 and in Prometheus; add a receiver below to make them travel.
+# visible at :9093 and in Prometheus; uncomment a receiver template below and
+# name it on the route to make them travel.
 global:
   resolve_timeout: 5m
 
@@ -31,6 +32,53 @@ route:
 receivers:
   - name: none
 
+  # Receiver templates. Uncomment one, fill in where it goes, and name it in
+  # `receiver:` above — on the route, the critical branch, or both. Secrets go
+  # in files Alertmanager reads (the *_file settings), mode 0640 owned by
+  # root:prometheus, not in this file. `amtool check-config` before a restart.
+  #
+  # Slack (an incoming webhook):
+  # - name: slack
+  #   slack_configs:
+  #     - api_url_file: /etc/prometheus/slack-webhook-url
+  #       channel: '#llmgw'
+  #       send_resolved: true
+  #       title: '{{ .Status | toUpper }}: {{ .CommonLabels.alertname }}'
+  #       text: >-
+  #         {{ range .Alerts }}{{ .Annotations.summary }}
+  #         {{ .Annotations.description }}
+  #         {{ end }}
+  #
+  # E-mail (through a relay that takes authenticated submission):
+  # - name: email
+  #   email_configs:
+  #     - to: ops@example.com
+  #       from: llmgw-alerts@example.com
+  #       smarthost: smtp.example.com:587
+  #       auth_username: llmgw-alerts@example.com
+  #       auth_password_file: /etc/prometheus/smtp-password
+  #       send_resolved: true
+  #
+  # PagerDuty (Events API v2), for the critical branch — what should wake
+  # someone:
+  # - name: pagerduty
+  #   pagerduty_configs:
+  #     - routing_key_file: /etc/prometheus/pagerduty-routing-key
+  #       severity: '{{ .CommonLabels.severity }}'
+  #       description: '{{ .CommonAnnotations.summary }}'
+  #
+  # A webhook of your own (Alertmanager's JSON, version 4):
+  # - name: webhook
+  #   webhook_configs:
+  #     - url_file: /etc/prometheus/alert-webhook-url
+  #       send_resolved: true
+  #       max_alerts: 20
+  #
+  # The gateway itself also sends a few events straight to webhooks, with no
+  # Prometheus in between — a model parked, a node lost, a budget spent, new
+  # weights published: `notify.webhooks` in server.yaml (docs/install.md,
+  # "Being told").
+
 inhibit_rules:
   # A node that is down explains every replica on it. Reporting both says the
   # same thing twice and buries whichever is the actual cause.

deploy/monitoring/grafana/llmgw-overview.json

@@ -487,6 +487,427 @@
         "defaults": {},
         "overrides": []
       }
+    },
+    {
+      "type": "row",
+      "title": "GPUs",
+      "id": 14,
+      "gridPos": {
+        "x": 0,
+        "y": 30,
+        "w": 24,
+        "h": 1
+      },
+      "collapsed": false,
+      "panels": []
+    },
+    {
+      "type": "timeseries",
+      "title": "GPU busy, by card",
+      "description": "Share of each sample period a kernel was running, sampled every heartbeat.",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "gridPos": {
+        "x": 0,
+        "y": 31,
+        "w": 12,
+        "h": 7
+      },
+      "id": 15,
+      "targets": [
+        {
+          "expr": "llmgw_gpu_utilization_percent",
+          "legendFormat": "{{node}} gpu {{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "max": 100
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "GPU memory in use, by card",
+      "description": "Framebuffer in use. Engines reserve most of it at start.",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "gridPos": {
+        "x": 12,
+        "y": 31,
+        "w": 12,
+        "h": 7
+      },
+      "id": 16,
+      "targets": [
+        {
+          "expr": "llmgw_gpu_memory_used_bytes / llmgw_gpu_memory_total_bytes",
+          "legendFormat": "{{node}} gpu {{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percentunit",
+          "min": 0,
+          "max": 1
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "GPU memory bandwidth busy, by card",
+      "description": "Decode is bound by memory: high here with compute low is a card waiting on memory.",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "gridPos": {
+        "x": 0,
+        "y": 38,
+        "w": 12,
+        "h": 7
+      },
+      "id": 17,
+      "targets": [
+        {
+          "expr": "llmgw_gpu_memory_utilization_percent",
+          "legendFormat": "{{node}} gpu {{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percent",
+          "min": 0,
+          "max": 100
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "GPU temperature",
+      "description": "Throttling usually starts in the high 80s.",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "gridPos": {
+        "x": 12,
+        "y": 38,
+        "w": 12,
+        "h": 7
+      },
+      "id": 18,
+      "targets": [
+        {
+          "expr": "llmgw_gpu_temperature_celsius",
+          "legendFormat": "{{node}} gpu {{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "celsius"
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "GPU power against its limit",
+      "description": "1 is the enforced limit; a card held there is power-capped.",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "gridPos": {
+        "x": 0,
+        "y": 45,
+        "w": 12,
+        "h": 7
+      },
+      "id": 19,
+      "targets": [
+        {
+          "expr": "llmgw_gpu_power_watts / llmgw_gpu_power_limit_watts",
+          "legendFormat": "{{node}} gpu {{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percentunit",
+          "min": 0,
+          "max": 1.1
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "GPU clock",
+      "description": "A clock held low under load is the card throttled; see the next panel for why.",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "gridPos": {
+        "x": 12,
+        "y": 45,
+        "w": 12,
+        "h": 7
+      },
+      "id": 20,
+      "targets": [
+        {
+          "expr": "llmgw_gpu_sm_clock_mhz",
+          "legendFormat": "{{node}} gpu {{gpu}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "rotmhz"
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "What holds GPUs back",
+      "description": "Cards throttled now, by reason, and uncorrected ECC errors since the driver loaded.",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "gridPos": {
+        "x": 0,
+        "y": 52,
+        "w": 24,
+        "h": 7
+      },
+      "id": 21,
+      "targets": [
+        {
+          "expr": "sum by (reason) (llmgw_gpu_throttled)",
+          "legendFormat": "throttled: {{reason}}",
+          "refId": "A"
+        },
+        {
+          "expr": "sum by (node, gpu) (llmgw_gpu_ecc_errors)",
+          "legendFormat": "ECC errors {{node}} gpu {{gpu}}",
+          "refId": "B"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "Output tokens/s per GPU, by model",
+      "description": "What each model gets out of each card it holds.",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "gridPos": {
+        "x": 0,
+        "y": 59,
+        "w": 12,
+        "h": 7
+      },
+      "id": 22,
+      "targets": [
+        {
+          "expr": "sum by (model) (rate(llmgw_tokens_total{direction=\"completion\"}[5m])) / count by (model) (llmgw_gpu_assigned)",
+          "legendFormat": "{{model}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "Output tokens per watt-hour, by model",
+      "description": "Tokens for the energy the model's cards draw.",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "gridPos": {
+        "x": 12,
+        "y": 59,
+        "w": 12,
+        "h": 7
+      },
+      "id": 23,
+      "targets": [
+        {
+          "expr": "sum by (model) (rate(llmgw_tokens_total{direction=\"completion\"}[5m])) * 3600 / sum by (model) (llmgw_gpu_power_watts * on (node, gpu) group_left (model) llmgw_gpu_assigned)",
+          "legendFormat": "{{model}}",
+          "refId": "A"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
+    },
+    {
+      "type": "timeseries",
+      "title": "GPU wear",
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "id": 24,
+      "description": "What wears cards out: XID errors in the last 15 minutes, memory rows remapped, PCIe retries an hour. Anything above zero here is worth a look on that card's node page.",
+      "gridPos": {
+        "x": 0,
+        "y": 66,
+        "w": 24,
+        "h": 7
+      },
+      "targets": [
+        {
+          "expr": "increase(llmgw_gpu_xid_errors[15m]) > 0",
+          "legendFormat": "XID {{node}} gpu {{gpu}}",
+          "refId": "A"
+        },
+        {
+          "expr": "sum by (node, gpu) (llmgw_gpu_remapped_rows) > 0",
+          "legendFormat": "rows remapped {{node}} gpu {{gpu}}",
+          "refId": "B"
+        },
+        {
+          "expr": "increase(llmgw_gpu_pcie_replays[1h]) > 0",
+          "legendFormat": "PCIe retries/h {{node}} gpu {{gpu}}",
+          "refId": "C"
+        },
+        {
+          "expr": "increase(llmgw_gpu_nvlink_errors[1h]) > 0",
+          "legendFormat": "NVLink {{kind}}/h {{node}} gpu {{gpu}}",
+          "refId": "D"
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "list",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "multi"
+        }
+      }
     }
   ]
 }

deploy/monitoring/grafana/llmgw-tenants.json

@@ -0,0 +1,650 @@
+{
+  "uid": "llmgw-tenants",
+  "title": "llmgw \u2014 tenants",
+  "schemaVersion": 39,
+  "version": 1,
+  "editable": true,
+  "time": {
+    "from": "now-24h",
+    "to": "now"
+  },
+  "refresh": "1m",
+  "tags": [
+    "llmgw"
+  ],
+  "description": "Requests, tokens, failures, refusals and first-token time per tenant \u2014 the level router.tenant_label names \u2014 and every budget's share spent.",
+  "templating": {
+    "list": [
+      {
+        "name": "tenant",
+        "label": "Tenant",
+        "type": "query",
+        "datasource": {
+          "type": "prometheus",
+          "uid": "llmgw-prom"
+        },
+        "query": {
+          "query": "label_values(llmgw_tenant_requests_total, tenant)",
+          "refId": "tenant"
+        },
+        "definition": "label_values(llmgw_tenant_requests_total, tenant)",
+        "multi": true,
+        "includeAll": true,
+        "allValue": ".*",
+        "current": {
+          "text": "All",
+          "value": "$__all"
+        },
+        "refresh": 2,
+        "sort": 1
+      }
+    ]
+  },
+  "panels": [
+    {
+      "id": 1,
+      "title": "Requests a second",
+      "type": "stat",
+      "description": "Across the tenants chosen above.",
+      "gridPos": {
+        "x": 0,
+        "y": 0,
+        "w": 6,
+        "h": 4
+      },
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "sum(rate(llmgw_tenant_requests_total{tenant=~\"$tenant\"}[5m]))",
+          "legendFormat": "",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "llmgw-prom"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "reqps"
+        },
+        "overrides": []
+      },
+      "options": {
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "textMode": "auto",
+        "colorMode": "value"
+      }
+    },
+    {
+      "id": 2,
+      "title": "Failing",
+      "type": "stat",
+      "description": "Requests that failed, not counting refusals by a limit.",
+      "gridPos": {
+        "x": 6,
+        "y": 0,
+        "w": 6,
+        "h": 4
+      },
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "sum(rate(llmgw_tenant_requests_total{tenant=~\"$tenant\",outcome=\"error\"}[5m])) / sum(rate(llmgw_tenant_requests_total{tenant=~\"$tenant\"}[5m]))",
+          "legendFormat": "",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "llmgw-prom"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percentunit",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "orange",
+                "value": 0.02
+              },
+              {
+                "color": "red",
+                "value": 0.05
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "textMode": "auto",
+        "colorMode": "value"
+      }
+    },
+    {
+      "id": 3,
+      "title": "Refused by a limit",
+      "type": "stat",
+      "description": "Rate, token and budget limits; 429 to the caller.",
+      "gridPos": {
+        "x": 12,
+        "y": 0,
+        "w": 6,
+        "h": 4
+      },
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "sum(rate(llmgw_tenant_requests_total{tenant=~\"$tenant\",outcome=\"limited\"}[5m])) / sum(rate(llmgw_tenant_requests_total{tenant=~\"$tenant\"}[5m]))",
+          "legendFormat": "",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "llmgw-prom"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percentunit",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "orange",
+                "value": 0.02
+              },
+              {
+                "color": "red",
+                "value": 0.1
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "textMode": "auto",
+        "colorMode": "value"
+      }
+    },
+    {
+      "id": 4,
+      "title": "First token, p95",
+      "type": "stat",
+      "description": "What people wait for before anything appears.",
+      "gridPos": {
+        "x": 18,
+        "y": 0,
+        "w": 6,
+        "h": 4
+      },
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "histogram_quantile(0.95, sum by (le) (rate(llmgw_tenant_ttft_seconds_bucket{tenant=~\"$tenant\"}[5m])))",
+          "legendFormat": "",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "llmgw-prom"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "s",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "orange",
+                "value": 3
+              },
+              {
+                "color": "red",
+                "value": 10
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "textMode": "auto",
+        "colorMode": "value"
+      }
+    },
+    {
+      "id": 5,
+      "title": "Requests by tenant",
+      "type": "timeseries",
+      "description": "Stacked, so the top edge is the whole of it.",
+      "gridPos": {
+        "x": 0,
+        "y": 4,
+        "w": 12,
+        "h": 9
+      },
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "sum by (tenant) (rate(llmgw_tenant_requests_total{tenant=~\"$tenant\"}[5m]))",
+          "legendFormat": "{{tenant}}",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "llmgw-prom"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "reqps",
+          "custom": {
+            "stacking": {
+              "mode": "normal"
+            },
+            "fillOpacity": 30
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "right",
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      }
+    },
+    {
+      "id": 6,
+      "title": "Tokens by tenant",
+      "type": "timeseries",
+      "description": "Prompt and completion together: what was consumed.",
+      "gridPos": {
+        "x": 12,
+        "y": 4,
+        "w": 12,
+        "h": 9
+      },
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "sum by (tenant) (rate(llmgw_tenant_tokens_total{tenant=~\"$tenant\"}[5m]))",
+          "legendFormat": "{{tenant}}",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "llmgw-prom"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "custom": {
+            "stacking": {
+              "mode": "normal"
+            },
+            "fillOpacity": 30
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "right",
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      }
+    },
+    {
+      "id": 7,
+      "title": "Refused by a limit, by tenant",
+      "type": "timeseries",
+      "description": "The share of each tenant's requests a limit turned away.",
+      "gridPos": {
+        "x": 0,
+        "y": 13,
+        "w": 12,
+        "h": 8
+      },
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "sum by (tenant) (rate(llmgw_tenant_requests_total{tenant=~\"$tenant\",outcome=\"limited\"}[5m])) / sum by (tenant) (rate(llmgw_tenant_requests_total{tenant=~\"$tenant\"}[5m]))",
+          "legendFormat": "{{tenant}}",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "llmgw-prom"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "right",
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      }
+    },
+    {
+      "id": 8,
+      "title": "Failing, by tenant",
+      "type": "timeseries",
+      "description": "One tenant alone failing is usually what it sends; all of them together is a model.",
+      "gridPos": {
+        "x": 12,
+        "y": 13,
+        "w": 12,
+        "h": 8
+      },
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "sum by (tenant) (rate(llmgw_tenant_requests_total{tenant=~\"$tenant\",outcome=\"error\"}[5m])) / sum by (tenant) (rate(llmgw_tenant_requests_total{tenant=~\"$tenant\"}[5m]))",
+          "legendFormat": "{{tenant}}",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "llmgw-prom"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "right",
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      }
+    },
+    {
+      "id": 9,
+      "title": "First token p95, by tenant",
+      "type": "timeseries",
+      "description": "",
+      "gridPos": {
+        "x": 0,
+        "y": 21,
+        "w": 12,
+        "h": 8
+      },
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "histogram_quantile(0.95, sum by (tenant, le) (rate(llmgw_tenant_ttft_seconds_bucket{tenant=~\"$tenant\"}[10m])))",
+          "legendFormat": "{{tenant}}",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "llmgw-prom"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "right",
+          "calcs": [
+            "mean",
+            "max"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      }
+    },
+    {
+      "id": 10,
+      "title": "Budgets spent this period",
+      "type": "bargauge",
+      "description": "Every organization, team, project and person with a budget. Requests are refused at 100%.",
+      "gridPos": {
+        "x": 12,
+        "y": 21,
+        "w": 12,
+        "h": 8
+      },
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "sort_desc(llmgw_budget_spent_ratio)",
+          "legendFormat": "{{scope}} {{name}} ({{period}})",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "llmgw-prom"
+          }
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {
+          "unit": "percentunit",
+          "min": 0,
+          "max": 1,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green",
+                "value": null
+              },
+              {
+                "color": "orange",
+                "value": 0.8
+              },
+              {
+                "color": "red",
+                "value": 1
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "displayMode": "gradient",
+        "orientation": "horizontal",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ]
+        },
+        "showUnfilled": true
+      }
+    },
+    {
+      "id": 11,
+      "title": "Who used most, last 24 hours",
+      "type": "table",
+      "description": "Spend in money is on the people page's usage tab, which reads it from the store.",
+      "gridPos": {
+        "x": 0,
+        "y": 29,
+        "w": 24,
+        "h": 8
+      },
+      "datasource": {
+        "type": "prometheus",
+        "uid": "llmgw-prom"
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "expr": "sort_desc(sum by (tenant) (increase(llmgw_tenant_requests_total{tenant=~\"$tenant\"}[24h])))",
+          "legendFormat": "requests",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "llmgw-prom"
+          },
+          "format": "table",
+          "instant": true
+        },
+        {
+          "refId": "B",
+          "expr": "sum by (tenant) (increase(llmgw_tenant_tokens_total{tenant=~\"$tenant\"}[24h]))",
+          "legendFormat": "tokens",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "llmgw-prom"
+          },
+          "format": "table",
+          "instant": true
+        },
+        {
+          "refId": "C",
+          "expr": "sum by (tenant) (increase(llmgw_tenant_requests_total{tenant=~\"$tenant\",outcome=\"limited\"}[24h]))",
+          "legendFormat": "limited",
+          "datasource": {
+            "type": "prometheus",
+            "uid": "llmgw-prom"
+          },
+          "format": "table",
+          "instant": true
+        }
+      ],
+      "fieldConfig": {
+        "defaults": {},
+        "overrides": []
+      },
+      "options": {
+        "showHeader": true
+      },
+      "transformations": [
+        {
+          "id": "merge",
+          "options": {}
+        },
+        {
+          "id": "organize",
+          "options": {
+            "excludeByName": {
+              "Time": true
+            },
+            "renameByName": {
+              "Value #A": "Requests",
+              "Value #B": "Tokens",
+              "Value #C": "Refused by a limit"
+            }
+          }
+        }
+      ]
+    }
+  ]
+}

deploy/monitoring/llmgw-rules.yml

@@ -42,10 +42,131 @@ groups:
         annotations:
           summary: "{{ $labels.model }} has no replica ready"
           description: >-
-            The model is placed and nothing is serving it. Ten minutes, because
-            a large model on CPU legitimately takes minutes to load. A model
-            that is deliberately stopped publishes no series at all, so this
-            cannot fire for one nobody asked for.
+            The model should be running and nothing is serving it. Ten minutes,
+            because a large model on CPU legitimately takes minutes to load. The
+            series is published at 0 for every model that should be running —
+            before v0.10.4 it was published only while a replica was ready, so
+            this could not fire at all. A model deliberately stopped, or an
+            on-demand one nobody is asking for, publishes nothing.
+
+      - alert: ModelParked
+        expr: llmgw_model_parked == 1
+        labels: { severity: critical }
+        annotations:
+          summary: "{{ $labels.model }} failed every time it started and is no longer retried"
+          description: >-
+            Five replicas in a row failed at start. Before this existed a model
+            whose weights its engine could not load was started 155 times over
+            eight hours. `llmgw ctl status` has the last error; once it is dealt
+            with, `llmgw ctl retry <model>`. Changing the model's definition
+            also retries it.
+
+      - alert: ModelFailingToStart
+        expr: llmgw_model_start_failures >= 2
+        for: 5m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.model }} has failed to start {{ $value }} times in a row"
+          description: >-
+            On its way to being parked. The engine's own words are in
+            `llmgw ctl logs <node> --source <shard>` for the next attempt, or in
+            the control plane's log for the last one.
+
+      - alert: ModelCannotBePlaced
+        expr: llmgw_model_unplaceable == 1
+        for: 10m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.model }} is wanted and fits on no node"
+          description: >-
+            Short of replicas, and the last attempt found nowhere with the
+            memory, cards or engine it needs. `llmgw ctl explain-placement
+            <model>` says what each node lacks. For an on-demand model, requests
+            for it are told this rather than asked to retry.
+
+      - alert: ModelPreempted
+        expr: increase(llmgw_model_preempted_total[15m]) > 0
+        labels: { severity: info }
+        annotations:
+          summary: "{{ $labels.model }} ({{ $labels.class }}) gave up replicas to a higher class"
+          description: >-
+            Capacity ran short and a model of a higher class took this one's
+            room. Expected now and then; if it keeps firing for the same model,
+            the cluster is too small for what is asked of it at these classes.
+            `llmgw ctl models` shows who it gave way to.
+
+      - alert: CapacityAtLimit
+        expr: llmgw_capacity_holds >= on(scope, resource) llmgw_capacity_limit
+        for: 15m
+        labels: { severity: info }
+        annotations:
+          summary: "{{ $labels.scope }} holds all the {{ $labels.resource }} it may"
+          description: >-
+            Its models get no further replicas, under load or not, until
+            something of theirs stops or the limit is raised: `llmgw ctl quota
+            list`, `llmgw ctl quota set`.
+
+      - alert: EngineInstallFailed
+        expr: llmgw_node_engine_install{state="failed"} == 1
+        for: 15m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.engine }} {{ $labels.version }} will not install on {{ $labels.node }}"
+          description: >-
+            The node takes no model needing it until it does. The agent retries
+            on its own; `llmgw ctl nodes` and the node's logs on the cluster
+            page say why it failed.
+
+      - alert: ControlPlaneLeadership
+        expr: sum(llmgw_control_plane_leader) != 1
+        for: 2m
+        labels: { severity: critical }
+        annotations:
+          summary: "{{ $value }} control planes believe they are placing work"
+          description: >-
+            None means nothing is placed or replaced; two means both are, each
+            into GPUs the other believes free. The lease is in the store: check
+            it is reachable from every control plane.
+
+      - alert: CertificateExpiresSoon
+        expr: (llmgw_certificate_expiry_timestamp_seconds - time()) < 30 * 86400
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.cert }} ({{ $labels.subject }}) expires in {{ $value | humanizeDuration }}"
+          description: >-
+            Certificates last a year and nothing renews them. When the agent
+            server's runs out every agent refuses to connect at once. Reissue
+            with `llmgw ctl cert` and restart the control plane.
+
+      - alert: CertificateExpiresVerySoon
+        expr: (llmgw_certificate_expiry_timestamp_seconds - time()) < 7 * 86400
+        labels: { severity: critical }
+        annotations:
+          summary: "{{ $labels.cert }} ({{ $labels.subject }}) expires in {{ $value | humanizeDuration }}"
+          description: See CertificateExpiresSoon; a week is not long.
+
+      - alert: BackupTooOld
+        expr: time() - llmgw_backup_last_success_timestamp_seconds > 26 * 3600
+        labels: { severity: warning }
+        annotations:
+          summary: "The newest llmgw backup is {{ $value | humanizeDuration }} old"
+          description: >-
+            llmgw-backup.timer runs nightly. Also fires when there has never
+            been a backup (the series is 0 then). `journalctl -u
+            llmgw-backup.service` on the control plane says why the last one
+            failed; docs/install.md, "Backing up", says how to set it up.
+
+      - alert: ModelUpdateAvailable
+        expr: llmgw_model_update_available == 1
+        for: 1h
+        labels: { severity: info }
+        annotations:
+          summary: "{{ $labels.repo }} has new weights for {{ $labels.model }}"
+          description: >-
+            The registry repository the model was served from has published
+            different files under the same names. `llmgw ctl model updates`
+            lists what changed; `llmgw ctl model update {{ $labels.model }}`
+            moves it to them, and `llmgw ctl model rollback` goes back.
 
       - alert: PoolSaturated
         expr: llmgw_pool_saturation > 1
@@ -91,6 +212,94 @@ groups:
             is skipped by placement rather than failing, so this is quiet until
             somebody wonders why a model will not land there.
 
+  - name: llmgw-gpus
+    rules:
+      - alert: GPUThermalThrottling
+        expr: llmgw_gpu_throttled{reason=~"sw_thermal|hw_thermal|hw_slowdown"} == 1
+        for: 10m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.node }} GPU {{ $labels.gpu }} is slowed by heat ({{ $labels.reason }})"
+          description: >-
+            Ten minutes held back by temperature: every replica on the card is
+            slower than its measurements say. Usually airflow, a fan, or the
+            room — the node page shows the card's temperature over time.
+
+      - alert: GPUUncorrectedECCErrors
+        expr: llmgw_gpu_ecc_errors > 0
+        for: 1m
+        labels: { severity: critical }
+        annotations:
+          summary: "{{ $labels.node }} GPU {{ $labels.gpu }} has {{ $value }} uncorrected ECC errors"
+          description: >-
+            Uncorrected memory errors since the driver loaded: what runs on the
+            card may be computing on corrupted memory. Drain the node
+            (llmgw ctl drain) and have the card looked at.
+
+      - alert: GPUXidError
+        expr: increase(llmgw_gpu_xid_errors[15m]) > 0
+        for: 0m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.node }} GPU {{ $labels.gpu }} logged an XID error"
+          description: >-
+            The driver reported an error on the card (its code is
+            llmgw_gpu_last_xid, and the node page says it in words). 79 is a
+            card fallen off the bus, 48 and 63/64 memory errors, 74 NVLink,
+            94/95 contained and uncontained ECC errors: those need the card
+            looked at. Others are often an engine's own fault, and pass.
+
+      - alert: GPUOutOfSpareRows
+        expr: llmgw_gpu_remap_failure == 1
+        for: 1m
+        labels: { severity: critical }
+        annotations:
+          summary: "{{ $labels.node }} GPU {{ $labels.gpu }} has no spare memory rows left"
+          description: >-
+            The card cannot remap another failing row. Drain the node and
+            have the card replaced.
+
+      - alert: GPUNeedsReset
+        expr: llmgw_gpu_remap_pending == 1 or llmgw_gpu_retirement_pending == 1
+        for: 5m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.node }} GPU {{ $labels.gpu }} has memory repairs waiting for a reset"
+          description: >-
+            Rows remapped or pages retired take effect only after the card is
+            reset. Drain the node (llmgw ctl drain), reset or reboot, and bring
+            it back.
+
+      - alert: GPUPCIeRetriesClimbing
+        expr: increase(llmgw_gpu_pcie_replays[1h]) > 100
+        for: 0m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.node }} GPU {{ $labels.gpu }}: {{ $value }} PCIe retries in an hour"
+          description: >-
+            The card's link to the host is retrying. A riser, the slot or a
+            cable is the usual cause, and transfers to the card slow down.
+
+      - alert: GPUNVLinkErrorsClimbing
+        expr: increase(llmgw_gpu_nvlink_errors{kind="crc"}[1h]) > 10
+        for: 0m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.node }} GPU {{ $labels.gpu }}: NVLink CRC errors climbing"
+          description: >-
+            Errors on the card's NVLink links: tensor-parallel replicas on it
+            slow down, and a link that keeps failing takes a replica with it.
+
+      - alert: GPUHot
+        expr: llmgw_gpu_temperature_celsius > 87
+        for: 10m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.node }} GPU {{ $labels.gpu }} at {{ $value }} °C"
+          description: >-
+            Ten minutes above 87 °C, where most data-centre cards begin to
+            throttle.
+
   - name: monitoring-host
     rules:
       - alert: MonitoringDiskFilling
@@ -153,3 +362,225 @@ groups:
             Working as designed when the cluster is full: the lowest band is
             held first. Worth knowing about because the callers being refused
             do not know why.
+
+  # Per tenant: the level router.tenant_label names (a team by default), and
+  # every organization, team, project and person given a budget.
+  - name: llmgw-tenants
+    rules:
+      - alert: BudgetMostlySpent
+        expr: llmgw_budget_spent_ratio >= 0.8 and llmgw_budget_spent_ratio < 1
+        for: 5m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.scope }} {{ $labels.name }} has spent {{ $value | humanizePercentage }} of its {{ $labels.period }}ly budget"
+          description: >-
+            Its requests are refused once it reaches all of it, until the
+            period turns. Raise it on the people page, or tell them now
+            rather than when they are refused.
+
+      - alert: BudgetSpent
+        expr: llmgw_budget_spent_ratio >= 1
+        for: 1m
+        labels: { severity: critical }
+        annotations:
+          summary: "{{ $labels.scope }} {{ $labels.name }} has spent its {{ $labels.period }}ly budget"
+          description: >-
+            Every request under it is refused with 429 until the period
+            turns, unless a cheaper model is named as its fallback.
+
+      - alert: TenantHittingLimits
+        expr: >-
+          sum by (tenant) (rate(llmgw_tenant_requests_total{outcome="limited"}[10m]))
+          / sum by (tenant) (rate(llmgw_tenant_requests_total[10m])) > 0.1
+        for: 10m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $value | humanizePercentage }} of {{ $labels.tenant }}'s requests are refused by a limit"
+          description: >-
+            A rate, token or budget limit is turning their traffic away. Either
+            the limit is too low for what they now do, or something of theirs
+            is looping.
+
+      - alert: TenantErrors
+        expr: >-
+          sum by (tenant) (rate(llmgw_tenant_requests_total{outcome="error"}[10m]))
+          / sum by (tenant) (rate(llmgw_tenant_requests_total[10m])) > 0.05
+          and sum by (tenant) (rate(llmgw_tenant_requests_total[10m])) > 0.05
+        for: 10m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $value | humanizePercentage }} of {{ $labels.tenant }}'s requests fail"
+          description: >-
+            Not counting refusals by a limit. If every tenant fails alike it
+            is a model (ModelFailing); one alone is usually what they send —
+            prompts past the context, a model they may not use.
+
+      - alert: TenantTrafficSpike
+        expr: >-
+          sum by (tenant) (rate(llmgw_tenant_requests_total[30m]))
+          > 3 * sum by (tenant) (rate(llmgw_tenant_requests_total[7d]))
+          and sum by (tenant) (rate(llmgw_tenant_requests_total[30m])) > 0.2
+        for: 15m
+        labels: { severity: info }
+        annotations:
+          summary: "{{ $labels.tenant }} is sending three times its weekly average"
+          description: >-
+            A new workload, a batch job, or a client retrying in a loop. Only
+            for a tenant sending more than one request every five seconds, so
+            a quiet team starting work in the morning does not page anybody.
+
+      - alert: TenantSlowFirstToken
+        expr: >-
+          histogram_quantile(0.95,
+            sum by (tenant, le) (rate(llmgw_tenant_ttft_seconds_bucket[15m]))) > 10
+          and sum by (tenant) (rate(llmgw_tenant_ttft_seconds_count[15m])) > 0.02
+        for: 15m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.tenant }} waits {{ $value | humanizeDuration }} for a first token at p95"
+          description: >-
+            What their people feel. Compare with SlowFirstToken per model: if
+            only this tenant is slow, it is the models it uses or its queue
+            band, not the cluster.
+  # The store, when it is a replicated cluster under Patroni (llmgw server
+  # init --patroni). Published only for a store of several hosts.
+  - name: llmgw-store
+    rules:
+      - alert: StoreHasNoLeader
+        expr: llmgw_store_patroni_up == 1 and on() count(llmgw_store_member{role="leader"}) == 0
+        for: 1m
+        labels: { severity: critical }
+        annotations:
+          summary: "The store's cluster has no primary"
+          description: >-
+            Every write fails — keys, usage, budgets, leadership. Patroni
+            promotes a standby within its 30-second TTL; a minute without one
+            means it cannot: etcd has lost its majority, or no standby is fit.
+            `patronictl -c /etc/patroni/config.yml list` on a member says which.
+
+      - alert: StorePatroniUnreachable
+        expr: llmgw_store_patroni_up == 0
+        for: 2m
+        labels: { severity: warning }
+        annotations:
+          summary: "No member of the store's cluster answers on its Patroni port"
+          description: >-
+            The control plane reads the cluster's state from port 8008 on each
+            member. The database may still be serving; nothing here can tell.
+
+      - alert: StoreReplicaNotStreaming
+        expr: llmgw_store_member{role!="leader", state!="streaming"} == 1
+        for: 5m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.member }} is {{ $labels.state }}, not streaming from the primary"
+          description: >-
+            A standby that is not streaming is not a standby: if the primary
+            is lost now, there is nothing to promote. "missing" is a host of
+            the store address the cluster no longer lists — usually a machine
+            that is down.
+
+      - alert: StoreReplicaBehind
+        expr: llmgw_store_replica_lag_bytes > 64 * 1024 * 1024 or llmgw_store_replica_lag_bytes == -1
+        for: 10m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.member }} is {{ $value | humanize1024 }}B behind the primary"
+          description: >-
+            Patroni will not promote a standby more than 1 MB behind, so a
+            failover now would find none fit. -1 is a lag Patroni cannot read.
+
+  - name: llmgw-guard
+    rules:
+      - alert: GuardFailingOpen
+        expr: >-
+          sum(rate(llmgw_guard_fail_open_total[5m]))
+            / clamp_min(sum(rate(llmgw_guard_checks_total[5m])), 1e-9) > 0.01
+        for: 5m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $value | humanizePercentage }} of judged traffic is served unjudged"
+          description: >-
+            A guard policy's judge model is not answering within its latency
+            budget, and the policy fails open: requests go through flagged
+            "judge unavailable" instead of being judged.
+            llmgw_guard_judge_errors_total says whether it is timing out or
+            not there; `llmgw ctl replicas` whether the judge has replicas.
+
+      - alert: GuardJudgeSlow
+        expr: >-
+          histogram_quantile(0.95, sum by (le, judge_model) (rate(llmgw_guard_judge_latency_seconds_bucket[5m]))) > 0.25
+        for: 10m
+        labels: { severity: warning }
+        annotations:
+          summary: "Judge {{ $labels.judge_model }} answers in {{ $value | humanizeDuration }} at p95"
+          description: >-
+            Over the default latency budget: every judged request waits this
+            long, and those over their policy's budget are served unjudged or
+            refused. Give the judge more replicas, or faster ones.
+
+      - alert: GuardJudgeUnavailable
+        expr: sum by (reason) (rate(llmgw_guard_judge_errors_total{reason!="timeout"}[5m])) > 0
+        for: 5m
+        labels: { severity: critical }
+        annotations:
+          summary: "The guardrails cannot ask their judge ({{ $labels.reason }})"
+          description: >-
+            no_judge: a policy names a model that is not in the catalog with
+            role: guard. unavailable: it has no replica answering. format: it
+            answers in a form its guard.format does not read.
+
+      - alert: GuardBlocksSpiking
+        expr: >-
+          sum by (tenant) (rate(llmgw_tenant_guard_blocks_total[1h]))
+            > 3 * sum by (tenant) (rate(llmgw_tenant_guard_blocks_total[7d]))
+          and sum by (tenant) (increase(llmgw_tenant_guard_blocks_total[1h])) > 10
+        for: 15m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.tenant }} is being blocked three times as often as usual"
+          description: >-
+            A tenant's requests or answers are blocked by the guardrails
+            more than three times their weekly rate. Someone probing, a
+            client sending data it should not, or a policy that changed.
+            The /admin/guard page lists the recent ones by request.
+
+      - alert: GuardSecretInAnswer
+        expr: sum(increase(llmgw_guard_checks_total{stage="output",category="secret",action!="allowed"}[5m])) > 0
+        labels: { severity: critical }
+        annotations:
+          summary: "A model put a credential in an answer"
+          description: >-
+            An answer contained something shaped like a key or a private key.
+            It was stopped or rewritten if the policy enforces; either way a
+            model has seen it, in its prompt or its training. The usage rows
+            with guard_category secret say which request.
+
+  - name: llmgw-slo
+    rules:
+      - alert: ModelTTFTOverSLO
+        expr: >-
+          histogram_quantile(0.99, sum by (le, model) (rate(llmgw_ttft_seconds_bucket[10m])))
+            > on (model) group_left llmgw_model_slo_seconds{kind="ttft_p99"}
+        for: 15m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.model }} answers its first token past its SLO at p99"
+          description: >-
+            The p99 time to the first token over ten minutes is past the
+            model's slo.ttft_p99. Admission already holds the lower bands back
+            while it is; this says it has lasted. More replicas, or less
+            traffic in the bands above.
+
+      - alert: ModelTPOTOverSLO
+        expr: >-
+          histogram_quantile(0.99, sum by (le, model) (rate(llmgw_tpot_seconds_bucket[10m])))
+            > on (model) group_left llmgw_model_slo_seconds{kind="tpot_p99"}
+        for: 15m
+        labels: { severity: warning }
+        annotations:
+          summary: "{{ $labels.model }} produces tokens slower than its SLO at p99"
+          description: >-
+            The p99 time per output token is past slo.tpot_p99: replicas are
+            batching more than they can decode quickly, or a slower card is
+            serving. llmgw_output_tokens_per_second by pool says which.

deploy/monitoring/prometheus.yml

@@ -27,6 +27,17 @@ scrape_configs:
         labels:
           instance: control-plane
 
+  # Every machine of the cluster, for its node exporter: network and disk
+  # traffic, filesystems, CPU time. The control plane lists them — nodes,
+  # itself, the store's members — so a node added is a node scraped with
+  # nothing edited here, and each carries its llmgw id as the node label.
+  # `llmgw node add` installs the exporter; on a machine added before that,
+  # apt-get install prometheus-node-exporter.
+  - job_name: nodes
+    http_sd_configs:
+      - url: http://10.0.0.140:9091/prometheus/targets
+        refresh_interval: 1m
+
   - job_name: prometheus
     static_configs:
       - targets: ['localhost:9090']

deploy/proxy/README.md

@@ -10,6 +10,9 @@ put it behind a proxy that holds a publicly trusted certificate.
 
 Both are also attached to every release.
 
+The `/about` page shows both, from copies in `internal/web/proxy`; a test fails
+when those differ from these, so change them here and copy them over.
+
 Four things both files get right, and any other proxy has to as well:
 
 - **Streaming is not buffered.** Replies are server-sent events; a buffering

deploy/systemd/llmgw-agent.service

@@ -11,6 +11,10 @@ ExecStart=/usr/local/bin/llmgw agent --config /etc/llmgw/agent.yaml
 KillMode=process
 Restart=on-failure
 RestartSec=2s
+# RDMA pins the buffers it registers, and NCCL registers a great deal: with
+# systemd's default 8 MB lock limit, an engine that drops the capability that
+# lets root ignore it fails its first collective over InfiniBand.
+LimitMEMLOCK=infinity
 StateDirectory=llmgw-agent
 
 [Install]

deploy/systemd/llmgw-backup.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=llmgw backup: the store and /etc/llmgw, to /var/backups/llmgw-server
+After=llmgw-server.service postgresql.service
+
+[Service]
+Type=oneshot
+# Nothing it writes is for anyone else: the archive holds the CA's key and a
+# copy of the store.
+UMask=0077
+# Root, because the archive includes /etc/llmgw/secrets and the certificate
+# authority's key, which the llmgw user deliberately cannot read all of.
+ExecStart=/usr/local/bin/llmgw server backup --config /etc/llmgw/server.yaml --keep 14
+Nice=10
+IOSchedulingClass=idle

deploy/systemd/llmgw-backup.timer

@@ -0,0 +1,12 @@
+[Unit]
+Description=Back up llmgw every night
+
+[Timer]
+OnCalendar=*-*-* 03:15:00
+# A machine that was off at 03:15 backs up when it next starts, rather than
+# waiting another day with a gap nobody notices until the alert.
+Persistent=true
+RandomizedDelaySec=10m
+
+[Install]
+WantedBy=timers.target

docs.go

@@ -0,0 +1,103 @@
+// Package llmgw holds what the binary carries besides code: its manual, the
+// description of its admin API, and the example quality suites.
+package llmgw
+
+import (
+	"embed"
+	"io/fs"
+	"sort"
+	"strings"
+)
+
+// Docs is the documentation, read on any machine by `llmgw docs` and the
+// console's manual without a checkout or the internet.
+//
+//go:embed README.md CHANGELOG.md docs/*.md
+var Docs embed.FS
+
+// Doc is one page of the manual.
+type Doc struct {
+	// Key is what `llmgw docs KEY` takes, and the page's address under /docs/
+	// on the gateway.
+	Key string
+	// Path is the file in Docs.
+	Path string
+	// Title is the document's first heading.
+	Title string
+}
+
+// Source is the document's markdown.
+func (d Doc) Source() string {
+	b, err := fs.ReadFile(Docs, d.Path)
+	if err != nil {
+		return "# " + d.Path + "\n\nNot in this build."
+	}
+	return string(b)
+}
+
+// docOrder is the documents in the order someone new reads them. Here rather
+// than with either reader, because the console's manual and the gateway's
+// docs portal both list them, and two lists drift.
+var docOrder = []string{"console", "quick-install", "install", "node-onboarding", "onboarding",
+	"clients", "guardrails", "choosing-models", "fabrics", "facility-aware-placement", "data",
+	"reference", "development"}
+
+// Manual is every document, in reading order: those docOrder names, then any
+// other under docs/ alphabetically, so a new one is never missing, then the
+// README and the changes.
+func Manual() []Doc {
+	var out []Doc
+	seen := map[string]bool{}
+	add := func(key, path string) {
+		if seen[key] {
+			return
+		}
+		b, err := fs.ReadFile(Docs, path)
+		if err != nil {
+			return
+		}
+		seen[key] = true
+		out = append(out, Doc{Key: key, Path: path, Title: titleOf(string(b), path)})
+	}
+	for _, k := range docOrder {
+		add(k, "docs/"+k+".md")
+	}
+	entries, _ := fs.ReadDir(Docs, "docs")
+	var rest []string
+	for _, e := range entries {
+		if strings.HasSuffix(e.Name(), ".md") {
+			rest = append(rest, strings.TrimSuffix(e.Name(), ".md"))
+		}
+	}
+	sort.Strings(rest)
+	for _, k := range rest {
+		add(k, "docs/"+k+".md")
+	}
+	add("readme", "README.md")
+	add("changes", "CHANGELOG.md")
+	return out
+}
+
+// titleOf is a document's first top-level heading, or its path when it has
+// none.
+func titleOf(src, path string) string {
+	for _, l := range strings.Split(src, "\n") {
+		if strings.HasPrefix(l, "# ") {
+			return strings.TrimSpace(strings.TrimPrefix(l, "# "))
+		}
+	}
+	return path
+}
+
+// AdminOpenAPI is the admin API described in OpenAPI 3.1, generated from its
+// route table by `go generate` in internal/docgen and served at
+// /api/v1/openapi.json, so a client can be pointed at the server it talks to.
+//
+//go:embed docs/admin-api.openapi.json
+var AdminOpenAPI []byte
+
+// EvalSuites are the example quality suites under deploy/eval, which the
+// control plane runs by name when its eval directory has none of the name.
+//
+//go:embed deploy/eval/*.yaml
+var EvalSuites embed.FS

docs/admin-api.md

@@ -0,0 +1,160 @@
+# The admin API
+
+Written for whoever automates a cluster rather than typing at it: how to reach
+the control plane's management API, what it asks of a request, and where its
+description is.
+
+`llmgw ctl` and the console are clients of this API and nothing more, so
+anything they do can be done with `curl`, a generated client or the
+[Terraform provider](../terraform-provider-llmgw/README.md). It adds and
+removes models, scales them, cordons and upgrades nodes, sets capacity
+quotas, attaches guardrail policies, and reads the fleet, usage and the audit
+log.
+
+## Reaching it
+
+The API is under `/api/v1` on the admin listener, `admin_listen` in
+`/etc/llmgw/server.yaml`: `127.0.0.1:9090` unless changed. It is on loopback
+on purpose. The same listener serves pprof when it is turned on, and the
+server refuses to start with it on any other address unless
+`admin_remote: true` — the token would cross the network in clear.
+
+From another machine, tunnel to it rather than moving it:
+
+```sh
+ssh -N -L 9090:127.0.0.1:9090 admin@control-plane &
+curl -s -H "Authorization: Bearer $LLMGW_ADMIN_TOKEN" http://127.0.0.1:9090/api/v1/summary
+```
+
+With `admin_remote: true` and `admin_listen: 10.0.0.5:9090`, call that address
+directly — on a network you trust, or behind a TLS proxy that keeps the
+`Host` header an address.
+
+## The token
+
+Every path under `/api` needs the admin token as a bearer token:
+
+```
+Authorization: Bearer 6f1c…
+```
+
+The server writes it the first time it starts, 0600, to
+`/var/lib/llmgw/admin-token` under its systemd unit (`admin_token_file`
+moves it; a server run by hand keeps it in `secrets/admin-token` beside its
+configuration). `llmgw ctl` reads it from there, which is why it runs with
+sudo, or from `LLMGW_ADMIN_TOKEN`. To give it to automation:
+
+```sh
+sudo cat /var/lib/llmgw/admin-token
+```
+
+The token is the whole of the API's authorisation: whoever holds it can do
+everything the API does. Keep it where you keep other root credentials.
+
+## What a request must look like
+
+Besides the token, the listener refuses three things before a handler sees
+them, as defences against a browser being turned against it:
+
+- **A name in `Host`.** The listener answers to an address or `localhost`,
+  not a DNS name, so a page on some other site cannot reach it by rebinding
+  a name to 127.0.0.1. Call it as `http://127.0.0.1:9090`, not
+  `http://cp.example.com:9090`; behind a proxy, have the proxy send an
+  address.
+- **A cross-site request.** One whose `Origin` is another host, or whose
+  `Sec-Fetch-Site` says another site sent it.
+- **A change that is not JSON.** Every method but `GET` and `HEAD` must carry
+  `Content-Type: application/json`, even a `DELETE` or a `POST` with no body.
+  A form post from a page cannot set that header.
+
+A change is recorded in the audit log with who made it, as the request says
+in `X-Llmgw-Actor` (letters, digits and `._-@`, at most 64; `unknown` when
+absent). `llmgw ctl` sends the name of whoever ran it; automation should send
+its own, `terraform` or `ci@deploy`, so `llmgw ctl audit` can tell them apart.
+
+A refusal is a 4xx or 5xx with `{"error": "…"}` saying why. 501 means this
+control plane lacks what the endpoint needs — a store, a mirror, guard
+policies — and says which.
+
+## Some calls
+
+```sh
+H=(-H "Authorization: Bearer $LLMGW_ADMIN_TOKEN" -H "Content-Type: application/json" -H "X-Llmgw-Actor: $USER")
+API=http://127.0.0.1:9090/api/v1
+
+# The fleet in one answer, and every model.
+curl -s "${H[@]}" $API/summary
+curl -s "${H[@]}" $API/models
+
+# Add a model, read back its definition with the defaults filled in, scale it.
+curl -s "${H[@]}" -X POST $API/models -d '{
+  "name": "qwen-small",
+  "source": "/srv/models/qwen2.5-1.5b-instruct-q4_k_m.gguf",
+  "profiles": [{"name": "cpu", "engine": "llamacpp", "min_memory_gb": 4, "cpu_cores": 4}],
+  "scaling": {"min": 1, "max": 2}
+}'
+curl -s "${H[@]}" $API/models/qwen-small
+curl -s "${H[@]}" -X POST $API/models/qwen-small/scale -d '{"min": 0, "max": 2, "idle_timeout": 1800000000000}'
+
+# A team's capacity quota.
+curl -s "${H[@]}" -X PUT $API/quotas -d '{"scope": "team:Acme/ml", "limit": {"gpus": 8}}'
+
+# Remove the model; a DELETE carries the content type too.
+curl -s "${H[@]}" -X DELETE $API/models/qwen-small
+```
+
+Durations in bodies are integer nanoseconds, as Go encodes them: half an hour
+is `1800000000000`.
+
+## The description
+
+The API is described in OpenAPI 3.1:
+
+- served by every control plane at `GET /api/v1/openapi.json` (with the
+  token, like the rest), as built into that binary, so it describes the
+  server you are talking to;
+- committed as [admin-api.openapi.json](admin-api.openapi.json) for reading
+  without a cluster.
+
+```sh
+curl -s "${H[@]}" $API/openapi.json > llmgw-admin.json
+```
+
+It lists every endpoint, its path and query parameters, and the schema of
+each request and answer, with the meaning of each field. Load it into any
+OpenAPI tool — Swagger UI, Redoc, an editor — or generate a client from it:
+
+```sh
+docker run --rm -v "$PWD:/w" openapitools/openapi-generator-cli generate \
+  -i /w/llmgw-admin.json -g python -o /w/llmgw-admin-client
+```
+
+### How it is kept true
+
+The document is generated, not written. `internal/control/adminapi/routes.go`
+holds a table of every endpoint: its method and path, a summary, its query
+parameters, and Go values of the types it reads and answers with. The
+generator in `internal/docgen/openapi` reads those types by reflection, the
+way `encoding/json` encodes them, and takes each field's description from its
+comment in the source.
+
+Two tests keep it from drifting. One registers the API on a recording mux and
+fails when an endpoint is served and not in the table, or in the table and not
+served. The other regenerates the document and fails when it differs from the
+committed one. After changing an endpoint or a type it carries:
+
+```sh
+go generate ./internal/docgen
+```
+
+## What it does not cover
+
+- **Organizations, teams, projects, people and API keys.** These live in the
+  store and are managed with `llmgw org`, `llmgw users` and `llmgw keys` on the
+  control plane, or in the web console's `/admin` pages on the client port
+  behind a session. The admin API reads the tree only where a quota or a
+  policy names a part of it.
+- **The client-facing API** (`/v1/chat/completions` and the rest), which is
+  OpenAI's and Anthropic's, on `listen`, with API keys.
+- **The rest of the admin listener**: `/metrics`, `/health`, the dashboard
+  pages and `/debug/pprof`, which are not under `/api`.

docs/choosing-models.md

@@ -141,7 +141,7 @@ not count the same free terabyte once per node.
 Set budgets and limits on day one, not later:
 
 ```
-llmgw keys limits --scope project --id <project> --rpm 60 --budget 50000000
+llmgw keys limits --scope project --id <project> --rpm 60 --budget 50
 ```
 
 The reason is not technical. A resource that appears free and unlimited becomes,

docs/clients.md

@@ -0,0 +1,548 @@
+# Using llmgw from code
+
+Written for a developer whose program talks to a model through llmgw. There
+is no llmgw SDK, and there will not be one: the gateway speaks OpenAI's API
+and Anthropic's Messages API, so the official SDKs for both work as they are.
+Only two things change — the base URL and the key. Everything llmgw adds on
+top is an HTTP header, which every one of those SDKs lets you set.
+
+The examples use `https://llm.example.com` for the gateway; use the address
+your operator gave you, or the one on the gateway's own front page. Every
+example reads the key from `LLMGW_API_KEY`. `<model-name>` is a model this
+gateway serves: `GET /v1/models` lists the ones your key may use, and sending
+the placeholder unchanged is answered with that list rather than with an
+error.
+
+## Getting a key
+
+Keys are made on the gateway's **Account** page after signing in, or issued
+by an operator. A key is shown once and never again — only its hash is kept —
+so put it in a password manager straight away. `GET /me` with the key says
+what it may do and what it has spent.
+
+## The base URL and the key
+
+| SDK | Base URL | Key |
+|---|---|---|
+| OpenAI (any language) | `https://llm.example.com/v1` | `Authorization: Bearer …`, as the SDK sends it |
+| Anthropic (any language) | `https://llm.example.com` — the SDK adds `/v1/messages` | `x-api-key: …`, as the SDK sends it |
+
+Both SDKs also read their usual environment variables, so a program that
+already uses them needs no change at all:
+
+```
+export OPENAI_BASE_URL=https://llm.example.com/v1
+export OPENAI_API_KEY=$LLMGW_API_KEY
+
+export ANTHROPIC_BASE_URL=https://llm.example.com
+export ANTHROPIC_API_KEY=$LLMGW_API_KEY
+```
+
+## A first request
+
+### curl
+
+```
+curl https://llm.example.com/v1/chat/completions \
+  -H "Authorization: Bearer $LLMGW_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"model": "<model-name>",
+       "messages": [{"role": "user", "content": "Say hello in Turkish."}]}'
+```
+
+### Python
+
+```
+pip install openai
+```
+
+```python
+import os
+from openai import OpenAI
+
+client = OpenAI(base_url="https://llm.example.com/v1",
+                api_key=os.environ["LLMGW_API_KEY"])
+
+reply = client.chat.completions.create(
+    model="<model-name>",
+    messages=[{"role": "user", "content": "Say hello in Turkish."}],
+)
+print(reply.choices[0].message.content)
+```
+
+### TypeScript
+
+```
+npm install openai
+```
+
+```typescript
+import OpenAI from "openai";
+
+const client = new OpenAI({
+  baseURL: "https://llm.example.com/v1",
+  apiKey: process.env.LLMGW_API_KEY,
+});
+
+const reply = await client.chat.completions.create({
+  model: "<model-name>",
+  messages: [{ role: "user", content: "Say hello in Turkish." }],
+});
+console.log(reply.choices[0].message.content);
+```
+
+### Go
+
+```
+go get github.com/openai/openai-go/v3
+```
+
+```go
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"os"
+
+	"github.com/openai/openai-go/v3"
+	"github.com/openai/openai-go/v3/option"
+)
+
+func main() {
+	client := openai.NewClient(
+		option.WithBaseURL("https://llm.example.com/v1/"),
+		option.WithAPIKey(os.Getenv("LLMGW_API_KEY")),
+	)
+	reply, err := client.Chat.Completions.New(context.Background(), openai.ChatCompletionNewParams{
+		Model:    "<model-name>",
+		Messages: []openai.ChatCompletionMessageParamUnion{openai.UserMessage("Say hello in Turkish.")},
+	})
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Println(reply.Choices[0].Message.Content)
+}
+```
+
+The import path carries the SDK's major version; use the one your module
+already has.
+
+## Streaming
+
+Set `stream` and read the chunks. llmgw may send a last chunk that carries
+only the token counts and no choices, so check for a choice before reading
+one — the OpenAI API does the same when usage is asked for.
+
+```python
+stream = client.chat.completions.create(
+    model="<model-name>",
+    messages=[{"role": "user", "content": "Count to ten."}],
+    stream=True,
+)
+for chunk in stream:
+    if chunk.choices and chunk.choices[0].delta.content:
+        print(chunk.choices[0].delta.content, end="", flush=True)
+print()
+```
+
+```typescript
+const stream = await client.chat.completions.create({
+  model: "<model-name>",
+  messages: [{ role: "user", content: "Count to ten." }],
+  stream: true,
+});
+for await (const chunk of stream) {
+  process.stdout.write(chunk.choices[0]?.delta?.content ?? "");
+}
+```
+
+```go
+stream := client.Chat.Completions.NewStreaming(ctx, openai.ChatCompletionNewParams{
+	Model:    "<model-name>",
+	Messages: []openai.ChatCompletionMessageParamUnion{openai.UserMessage("Count to ten.")},
+})
+for stream.Next() {
+	chunk := stream.Current()
+	if len(chunk.Choices) > 0 {
+		fmt.Print(chunk.Choices[0].Delta.Content)
+	}
+}
+if err := stream.Err(); err != nil {
+	log.Fatal(err)
+}
+```
+
+With curl, add `"stream": true` to the body and `-N` so curl prints the
+events as they come.
+
+## Tools
+
+Function calling is OpenAI's: describe the tools, run the ones the model
+asks for, send the results back. Whether a model calls tools well is the
+model's business, not the gateway's; ask your operator which of the served
+models are set up for it.
+
+```python
+import json
+
+tools = [{
+    "type": "function",
+    "function": {
+        "name": "get_weather",
+        "description": "The current weather in a city.",
+        "parameters": {
+            "type": "object",
+            "properties": {"city": {"type": "string"}},
+            "required": ["city"],
+        },
+    },
+}]
+
+messages = [{"role": "user", "content": "Is it raining in Ankara?"}]
+reply = client.chat.completions.create(model="<model-name>", messages=messages, tools=tools)
+msg = reply.choices[0].message
+
+if msg.tool_calls:
+    messages.append(msg)
+    for call in msg.tool_calls:
+        args = json.loads(call.function.arguments)
+        result = {"city": args["city"], "raining": False}  # your code here
+        messages.append({"role": "tool", "tool_call_id": call.id,
+                         "content": json.dumps(result)})
+    reply = client.chat.completions.create(model="<model-name>", messages=messages, tools=tools)
+
+print(reply.choices[0].message.content)
+```
+
+## Embeddings
+
+```python
+result = client.embeddings.create(
+    model="<embedding-model>",
+    input=["llmgw routes requests", "to GPUs it can reach"],
+)
+vectors = [d.embedding for d in result.data]
+```
+
+```typescript
+const result = await client.embeddings.create({
+  model: "<embedding-model>",
+  input: ["llmgw routes requests", "to GPUs it can reach"],
+});
+const vectors = result.data.map((d) => d.embedding);
+```
+
+An embedding model is a model of its own; a chat model does not answer
+`/v1/embeddings`.
+
+## The Responses API
+
+`/v1/responses` is served too, for clients that speak nothing else (Codex
+among them). llmgw translates it to chat completions, so it works with every
+model the gateway serves; what has no equivalent there — OpenAI's hosted
+tools, reasoning summaries — is ignored rather than refused.
+
+```python
+response = client.responses.create(
+    model="<model-name>",
+    instructions="Answer in one sentence.",
+    input="Why is the sky blue?",
+)
+print(response.output_text)
+```
+
+Streamed, the events are the Responses API's own:
+
+```python
+stream = client.responses.create(model="<model-name>", input="Count to ten.", stream=True)
+for event in stream:
+    if event.type == "response.output_text.delta":
+        print(event.delta, end="", flush=True)
+```
+
+## Batches
+
+For work that need not finish now: OpenAI's Files and Batch APIs. A batch runs
+at the lowest priority, so it uses what interactive traffic leaves free, and
+each line is counted against the key that submitted it.
+
+```python
+import json
+
+with open("requests.jsonl", "w") as f:
+    for i, text in enumerate(["first document", "second document"]):
+        f.write(json.dumps({
+            "custom_id": f"doc-{i}",
+            "method": "POST",
+            "url": "/v1/chat/completions",
+            "body": {"model": "<model-name>",
+                     "messages": [{"role": "user", "content": "Summarise: " + text}]},
+        }) + "\n")
+
+batch_file = client.files.create(file=open("requests.jsonl", "rb"), purpose="batch")
+batch = client.batches.create(
+    input_file_id=batch_file.id,
+    endpoint="/v1/chat/completions",
+    completion_window="24h",
+)
+
+# Later:
+batch = client.batches.retrieve(batch.id)
+if batch.status == "completed":
+    for line in client.files.content(batch.output_file_id).text.splitlines():
+        result = json.loads(line)
+        print(result["custom_id"], result["response"]["body"]["choices"][0]["message"]["content"])
+```
+
+## The Anthropic SDK
+
+`/v1/messages` is Anthropic's Messages API, translated to chat completions and
+back, streamed or not, with tools and images. It serves the gateway's own
+models — `model` is a model this gateway serves, not a Claude model.
+
+```
+pip install anthropic
+```
+
+```python
+import os
+import anthropic
+
+client = anthropic.Anthropic(base_url="https://llm.example.com",
+                             api_key=os.environ["LLMGW_API_KEY"])
+
+message = client.messages.create(
+    model="<model-name>",
+    max_tokens=1024,
+    messages=[{"role": "user", "content": "Say hello in Turkish."}],
+)
+print(message.content[0].text)
+
+with client.messages.stream(
+    model="<model-name>",
+    max_tokens=1024,
+    messages=[{"role": "user", "content": "Count to ten."}],
+) as stream:
+    for text in stream.text_stream:
+        print(text, end="", flush=True)
+```
+
+```typescript
+import Anthropic from "@anthropic-ai/sdk";
+
+const client = new Anthropic({
+  baseURL: "https://llm.example.com",
+  apiKey: process.env.LLMGW_API_KEY,
+});
+
+const message = await client.messages.create({
+  model: "<model-name>",
+  max_tokens: 1024,
+  messages: [{ role: "user", content: "Say hello in Turkish." }],
+});
+for (const block of message.content) {
+  if (block.type === "text") console.log(block.text);
+}
+```
+
+```go
+client := anthropic.NewClient(
+	option.WithBaseURL("https://llm.example.com/"),
+	option.WithAPIKey(os.Getenv("LLMGW_API_KEY")),
+)
+message, err := client.Messages.New(ctx, anthropic.MessageNewParams{
+	Model:     "<model-name>",
+	MaxTokens: 1024,
+	Messages: []anthropic.MessageParam{
+		anthropic.NewUserMessage(anthropic.NewTextBlock("Say hello in Turkish.")),
+	},
+})
+if err != nil {
+	log.Fatal(err)
+}
+for _, block := range message.Content {
+	if text, ok := block.AsAny().(anthropic.TextBlock); ok {
+		fmt.Println(text.Text)
+	}
+}
+```
+
+(`github.com/anthropics/anthropic-sdk-go` and its `option` package.)
+
+With curl:
+
+```
+curl https://llm.example.com/v1/messages \
+  -H "x-api-key: $LLMGW_API_KEY" \
+  -H "anthropic-version: 2023-06-01" \
+  -H "Content-Type: application/json" \
+  -d '{"model": "<model-name>", "max_tokens": 1024,
+       "messages": [{"role": "user", "content": "Say hello in Turkish."}]}'
+```
+
+## What llmgw adds
+
+Each is a header, so a request stays exactly what the SDK would send anywhere
+else. Set one for every request on the client, or for one request:
+
+| | Every request | One request |
+|---|---|---|
+| Python (both SDKs) | `OpenAI(..., default_headers={...})` | `create(..., extra_headers={...})` |
+| TypeScript (both SDKs) | `new OpenAI({ ..., defaultHeaders: {...} })` | `create({...}, { headers: {...} })` |
+| Go (both SDKs) | `openai.NewClient(..., option.WithHeader(k, v))` | `New(ctx, params, option.WithHeader(k, v))` |
+| curl | | `-H "k: v"` |
+
+### Stored conversations: `x-llmgw-thread`
+
+Send the same thread id with each request and only the new turn; llmgw puts
+the stored conversation in front of it. The conversation continues on
+whichever model serves the next turn, even a different one. It must be
+turned on for your project by an operator (`llmgw keys threads`); a request
+that names a thread on a gateway that keeps none is refused rather than
+answered without its history.
+
+```python
+import uuid
+
+thread = str(uuid.uuid4())  # anyone in your project who knows it reads it
+for turn in ["My name is Deniz.", "What is my name?"]:
+    reply = client.chat.completions.create(
+        model="<model-name>",
+        messages=[{"role": "user", "content": turn}],
+        extra_headers={"x-llmgw-thread": thread},
+    )
+    print(reply.choices[0].message.content)
+```
+
+A thread belongs to the project, not to the key, so use an id nobody can
+guess: at most 128 letters, digits and `- _ . :`. When the conversation no
+longer fits the model, the oldest turns are left out and the reply carries
+`x-llmgw-thread-trimmed` with how many. `DELETE /v1/threads/{id}` forgets one:
+
+```
+curl -X DELETE https://llm.example.com/v1/threads/$THREAD \
+  -H "Authorization: Bearer $LLMGW_API_KEY"
+```
+
+### Sessions: `x-session-id`
+
+Requests with the same session id go to the same replica while it is
+healthy, so a conversation that resends its history finds it already in that
+replica's cache and answers sooner. Without the header, the body's `user`
+field is used. Nothing is stored; it is only a routing hint.
+
+```python
+client = OpenAI(base_url="https://llm.example.com/v1", api_key=os.environ["LLMGW_API_KEY"],
+                default_headers={"x-session-id": "chat-7f3a"})
+```
+
+### Tags and metadata
+
+Requests can be labelled so the usage they record can be told apart — by
+feature, by customer, by job. Send OpenAI's own `metadata`, string keys to
+string values, or the same as the `x-llmgw-tags` header for a client that
+cannot set `metadata`; the `user` field is recorded too. Which tags also
+become metric labels is the operator's choice (`router.tag_labels`).
+
+```python
+reply = client.chat.completions.create(
+    model="<model-name>",
+    messages=[{"role": "user", "content": "Classify this ticket."}],
+    metadata={"feature": "triage", "customer": "acme"},
+    user="user-1234",
+)
+```
+
+```
+curl https://llm.example.com/v1/chat/completions \
+  -H "Authorization: Bearer $LLMGW_API_KEY" \
+  -H "x-llmgw-tags: feature=triage,customer=acme" \
+  -H "Content-Type: application/json" \
+  -d '{"model": "<model-name>", "messages": [{"role": "user", "content": "Classify this ticket."}]}'
+```
+
+### Canaries: `x-llmgw-variant`
+
+While an operator tries a model's newer weights on a share of its traffic, a
+session stays on one side. `x-llmgw-variant: canary` sends a request to the
+canary deliberately — to try it before it is promoted, or to compare the two.
+
+```python
+reply = client.chat.completions.create(
+    model="<model-name>",
+    messages=[{"role": "user", "content": "hello"}],
+    extra_headers={"x-llmgw-variant": "canary"},
+)
+```
+
+### Memory notes: `/v1/memory`
+
+Notes an agent keeps for itself across conversations: a key, some text, and
+optional tags, private to your project and to the agent named in
+`x-llmgw-agent` (`default` when it is not sent). An operator turns them on for
+a project (`llmgw keys memory`). They are plain REST, so any HTTP client
+will do:
+
+```
+H="Authorization: Bearer $LLMGW_API_KEY"
+
+curl -X PUT https://llm.example.com/v1/memory/favourite-colour -H "$H" \
+  -H "x-llmgw-agent: helper" -H "Content-Type: application/json" \
+  -d '{"text": "The user likes dark green.", "tags": ["preference"]}'
+
+curl "https://llm.example.com/v1/memory?q=green" -H "$H" -H "x-llmgw-agent: helper"
+curl "https://llm.example.com/v1/memory?tag=preference" -H "$H" -H "x-llmgw-agent: helper"
+curl https://llm.example.com/v1/memory/favourite-colour -H "$H" -H "x-llmgw-agent: helper"
+curl -X DELETE https://llm.example.com/v1/memory/favourite-colour -H "$H" -H "x-llmgw-agent: helper"
+```
+
+A key is up to 200 bytes, a note up to 16 KiB, with at most 16 tags of
+lowercase letters, digits, `-` and `_`, and 1000 notes per agent.
+
+### MCP: `/mcp`
+
+The same notes as tools an agent can be given — `remember`, `recall` and
+`forget` — from an MCP server at `https://llm.example.com/mcp` (the HTTP
+transport, answered as plain JSON). Add it to your agent's MCP servers with
+the key as a bearer token and, if you want notes kept apart, `x-llmgw-agent`.
+llmgw does not put these tools into requests by itself: an agent that is not
+given the server never sees its notes.
+
+```
+curl https://llm.example.com/mcp \
+  -H "Authorization: Bearer $LLMGW_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/list"}'
+```
+
+### Headers llmgw sends back
+
+| Header | Says |
+|---|---|
+| `x-request-id` | The request's id in the gateway's logs and usage records — quote it when asking an operator about a request. |
+| `x-llmgw-served-model` | The model that answered, when it was not the one asked for: a spent budget can move a request to a cheaper model. |
+| `x-llmgw-queue-ms` | How long the request waited for room before it was sent. |
+| `x-llmgw-thread-trimmed` | How many stored turns were left out to fit the model. |
+
+## When something is refused
+
+Errors come back in the shape of the API that was called — OpenAI's
+`{"error": {"message": …, "type": …}}` or Anthropic's — so each SDK raises
+its usual exception with the gateway's message in it. The ones worth knowing:
+
+| Status | Usually means |
+|---|---|
+| 400 | Besides a malformed request: a prompt too long for the model, or a guardrail policy refused it (the code `content_policy_violation`). |
+| 401 | No key, a mistyped one, or one that was revoked or has expired. |
+| 403 | The key may not use that model. |
+| 429 | A rate limit or budget of the key, its project or its team was reached. `Retry-After` says when to try again, and is absent when waiting will not help — a spent monthly budget. |
+| 503 | No model of that name is served (the message lists the ones that are), the model is still loading, or every replica is busy and the request waited as long as it may. The SDKs retry by themselves; a name that is not served will not start to be. |
+
+## Priority
+
+With keys on, the key decides the request's priority band and routing
+profile, set by an operator; the `x-llmgw-band` and `x-llmgw-profile` headers
+are ignored, so a client cannot promote itself. On a gateway without keys
+they are read from the request.

docs/console.md

@@ -0,0 +1,321 @@
+# The console
+
+`sudo llmgw`, with nothing after it, on a machine llmgw runs on. On a machine
+with nothing installed it opens the setup screens; on a control plane, the
+console described here; on a node, the node's own console, which edits
+`agent.yaml`. Everything on these screens can also be done by command — each
+screen says which — so a script never needs them and a person never needs
+to remember the commands.
+
+The keyboard drives it; there is no mouse. **?** opens this page from
+anywhere, and the **Manual** entry holds every other page, as `llmgw docs`
+does without the console.
+
+## The layout
+
+A bar across the top names the machine. Down the left, the entries, in four
+groups: **Watch**, **People**, **Help**, **Settings** and **Do**. The panel on
+the right shows the entry chosen. The bottom line always says which keys do
+what at that moment, and a question or a result opens as a dialog over the
+panel.
+
+| Key | Does |
+|---|---|
+| ↑ ↓ | Choose an entry, or a row in the panel |
+| → or Enter | Go into the panel |
+| Enter on a row | What can be done to it: its details first, then the rest |
+| ← or Esc | Back out: from a page to its list, from the panel to the entries |
+| A | Add one, on a view that holds things: a quota, an account, a key |
+| PgUp PgDn | Scroll a long panel |
+| ? | This page |
+| Q | Leave; the cluster keeps running |
+| Ctrl-C | Leave at once |
+
+What is watched is read again every three seconds.
+
+## Forms and questions
+
+A change that needs values opens a form, filled in with what is set now. Tab
+or ↓ moves to the next field, ← → changes a choice, and Enter on **Apply**
+sends it; a form of one field is sent by Enter on it. A mistake the form can
+see — a maximum below the minimum, a word where a number goes — is said in the
+form and nothing is sent. One the control plane refuses comes back as a dialog
+with its reason, word for word.
+
+Anything that cannot be undone — removing, draining, deleting, revoking —
+asks first, and only **Y** goes ahead.
+
+Serving a model and moving one to new weights are jobs on the control plane:
+started from here, they run there in the background whatever this screen
+does, and the console is free at once. **Jobs** follows them. Upgrading the
+cluster, a backup and adding a node change this machine or another over ssh;
+those close the screen and run in the terminal, so their output is there to
+read, and Enter brings the console back.
+
+## Setting up
+
+On a machine with nothing installed, the control plane is set up from one
+form (`sudo llmgw server init`): the administrator's email, other names nodes
+reach the machine by, and ticks for PostgreSQL, the model mirror, this machine
+as a node, the starter model and the guardrails' judge. **Offline bundle**
+and **Its sha256** are for a site with no internet: the path of a bundle made
+by `llmgw bundle create`, and the sha256 it printed. Given, the bundle goes
+into the mirror, every file checked, and the cluster is set up to fetch
+nothing from outside (install.md, "Offline sites"). A bundle with no sha256,
+or with the mirror unticked, is said in the form and nothing starts.
+
+## Watch
+
+**Overview** is `llmgw ctl status`: nodes, GPUs by class, fabrics, replicas,
+models, the store's members, and anything parked, unplaced or idle.
+
+**Monitor** draws the cluster the way btop draws a machine: CPU, memory,
+GPU busy and GPU memory, requests and tokens a second, time to first token,
+requests in flight and queued, network and disk — Braille charts, filled
+and coloured green to red by height — over 5 minutes, an hour, a day or a
+week (**1**–**4**, or **R** for the next). Below them each node's CPU,
+memory and network now and as a sparkline, each card's busy, memory, heat
+and power, and each model's requests a second. The history comes from the
+Prometheus named by `monitoring.prometheus` in server.yaml; without one the
+charts draw what this console has seen since it opened, and say so. Network
+and disk come from each machine's node exporter, which `llmgw node add`
+installs. **N** sends a test notification to each webhook in server.yaml's
+`notify` section and says how each answered (`llmgw ctl notify test`). A node's and a model's own pages have their charts too, over the
+same range.
+
+**Nodes** lists every node with its state, where it is (its rack, or row,
+room or site, and PDUs), load, GPUs, replicas, disk and agent version. A node
+in a held rack reads *ready, held*. On a row:
+
+- **Details** — its address, location and any hold, system, load, engines and
+  GPUs, and any warning.
+- **Cordon** places nothing new on it; **Uncordon** undoes it.
+- **Location…** sets its site, room, row, rack and PDUs (the `llmgw.io/`
+  labels), which placement spreads replicas across.
+- **Hold rack …** places nothing new in the node's rack, and can drain it;
+  **Release …** on a node in a held domain undoes it. See
+  [facility-aware-placement.md](facility-aware-placement.md).
+- **Drain** moves its replicas off one at a time, each replacement up before
+  the original stops.
+- **vllm build / sglang build** (nodes with GPUs) — which build of the engine
+  the node installs: `auto` follows its hardware, `none` installs none.
+- **Upgrade its agent** to a release; its engines keep serving.
+- **Delete model files nothing uses** frees the node's disk.
+- **Remove from the cluster** — the control plane forgets it; the machine is
+  not touched.
+
+**GPUs** is every card: how busy, its memory, temperature, power, and the
+model holding it.
+
+**Models** lists the catalog: ready against wanted, status, class, profiles,
+and **UPDATE** when the registry has new weights for it. On a row:
+
+- **Details** — description, replicas, class, owner, profiles, source, where
+  its weights came from, what it reserves against what it uses, and its
+  replicas.
+- **Replicas (scale)** — the minimum kept running, the most it scales to,
+  and for a model loaded on demand how long it may sit unused. A maximum of
+  0 stops it.
+- **Class** — critical, standard or opportunistic: whose capacity gives way
+  when there is not enough for everyone.
+- **Owner** — the organization, team or project whose capacity quota it
+  counts against.
+- **Resources** — the memory and cores one replica reserves on its node.
+- **LoRA adapters** — `name=source[@scale]`, separated by commas.
+- **Restart its replicas**, one by one or in place.
+- **Update to …** — when the repository it came from has published different
+  weights for its files: they are fetched into the mirror beside the ones in
+  use, checked, swapped in, and the replicas replaced one at a time.
+  **Go back to …** returns to the weights the update replaced.
+  **Ask the registry for new weights now** checks without waiting for the
+  next scheduled look (`mirror.update_check`, six hours by default).
+- **Try the new weights as a canary…** — instead of swapping them in, runs
+  them beside the model as `MODEL-canary`, one replica, given the share of
+  its requests you choose. With a canary running the menu has **Canary's
+  share…**, **Promote the canary…** (the model moves to its weights, the
+  canary is removed) and **Take the canary out…**. A canary that errs or
+  answers more slowly than the model is taken out by itself. The MODEL
+  column shows `(10% to canary)` and `(canary of …)`.
+- **Ask it a quality suite…** — one of the suites the control plane has (in
+  `control.eval_dir`, or built in: `arithmetic`, `json-format`), asked
+  through the router; the dialog counts the answers as they come in, then
+  shows the score, each case and the model's last runs. Esc stops watching;
+  the run carries on and is kept. **Its quality runs** lists them, as
+  `llmgw ctl eval --history` does.
+- **Hold its updates to a quality suite…** — the suite and score its new
+  weights must reach before an update or a promotion moves it to them
+  (`llmgw ctl model gate`); **none** takes it away. With one set, **Update
+  to …** and **Promote the canary…** say so.
+- **Why is it placed where it is** — `llmgw ctl explain-placement`.
+- **Try again**, for a model parked after failing every start.
+- **Remove** — its replicas stop and it leaves the catalog. A model from
+  `server.yaml` is changed there instead; the console says so.
+
+**A** on Models adds one from a definition file on this machine: the YAML a
+model takes in `server.yaml`.
+
+**Replicas** lists every replica; on one, **Restart it**, replaced or in
+place.
+
+**Usage** is the last 24 hours by team, project or organization (→ changes
+which): requests, tokens, errors and spend.
+
+**Quotas** are capacity quotas: the GPUs, cores and memory each organization,
+team or project is guaranteed and may at most hold, and what it holds now.
+**A** adds one; on a row, change or remove it.
+
+**Mirror** is what the model mirror holds, one row for each version of each
+model — a file, or the set of files a model of several is: shards, a vision
+projector, a config and tokenizer — with how far its download has got and
+which models use it. **A** downloads a URL into it; **I** imports a model
+from an Ollama on this machine into a mirror directory on this machine — the
+mirror beside the control plane — and shows the model definition to add for
+it (a mirror elsewhere: `llmgw mirror import-ollama` there); on a row, its files with
+their checksums and where each was fetched from, the source a model
+definition names for it, or remove it — with a warning when a model still
+uses it.
+
+**Jobs** lists the models being served or updated since the control plane
+started: what each is doing now — the download's progress, a replica
+starting — and whether it ended done, failed, or waiting for room on busy
+cards. The entry shows how many are running. Enter on one shows its steps.
+`llmgw ctl jobs` is the same, and `llmgw ctl jobs ID` follows one.
+
+**Logs** shows a node's agent log, newest at the bottom, errors and warnings
+coloured.
+
+## People
+
+The accounts, keys and organizations live in the store; these views read it
+and change it with the same commands as `llmgw users`, `llmgw keys` and
+`llmgw org`, so their checks and messages are the ones shown.
+
+**Accounts** — who has signed up, their state, whether they see the cluster
+dashboard, and what they belong to. **A** creates an account, already
+approved. On a row: approve one waiting, suspend or reinstate, give or take
+the cluster dashboard, add to or take out of an organization, team or
+project, their limits, a new password (their sessions close), delete, and
+**Forget them…** for a request to be forgotten (`llmgw users forget`).
+
+**API keys** — every key, its project, owner, state and last use. **A**
+issues one; the key is shown once, in the result, and never again. On a row:
+its limits, **Rotate…** — a new key with the same project, owner and limits,
+the old one working on for the overlap you give (`llmgw keys rotate`) — or
+revoke it.
+
+**Accounts** rows also have **Staff role…**:
+- `viewer` looks at every page under /admin and changes nothing;
+- `operator` also runs the cluster from them (models through the mirror, a
+  node's engines);
+- `billing` sees usage and quotas;
+- `admin` may do anything.
+
+The STAFF column shows each person's role.
+
+On **Usage**, **E** exports usage as CSV to a file on the control plane:
+by hour, day or month and any of organization, team, project, user, key and
+model.
+
+**Audit** lists every change of the last week — through `ctl`, this console
+or the /admin pages, and people's own keys and passwords — with who made
+it, through what, and how it ended. Enter shows the fields it was given,
+with anything secret taken out. `llmgw ctl audit` is the same, with filters.
+
+**Organizations** — the tenancy tree: organizations, their teams, the teams'
+projects, with members, keys and limits. **A** adds an organization. On a
+row: add a team or project inside it, rename, move, limits for the level and
+for each of its members, its capacity quota, and for a project how long
+conversations and agent notes are kept, and whether its requests are
+(**Keep requests…**: for how long, and what share), and whether they stay in
+the cluster (**Requests stay in the cluster…**: never an outside provider),
+and whether the same request is answered again from memory (**Cache
+answers…**: for how long, and whether only reproducible answers or any). **Longest key lifetime…** caps how
+long a key made there may live, and is the expiry of one made without any
+(`llmgw keys ttl`; `auth.max_key_ttl` in server.yaml caps every key).
+**Remove** takes away only something empty.
+
+Limits are requests and tokens a minute, a budget per day or month, and the
+models allowed. Each level only narrows what is above it.
+
+**Guardrails…** on a row lists the guardrail policies server.yaml defines.
+Each policy is marked in one of three ways:
+
+- attached here (✓): Enter detaches it;
+- applying from above (·): from everywhere, or from the organization or
+  team named;
+- neither: Enter attaches it.
+
+The **GUARDRAILS** column names those attached to the row itself. Policies
+narrow like limits; see [guardrails.md](guardrails.md).
+
+## Help
+
+**Manual** lists every page there is: these, the installation and operation
+guides, the configuration reference, a page for every command, the README
+and the changes in each release. On a page:
+
+| Key | Does |
+|---|---|
+| ↑ ↓, PgUp PgDn, Space | Scroll |
+| g, G | The top, the end |
+| T | Contents: the page's headings, Enter goes to one |
+| / | Find; the lines holding it are marked |
+| n, N | The next match, the one before |
+| [ ] | The topic before, the one after |
+| ← | Back to the list |
+
+`llmgw docs` opens the same manual outside the console, on any machine,
+installed or not; `llmgw docs install` opens one page; piped, it prints the
+page's text.
+
+## Settings
+
+**server.yaml** (on a node, **agent.yaml**) is every key of the file, as a
+tree of menus built from the configuration reference: the value set, or the
+one that applies when nothing is, its type, and what it is for. Enter changes
+a value or opens a block; on a list or map of blocks, Enter opens an entry and
+**D** removes one. **U** puts a key back to its default. **S** saves: the file
+is checked the way the service reads it before anything is written, and its
+comments are kept. The service reads it when it starts, so the console offers
+to restart it. Another control plane keeps its own copy.
+
+## Do
+
+- **Add a node** — installs llmgw on a machine over ssh, checks it, gives it a
+  certificate and starts its agent (`sudo llmgw node add`).
+- **Replicate the store** — moves the store onto two more machines under
+  Patroni (offered only while it is not replicated).
+- **Serve a model** — Hugging Face's models: trending, most downloaded,
+  most liked or newest (**S** changes which), or **/** to search. **F**
+  switches between GGUF files, which llama.cpp runs on the CPU or a GPU, and
+  original safetensors weights, which vLLM runs on GPUs. Enter on a
+  repository plans it against the cluster as it is, before anything is
+  fetched: the model's shape is read from one file's header, or its
+  config.json, and every file is listed with the best way it runs here — on
+  one card, on several of a node's cards, across several nodes' cards over a
+  fabric (original weights only), or on a CPU node — what each card or node
+  would hold, and whether that hardware is free now. The file that suits the
+  cluster best is first, marked ★; one that fits nowhere says so. Busy is not
+  unfit: which file is best follows the hardware the cluster has, not what it
+  is running, so a file for a card that is in use is still offered for it —
+  served, it waits for the card, or with a fallback runs elsewhere until then. Choosing a
+  file offers every way it fits, best first, and what to do when that one is
+  busy: the next best way, written as a lower-priority profile so placement
+  falls back to it, or wait. A vision model offers its projector too, fetched
+  beside it and loaded with it so the model reads images. What is chosen is
+  fetched into the mirror, checked, added to the catalog and started, and a
+  replica is asked to say hello (`llmgw ctl model serve`; the plan alone is
+  `llmgw ctl model plan`).
+  `mirror.registry` points it at another registry, for a site without the
+  internet.
+- **Upgrade the cluster** to a release: this machine, then every node in turn
+  (`sudo llmgw ctl upgrade`).
+- **Restart all replicas**, one at a time.
+- **Back up now** — the store and `/etc/llmgw` into one archive
+  (`sudo llmgw server backup`).
+- **Leave**.
+
+## The node's console
+
+On a node, `sudo llmgw` opens `agent.yaml` in the same settings view, and the
+manual. The cluster is watched and changed from a control plane.

docs/data.md

@@ -16,20 +16,38 @@ who made a request, when, how many tokens, and what it cost.
 Two features change that, and both are off until somebody turns them on for a
 named project, and neither can be turned on without also saying for how long.
 
-Nothing on the serving path leaves the cluster.
+Nothing on the serving path leaves the cluster — **unless the catalog has a
+model served outside it** (`external:` in a model definition): a request for
+that model, or one that falls back to it, sends its prompt to that provider.
+A guardrail policy with `no_store` refuses both for the scopes it covers.
+
+**Guardrails** read every prompt and answer they are configured for, in the
+gateway's own memory, to judge them. What they record — in the usage row and
+the log — is the action, the policy, the category and how long it took: never
+the text, the value that matched, or the placeholder map of a redaction. See
+[guardrails.md](guardrails.md).
 
 ## What is stored, exactly
 
 **Usage records**, one per request: the key, the project, the model asked for,
 the model that answered, prompt and completion token counts, cost, HTTP status
 and latency. No message content. The row is in `internal/store/store.go` as
-`Usage` and there is no field for text in it.
+`Usage` and there is no field for text in it. What the client chose to say
+about the request is kept with it: OpenAI's `user` field and its `metadata`
+or `x-llmgw-tags` — short strings, set by the client, for attributing spend.
+A client that puts a person's name or address there puts it in the usage
+records; the field is the client's, and so is that choice. Tags are not sent
+on to the engine.
 
 **API keys**, as SHA-256 hashes. The key itself is shown once, at creation, and
 never stored — so a leaked database hands over no working credential, and
 neither llmgw nor an administrator can recover a key somebody lost. A prefix is
 kept so a key can be identified in a listing without revealing it.
 
+**The store's own secrets**, like the one engine keys are derived from, plain
+unless `secrets.master_key` seals them — with Vault's transit engine, so that
+neither the store nor its backups hold them.
+
 **People and tenancy**: accounts, the organisation/team/project tree, and the
 limits attached to it. Passwords are hashed.
 
@@ -37,10 +55,32 @@ limits attached to it. Passwords are hashed.
 
 **Conversations and agent notes** — only for a project that asked. See below.
 
+**Kept requests** — only for a project that asked (`llmgw keys requests`):
+what each request sent the model, after the guardrails' redaction and with
+any stored conversation in it, and the answer the client got, for the hours
+it said, all of them or a share. Never under a `no_store` policy.
+
+**Batch files** — when a client uses the Batch API: the file of requests it
+uploaded (prompts) and the files the batch wrote (answers), in the store,
+until deleted (`DELETE /v1/files/{id}`) or, for what a batch wrote, until
+`router.batch.retain_days` (30) pass. Only keys of the project that made
+them can read them, and a project under a `no_store` policy cannot make
+them.
+
+**Reused answers** — only for a project that asked (`llmgw keys cache`):
+each answer that may be reused, as the client got it, and a hash of the
+request it answers, in the gateway process's memory — never in the store,
+never on disk — for the project's TTL or until pushed out by newer ones
+(`router.cache.max_bytes`), and gone with a restart. Never under a `no_store`
+policy. Forgetting a person does not reach into it; the answers age out by
+the TTL. The store keeps only the setting, and a usage record's mark that it
+was answered from the cache.
+
 ## What is not stored
 
 Prompts. Completions. Anything the model was shown or produced, unless the
-project turned on conversations or notes.
+project turned on conversations, notes or kept requests, or sent a batch.
+(Reused answers are held in memory only, as above.)
 
 The chat page in llmgw's own web interface keeps the conversation in a
 JavaScript variable in the browser. Refresh it and the conversation is gone,
@@ -86,22 +126,62 @@ your own hardware, and the answer comes back. The router talks to engines, the
 engines talk to nothing, the agents talk to the control plane. All of it is
 inside the cluster.
 
-Two things can reach outside, both started by an operator rather than by a
-request:
+Around the serving path, a cluster set up the ordinary way does reach out.
+None of it carries a prompt, an answer, a key or a user — it is software and
+public model files coming in — but a review should know each one:
 
-**Fetching weights.** When a model's `source` is a URL, the agent downloads it.
-Point that at an internal mirror and nothing leaves at all — which is also the
+**Installing engines.** Each node's agent downloads the llama.cpp build for its
+hardware from GitHub, checked against the checksum GitHub publishes, and vLLM
+(SGLang when asked) from PyPI, with `uv` from GitHub. On every node, when it
+joins and when the engine version changes.
+
+**Releases.** `llmgw node add`, `llmgw ctl upgrade` and `llmgw upgrade` fetch
+llmgw's own release binaries from the project's release server, checked against
+its signed checksums.
+
+**Fetching weights.** When a model's `source` is a URL, the agent downloads it;
+the mirror fetches what it is asked to, from Hugging Face or another URL, and
+`server init` has it fetch the starter model and the guardrails' judge. Point
+sources at the mirror and the nodes fetch only from it — which is also the
 faster arrangement, because eight nodes pulling forty gigabytes from the
 internet is a day's work and from a local mirror it is minutes. A `source` that
 is a path on disk is never fetched.
 
-**`llmgw ctl plan`.** Reads a model's architecture from huggingface.co to work
-out whether it fits your hardware. An operator command run at planning time,
-not part of serving, and not run by anything automatically.
+**The registry.** With a mirror configured, the control plane asks Hugging Face
+every six hours whether the models served from it have newer files
+(`mirror.update_check`), and `/admin/mirror` searches it. `llmgw ctl plan`
+reads a model's architecture from huggingface.co to work out whether it fits
+your hardware.
 
-There is no telemetry, no licence check, and no call home. The binary is
-static, built with `CGO_ENABLED=0`, and runs in a network with no route to the
-internet as long as the weights are already on disk.
+There is no telemetry, no licence check, and no call home.
+
+### A cluster with no way out
+
+A site with no route to the internet installs from an **offline bundle**
+instead, and then nothing at all leaves the cluster (docs/install.md, "Offline
+sites"). The bundle is made on a machine that has internet — llmgw's release
+binaries with their signed checksums, the llama.cpp builds with the checksums
+GitHub publishes, the model files with the checksums Hugging Face publishes,
+each checked as it is downloaded — carried in, and imported into the mirror.
+With `offline.mirror` set in `server.yaml`, nodes install engines from the
+mirror and never from GitHub, releases come from the mirror, and the registry
+is not asked about newer weights.
+
+Verification is not weakened by any of this. A release is held to the project's
+signing key wherever it is fetched from. An engine file is held to the checksum
+recorded when the bundle was made, which the control plane keeps and hands each
+node over the agent's authenticated connection: the mirror serves plain HTTP,
+and nothing a node runs is taken on the mirror's word. The bundle itself is
+checked against the sha256 its maker printed, carried to the site apart from
+the bundle.
+
+What does not come in a bundle: vLLM and SGLang, which are Python environments
+from PyPI — an offline node serves with llama.cpp unless one is installed on it
+by hand — and the operating system's own packages (the OpenMP runtime the
+engine needs, PostgreSQL when chosen), which come from the machines' package
+sources: at an offline site, the distribution mirror it already has. Searching
+the registry from `/admin/mirror` and `llmgw ctl plan` need the internet and
+do not work offline; `mirror.registry` can point the first at an internal copy.
 
 ## What the software cannot do for you
 
@@ -131,3 +211,29 @@ touch, whatever the catalog says.
 | Scope is part of the lookup | `internal/store/threads.go`, `Thread` |
 | Deletion is a client endpoint | `internal/router/threads.go`, `handleDeleteThread` |
 | Weight fetching is the only serving-path egress | `internal/agent/weights/fetch.go` |
+
+## Forgetting a person
+
+`llmgw users forget <email> --yes` (or **Forget them…** in the console) is for
+a request to be forgotten:
+
+- their usage — every request record and every sum — is kept, so totals and
+  budgets stay true, but under a random pseudonym that links to nothing;
+- their kept requests (`keys requests`), personal files and batches, and
+  their own limits are deleted;
+- their email and id are taken out of the audit log, which keeps what was
+  done;
+- then the account goes, as `users delete` removes it: sessions ended, keys
+  revoked and left without an owner.
+
+Conversations and agent notes belong to projects, not to the people in them,
+and are not touched: a project forgets them by its retention, and a thread by
+`DELETE /v1/threads/{id}`. Backups taken before still hold everything until
+they age out; that is what their retention is for.
+
+## Keeping a project's requests in the cluster
+
+`llmgw keys residency --project <path> --in-cluster` refuses the project's
+keys any model served by an outside provider, and never uses one for them as
+a fallback or a canary: their prompts do not leave the machines the cluster
+runs on. `--anywhere` lifts it.

docs/development.md

@@ -1,8 +1,9 @@
-# Quickstart: one machine, one model, ten minutes
+# Development: llmgw from source on one machine
 
-Written for someone who wants to see llmgw answer a request on a single
-workstation before reading anything else. No systemd, no `sudo`. For a real
-cluster, see [install.md](install.md).
+Written for a developer who wants to see llmgw answer a request on a single
+workstation, built from source, with no systemd and no `sudo` — for working on
+llmgw itself. **To install llmgw on servers, read
+[quick-install.md](quick-install.md) instead.**
 
 What you end up with: an OpenAI-compatible endpoint on `localhost:8080` in front
 of a real model served by llama.cpp.
@@ -26,7 +27,7 @@ make test
 ./bin/llmgw --version
 ```
 
-`make build` writes `./bin/llmgw`. Go 1.26 or later is the only requirement.
+`make build` writes `./bin/llmgw`. Go 1.26.6 or later is the only requirement (an older Go fetches it itself).
 
 ## 2. Check the path with a fake engine
 

docs/fabrics.md

@@ -0,0 +1,210 @@
+# InfiniBand fabrics and NVLink
+
+For a site whose GPU nodes are joined by InfiniBand or RoCE, by NVLink, or both
+— several independent fabrics, NVL72 racks, eight-GPU HGX boards. It says what
+llmgw does with them, what it needs from you before it can, how to check a node
+in one command, and where to look when a replica spanning nodes will not run.
+
+Read [install.md](install.md) first; this is the part of it that only matters
+once there is a fabric.
+
+> **Where this stands.** Every piece here was written against the real formats
+> of `sminfo`, `saquery`, `ibnetdiscover`, `nvidia-smi topo -m` and
+> `nvidia-smi -q`, and tested against them — but none of it has yet run on a
+> site with the hardware. Run `llmgw doctor --json` on two or three nodes first
+> and keep the reports: if a parser meets a format it does not know, that report
+> is what fixes it, and the fix is a control plane upgrade, not one per node.
+
+## What llmgw does with them
+
+**Two kinds of interconnect.** InfiniBand or RoCE joins nodes (scale-out).
+NVLink joins GPUs — inside one machine on an HGX board, or across the nodes of a
+rack on an NVL72 or an NVLink Switch system (scale-up). A replica spanning nodes
+is placed, in order of preference:
+
+1. inside one **multi-node NVLink domain**, if any has enough usable nodes:
+   tensor parallelism between its nodes then runs over NVLink;
+2. on one **physical InfiniBand or RoCE fabric**, preferring nodes under one
+   leaf switch and putting nodes with a degraded cable last.
+
+It is never split across two fabrics or two NVLink domains. Within a node, the
+GPUs a shard gets are the set with the most NVLink pairs, then the nearest to
+the fabric's adapters, then on one NUMA node.
+
+**A fabric has a name and an identity.** The name is what `agent.yaml` says; the
+identity is what the adapters report — on InfiniBand the subnet managers every
+port on one fabric sees, on RoCE the IP network of its RoCE v2 address. The name
+is how you address a fabric; the identity is how llmgw catches the name being
+wrong: two independent fabrics given one name are placed as two, and the
+cluster page says so.
+
+## Before a node joins
+
+On every GPU node:
+
+| What | Why | Check |
+|---|---|---|
+| NVIDIA driver | everything | `nvidia-smi` |
+| `nvidia-fabricmanager`, on an NVSwitch machine | without it CUDA does not start on those GPUs | `systemctl is-active nvidia-fabricmanager` |
+| `rdma-core`, `ib_uverbs` loaded | user-space RDMA at all | `ls /sys/class/infiniband`, `lsmod \| grep ib_uverbs` |
+| `nvidia_peermem` loaded | GPUDirect RDMA; without it NCCL copies every transfer through host memory | `lsmod \| grep nvidia_peermem` |
+| `infiniband-diags` | tells llmgw which fabric a port is on; the agent installs it if missing | `which sminfo` |
+
+On an NVL72 or NVLink Switch system, also:
+
+| What | Why | Check |
+|---|---|---|
+| `nvidia-imex` running, every node of the domain in `/etc/nvidia-imex/nodes_config.cfg` | GPUs in different nodes share memory through it | `systemctl is-active nvidia-imex` |
+| an IMEX channel (`options nvidia NVreg_CreateImexChannel0=1`) | an engine opens one | `ls /dev/nvidia-caps-imex-channels` |
+| every GPU joined to its domain | the fabric manager does this | `nvidia-smi -q \| grep -A6 Fabric` shows `State: Completed` |
+
+On each InfiniBand fabric:
+
+- **A subnet manager, and a standby.** Without one, ports come up to `INIT` and
+  stay there; without a standby, the fabric keeps its routes if the master
+  stops but cannot recover from any change after. llmgw watches this but does
+  not run one.
+- **Its own name** in `agent.yaml` on every node attached to it. Optionally, a
+  distinct `subnet_prefix` in each subnet manager's configuration, which makes
+  GIDs unique across fabrics; llmgw does not need it.
+
+## Declaring the fabrics
+
+In `/etc/llmgw/agent.yaml`, the adapters on each fabric, by name:
+
+```yaml
+fabrics:
+  - name: ib-compute
+    hcas: [mlx5_0, mlx5_1, mlx5_2, mlx5_3, mlx5_6, mlx5_7, mlx5_8, mlx5_9]
+  - name: ib-storage
+    hcas: [mlx5_4]
+```
+
+or `--fabric ib-compute:mlx5_0,mlx5_1,…` when onboarding ([node-onboarding.md](node-onboarding.md)).
+An adapter belongs to one fabric; a node may be on several. A replica on
+`ib-compute` is given only `ib-compute`'s adapters (`NCCL_IB_HCA`).
+
+The rate is measured, not taken from the file: a fabric's rate on a node is the
+slowest of its active adapters, because a collective runs at the speed of its
+slowest link.
+
+The agent checks the declaration against the adapters on every heartbeat. An
+adapter that is missing, or whose port is down, takes that fabric off the node
+within seconds — the node stops being offered multi-node work on it — and
+returns it when the port comes back.
+
+## Checking a node: `llmgw doctor`
+
+```
+sudo llmgw doctor                 # uses /etc/llmgw/agent.yaml when present
+sudo llmgw doctor --json > $(hostname)-doctor.json
+```
+
+It reads the node and says what is wrong and how to fix it, most serious first,
+and exits non-zero when anything fails:
+
+```
+FAIL  nvlink  this machine has NVSwitch but nvidia-fabricmanager is inactive: CUDA will not initialise on its GPUs
+              → systemctl enable --now nvidia-fabricmanager (its version must match the driver's)
+WARN  fabric  nvidia_peermem is not loaded: GPUDirect RDMA is off, and NCCL copies every transfer through host memory
+              → modprobe nvidia_peermem
+OK    gpu     8 GPUs: 8× NVIDIA H100 80GB HBM3
+OK    nvlink  NVLink groups: [0 1 2 3 4 5 6 7]
+OK    fabric  mlx5_0/1 ACTIVE at 400 Gb/s (InfiniBand), subnet manager 0x248a07030030f0c0 (LID 1, SMINFO_MASTER)
+OK    fabric  subnet managers of 0x248a07030030f0c0's fabric: 0x248a07030030f0c0 (master, priority 15), 0x248a07030030f1d4 (standby, priority 14)
+OK    agent   fabric ib-compute: mlx5_0,mlx5_1,… usable at 400 Gb/s
+OK    agent   NCCL bootstraps over ens3 (10.1.0.21)
+```
+
+followed by each GPU's NVLink peers and nearest adapter, each port's state,
+rate and errors, and the NCCL environment a shard on each fabric would be given.
+`--json` writes every fact it read as well as what it concluded — send that
+file when the report is not enough.
+
+## Checking two nodes: `llmgw ctl fabric-test`
+
+Every check on one node can pass while two nodes still cannot reach each other
+— a cable into the wrong switch, a partition key, a RoCE network with no route
+— and a replica spanning them then hangs on its first all-reduce. Before
+placing one, on the control plane:
+
+```
+llmgw ctl fabric-test gpu01 gpu02
+```
+
+```
+gpu01 → gpu02 on ib-compute, 41s
+
+RAIL              LINK      MEASURED    VERDICT  DETAIL
+mlx5_0 → mlx5_0   400 Gb/s  388.2 Gb/s  ok       97% of 400 Gb/s
+mlx5_1 → mlx5_1   400 Gb/s  241.0 Gb/s  slow     60% of 400 Gb/s: check the cable, and the card's PCIe width and NUMA node
+mlx5_2 → mlx5_2   400 Gb/s  0.0 Gb/s    fail     gpu01: ib_write_bw: Couldn't connect to 10.1.0.22:18517
+```
+
+It runs `ib_write_bw` (perftest, installed on a node the first time) from each
+of the first node's adapters on the fabric to the same adapter on the second —
+mlx5_0 to mlx5_0, the way NCCL pairs them — one rail at a time, through the
+agents, so no SSH between nodes is needed. Each rail is graded against its
+link's rate: **ok** at 80% or more, **slow** at 50%, **fail** below that or when
+nothing got through. `--fabric` picks one when the nodes share several,
+`--seconds` the length of each rail's run. The traffic is real: run it when the
+fabric is quiet.
+
+It measures RDMA between adapters, not GPUDirect or NCCL itself: a pass says
+the fabric carries traffic between these two nodes at its rate, which is what
+a first all-reduce needs and what nothing on one node can show.
+
+## Watching them
+
+- **Cluster page, Fabrics.** Each declared fabric and what it physically is;
+  a table of subnet managers per fabric — master, priority, standbys, the last
+  change of master — and every disagreement: one name on two fabrics, two names
+  on one, an adapter up but undeclared, ports up with no subnet manager, a
+  fabric with no standby, a recent failover.
+- **`/admin/fabrics`.** Each fabric's map, from `ibnetdiscover` run by one of
+  its nodes every five minutes: switches in their tiers, adapters under their
+  leaves, cables coloured by rate, degraded ones in red, rail alignment, and
+  the cluster's own adapters live with their traffic. Click anything for its
+  detail.
+- **`/admin/nvlink`.** Each multi-node NVLink domain as a rack of trays: which
+  GPUs are joined, which node's IMEX is down, which link runs degraded.
+- **A node's page.** Its ports with state, rate, errors and what they are
+  physically on; its GPU-by-GPU NVLink matrix; its load.
+- **Metrics**, for alerts:
+
+| Metric | Alert when |
+|---|---|
+| `llmgw_ib_port_active` | a declared port is 0 |
+| `llmgw_ib_port_counter_total{counter="symbol_error"}` and `link_downed` | rising |
+| `llmgw_ib_port_rate_gbps` | below its usual rate |
+| `llmgw_fabric_subnet_managers{state="standby"}` | absent or 0 |
+| `llmgw_fabric_master_sm` | its `sm_guid` changes (a failover) |
+| `llmgw_fabric_problems{level="fail"}` | above 0 |
+| `llmgw_gpu_nvlink_joined` | 0 |
+| `llmgw_imex_up` | 0 |
+
+## What an engine is given
+
+For a shard on an InfiniBand or RoCE fabric:
+
+| Variable | Value |
+|---|---|
+| `NCCL_IB_HCA` | that fabric's adapters on this node, and no others |
+| `NCCL_IB_DISABLE` | `0` (`1` for a single-node shard) |
+| `NCCL_SOCKET_IFNAME`, `GLOO_SOCKET_IFNAME` | the node's management interface: `mgmt_interface`, or the one holding its management address |
+| `NCCL_IB_GID_INDEX` | on RoCE only: the RoCE v2 entry with an IPv4 address |
+| `NCCL_MNNVL_ENABLE`, `NCCL_CUMEM_ENABLE` | `1`, for a replica inside a multi-node NVLink domain |
+
+A profile's `env` overrides any of them. vLLM launches a multi-node replica
+with its own multiprocessing (`engines.vllm.launch_mode: mp`, the default):
+every node runs `vllm serve` with its rank and the leader's address, the
+workers headless. `launch_mode: ray` is there for a vLLM too old for that.
+
+## When a replica spanning nodes will not run
+
+| It | Look at |
+|---|---|
+| is not placed | `llmgw ctl explain-placement <model>`: a fabric split by identity, a node whose IMEX is down, a node refused because its adapters are cabled to two fabrics |
+| starts and hangs on its first collective | `llmgw ctl fabric-test` between two of its nodes; the cluster page's fabric problems; `doctor` on each node — a port down, the wrong interface, RoCE without a v2 GID |
+| runs, slowly | `nvidia_peermem`; the map for a degraded cable; the node page's NVLink matrix for a group that crossed PCIe |
+| worked yesterday | the subnet manager table for a failover; `link_downed` on the node's ports |

docs/facility-aware-placement.md

@@ -0,0 +1,400 @@
+# Facility-aware placement: rack power, temperature and cooling
+
+**Status: steps 0, 1 and 2 are built, with the manual hold of step 4;
+temperature conditions (steps 3 and 4) and shedding (step 5) are not**,
+until the thermal data of a real site is at hand — without it thresholds would
+be designed against guesses. This is the design for step 5 of resource
+allocation, after reserved CPU cores and memory (1), capacity classes and
+preemption (2), tenant capacity quotas (3) and sizing by measured throughput
+(4). [What is built](#what-is-built) says what works today and where it
+departs from the design below; the rest of the document is the design.
+
+## What is built
+
+**Where a node is.** Five labels: `llmgw.io/site`, `room`, `row`, `rack` and
+`pdu` (a comma separated list, for a dual-fed rack). They come from the node's
+`agent.yaml` under `labels:`, or from the control plane:
+
+```
+llmgw ctl label gpu01 llmgw.io/rack=r12-07 llmgw.io/pdu=r12-07-a,r12-07-b
+llmgw ctl label gpu01 llmgw.io/rack-        # back to agent.yaml's value, if any
+```
+
+Labels set with `ctl label` are kept in the store, win over the agent's, and
+may be set before the node joins. A misspelt `llmgw.io/` key is refused. A
+domain is named `level:name` — `rack:r12-07`, `pdu:r12-07-a` — and names are
+taken as given, so two rooms that both have a rack `r1` must label them apart.
+A node without location labels is in no domain and places as it always did.
+
+**Spreading.** A model's next replica goes first to a node sharing no rack and
+no PDU with the nodes the model already runs on; nodes sharing fewer come
+before nodes sharing more. It is an ordering, never a filter: a rack holding
+the only free cards still takes the replica. It ranks above preferring a node
+that already holds the weights — a second replica one breaker away from the
+first is worth less than the copy saved — and above bin packing.
+
+**Keeping a replica together.** A profile's `keep_within: rack` (or `row`,
+`room`, `site`) keeps a multi-node replica's nodes in one such domain, inside
+the fabric or NVLink domain placement already requires; nodes without the
+label are passed over for it, with the reason.
+
+**Holds.** `llmgw ctl facility hold rack:r12-07 --reason "PDU swap"` places
+nothing new in the domain, as a cordon of each of its nodes would, including
+nodes labelled into it later. `--drain` also drains its nodes, one replica at
+a time with the replacement up first; `llmgw ctl facility release` undoes
+both. Holds are kept in the store across restarts (the drain itself is node
+state, which is not: after a restart the hold still keeps work out, and
+replicas not yet moved stay where they are). Any domain can be held: a PDU
+holds every rack on it.
+
+**Power budgets.** In `server.yaml`:
+
+```yaml
+facility:
+  margin: 0.1            # share of every cap kept free
+  gpu_watts: 700         # a card that reports no power limit
+  cpu_core_watts: 10     # a core reserved by a CPU replica (cpu_cores)
+  node_watts: 350        # each node's own draw beyond its cards
+  budgets:
+    - domain: rack:r12-07
+      cap_watts: 16000   # what one feed carries alone, derated
+      other_watts: 800   # switches, storage
+    - domain: pdu:r12-07-a
+      cap_watts: 7400
+```
+
+A replica's draw is the profile's `power_watts` (split over its nodes) when
+declared; otherwise each card at the power limit it reports through the agent's
+sensors (or `gpu_watts`), and each reserved core at `cpu_core_watts`. A
+domain's use is, node by node, `node_watts` plus the larger of what is placed
+there and what the node's sensors read in the last two minutes
+(`measured_fresh`), plus the domain's `other_watts`. A shard that would take
+any of its node's domains past `cap × (1 − margin)` is refused; a multi-node
+replica's shards are counted together, so two that each fit a rack alone do not
+both go into it. A draw nobody knows — no declared figure, no card limit, no
+`gpu_watts` — counts as nothing: missing data never blocks.
+
+**What people see.** `llmgw ctl explain-placement` names the domain: *rack
+r12-07 is held: PDU swap*, *rack r12-07: 14.2 kW of a 14.4 kW limit (16.0 kW
+cap less 10%) in use, the shard needs ~2.8 kW*. The rejections of a placed
+replica are kept too, so a replica in an unexpected rack says why. `llmgw ctl
+nodes` has a LOCATION column, shows *ready, held*, and filters with `--domain
+rack:r12-07`. `llmgw ctl facility` lists every domain with its nodes, use,
+limit, reserved and measured draw, and holds. The console's Nodes view has a
+WHERE column; a node's page shows its location and hold, and its menu sets
+the location (**Location…**) and holds or releases its rack. The admin API:
+`GET /api/v1/facility`, `POST /api/v1/facility/holds`, `DELETE
+/api/v1/facility/holds/{domain}`, `POST /api/v1/nodes/{id}/labels`.
+
+**Where it departs from the design below, and why.**
+
+- Domains come from labels alone; there is no facility file declaring them.
+  Budgets are in `server.yaml`, the one file the control plane already reads.
+  A DCIM export would generate that block.
+- Feeds are not modelled. The cap given is what one feed carries alone,
+  derated — the figure the design says matters — so the operator gives the
+  one number instead of llmgw deriving it from two.
+- The manual hold of step 4 is built now, without conditions: it needs no
+  sensor data and answers the commonest facility event, planned maintenance.
+  Its command is `ctl facility hold`, with a `--drain` the design did not have.
+- `keep_within` is new: the request that a multi-node replica stay in one rack
+  where the cabling requires it.
+- Spreading is an ordering of candidates, not the scoring of the design; power
+  headroom does not yet order racks ("level load across racks"), and
+  multi-node replicas are not spread across racks.
+- No `llmgw_domain_*` metrics or alerts yet; `ctl facility` and the API carry
+  the same figures.
+
+## Why
+
+In a large installation the scarce thing is often not a GPU but the room it
+sits in. Three failures are invisible to placement today:
+
+- **A rack goes over its power budget.** Every node in it reports healthy;
+  placement sees free cards and fills them; the breaker, or the facility's
+  power cap, decides the rest. A rack with A and B feeds is worse: it runs
+  fine until one feed fails and the other cannot carry the load.
+- **Hot hardware is slow hardware.** GPUs throttle long before they fail. A
+  replica placed in a rack whose inlet air is too warm serves fewer tokens per
+  second than its measured capacity says, and nothing connects the two.
+- **Correlated failure.** Two replicas of a model on two nodes in the same rack
+  or on the same PDU are one failure away from zero. Placement spreads replicas
+  across nodes, not across racks.
+
+The goal is for placement to treat facility limits the way it already treats
+memory and cores: reserve against a budget, refuse what does not fit, say why,
+and never let missing data stop the cluster.
+
+## What it builds on
+
+| Already in place | Used for |
+|---|---|
+| Node labels, reported by agents, matched by `node_selector` | Where a node is: its rack, row, PDU |
+| `inventory.Allocation` carries GPUs, memory and cores per shard | Adding watts, summed per rack and PDU |
+| Placement rejections (`explain-placement`, headroom's "why not") | Naming the rack that is full or hot |
+| Headroom: the scheduler dry-run on a copy of the inventory | Room that respects power budgets, for free |
+| Preemption with classes, minimums and a dry run (step 2) | Shedding load from a hot rack in the right order |
+| Measured throughput per profile (step 4) | Tokens per watt as a placement preference |
+| Node sensors, read by every agent (step 0, built) | Heat and power with no facility integration: see below |
+| `internal/promq`, a Prometheus client | Reading facility metrics that DCIM exporters publish |
+
+## Concepts
+
+**Location.** Each node has a place in a tree: site, room, row, rack. Power has
+its own tree beside it: a rack draws from one or more PDUs, and each PDU from a
+feed. Both are read from node labels with well-known keys:
+
+```yaml
+# agent.yaml
+labels:
+  llmgw.io/site: sto1
+  llmgw.io/room: hall-b
+  llmgw.io/row: "12"
+  llmgw.io/rack: r12-07
+  llmgw.io/pdu: r12-07-a,r12-07-b   # both feeds, for a dual-fed rack
+```
+
+A node without these labels is its own rack of one: placement behaves as it
+does today.
+
+**Domain.** A rack, a row, a PDU, a room: anything with a budget or a
+condition. Domains are declared in a facility file (below) or discovered from
+node labels; a label naming a domain the file does not declare creates it with
+no budget and no condition.
+
+**Budget.** A domain may have a power cap in watts. Placement reserves each
+replica's estimated draw against every domain its node belongs to and refuses a
+placement that would take any of them past its cap less a safety margin. For a
+dual-fed rack the cap that matters is what one feed can carry alone, since that
+is what the rack must survive.
+
+**Condition.** A domain has a thermal and cooling condition: `ok`, `warm`, `hot`
+or `unknown`, derived from readings against thresholds with hysteresis.
+Conditions change what placement prefers and allows; they are not amounts to
+fill.
+
+**Reading.** A measured value with a time: inlet temperature, power draw, a
+cooling unit's alarm state. Readings older than their staleness limit are
+treated as absent.
+
+## Estimating a replica's draw
+
+What placement reserves has to be known before the replica runs, so it is an
+estimate first and a measurement later:
+
+1. **Declared.** A profile may say `power_watts`. The operator's figure wins.
+2. **Derived.** Otherwise GPU profiles take each card's power limit from NVML
+   (the agent already reads the cards; the power limit is one more field) plus
+   a per-node share for CPU, memory and fans; CPU profiles take their reserved
+   cores times a per-core figure for the node's CPU model.
+3. **Measured.** Once replicas run, the agent reports their cards' actual draw
+   (NVML) and, where the BMC allows, the node's (Redfish or IPMI DCMI). A
+   domain's headroom is computed from the larger of what is reserved and what
+   is measured, so an estimate that was too low is corrected by the room it
+   stops offering, not by an outage.
+
+## Decisions
+
+### Power
+
+- **Hard limit.** A placement that would take any domain past `cap × (1 −
+  margin)` is rejected, with the domain and the figures: *rack r12-07: 14.2 of
+  16.0 kW reserved, replica needs ~2.8, margin 10%*.
+- **Feeds.** For a domain with two feeds the cap is the smaller feed's rating
+  times its derating (typically 80%), not the sum.
+- **Already over.** A domain found over its cap, because the estimate was low
+  or the cap was lowered, gets no new placements, and an alert. It is not
+  emptied automatically; shedding power is the facility's decision, and
+  stopping inference to do it is ours only if asked (see shedding below).
+
+### Temperature and cooling
+
+Thresholds are per domain with defaults, and each condition needs to hold for a
+while before it changes, in both directions, so a single reading neither
+starts nor ends anything:
+
+| Condition | Enters when | Placement |
+|---|---|---|
+| `ok` | below the warm threshold for 5 min | normal |
+| `warm` | inlet above the warm threshold for 2 min, GPU temperatures near throttling, or any GPU thermally throttled | allowed, scored down: other domains first |
+| `hot` | inlet above the hot threshold for 2 min, a cooling unit in alarm, or a sustained share of the domain's GPUs thermally throttled | no new placements, as a cordon would, but automatic and reversible |
+| `unknown` | no fresh reading | as `ok`, and reported as unknown |
+
+**Shedding** (optional, off by default): a domain `hot` for longer than its
+shed delay has load moved off it using step 2's machinery. The lowest class goes
+first, and replicas above their model's minimum go before any at it. A critical
+minimum is never touched, and moves are rate limited to one replica per domain
+per interval. The replica is placed elsewhere first where there is room, so
+shedding moves work rather than dropping it. GPU power capping (`nvidia-smi
+-pl`) is a gentler alternative worth measuring against shedding: less
+throughput, no restart.
+
+### Spreading
+
+Replicas of one model are spread across racks, and across PDUs, the way they
+are spread across nodes today. This is a preference, dropped when it is the only
+thing standing in the way, as node spreading already is.
+
+### Scoring
+
+Placement today filters, then takes the first candidate in a fixed order
+(fewest free GPUs for GPU profiles, fewest replicas for CPU ones, nodes holding
+the weights first). Facility signals are better as a score than as more
+filters. Candidates that pass the hard limits are ordered by:
+
+1. condition: `ok` before `warm`;
+2. power headroom left in the rack after this replica, more first, so load
+   levels across racks;
+3. the existing order.
+
+Once measurements include power, step 4's profile preference can use tokens per
+watt instead of tokens per GPU where both are known.
+
+## Where the data comes from
+
+A `FacilitySource` interface, implemented several ways, chosen in
+`server.yaml`:
+
+```go
+type FacilitySource interface {
+    // Domains is what the source knows: budgets, thresholds, members.
+    Domains(ctx) ([]Domain, error)
+    // Readings is the latest value of each signal, per domain.
+    Readings(ctx) ([]Reading, error)
+}
+```
+
+- **Static file.** Domains, caps and thresholds, written by hand or generated
+  from a DCIM export. Enough for power budgets with no live data at all.
+- **Prometheus.** DCIM, PDU (SNMP exporter) and BMC (Redfish exporter)
+  readings usually end up in Prometheus. The source runs configured instant
+  queries and maps their labels onto domains:
+
+  ```yaml
+  facility:
+    source: prometheus
+    prometheus: http://monitoring:9090
+    signals:
+      inlet_temp_c:
+        query: max by (rack) (dcim_rack_inlet_temperature_celsius)
+        domain_label: rack
+        stale_after: 2m
+      power_watts:
+        query: sum by (pdu) (pdu_outlet_power_watts)
+        domain_label: pdu
+      cooling_alarm:
+        query: max by (row) (crac_alarm)
+        domain_label: row
+  ```
+- **Agents (built, step 0).** What each node reads about itself, every ten
+  seconds at most, sent with its heartbeat:
+  - **GPUs, from nvidia-smi:** temperature, memory (HBM) temperature where the
+    driver reports it, power draw, the enforced power limit, and what is
+    holding the clocks down now — `sw_power_cap`, `hw_slowdown`, `sw_thermal`,
+    `hw_thermal`, `power_brake`.
+  - **CPUs, from hwmon** (what lm_sensors reads, without it installed): the
+    package temperature, or the hottest core; and the board's inlet or ambient
+    sensor where it has one (`SYSTIN`, `Inlet`, `Ambient`).
+  - **CPU power, from RAPL:** the packages' energy counters over time,
+    subdomains not counted twice, counter wrap handled.
+
+  A machine without a sensor reports nothing for it, never a zero; a VM has
+  none of them. Published as `llmgw_gpu_temperature_celsius`,
+  `llmgw_gpu_memory_temperature_celsius`, `llmgw_gpu_power_watts`,
+  `llmgw_gpu_power_limit_watts`, `llmgw_gpu_throttled{reason}`,
+  `llmgw_node_cpu_temperature_celsius`, `llmgw_node_cpu_power_watts` and
+  `llmgw_node_inlet_temperature_celsius`, and on each node's page.
+
+  What they can and cannot say:
+  - **Throttling is the strongest signal there is.** A temperature is a proxy;
+    a card holding its clocks down is the fact that invalidates its measured
+    capacity, and it needs no threshold to be chosen.
+  - **Measured power** is GPU draw plus CPU packages; memory, disks, fans and
+    power-supply losses are not in it, so a node's draw is that plus an
+    estimated remainder. A rack's is its llmgw nodes' plus a declared figure
+    for everything else in it: switches and storage report nothing here.
+  - **CPU and GPU temperatures follow the load, not the room.** A hot rack is
+    inferred from many nodes running hot at comparable load, or from
+    throttling, not from one node's CPU. Only a board inlet sensor reads the
+    air, and most boards have none.
+  - **No budget comes from a sensor.** A reading is a draw; the cap it is
+    measured against still comes from the facility.
+- **Simulated.** Readings from a script, for tests and for rehearsing a
+  thermal event on a cluster without facility data.
+
+## Safety
+
+- **Missing data never blocks.** A source that is down, a reading that is stale,
+  a node without location labels: placement behaves as it does today, and says
+  the data is missing (a metric, a line on the cluster page). Facility
+  awareness can make placement more careful, never impossible.
+- **Hysteresis and hold times** on every condition, so a noisy sensor does not
+  flap a rack between allowed and forbidden.
+- **Observe-only first.** A mode where every decision is computed, logged and
+  shown ("would have refused: rack r12-07 hot") but nothing is enforced, run
+  for long enough to trust the thresholds before turning enforcement on.
+- **Manual override.** `llmgw ctl facility hold RACK` and `release RACK`, for the
+  facility team to mark a domain unavailable, or to clear a condition they know
+  to be a sensor fault.
+- **Shedding is opt-in**, per domain or cluster-wide, and rate limited.
+
+## What people see
+
+- `explain-placement` and headroom name the domain: *rack r12-07 is hot (inlet
+  31°C for 6 min)*, *pdu r12-07-a: 7.1 of 7.4 kW*.
+- `llmgw ctl facility` lists domains with budget, reserved, measured and
+  condition. The cluster page gets a rack summary beside the nodes table.
+- Metrics: `llmgw_domain_power_budget_watts`, `_reserved_watts`,
+  `_measured_watts`, `llmgw_domain_condition{condition}`,
+  `llmgw_domain_reading_age_seconds`; alerts for a domain near its cap, a
+  domain hot, a domain over its cap, and facility data gone stale.
+
+## Rollout
+
+Each step ships on its own and is useful without the next:
+
+0. **Node sensors, observe-only (built).** GPU heat, power and throttling,
+   CPU heat and power, inlet air where the board has a sensor; published and
+   shown, no decision changed.
+1. **Location and spreading (built).** Well-known labels, domains from labels, replicas
+   spread across racks and PDUs, locations on the node views. No facility data
+   needed.
+2. **Power budgets from a static file (built, without headroom
+   scoring).** Caps and margins, estimated draw per
+   replica (declared or derived), hard limit in placement and headroom.
+3. **Readings, observe-only.** The Prometheus source beside the agents',
+   conditions with hysteresis (throttling first among them), measured power
+   folded into headroom; decisions shown, not enforced.
+4. **Thermal enforcement.** `warm` scored down, `hot` refused; the manual hold
+   and release are built.
+5. **Shedding and tokens per watt.** Opt-in shedding through step 2's
+   preemption; measured power in profile preference.
+
+## Testing
+
+- The simulated source drives unit tests of every condition transition, the
+  hysteresis, staleness, and the placement outcomes, with mutation checks as
+  for steps 1–4.
+- Property tests: whatever the readings, placement never exceeds a declared
+  cap with fresh data, and never refuses everything because data is missing.
+- On the PoC cluster, with no facility data: step 1 with labelled VMs, step 2
+  with a static file of made-up caps, steps 3–4 with the simulated source
+  replaying a thermal event.
+- Before enforcement anywhere real: a period in observe-only mode against the
+  site's actual data.
+
+## Open questions
+
+- **What the sites have.** Which DCIM, which PDUs, which BMCs, and whether any
+  of it already reaches a Prometheus. The source design assumes Prometheus is
+  the common ground; a site without it needs another source.
+- **Who owns the numbers.** Caps, deratings and thresholds belong to the
+  facility team. Whether they edit llmgw's file, or llmgw reads theirs.
+- **Phase balance.** Three-phase PDUs have per-phase limits; whether placement
+  should see phases or only the PDU total.
+- **Cooling granularity.** Cooling is often per row or per aisle, not per rack;
+  the domain tree allows either, but the defaults should match what sites
+  actually measure.
+- **Power capping instead of shedding.** Whether to lower GPU power limits in a
+  warm rack rather than move replicas, and how that interacts with measured
+  capacity from step 4, which would no longer hold at the lower limit.

docs/guardrails.md

@@ -0,0 +1,211 @@
+# Guardrails
+
+Written for the operator deciding what the gateway lets through: what a
+policy can check, what it can do, and how one is attached to a team.
+
+`llmgw server init` writes a `baseline` policy that applies to every
+request, with Llama Guard 3 1B as its judge on a CPU; see
+[install.md](install.md#2-the-control-plane) for what it checks. Without a
+`guard:` section in `server.yaml` nothing is checked and nothing costs
+anything. With one, every request is judged once it is authorised and
+within its limits, with its stored conversation spliced in, and before it is
+sent to a model; and the answer is judged before the client sees it.
+
+## A policy
+
+```yaml
+guard:
+  # Applied to every request.
+  default: [baseline]
+  policies:
+    baseline:
+      input:
+        pii: {secret: block, card: redact}
+        injection: flag
+      output:
+        pii: {secret: block}
+    finance:
+      mode: enforce          # enforce (default), shadow, off
+      fail: closed           # open (default) or closed, for checks that can fail
+      no_store: true         # no conversations, notes, prefix routing or external models
+      max_output_tokens: 2048
+      system_prompt: "You answer questions about Acme's products only."
+      drop_client_system: true
+      stream: sentence       # sentence (default) or buffer_all
+      require_capabilities: true   # no tools/images to models whose catalog entry lacks them
+      validate_structured: true    # answers must fit response_format's json_schema
+      input:
+        pii: {email: redact, phone: redact, iban: block, tckn: redact}
+        injection: block
+        max_chars: 40000
+        deny:
+          - {name: codename, regex: "(?i)project falcon", action: block}
+      output:
+        pii: {iban: redact, tckn: redact, secret: block}
+      tools:
+        allow: [search, fetch]
+        deny: [shell]
+        on_denied: strip     # strip (default) or block
+        max_calls_per_turn: 4
+        validate_arguments: true
+```
+
+**What is found.**
+
+- **Personal data:** email, phone, iban, card, tckn, ip. Each is checked
+  before it counts: IBANs by their mod-97 check, cards by Luhn and issuer
+  prefix, TCKNs by their two check digits, phone numbers only when written
+  to be dialled (`+90…`, `00…`, `0532…`).
+- **Secrets** (`secret`): OpenAI- and Anthropic-style keys, AWS access key
+  ids, GitHub, Slack and Google tokens, JWTs, PEM private keys and llmgw's
+  own keys.
+- **Prompt injection:** instructions to drop instructions (English and
+  Turkish), chat-template control tokens in user text, invisible Unicode,
+  long encoded blobs. These are found through disguises: fullwidth letters,
+  Cyrillic look-alikes, zero-width characters, and base64, hex and URL
+  encoding two levels deep.
+- **`deny` patterns:** matched against the text as written, and as a model
+  reads it once those disguises are removed.
+
+**What is done.**
+
+- **`flag`** lets the request through and records it.
+- **`redact`** rewrites the value as a placeholder (`[EMAIL_1]`; the same
+  value is the same placeholder throughout a request).
+- **`block`** stops it.
+
+**Shapes.**
+
+- `system_prompt` is put first.
+- `drop_client_system` removes the caller's own system and developer
+  messages.
+- `max_output_tokens` is set where a request asks for none, and lowers one
+  that asks for more.
+- A tool `deny`/`allow` list strips the tool from the request, or refuses
+  it.
+- In the answer, a call to a tool that is not allowed, more calls than
+  `max_calls_per_turn`, or arguments that do not fit the parameters the
+  request declared (`validate_arguments`) stop it.
+- `require_capabilities` refuses tools offered to a model whose catalog
+  entry does not say `capabilities.tools`, and images to one without
+  `capabilities.vision`. It is opt-in because an entry that says nothing is
+  read as "cannot".
+- `validate_structured` checks an answer against the `json_schema` the
+  request asked for in `response_format`. Buffered, or streamed with
+  `buffer_all`, an answer that does not fit is stopped; streamed a sentence
+  at a time it has gone out already, and is flagged.
+
+## A judge model
+
+Patterns find what has a shape. For what does not — violence, self-harm,
+abuse, whatever a moderation model was trained on — a policy can have a
+**judge model on the cluster** read the text:
+
+```yaml
+# a catalog model (server.yaml models:, or ctl model add)
+- name: llama-guard-3-1b
+  source: http://mirror:8081/llama-guard-3-1b/…/Llama-Guard-3-1B-Q4_K_M.gguf
+  role: guard
+  guard:
+    format: llamaguard3        # llamaguard3, shieldgemma or json
+    categories: [Violent Crimes, Non-Violent Crimes, Sex-Related Crimes, …]  # names for S1, S2, …
+  scaling: {min: 2, max: 2}
+  profiles: [{name: cpu, engine: llamacpp}]
+
+# in a guard policy
+judge:
+  model: llama-guard-3-1b
+  input: block                 # flag or block; empty does not ask about input
+  output: flag
+  categories: [S1, S10]        # only these count; empty: any unsafe verdict
+  latency_budget: 250ms        # then the policy's fail: open serves (flagged), closed refuses
+```
+
+A model with `role: guard` is the guardrails' alone:
+
+- it is not in `/v1/models` or the chat page, and is refused (404) to
+  every key, as a name and as a fallback;
+- it is `critical` by default and must always run — on demand is refused.
+  Give it two replicas on different nodes, because every judged request
+  waits on it.
+
+The gateway's calls to it go past admission, accounting and the guardrails
+themselves.
+
+- **Formats:**
+  - `llamaguard3` reads Meta's "safe" / "unsafe
+S1,S10".
+  - `shieldgemma` asks Google's model whether the text breaks the listed
+    principles (`categories`, each a sentence) and reads Yes or No.
+  - `json` expects `{"safe": false, "categories": [...]}`.
+- **What is read:**
+  - **Input:** the request's last user turn, after the patterns.
+  - **Output:** the answer, together with that user turn. A streamed answer
+    is read every 600 characters and at the end, so text between two
+    readings has gone out already; `stream: buffer_all` holds it until it
+    is read.
+- **Cache:** the same text is not asked about twice within five minutes.
+
+## Where a policy applies
+
+`guard.default` applies everywhere. Others are attached to a part of the
+tenancy tree, and apply to everything below it:
+
+```
+llmgw ctl guard attach project:Acme/finance/payroll finance
+llmgw ctl guard attach key:key-7f3a baseline
+llmgw ctl guard list
+llmgw ctl guard detach project:Acme/finance/payroll finance
+```
+
+Policies narrow, as limits do. A policy attached lower can tighten what
+applies above it, never loosen it. Combined, they take:
+
+- the strictest mode and failure;
+- for each kind, the strictest action;
+- every deny pattern and denied tool;
+- only the tools every allow list allows;
+- the smallest limits;
+- `no_store` if any of them asks;
+- every pinned prompt, widest first.
+
+An attachment applies at once.
+
+## What a client sees
+
+**A refused request** is answered with 400:
+
+```json
+{"error": {"type": "invalid_request_error", "code": "content_policy_violation",
+           "message": "this request was refused by the gateway's policy (secret)"}}
+```
+
+It names the category, never the text, and costs nothing.
+
+**A stopped answer** ends with `finish_reason: "content_filter"`. A stream
+ends with that chunk and `[DONE]`, and the engine is cancelled. The
+Responses API reports it as `incomplete` with
+`incomplete_details.reason: "content_filter"`.
+
+**Headers:** `x-llmgw-guard` (`flagged`, `redacted`, `blocked`) and
+`x-llmgw-guard-policy` say what was done.
+
+**Streams.** A streamed answer is judged a sentence at a time. Text is held
+until a sentence, a line or 200 characters ends, released up to its last
+whitespace — so a value still arriving is never sent in two halves — and
+rewritten if needed. **What was released cannot be taken back**: a policy
+that must never let a word through uses `stream: buffer_all`, which holds
+the whole answer until it is judged.
+
+## Shadow mode
+
+`mode: shadow` judges and records — the usage row says `shadow-blocked`,
+`shadow-redacted` — and changes nothing. Run a new policy in shadow first,
+and read what it would have done before enforcing it.
+
+## What is recorded
+
+Each request's usage row has the action, policy, category and the time the
+checks took. The access log has the action, stage and policy. Neither has
+the text, a matched value, or the placeholder map: the map exists only in
+the gateway's memory while the request is served.

docs/kubernetes.md

@@ -0,0 +1,228 @@
+# llmgw and Kubernetes
+
+The control plane runs in Kubernetes, from the Helm chart in
+`deploy/helm/llmgw`. The GPU nodes do not: they stay ordinary machines,
+joined with `llmgw node add` as on any other cluster. This page says why,
+and how the two meet.
+
+## What goes where
+
+| Part | Where | Why |
+|---|---|---|
+| Control plane: the API on 8080, the agents' port 7443, the scheduler | A StatefulSet, from the chart | A Go binary with a store and three ports: what Kubernetes runs well |
+| Store | A file on a PersistentVolumeClaim (SQLite), or your PostgreSQL | Either, as on a host |
+| GPU and CPU nodes | Outside, as hosts | See below |
+| Model mirror | Outside, on a machine with a large disk | Every node pulls tens of gigabytes from it over plain HTTP; a pod with a volume that size is a host in all but name |
+
+### Why the nodes stay outside
+
+The agent on a node is not a service that happens to use a GPU. It installs
+the engines on the machine — the llama.cpp build for its driver, vLLM in a
+Python environment — checks them against their publisher's checksums and
+runs them; it chooses which GPUs each replica gets, by index and by NVLink
+topology; it starts engines as processes that outlive its own restarts, so a
+node upgrades while it serves; it writes the machine's firewall; and it
+replaces its own binary when the cluster upgrades. All of that is root on
+the host, which is exactly what a container is built to prevent.
+
+Run as a DaemonSet it would need to be privileged, with the host's network,
+process namespace and filesystem, and the NVIDIA device plugin would have to
+be kept off its GPUs — or the two would hand the same card to two owners.
+What is left is the host agent with a container's indirection around it, and
+none of the scheduling, isolation or restart guarantees that make a pod
+worth having. So the chart does not ship one, and this is the
+recommendation:
+
+- **Keep GPU machines out of Kubernetes**, and add them with `node add`.
+- **If they are already Kubernetes workers**, dedicate them: taint them so
+  no other pod lands there, keep the NVIDIA device plugin off them (most
+  installs select nodes by label — leave the label off), and run the llmgw
+  agent on the host, where `node add` puts it. llmgw then owns the GPUs, and
+  Kubernetes schedules nothing that would want them.
+
+## The image
+
+The project publishes binaries, not an image. Build one from the repository
+and push it where the cluster pulls from — at an offline site, the internal
+registry:
+
+```
+docker build -f deploy/container/Dockerfile --build-arg VERSION=v0.11.1 \
+  -t registry.internal/llmgw:v0.11.1 .
+docker push registry.internal/llmgw:v0.11.1
+```
+
+It is the static binary on a distroless base: no shell, running as user
+65532, with a read-only root filesystem in the pod.
+
+## The agent port's certificate
+
+Agents and the control plane authenticate each other with certificates from
+llmgw's own authority, and the TLS ends in the pod — so the authority's key
+stays outside the cluster, on the machine you will add nodes from, and the
+pod is given only its own certificate.
+
+Decide first the address agents will dial: the `-agents` Service is a
+LoadBalancer, so give it a fixed `agentService.loadBalancerIP` or a DNS name
+that points at it. That address has to be in the certificate:
+
+```
+llmgw ctl cert init-ca --dir ./pki
+llmgw ctl cert issue-server llmgw-ctl --host 10.0.0.200 --host llmgw-agents.example.com \
+  --dir ./pki --out ./pki
+kubectl -n llmgw create secret generic llmgw-agent-tls \
+  --from-file=ca.pem=pki/ca.pem \
+  --from-file=server.pem=pki/server.pem \
+  --from-file=server-key.pem=pki/server-key.pem
+```
+
+Keep `pki/ca-key.pem` as you would on a host: whoever holds it can make any
+node's identity.
+
+## Installing
+
+```yaml
+# values.yaml
+image:
+  repository: registry.internal/llmgw
+  tag: v0.11.1
+agentTLS:
+  existingSecret: llmgw-agent-tls
+agentService:
+  loadBalancerIP: 10.0.0.200
+ingress:
+  enabled: true
+  className: nginx
+  hosts: [{host: llm.example.com, paths: [{path: /, pathType: Prefix}]}]
+  tls: [{secretName: llm-example-com, hosts: [llm.example.com]}]
+config:
+  mirror:
+    api: http://models.internal:8082
+  # The address the router reaches nodes' engines from is a Kubernetes
+  # node's, once the pod's traffic leaves the cluster: the nodes' firewalls
+  # must let it in.
+  firewall_networks: ["10.0.1.0/24"]
+```
+
+```
+helm install llmgw deploy/helm/llmgw -n llmgw -f values.yaml
+```
+
+`config` is `server.yaml`: any key of [reference.md](reference.md), laid
+under what the chart sets itself — the listeners, where the certificates,
+the admin token and the store are mounted. A changed `config` restarts the
+pod.
+
+**The store.** By default SQLite, on a 10 GiB claim. For PostgreSQL, put its
+address in a Secret and point the chart at it:
+
+```
+kubectl -n llmgw create secret generic llmgw-store \
+  --from-literal=dsn='postgres://llmgw:…@pg.internal:5432/llmgw?sslmode=verify-full'
+```
+
+```yaml
+store:
+  type: postgres
+  postgres:
+    existingSecret: llmgw-store
+```
+
+**One control plane.** The chart runs one replica. Two against PostgreSQL
+would elect a leader and keep a standby, but a standby serves nothing and is
+never ready, so a StatefulSet rollout would wait on it for ever. Kubernetes
+replaces the one pod within seconds when it goes, and agents reconnect on
+their own; the replicas on the nodes keep serving meanwhile.
+
+**Probes.** Alive is `/health`. Ready is `/leader`, which on PostgreSQL waits
+for the lease of the pod it replaced to run out — not `/ready`, which waits
+for a model replica, and would keep a cluster with no node yet from ever
+accepting one.
+
+**Monitoring.** The metrics port, 9091, serves metrics and nothing else;
+`serviceMonitor.enabled: true` makes a ServiceMonitor for the Prometheus
+Operator, and `deploy/monitoring` holds the rules and dashboards.
+
+## Using it
+
+The admin API listens on the pod's loopback, as on a host — it can dump keys
+from the heap when profiling is on. Reach it through the pod:
+
+```
+kubectl -n llmgw exec -it statefulset/llmgw -- llmgw users create you@example.com --password '…'
+kubectl -n llmgw exec -it statefulset/llmgw -- llmgw users role you@example.com admin
+kubectl -n llmgw exec -it statefulset/llmgw -- llmgw ctl status
+```
+
+or from your machine, through a port-forward:
+
+```
+kubectl -n llmgw port-forward statefulset/llmgw 9090:9090 &
+export LLMGW_ADMIN_TOKEN=$(kubectl -n llmgw get secret llmgw-admin -o jsonpath='{.data.admin-token}' | base64 -d)
+llmgw ctl status
+```
+
+The token is made by the chart and kept across upgrades
+(`adminToken.existingSecret` brings your own).
+
+## Adding nodes
+
+From the machine holding `pki/`, with the port-forward above running and
+`LLMGW_ADMIN_TOKEN` set:
+
+```
+sudo -E llmgw node add ubuntu@gpu01 \
+  --server https://10.0.0.200:7443 --pki ./pki --admin 127.0.0.1:9090
+```
+
+`--server` is the address in the certificate. The node is installed, checked
+and started over ssh exactly as on any cluster ([node-onboarding.md](node-onboarding.md)),
+and dials the control plane in the pod. Its firewall comes from
+`firewall_networks` in the server configuration `node add` reads (`--config`,
+`/etc/llmgw/server.yaml` by default): copy the chart's out of the cluster
+first, or give `--no-firewall` and keep the engines' ports open to the
+Kubernetes nodes by hand.
+
+```
+kubectl -n llmgw get configmap llmgw -o jsonpath='{.data.server\.yaml}' > server.yaml
+sudo -E llmgw node add ubuntu@gpu01 --config ./server.yaml --server https://10.0.0.200:7443 \
+  --pki ./pki --admin 127.0.0.1:9090
+```
+
+## Offline
+
+An offline site ([install.md](install.md), "Offline sites") works the same
+way with the control plane in a pod. Import the bundle on the mirror's
+machine with `llmgw bundle import`, record its engines' checksums in a
+file, and give that file to the chart as a ConfigMap:
+
+```
+llmgw bundle trust llmgw-bundle.tar --sha256 3f2a… --file ./offline.sha256
+kubectl -n llmgw create configmap llmgw-offline --from-file=offline.sha256
+```
+
+```yaml
+offlineChecksums:
+  configMap: llmgw-offline
+config:
+  offline:
+    mirror: http://models.internal:8081
+```
+
+A later bundle: `bundle trust` into the same file, and replace the ConfigMap
+(`kubectl create configmap … --dry-run=client -o yaml | kubectl apply -f -`).
+The control plane reads the file again when it changes; there is no restart.
+
+## What has and has not been tried
+
+The chart is checked with `helm lint` and `helm template` for SQLite,
+PostgreSQL, an Ingress, a ServiceMonitor and an offline cluster, and refuses
+what would not work — no image, no certificate, a PostgreSQL store without
+its address, more than one replica. The image has been run the way the
+chart runs it — read-only root, user 65532, the same files mounted at the
+same paths, SQLite on a volume — and answered `/health`, `/leader` and
+`/metrics`, with `llmgw ctl` and `llmgw users` working through `exec`.
+
+It has **not** been installed on a Kubernetes cluster, and no node has yet
+joined a control plane running in one. Until it has, a control plane on a
+host is the well-trodden path.

docs/node-onboarding.md

@@ -4,24 +4,16 @@ Written for whoever runs the cluster.
 
 ## The short version
 
-Where one person holds both the hypervisor and the certificate authority —
-which is the common case — one command does the whole thing in about
-45 seconds:
+On the control plane:
 
 ```
-llmgw-add-node \
-  --name llmgw-node05 --ip 10.0.0.145/24 \
-  --server https://10.0.0.140:7443 \
-  --cores 8 --memory 32768 --disk 60 \
-  --llamacpp-bin /opt/llama.cpp/llama-server
+sudo llmgw node add ubuntu@10.0.0.145
 ```
 
-The VMID defaults to the last octet of the address, so `qm list` and
-`llmgw ctl nodes` stay in the same order. `--provision-only` and
-`--onboard-only` split it back into the two halves below when the two kinds
-of access belong to different people.
-
-The rest of this page is what that command does, and what it still does not.
+That is all a machine that already exists needs — bare metal, or a VM you
+built. [install.md](install.md#5-adding-the-node) says what it does. On
+Proxmox, the machine itself can be built first by the script below, on the
+hypervisor.
 
 ## The two halves
 
@@ -54,41 +46,31 @@ their working tree.
 
 ## 2. The identity
 
-On the host that holds the certificate authority — this is the part that cannot
-be delegated, because it issues the credential by which the control plane
-believes the node is who it says it is:
+On the control plane, which holds the certificate authority — this is the
+part that cannot be delegated, because it issues the credential by which the
+control plane believes the node is who it says it is:
 
 ```
-llmgw-onboard-node \
-  --node llmgw-node04 \
-  --addr 10.0.0.144 \
-  --server https://10.0.0.140:7443 \
-  --fabric ib-b
+sudo llmgw node add ilker@10.0.0.144 --fabric ib-b:mlx5_0,mlx5_1
 ```
 
-It issues a client certificate whose common name is the node id, installs it
-along with the CA root, trusts that root system-wide so other tooling on the
-machine stops treating llmgw's certificates as strangers, installs the binary
-and the unit, and starts the agent. The node appears in `llmgw ctl nodes` within
-a few seconds.
+It checks the machine with `llmgw doctor`, issues a client certificate whose
+common name is the node id (the hostname), installs it along with the CA root,
+trusts that root system-wide, installs the binary and the unit, starts the
+agent, and waits for the node to join.
 
-If it does not, the control plane's log says why. A certificate whose common
-name does not match the claimed node id is refused by design — that check is
-what makes a node's identity something it proves rather than something it picks.
+If it does not join, the agent's log on the node says why. A certificate whose
+common name does not match the claimed node id is refused by design — that
+check is what makes a node's identity something it proves rather than
+something it picks.
 
-**It needs ssh from the CA host to the node.** Provisioning copies that host's
-`authorized_keys` into the new machine, so a node built by the script above
-already satisfies it; an older machine may need the key added.
+**It needs SSH from the control plane to the node.** Provisioning copies the
+hypervisor's `authorized_keys` into the new machine; with `ssh -A` to the
+control plane and `sudo --preserve-env=SSH_AUTH_SOCK`, the same key that
+reaches the hypervisor reaches the node.
 
-It waits for ssh rather than failing on it, and learns the host key of a machine
-it has not seen (`accept-new`, which still refuses a *changed* key — the risk
-being guarded against is a substituted machine, not a new one). Both are needed
-to run the halves back to back: for the first minute of its life a new machine
-is still regenerating host keys and restarting sshd, so it refuses connections
-it accepted a moment earlier.
-
-It also checks that a configured engine actually runs, which is cheap here and
-expensive later — see below.
+`deploy/bootstrap/onboard-node.sh` is the script this replaced, for a machine
+holding an authority but not a current llmgw.
 
 ## The CPU model matters, and its default is wrong
 
@@ -116,32 +98,23 @@ The trade is live migration: a VM pinned to the host CPU cannot move to a
 machine with a different one. For a node whose job is arithmetic that is the
 right way round, and `--cpu` overrides it where it is not.
 
-## What onboarding does not do
+## Engines
 
-It gives a machine an identity and an agent. It does **not** install inference
-engines or model weights, and a node missing either looks healthy in
-`llmgw ctl nodes` right up until a replica is placed on it and the shard dies
-with "executable file not found".
+The script installs none, and does not need to: once the agent is connected,
+the control plane tells it which engines to have and it installs them itself
+— llama.cpp on every node, vLLM on every node with an NVIDIA GPU it can run
+on, SGLang where the control plane names a version. Each is checked to run
+before the node offers it, so a node never advertises an engine that cannot
+start. [install.md](install.md#engines) says what vLLM needs of the node.
 
-Onboarding does check that an engine you point it at can be executed, and says
-so loudly when it cannot. That check exists because the failure is invisible
-otherwise: `llama-server` on node05 was present, executable, and could not start
-for want of `libgomp1`, and the node reported `ready` in `llmgw ctl nodes` the
-whole time. Being told at onboarding beats finding out when a replica is placed
-and the reason is three logs away.
+`--llamacpp-bin`, `--vllm-bin` and `--sglang-python` are for an engine you
+installed yourself. For the agent to use yours rather than install its own,
+also set that engine's version to `""` under `engines` in `server.yaml`.
 
-So the node is not finished until:
-
-- the engines its catalog profiles name are installed (`vllm`, `sglang`,
-  `llama-server`), at the paths the agent configuration gives
-- the weights are on disk, at the `source` each model declares
-
-Both are deliberately outside this script. Engines are a platform decision with
-versions and drivers attached, and distributing weights is its own problem —
-hundreds of gigabytes that want a shared filesystem or a cache, not an scp from
-a laptop. llmgw will fetch weights for a model whose `source` is a URL, one
-copy per node, which covers the simple case; anything larger stays the
-operator's arrangement, and llmgw is content to find the files already there.
+Weights are the other thing a node needs. llmgw fetches them for a model whose
+`source` is a URL, one copy per node, which covers the simple case; anything
+larger — a shared filesystem, a cache — stays the operator's arrangement, and
+llmgw is content to find the files already there.
 
 The `sim` engine needs neither, which is what makes it useful for exercising
 everything else.
@@ -178,18 +151,24 @@ was cut short.
 
 ## Fabrics
 
-`--fabric` is how a node says which InfiniBand fabric it is attached to, and
-there is no way around stating it. OpenSM's default subnet prefix is `fe80::` on
-every fabric, so a matching prefix proves nothing and a wrong guess produces a
-replica that starts, passes health checks, and then hangs on its first
-all-reduce.
+`--fabric` is how a node says which InfiniBand fabric it is attached to. The
+name is checked against what the adapters report — every port on one fabric
+sees the same subnet managers — so two independent fabrics given one name are
+placed as two, and the cluster page says so; give each fabric its own name.
+The agent installs `infiniband-diags`, which that check needs, if it is missing.
+
+Before a node with a fabric joins, run `sudo llmgw doctor` on it: it checks the
+subnet manager, GPUDirect RDMA, the fabric manager and IMEX on NVLink machines,
+and the declared fabrics against the adapters. [fabrics.md](fabrics.md) has the
+rest.
 
 Omit it for a node with no fabric. Such a node is its own island: it can host
 single-node replicas and will never be given a multi-node one.
 
 Two adapters per fabric is the default; `--fabric ib-b:mlx5_2,mlx5_3` names them
 explicitly. An adapter must never appear under two fabrics — the agent refuses
-that configuration, because the consequence is the hang above.
+that configuration: a replica given adapters on two fabrics starts, passes its
+health checks, and hangs on its first all-reduce.
 
 ## Where the driver is
 

docs/onboarding.md

@@ -39,16 +39,45 @@ The landing page then links to it, and the rest is:
 
 ```
 llmgw users list --pending --store …
-ID                    EMAIL              NAME   STATE    PROJECT  SIGNED UP
-usr-k4mq…             ayse@example.com   Ayşe   pending  -        4m12s ago
+ID          EMAIL              STATE    ADMIN  MEMBER OF     SIGNED UP
+usr-k4mq…   ayse@example.com   pending  -      on their own  4m12s ago
 
-llmgw users approve usr-k4mq… --project default --by ilker --store …
+llmgw users approve ayse@example.com --by ilker --store …
+llmgw users approve ayse@example.com --project Acme/ml/training --store …   # or straight into a project
 ```
 
 That is the whole operator loop. From then on they sign in at `/login`, and
-`/profile` is where they create keys, see when each was last used, and revoke the
-ones they are done with. A key is shown once on the page that creates it and
-never again.
+their account page (`/profile`) is where they create keys, see when each was
+last used, revoke the ones they are done with, and see their own use over the
+last thirty days against every budget that applies to them. A key is shown once
+on the page that creates it and never again.
+
+### Connecting an editor
+
+The account page's **Connect your editor** makes a key for Continue, Codex or
+Cline and shows what the tool needs with that key, this gateway's address and a
+model already in it:
+
+- **Continue** — an assistant file of its own, `~/.continue/assistants/llmgw.yaml`,
+  so their `config.yaml` is not touched.
+- **Codex** — a provider and a profile in `~/.codex/config.toml`, run with
+  `codex --profile llmgw`; their default model stays as it was. Codex speaks the
+  Responses API, which the gateway translates at `/v1/responses`.
+- **Cline** — four settings to paste into its own screen, since it keeps them
+  in VS Code's secret storage where no file reaches.
+- **Claude Code** — not on the page yet; it speaks Anthropic's Messages API,
+  which the gateway translates at `/v1/messages`:
+  `ANTHROPIC_BASE_URL=https://<gateway> ANTHROPIC_AUTH_TOKEN=<key>
+  ANTHROPIC_MODEL=<model> ANTHROPIC_SMALL_FAST_MODEL=<model> claude`. It
+  needs a model that calls tools well.
+
+For Continue and Codex there is a one-line command,
+`curl -fsSL <gateway>/setup/<tool>?model=… | sh`. Its script is served without
+signing in and holds no secret — the key comes from the environment — and it
+keeps a copy of anything it replaces. Revoking the key disconnects the tool.
+
+How well an editor's agent mode works depends on the model: it needs one that
+calls tools well, which the coder models do and small general ones often do not.
 
 **This gateway sends no email.** There is no "your account was approved" message
 and no password reset, so tell people what to expect: they sign up, they tell
@@ -88,11 +117,91 @@ means anything.
 If you have no structure yet, one of each is fine:
 
 ```
-llmgw keys init --store … --org mynodes --team default --project default
+llmgw org add org mynodes
+llmgw org add team default --in mynodes
+llmgw org add project default --in mynodes/default
+llmgw org tree --people
 ```
 
-It is idempotent: running it again renames rather than duplicating, so it can
-live in whatever provisions the machine.
+Everything that takes an organization, team or project — here, in `users` and
+in `keys` — accepts its id, its path (`mynodes/default/default`) or its name
+when the name is unique, so an id never has to be copied off a page. When there
+is only one project, `--project` can be left out.
+
+The tree is not fixed once made:
+
+```
+llmgw org rename project Acme/platform/gateway api-gateway
+llmgw org move project Acme/platform/gateway --to Scania/ml
+llmgw org remove team Acme/old                 # only when nothing is in it
+llmgw users delete ayse@example.com --yes      # signs out, revokes their keys
+llmgw keys list --all                          # every key, where it spends, and whose
+```
+
+A project that ever had a key cannot be removed, because usage history refers
+to it — rename it instead.
+
+### Where people belong
+
+A person can be a member of any number of organizations, teams and projects, or
+of none:
+
+```
+llmgw users join ayse@example.com --team Acme/ml          # every project in ml
+llmgw users join ayse@example.com --project Scania/research/vision
+llmgw users leave ayse@example.com --project Acme/ml/training
+```
+
+A member of a team or organization may use every project in it. Leaving revokes
+the keys the person made in projects they can no longer reach; a project they
+still reach through another membership keeps them.
+
+Someone who is a member of nothing still uses the gateway, on their own:
+personal keys, and the chat page, within their personal limits. When they make
+a key on `/profile` they choose what it spends against — one of their projects,
+or "Personal". An operator can do the same:
+
+```
+llmgw keys create laptop --for ayse@example.com                      # personal
+llmgw keys create ci --for ayse@example.com --project Acme/ml/training
+```
+
+Personal use can be limited by default, or turned off so people use the gateway
+only through their projects:
+
+```yaml
+auth:
+  personal:
+    rpm: 20
+    tpm: 50000
+    budget: 10        # whole units
+    period: month
+    # disabled: true
+```
+
+A personal key has no project, so it keeps no conversations or agent notes;
+those are kept per project.
+
+### Organization managers
+
+A member of an organization can be made its manager:
+
+```
+llmgw users join boss@acme.com --org Acme --role manager
+```
+
+or with the star on their organization membership on `/admin/users`. A manager
+gets an **Organization** link and a page at `/org`: usage over time by team,
+project or person, the teams and projects with their limits and spend, and every
+member. Only what was spent in that organization's projects is on it; what its
+people do elsewhere is not. The page is read-only — a manager is not an
+administrator of the cluster, and limits and memberships stay with those who
+are. An administrator following `/org` lands on the same organization's panel
+on the people page instead, where all of that can be changed.
+
+`llmgw keys init` still works for provisioning scripts and is idempotent, but it
+will no longer move a team or project that already exists under another parent;
+it says so and stops.
 
 Split it when you want separate limits or separate reporting, not before.
 
@@ -156,18 +265,34 @@ Allowlists compose by intersection: a key cannot add a model its team withheld.
 A model's canonical name and any of its aliases name the same thing, so either
 form works.
 
-Budgets are counted in micro-units, and what a unit means is yours to decide.
-Self-hosted models have no per-token price, so it can be GPU-seconds, a notional
-rate, or 1 000 000 everywhere — which turns a budget into a plain token quota.
+Budgets are given in whole units, as the Limits tab shows them, and what a unit
+means is yours to decide. Self-hosted models have no per-token price, so it can
+be GPU-seconds, a notional rate, or one unit per thousand tokens everywhere —
+a price of 1 000 000 in `auth.pricing`, which is in micro-units — and a budget
+becomes a plain quota of thousands of tokens.
 Models are priced in the server's `auth.pricing` section; a model priced at zero
 is exempt from budget checks, which is what lets a key with nothing left still be
 served a cheap fallback.
 
 ```
-llmgw keys limits --store … --scope project --id default \
-  --budget 50000000 --period month        # 50 units a month
+llmgw keys limits --store … --scope project --id Acme/platform/gateway \
+  --budget 50 --period month              # 50 units a month
 ```
 
+Two more kinds of limit follow people rather than the tree:
+
+```
+# A person, everywhere: every key they hold, every project, the chat page
+llmgw keys limits --scope user --id ayse@example.com --budget 25
+
+# Each member of a project separately — a fair share, not one shared pool
+llmgw keys limits --scope project --id Acme/ml/training --per-member --rpm 20
+```
+
+A request is held to all of them at once: the key's own, its project's, team's
+and organization's, each per-member limit on those for its owner, and the
+owner's own. The strictest wins, and each is counted in its own pool.
+
 ## The landing page
 
 Someone who reaches the gateway without a key sees the landing page. Tell it who
@@ -184,6 +309,28 @@ shown as text. Other schemes are never linked — configuration is not always
 written by whoever runs the gateway, and a `javascript:` href on a page served to
 every visitor is a short path to a stored XSS.
 
+## The docs portal
+
+The gateway also serves its manual at `/docs`: these pages, rendered, with
+[clients.md](clients.md) — how to use the gateway from the official OpenAI
+and Anthropic SDKs — first on its index. The landing page and the account
+page link to it, so a user's questions about streaming, tools or the Anthropic
+SDK have an answer that is not you.
+
+It is public, like the landing page. The client guide is for the person who
+has no account yet, and the operator documents describe llmgw in general —
+no address, model, node or key of this installation — which is what the
+project's repository publishes anyway. A site that would rather not say even
+that turns sign-in on:
+
+```yaml
+landing:
+  docs_sign_in: true
+```
+
+A visitor is then sent to sign in first. On a gateway with API keys and no
+accounts, the portal asks for a key instead, like the API.
+
 ## What the user sees
 
 They open the link, press the button, and get the key once. The page shows them
@@ -205,8 +352,15 @@ llmgw keys list --store … --project default
 minute. It is the column that tells you whether a key is still in use, which is
 what makes rotation safe:
 
-**To rotate**, issue the new key, let both work while the user switches, watch
-`LAST USED` on the old one stop moving, then revoke it.
+**To rotate**, `llmgw keys rotate <key-id> --overlap 48h` issues a new key with
+the same project, owner and limits and lets the old one work for the overlap,
+then stop. Watch `LAST USED` on the old one stop moving before it runs out.
+
+**To cap how long keys live**, `llmgw keys ttl project:Acme/ml/train 720h` (or
+`team:`, `org:`; `off` removes it), and `auth.max_key_ttl` in server.yaml for
+every key. A key is made within the shortest limit that applies, and one asked
+for without an expiry gets that limit. `keys list --all` shows each key's kind
+— service (a project's), member, personal — and when it expires.
 
 ```
 llmgw keys revoke --store … key-mpmip77twpt7qaxc
@@ -286,9 +440,23 @@ page exists.
 
 ## Managing accounts from the browser
 
-`/admin/users` lists who is waiting and who is active. Approving (into a project)
-and suspending are there, because that is the work an operator does constantly
-and it should not need a terminal.
+`/admin/users` is the tree: organizations, teams and projects, each project
+opening onto its members and its keys. From there an admin approves people
+(into a project or on their own), adds them to and takes them out of
+organizations, teams and projects, suspends and removes them, revokes keys, and
+adds, renames, moves and removes organizations, teams and projects. A
+searchable list of every account is at the bottom. Choosing any organization,
+team, project or person opens a panel beside the tree with its limits, its
+capacity quota and its use over the last week, and its limits can be changed
+there.
+
+The same page has two more tabs, each at the address it had as a page of its
+own: **Limits** (`/admin/quotas`) is every limit in the tree at once — per
+branch, per member of any part of it, and per person — with the capacity quotas;
+**Usage** (`/admin/usage`) is the cluster's use over time by organization, team,
+project or person, and the GPU time each owner held. The page works as plain
+forms; with scripts on, a change updates it in place and the projects you had
+open stay open.
 
 Three things are deliberately not there:
 
@@ -299,21 +467,26 @@ Three things are deliberately not there:
 | `llmgw keys create` | Issuing a credential on another person's behalf |
 
 Each of those turns a stolen admin cookie into more than it was, and each is
-rare enough that a shell is no hardship. Cordon, drain and everything else that
-touches the cluster are also CLI-only for the same reason: the dashboard shows
-the cluster, it does not steer it.
+rare enough that a shell is no hardship. Cordon and drain are CLI-only for the
+same reason; what the pages do change on the cluster — serving models through
+the mirror, a node's engines — needs the `operator` or `admin` staff role.
 
-Every administrative action is logged with who did it, including the ones that
-were refused.
+Every administrative change is recorded in the audit log — who, when, through
+what, the fields given with secrets taken out, and how it ended, refusals
+included: `llmgw ctl audit`, or **Audit** in the console.
 
 ## What this does not do
 
 - **No email.** No approval notice, no self-service password reset, no address
   verification. The loop is manual on purpose at this size; if it stops being
   the right size, that is the thing to automate.
-- **No SSO.** Accounts are local, with local passwords.
-- **No roles.** There is one flag, `is_admin`, and it grants looking at the
-  dashboard. Everything else an administrator does is the CLI, and having a
-  shell here is what makes someone one.
+- **Single sign-on is optional.** With `auth.oidc` people sign in through
+  your identity provider, and SCIM 2.0 (`auth.scim`) creates, updates and
+  suspends accounts from it; see [install.md](install.md#single-sign-on).
+  Without them accounts are local, with local passwords.
+- **Staff roles are coarse.** `viewer`, `operator`, `billing` and `admin`
+  (`llmgw users role`) decide what someone may see and do under /admin; an
+  organization's manager can view it but not change it. Every change is in
+  the audit log (`llmgw ctl audit`).
 - **Rate limits are per gateway instance.** With two instances each counts its own,
   so the effective limit doubles. v1 is single-instance by design.

docs/quick-install.md

@@ -0,0 +1,220 @@
+# Quick install
+
+From empty servers to a model answering requests, in six steps. This page
+has only the commands and what to check after each; [install.md](install.md)
+explains every choice.
+
+## What you need
+
+| | |
+|---|---|
+| **A control plane** | One machine, or three for high availability (the store replicated, either one able to take over). Linux, x86-64 or ARM64: Debian 12, Ubuntu 22.04+ or RHEL 10. No GPU needed; 2 GB RAM, 20 GB disk each — 8 GB RAM when it is also a node running the starter model and the two judges. |
+| **GPU nodes** (optional to start) | The same Linux, with the NVIDIA driver installed. vLLM needs driver 525 or newer and a Turing GPU or newer; a V100 gets an older vLLM. |
+| **root** | on the control plane. On the other two of a three-machine setup, `sudo` (its password is asked for if it needs one); on nodes, `sudo` without a password. |
+| **SSH** | from the control plane to the other machines. The setup screens take a key, the ssh agent or a password; `node add` uses ssh keys. A machine nothing may log into joins with a code instead (`llmgw join`). |
+| **Network** | nodes reach the control plane on 7443 and 8081; users reach it on 8080. The machines need internet access to download engines and models. |
+
+You do not install llama.cpp, vLLM, Python or CUDA. The nodes do that
+themselves once they join.
+
+## 1. Put llmgw on the control plane
+
+```
+VERSION=$(curl -fsSL https://gitea.mynodes.xyz/api/v1/repos/ilker/llmgw/releases/latest \
+  | grep -o '"tag_name":"[^"]*"' | cut -d'"' -f4)
+U=https://gitea.mynodes.xyz/ilker/llmgw/releases/download/$VERSION
+curl -fsSLO $U/llmgw-$VERSION-linux-amd64          # -linux-arm64 on ARM
+curl -fsSL $U/checksums.txt | sha256sum -c --ignore-missing
+sudo install -m0755 llmgw-$VERSION-linux-amd64 /usr/local/bin/llmgw
+llmgw --version
+```
+
+`sha256sum` must print `OK`. If it does not, the download is damaged; do not
+install it.
+
+## 2. Set up the control plane
+
+```
+sudo llmgw
+```
+
+With nothing installed, `llmgw` opens the setup screens. They ask whether
+this is **one machine or three** (high availability), and for three, the
+other two: address, user, and an ssh key, the ssh agent or a password. They
+check every machine before installing anything — system, disk, clock, ports,
+internet, whether the machines reach one another — show the plan, and
+install:
+
+- the service, its certificates and its configuration, and a firewall for
+  its internal ports;
+- with three machines, the store replicated across them (PostgreSQL under
+  Patroni);
+- your administrator account. **The password is shown once. Copy it now.**
+- a model mirror, which downloads model files once for the whole cluster;
+- this machine as a first node, and a small model (Qwen2.5 0.5B) on it;
+- guardrails on every request, with a judge model (Llama Guard 3 1B, two
+  replicas) on CPUs — a request it cannot check is refused, not let through — and API keys that expire within 90 days. What is hardened, and how
+  to loosen it: [install.md](install.md#2-the-control-plane).
+
+Run again later, `sudo llmgw` is the console: the cluster's state and
+everything you can do to it ([console.md](console.md)). Every step below is
+also there, under **Do**.
+
+**In a script**, the same for one machine:
+
+```
+sudo llmgw server init --admin you@example.com
+```
+
+If nodes will reach this machine by a name or address it does not know itself
+(a DNS name, a NAT address), add `--host` for each:
+`--host llm.example.com`. It is safe to run again: it keeps what exists and
+finishes what is missing.
+
+**The mirror on its own machine**, when it wants a larger disk than the
+control plane has: first on that machine, with llmgw installed as in step 1,
+
+```
+sudo llmgw mirror init --control-plane <control plane address>
+```
+
+then on the control plane `sudo llmgw server init --mirror http://<mirror
+address>:8082`. The mirror serves model files to every node, and takes
+orders only from the control plane. Untick "This machine as a node" in the
+form (or add `--no-node`) to keep models off the control plane; the starter
+model then starts on the first node you add.
+
+**Check:** open `http://<control-plane>:8080/chat`, sign in with the printed
+password, and ask something. The small model answers. Change the password on
+the account page.
+
+## 3. Add the GPU nodes
+
+In the console, **Do → Add a node**. Or on the control plane:
+
+```
+sudo llmgw node add ubuntu@10.0.0.21
+```
+
+Several at once: `sudo llmgw node add ubuntu@10.0.0.21 ubuntu@10.0.0.22 ubuntu@10.0.0.23`.
+
+Replace `ubuntu` with the user you log in to the node as, and `10.0.0.21` with
+its address. That user needs `sudo` without a password on the node.
+
+It logs in over SSH and, while you watch:
+
+1. installs llmgw on the node, the release for its processor, checksum checked;
+2. runs `llmgw doctor` there, and stops if the node has a problem. Each problem
+   comes with the command that fixes it. Fix it and run the same command again;
+3. gives the node its certificate and configuration, and starts its agent;
+4. waits for the node to join and install llama.cpp.
+
+The node's name in the cluster is its hostname. vLLM installs by itself after
+that, in a few more minutes on a GPU node (about 8 GB). The cluster page
+(`/admin`) shows its progress, or why the node cannot run it.
+
+**InfiniBand.** When the node's adapters are up, `node add` shows them grouped
+by the fabric they are on and asks for each fabric's name. Give every node on
+the same fabric the same name. In a script, give it instead:
+
+```
+sudo llmgw node add ubuntu@10.0.0.21 --fabric ib-a:mlx5_0,mlx5_1,mlx5_2,mlx5_3
+```
+
+Once two nodes on a fabric are in, check they reach each other at the link's
+rate before placing anything across them:
+
+```
+llmgw ctl fabric-test gpu01 gpu02
+```
+
+**If it cannot log in.** `sudo` runs SSH as root, with root's keys. To use your
+own keys instead, log in to the control plane with `ssh -A` and keep your
+agent through sudo:
+
+```
+sudo --preserve-env=SSH_AUTH_SOCK llmgw node add ubuntu@10.0.0.21
+```
+
+**Check:** `llmgw ctl nodes` lists the node. Running `node add` again on the
+same node is safe: it renews its certificate and configuration, and keeps what
+runs there.
+
+A machine retired for good is removed with `llmgw node remove <name>` once its
+agent is stopped.
+
+## 4. Add a model
+
+Open `/admin/mirror` and choose **Explore models**. It lists what is popular on
+Hugging Face, showing only what your nodes can run.
+
+1. Click a model to read its card.
+2. Pick one of its files, usually a `q4_k_m` for a first try, and click
+   **Fetch**. It is downloaded into the mirror once, for every node.
+3. When the download finishes, click **serve** on its row in the table above.
+4. In the form, choose how it runs: **always on**, or **on demand**, which
+   loads it on the first request and stops it after 15 minutes unused. Click
+   **Add to the catalog**.
+
+The model is placed on a node that fits it, and its status on `/admin` turns
+`ready`.
+
+**Check:** the model appears in the list on `/chat`. Ask it something.
+
+## 5. Give people access
+
+**A key for a program:** each person makes their own on the account page
+(`/profile`). The key is shown once.
+
+```
+curl http://<control-plane>:8080/v1/chat/completions \
+  -H "Authorization: Bearer $LLMGW_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"model": "<model-name>", "messages": [{"role": "user", "content": "hello"}]}'
+```
+
+Any OpenAI client works. Only the base URL changes:
+`http://<control-plane>:8080/v1`.
+
+**An editor:** the account page connects Continue, Codex or Cline. Pick the
+tool and a model, and it gives a one-line command that writes the
+configuration.
+
+**Other people's accounts:** they sign up at `/signup`, and you approve them on
+the people page (`/admin/users`).
+
+## 6. Put it behind HTTPS
+
+Port 8080 is plain HTTP. Before users outside a trusted network use it, put a
+reverse proxy in front with a real certificate. With Caddy, which gets the
+certificate by itself:
+
+```
+sudo apt-get install -y caddy          # Debian and Ubuntu
+curl -fsSL $U/Caddyfile | sed 's/llm.example.com/YOUR.DOMAIN/' | sudo tee /etc/caddy/Caddyfile
+sudo systemctl reload caddy
+```
+
+Keep 7443 (nodes) and 8081 (mirror) on the internal network. They never go
+through the proxy. There is an nginx configuration too:
+[deploy/proxy/](../deploy/proxy/).
+
+## When something does not work
+
+| What you see | What to do |
+|---|---|
+| `node add` stops at `join` | `sudo journalctl -u llmgw-agent -n 50` on the node. Usually it cannot reach port 7443 on the control plane. |
+| `node add` says the address is not in the certificate | Run `sudo llmgw server init --host <that address>`, then `node add` again. |
+| A node says it cannot run vLLM | The reason is on `/admin`: the driver is older than 580, the GPU is older than Turing, or there is less than 25 GB free. |
+| A model shows `not placed` | `llmgw ctl explain-placement <model>` names each node and why it was not used. |
+| A reply stops after 60 seconds behind nginx | Use the nginx configuration from the release. Its timeouts are set for slow models. |
+| Anything else about a node | `sudo llmgw doctor` on it. `--json` writes everything it read, to send to whoever helps you. |
+
+## Next
+
+- [install.md](install.md): the same steps with every option explained, and
+  running the cluster after: monitoring, notifications, single sign-on,
+  backups, upgrades.
+- [console.md](console.md): everything the console does.
+- [fabrics.md](fabrics.md): InfiniBand and NVLink.
+- [onboarding.md](onboarding.md): accounts, projects, budgets and keys.

go.mod

@@ -1,49 +1,95 @@
 module gitea.mynodes.xyz/ilker/llmgw
 
-go 1.26.3
+go 1.26.6
 
 require (
 	connectrpc.com/connect v1.21.0
+	filippo.io/age v1.3.2
 	github.com/NVIDIA/go-nvml v0.13.4-0
 	github.com/cespare/xxhash/v2 v2.3.0
+	github.com/charmbracelet/bubbletea v1.3.10
+	github.com/charmbracelet/lipgloss v1.1.0
+	github.com/charmbracelet/x/ansi v0.11.6
+	github.com/coreos/go-oidc/v3 v3.21.0
+	github.com/go-jose/go-jose/v4 v4.1.4
+	github.com/go-zeromq/zmq4 v0.17.0
 	github.com/jackc/pgx/v5 v5.11.0
 	github.com/knadh/koanf/parsers/yaml v1.1.1
 	github.com/knadh/koanf/providers/env/v2 v2.0.1
 	github.com/knadh/koanf/providers/file v1.2.1
 	github.com/knadh/koanf/v2 v2.3.6
+	github.com/mattn/go-isatty v0.0.24
 	github.com/prometheus/client_golang v1.24.1
 	github.com/prometheus/client_model v0.6.3
 	github.com/prometheus/common v0.71.0
 	github.com/spf13/cobra v1.10.2
+	github.com/vmihailenco/msgpack/v5 v5.4.1
+	github.com/yuin/goldmark v1.8.6
+	go.opentelemetry.io/otel v1.46.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0
+	go.opentelemetry.io/otel/sdk v1.46.0
+	go.opentelemetry.io/otel/trace v1.46.0
+	go.yaml.in/yaml/v3 v3.0.5
 	golang.org/x/crypto v0.57.0
 	golang.org/x/net v0.59.0
+	golang.org/x/oauth2 v0.37.0
 	golang.org/x/sync v0.23.0
+	golang.org/x/text v0.42.0
 	google.golang.org/protobuf v1.36.12
 	modernc.org/sqlite v1.59.0
 )
 
 require (
+	filippo.io/edwards25519 v1.2.0 // indirect
+	filippo.io/hpke v0.4.0 // indirect
+	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/charmbracelet/colorprofile v0.4.1 // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
+	github.com/charmbracelet/x/term v0.2.2 // indirect
+	github.com/clipperhouse/displaywidth v0.9.0 // indirect
+	github.com/clipperhouse/stringish v0.1.1 // indirect
+	github.com/clipperhouse/uax29/v2 v2.5.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/go-zeromq/goczmq/v4 v4.2.2 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/knadh/koanf/maps v0.1.2 // indirect
-	github.com/mattn/go-isatty v0.0.24 // indirect
+	github.com/kylelemons/godebug v1.1.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
+	github.com/mattn/go-localereader v0.0.1 // indirect
+	github.com/mattn/go-runewidth v0.0.19 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
+	github.com/muesli/cancelreader v0.2.2 // indirect
+	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
-	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect
+	go.opentelemetry.io/otel/metric v1.46.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
-	golang.org/x/text v0.42.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
+	google.golang.org/grpc v1.83.1 // indirect
 	modernc.org/libc v1.75.7 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.12.1 // indirect

go.sum

@@ -1,25 +1,74 @@
+c2sp.org/CCTV/age v0.0.0-20260829155415-4448f2097b2d h1:Blprhc2SbChNZtWcU+BLTM4YdoqYAS9V7cJgOwJKyAs=
+c2sp.org/CCTV/age v0.0.0-20260829155415-4448f2097b2d/go.mod h1:SrHC2C7r5GkDk8R+NFVzYy/sdj0Ypg9htaPXQq5Cqeo=
 connectrpc.com/connect v1.21.0 h1:LhqSJt7jHf5NJBo9Jq/t/9FjcYAideif0mg+qe2jCUs=
 connectrpc.com/connect v1.21.0/go.mod h1:A2ygJrukXwWy32vkCAAHNVguZrqZ+jeZ9rGRnGR4dN4=
+filippo.io/age v1.3.2 h1:r6RSZLFSMm6rzKepZ7ZAYkKCu14f3/Me8c7uKYh7C8c=
+filippo.io/age v1.3.2/go.mod h1:TH/Yr2sSRhCKbaH4XPxpUV0Us8Gv6txYUpiZQWz8Evk=
+filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
+filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
+filippo.io/hpke v0.4.0 h1:p575VVQ6ted4pL+it6M00V/f2qTZITO0zgmdKCkd5+A=
+filippo.io/hpke v0.4.0/go.mod h1:EmAN849/P3qdeK+PCMkDpDm83vRHM5cDipBJ8xbQLVY=
 github.com/NVIDIA/go-nvml v0.13.4-0 h1:o3jp9u2x1R9ShFE3v+Aesp55XOSIQFMJz/VGNUcJaNE=
 github.com/NVIDIA/go-nvml v0.13.4-0/go.mod h1:id63qwpoDWpFXwnwM6psDCSqW4BmNu6mWpr4YeQtPGo=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=
+github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4=
+github.com/charmbracelet/colorprofile v0.4.1 h1:a1lO03qTrSIRaK8c3JRxJDZOvhvIeSco3ej+ngLk1kk=
+github.com/charmbracelet/colorprofile v0.4.1/go.mod h1:U1d9Dljmdf9DLegaJ0nGZNJvoXAhayhmidOdcBwAvKk=
+github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
+github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
+github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=
+github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=
+github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=
+github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q=
+github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
+github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
+github.com/clipperhouse/displaywidth v0.9.0 h1:Qb4KOhYwRiN3viMv1v/3cTBlz3AcAZX3+y9OLhMtAtA=
+github.com/clipperhouse/displaywidth v0.9.0/go.mod h1:aCAAqTlh4GIVkhQnJpbL0T/WfcrJXHcj8C0yjYcjOZA=
+github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfatpWHKCs=
+github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEXNWYXQgCt4hdOzA=
+github.com/clipperhouse/uax29/v2 v2.5.0 h1:x7T0T4eTHDONxFJsL94uKNKPHrclyFI0lm7+w94cO8U=
+github.com/clipperhouse/uax29/v2 v2.5.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
+github.com/coreos/go-oidc/v3 v3.21.0 h1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=
+github.com/coreos/go-oidc/v3 v3.21.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
-github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-zeromq/goczmq/v4 v4.2.2 h1:HAJN+i+3NW55ijMJJhk7oWxHKXgAuSBkoFfvr8bYj4U=
+github.com/go-zeromq/goczmq/v4 v4.2.2/go.mod h1:Sm/lxrfxP/Oxqs0tnHD6WAhwkWrx+S+1MRrKzcxoaYE=
+github.com/go-zeromq/zmq4 v0.17.0 h1:r12/XdqPeRbuaF4C3QZJeWCt7a5vpJbslDH1rTXF+Kc=
+github.com/go-zeromq/zmq4 v0.17.0/go.mod h1:EQxjJD92qKnrsVMzAnx62giD6uJIPi1dMGZ781iCDtY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -46,12 +95,24 @@ github.com/knadh/koanf/v2 v2.3.6 h1:JoQPSJmvS4aP0xNc8xMDr5tcrkSEInL23/Il7pITAKo=
 github.com/knadh/koanf/v2 v2.3.6/go.mod h1:gRb40VRAbd4iJMYYD5IxZ6hfuopFcXBpc9bbQpZwo28=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
+github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
+github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
+github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=
+github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
+github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
+github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
+github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
+github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
@@ -67,6 +128,8 @@ github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+
 github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
+github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
@@ -77,6 +140,32 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IUPn0Bjt8=
+github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
+github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
+github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
+github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+github.com/yuin/goldmark v1.8.6 h1:d0VcaP1sx9GkFVkoW+KtggpGi2KZ965i14b0+bDQST4=
+github.com/yuin/goldmark v1.8.6/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc=
+go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 h1:OFnwLJr+pF3iHrlGSzbxyuo6/6HyBlnlN1CWEJmBVcw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0/go.mod h1:716wFneO0ov19A2beH5hjfh9AK5z/VWNAtDijp1Y0/g=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0 h1:KrC1YrQeSt46ITMWAbgQx1M1eV1/1TKzttrBzymPmss=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0/go.mod h1:zDSEzoEqsOrgBeGvH66KRgxh90VonFyJqBHA0Pk3+rM=
+go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8=
+go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o=
+go.opentelemetry.io/otel/sdk v1.46.0 h1:h5CNQQjEbuQXY/JfZtgt3i7HVFV3aHPO2OAwO2eTYPI=
+go.opentelemetry.io/otel/sdk v1.46.0/go.mod h1:GAERFXFt5SYCEB+YiKUbMBeza6UaDH7GmGOZEfh2gSM=
+go.opentelemetry.io/otel/sdk/metric v1.46.0 h1:0piZ26EG4RBfebb2jhDH6ERCYHoVWduc3kLgPCwSnSE=
+go.opentelemetry.io/otel/sdk/metric v1.46.0/go.mod h1:I1PbKrdVc8Qu8HYVDNtqVIwLwjNrhsV/uFuxfwg8mO4=
+go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c=
+go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI=
+go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
+go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
@@ -86,18 +175,33 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
 golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
+golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
 golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
 golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
 golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
+golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
 golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
 golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
 golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
 golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
+google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 h1:ax2KzoSRIZU/M0cIxri3pKxy99vniH1PVxWC6si/eZI=
+google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688/go.mod h1:1RJ9BQGyNdZwkGc1eTqkErfRZ6RJyYPHZo73BZ1vQqI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
+google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y=
+google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/account/account_test.go

@@ -99,17 +99,21 @@ func TestApprovalIsWhatMakesAnAccountWork(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got.ProjectID != "proj" {
-		t.Errorf("the approved account landed in project %q", got.ProjectID)
+	if ok, err := st.CanUseProject(ctx, got.ID, "proj"); err != nil || !ok {
+		t.Errorf("the approved account is not a member of the project it was approved into: %v", err)
 	}
 }
 
-func TestApprovalNeedsAProject(t *testing.T) {
-	// An approved account with nowhere to put its keys passes every check and
-	// then fails at the first key it tries to make.
-	_, st := newStoreAndUser(t)
-	if err := st.ApproveUser(context.Background(), "usr-1", "", "ilker", time.Now()); err == nil {
-		t.Error("an account was approved into no project")
+func TestApprovalNeedNotNameAProject(t *testing.T) {
+	// A person need not belong to anything to use the gateway: approved into
+	// nothing, they work on their own within their personal limits.
+	svc, st := newStoreAndUser(t)
+	ctx := context.Background()
+	if err := st.ApproveUser(ctx, "usr-1", "", "ilker", time.Now()); err != nil {
+		t.Fatalf("approving with no project: %v", err)
+	}
+	if _, _, err := svc.SignIn(ctx, "ayse@example.com", goodPassword); err != nil {
+		t.Errorf("an account approved into nothing cannot sign in: %v", err)
 	}
 }
 
@@ -394,3 +398,53 @@ func TestGuessingTheCurrentPasswordIsBounded(t *testing.T) {
 		t.Errorf("guessing was unbounded: %v", err)
 	}
 }
+
+func TestSomebodyGuessingElsewhereCannotLockTheOwnerOut(t *testing.T) {
+	svc, st := newStoreAndUser(t)
+	ctx := context.Background()
+	must(t, st.ApproveUser(ctx, "usr-1", "proj", "ilker", time.Now()))
+	cfg := DefaultConfig()
+	cfg.MaxAttempts = 3
+	svc = New(st, cfg, slog.New(slog.DiscardHandler))
+
+	attacker, owner := WithClient(ctx, "203.0.113.9"), WithClient(ctx, "198.51.100.7")
+	for range 5 {
+		_, _, _ = svc.SignIn(attacker, "ayse@example.com", "nope")
+	}
+	if _, _, err := svc.SignIn(attacker, "ayse@example.com", "nope"); !errors.Is(err, ErrTooManyTries) {
+		t.Errorf("the guessing client was not held back: %v", err)
+	}
+	if _, _, err := svc.SignIn(owner, "ayse@example.com", goodPassword); err != nil {
+		t.Errorf("the owner, elsewhere, was locked out: %v", err)
+	}
+	// Spread over many clients, guessing is still bounded per address.
+	held := false
+	for i := range 40 {
+		c := WithClient(ctx, "192.0.2."+strings.Repeat("1", 1+i%3)+string(rune('0'+i%10)))
+		if _, _, err := svc.SignIn(c, "ayse@example.com", "nope"); errors.Is(err, ErrTooManyTries) {
+			held = true
+		}
+	}
+	if !held {
+		t.Error("guesses from many clients were not bounded")
+	}
+}
+
+func TestAHashThatCannotGetATurnSaysTheServerIsBusy(t *testing.T) {
+	was := argonWait
+	argonWait = 10 * time.Millisecond
+	t.Cleanup(func() { argonWait = was })
+	// Every turn taken.
+	n := cap(argonSlots)
+	for range n {
+		argonSlots <- struct{}{}
+	}
+	t.Cleanup(func() {
+		for range n {
+			<-argonSlots
+		}
+	})
+	if _, err := HashPassword(goodPassword); !errors.Is(err, ErrBusy) {
+		t.Errorf("a hash with no turn: %v", err)
+	}
+}

internal/account/password.go

@@ -15,7 +15,9 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"runtime"
 	"strings"
+	"time"
 
 	"golang.org/x/crypto/argon2"
 )
@@ -56,7 +58,10 @@ func HashPassword(password string) (string, error) {
 	if _, err := rand.Read(salt); err != nil {
 		return "", err
 	}
-	sum := argon2.IDKey([]byte(password), salt, argonTime, argonMemory, argonThreads, argonKeyLen)
+	sum, err := idKey([]byte(password), salt, argonTime, argonMemory, argonThreads, argonKeyLen)
+	if err != nil {
+		return "", err
+	}
 
 	b64 := base64.RawStdEncoding.EncodeToString
 	return fmt.Sprintf("$argon2id$v=%d$m=%d,t=%d,p=%d$%s$%s",
@@ -93,7 +98,10 @@ func VerifyPassword(password, encoded string) (bool, error) {
 		return false, ErrBadHash
 	}
 
-	got := argon2.IDKey([]byte(password), salt, time, memory, threads, uint32(len(want)))
+	got, err := idKey([]byte(password), salt, time, memory, threads, uint32(len(want)))
+	if err != nil {
+		return false, err
+	}
 	return subtle.ConstantTimeCompare(got, want) == 1, nil
 }
 
@@ -110,3 +118,27 @@ func init() {
 	}
 	dummyHash = h
 }
+
+// argonSlots bounds how many hashes run at once. Each takes 64 MiB, and the
+// login and signup forms are on the client-facing port: without a bound, a
+// few hundred parallel attempts at random addresses asked for gigabytes at
+// once, and the per-address throttle does not see them — each address is new.
+// Beyond the bound, attempts wait their turn instead.
+var argonSlots = make(chan struct{}, max(2, runtime.NumCPU()/2))
+
+// ErrBusy is a hash that waited its turn too long: the server is answering
+// more sign-ins than it can hash, and says so rather than hold the request.
+var ErrBusy = errors.New("too many sign-ins at once; try again in a moment")
+
+// argonWait bounds the wait for a turn; a variable so a test can shorten it.
+var argonWait = 10 * time.Second
+
+func idKey(password, salt []byte, t, memory uint32, threads uint8, keyLen uint32) ([]byte, error) {
+	select {
+	case argonSlots <- struct{}{}:
+	case <-time.After(argonWait):
+		return nil, ErrBusy
+	}
+	defer func() { <-argonSlots }()
+	return argon2.IDKey(password, salt, t, memory, threads, keyLen), nil
+}

internal/account/service.go

@@ -138,7 +138,15 @@ func (s *Service) SignUp(ctx context.Context, email, name, password string) erro
 // the CSRF token that must accompany the forms in it.
 func (s *Service) SignIn(ctx context.Context, email, password string) (token, csrf string, err error) {
 	email = store.NormalizeEmail(email)
-	if !s.allowAttempt(email) {
+	// Counted per address and the client trying it, so somebody guessing
+	// from elsewhere cannot lock the owner out of their own account; and per
+	// address alone, more loosely, so guesses spread over many clients are
+	// still bounded.
+	byClient := email
+	if c := clientFrom(ctx); c != "" {
+		byClient = email + "|" + c
+	}
+	if !s.allowAttempt(byClient, s.cfg.MaxAttempts) || !s.allowAttempt("all|"+email, 10*s.cfg.MaxAttempts) {
 		return "", "", ErrTooManyTries
 	}
 
@@ -154,11 +162,15 @@ func (s *Service) SignIn(ctx context.Context, email, password string) (token, cs
 	}
 
 	ok, err := VerifyPassword(password, u.PasswordHash)
+	if errors.Is(err, ErrBusy) {
+		// Not an answer about the password: said as what it is.
+		return "", "", err
+	}
 	if err != nil || !ok {
 		return "", "", ErrBadCredentials
 	}
 	// The password was right, so this was not an attack.
-	s.clearAttempts(email)
+	s.clearAttempts(byClient)
 
 	// State is checked after the password, on purpose. Checking first would
 	// tell anyone who guesses an address whether it has a pending account.
@@ -224,20 +236,53 @@ func (s *Service) CheckCSRF(sess store.Session, submitted string) bool {
 // Per address rather than per IP: an attacker has many addresses to come from
 // and only one to guess against, and limiting by IP would lock out everyone
 // behind one office NAT the moment somebody fat-fingers their password.
-func (s *Service) allowAttempt(email string) bool {
+func (s *Service) allowAttempt(email string, limit int) bool {
 	now := s.now()
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	w, ok := s.attempts[email]
+	if !ok && len(s.attempts) >= maxTrackedAddresses {
+		// Full of addresses nobody has signed in as for a while: forget the
+		// ones whose window has passed. Only expiring, never evicting early —
+		// dropping a live window is how an attacker spraying random addresses
+		// would buy unlimited guesses at the one they care about.
+		for k, v := range s.attempts {
+			if now.Sub(v.since) > s.cfg.AttemptWindow {
+				delete(s.attempts, k)
+			}
+		}
+		if len(s.attempts) >= maxTrackedAddresses {
+			// Still full, so somebody is spraying addresses faster than they
+			// expire. New ones wait; those already tracked are unaffected.
+			return false
+		}
+	}
 	if !ok || now.Sub(w.since) > s.cfg.AttemptWindow {
 		s.attempts[email] = &attemptWindow{count: 1, since: now}
 		return true
 	}
 	w.count++
-	return w.count <= s.cfg.MaxAttempts
+	return w.count <= limit
 }
 
+type clientKey struct{}
+
+// WithClient says which client a request comes from — its address — for the
+// sign-in throttle.
+func WithClient(ctx context.Context, client string) context.Context {
+	return context.WithValue(ctx, clientKey{}, client)
+}
+
+func clientFrom(ctx context.Context) string {
+	c, _ := ctx.Value(clientKey{}).(string)
+	return c
+}
+
+// maxTrackedAddresses bounds the throttle's memory. Unbounded, it grew by one
+// entry per address tried and shrank only on a successful sign-in.
+const maxTrackedAddresses = 50000
+
 func (s *Service) clearAttempts(email string) {
 	s.mu.Lock()
 	delete(s.attempts, email)
@@ -287,7 +332,7 @@ type PasswordChanger interface {
 func (s *Service) ChangePassword(ctx context.Context, pw PasswordChanger,
 	u store.User, current, next string,
 ) error {
-	if !s.allowAttempt("pw:" + u.ID) {
+	if !s.allowAttempt("pw:"+u.ID, s.cfg.MaxAttempts) {
 		return ErrTooManyTries
 	}
 	ok, err := VerifyPassword(current, u.PasswordHash)

internal/account/throttle_bound_test.go

@@ -0,0 +1,33 @@
+package account
+
+import (
+	"fmt"
+	"testing"
+	"time"
+)
+
+func TestSprayingAddressesCannotGrowTheThrottleOrEscapeIt(t *testing.T) {
+	now := time.Unix(0, 0)
+	s := &Service{cfg: DefaultConfig(), attempts: map[string]*attemptWindow{}, now: func() time.Time { return now }}
+
+	// The target is being guessed at.
+	for i := 0; i < s.cfg.MaxAttempts; i++ {
+		s.allowAttempt("victim@example.com", s.cfg.MaxAttempts)
+	}
+	// Then the table is flooded with made-up addresses.
+	for i := 0; i < maxTrackedAddresses+100; i++ {
+		s.allowAttempt(fmt.Sprintf("x%d@example.com", i), s.cfg.MaxAttempts)
+	}
+	if n := len(s.attempts); n > maxTrackedAddresses {
+		t.Errorf("the table grew to %d", n)
+	}
+	if s.allowAttempt("victim@example.com", s.cfg.MaxAttempts) {
+		t.Error("flooding the table reset the target's throttle")
+	}
+
+	// Once the window passes, everything expires and sign-ins work again.
+	now = now.Add(s.cfg.AttemptWindow + time.Second)
+	if !s.allowAttempt("new@example.com", s.cfg.MaxAttempts) {
+		t.Error("a new address was refused after the flood expired")
+	}
+}

internal/accounting/accounting.go

@@ -5,9 +5,12 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"strings"
+	"sync/atomic"
 	"time"
 
 	"gitea.mynodes.xyz/ilker/llmgw/internal/auth"
+	"gitea.mynodes.xyz/ilker/llmgw/internal/notify"
 	"gitea.mynodes.xyz/ilker/llmgw/internal/store"
 )
 
@@ -44,8 +47,13 @@ type Accountant struct {
 	tokens   *Limiter
 	recorder *Recorder
 	log      *slog.Logger
+	// notify is told when a budget runs out; nil tells no one.
+	notify atomic.Pointer[notify.Notifier]
 }
 
+// SetNotifier gives the accountant somewhere to say a budget is spent.
+func (a *Accountant) SetNotifier(n *notify.Notifier) { a.notify.Store(n) }
+
 // New builds an accountant.
 func New(pricing *Pricing, recorder *Recorder, log *slog.Logger) *Accountant {
 	if log == nil {
@@ -79,14 +87,27 @@ func (a *Accountant) RestoreBudgets(ctx context.Context, s store.Store, period s
 	// totals would bring the control plane back up believing the team had spent
 	// nothing — which is a budget that resets on every restart, for exactly the
 	// scopes where it matters most.
-	spend := make(map[string]int64, len(rows)*4)
+	// And every pool a person is in: their own, and each per-member limit of
+	// the project, team and organization they spent it in.
+	spend := make(map[string]int64, len(rows)*8)
 	for _, r := range rows {
-		for _, o := range []store.LimitOwner{
+		owners := []store.LimitOwner{
 			{Scope: store.ScopeKey, ID: r.KeyID},
 			{Scope: store.ScopeProject, ID: r.ProjectID},
 			{Scope: store.ScopeTeam, ID: r.TeamID},
 			{Scope: store.ScopeOrg, ID: r.OrgID},
-		} {
+			{Scope: store.ScopeUser, ID: r.UserID},
+		}
+		if r.UserID != "" && r.ProjectID != "" {
+			owners = append(owners,
+				store.MemberOwner(store.ScopeProjectMember, r.ProjectID, r.UserID),
+				store.MemberOwner(store.ScopeTeamMember, r.TeamID, r.UserID),
+				store.MemberOwner(store.ScopeOrgMember, r.OrgID, r.UserID))
+		}
+		for _, o := range owners {
+			if o.ID == "" || strings.HasPrefix(o.ID, "/") {
+				continue
+			}
 			if k := o.CounterKey(); k != "" {
 				spend[k] += r.Micros
 			}
@@ -168,6 +189,10 @@ func (a *Accountant) Check(p auth.Principal, model string, estimatedTokens int64
 	if !price.Zero() {
 		for _, l := range chain {
 			if l.Budget != nil && a.budgets.Exhausted(l.Counter, l.Period, *l.Budget) {
+				a.notify.Load().Notify(notify.BudgetSpent, l.Counter,
+					fmt.Sprintf("the %s budget of %s is spent: requests to priced models are refused until it renews",
+						or(string(l.Period), "total"), l.Counter),
+					map[string]any{"counter": l.Counter, "period": string(l.Period), "budget": *l.Budget})
 				return res, &LimitError{Err: ErrBudgetSpent}
 			}
 		}
@@ -292,7 +317,13 @@ func (a *Accountant) Record(res Reservation, u store.Usage) {
 		a.tokens.Charge(c, actual-res.EstimatedTokens)
 	}
 
-	u.CostMicros = res.Price.Cost(u.PromptTokens, u.CompletionTokens)
+	// Priced by the model that answered: a fallback served by another model
+	// costs what that one costs, not what the one asked for would have.
+	price := res.Price
+	if u.ServedModel != "" && u.ServedModel != u.Model && a.pricing != nil {
+		price = a.pricing.For(u.ServedModel)
+	}
+	u.CostMicros = price.Cost(u.PromptTokens, u.CompletionTokens)
 	for _, b := range res.Budgets {
 		a.budgets.Add(b.Counter, b.Period, u.CostMicros)
 	}
@@ -302,6 +333,17 @@ func (a *Accountant) Record(res Reservation, u store.Usage) {
 	}
 }
 
+// RecordRefused queues the row of a request a limit refused: nothing is
+// charged — it used nothing — but it is counted, so a team running into its
+// limits shows as one rather than as a team that went quiet.
+func (a *Accountant) RecordRefused(u store.Usage) {
+	if u.KeyID == "" || a.recorder == nil {
+		return
+	}
+	u.PromptTokens, u.CompletionTokens, u.CostMicros = 0, 0, 0
+	a.recorder.Record(u)
+}
+
 // Status returns what a key has used, for headers and `ctl`.
 func (a *Accountant) Status(p auth.Principal) (spent int64, rpm, tpm float64) {
 	if p.KeyID == "" {
@@ -369,3 +411,39 @@ func keyCounter(keyID string) string {
 // they are asking is whether the budgets they are about to display mean
 // anything, and the accountant is what would enforce them.
 func (a *Accountant) AnythingPriced() bool { return a.pricing.AnythingPriced() }
+
+// Headroom is the tightest of a principal's request and token limits: how
+// much is left of each, and when the minute it is counted over rolls on.
+type Headroom struct {
+	RequestLimit, RequestsLeft int
+	TokenLimit, TokensLeft     int
+	Reset                      time.Duration
+}
+
+// Headroom reports what a principal has left, after whatever Check just
+// charged. Of several levels the one with least left is the one that will
+// refuse first, so that is the one reported. A limit of 0 means none is set.
+func (a *Accountant) Headroom(p auth.Principal) Headroom {
+	var h Headroom
+	firstReq, firstTok := true, true
+	for _, l := range levels(p.Limits, p.KeyID) {
+		if l.RPM != nil && *l.RPM > 0 {
+			left := max(0, *l.RPM-int(a.requests.Rate(l.Counter)))
+			if firstReq || left < h.RequestsLeft {
+				h.RequestLimit, h.RequestsLeft, firstReq = *l.RPM, left, false
+			}
+		}
+		if l.TPM != nil && *l.TPM > 0 {
+			left := max(0, *l.TPM-int(a.tokens.Rate(l.Counter)))
+			if firstTok || left < h.TokensLeft {
+				h.TokenLimit, h.TokensLeft, firstTok = *l.TPM, left, false
+			}
+		}
+	}
+	// The windows slide, so room comes back continuously; the next minute
+	// boundary is when a whole window's worth has moved on, and is the figure
+	// a client pacing itself can act on.
+	now := time.Now()
+	h.Reset = now.Truncate(windowLen).Add(windowLen).Sub(now)
+	return h
+}

internal/accounting/accounting_test.go

@@ -5,11 +5,14 @@ import (
 	"errors"
 	"log/slog"
 	"path/filepath"
+	"strings"
 	"sync"
 	"testing"
 	"time"
 
 	"gitea.mynodes.xyz/ilker/llmgw/internal/auth"
+	"gitea.mynodes.xyz/ilker/llmgw/internal/notify"
+	"gitea.mynodes.xyz/ilker/llmgw/internal/notify/notifytest"
 	"gitea.mynodes.xyz/ilker/llmgw/internal/store"
 )
 
@@ -630,3 +633,74 @@ func TestAnEmptyPriceTableMeansNoBudgetCanEverBind(t *testing.T) {
 		t.Error("no price table at all is not priced")
 	}
 }
+
+func TestHeadroomIsTheTightestLimitAfterThisRequest(t *testing.T) {
+	// A project allowing 100 a minute under a team allowing 3: the team is
+	// what will refuse, so the team is what a client is told about.
+	a := New(pricing(t), nil, slog.New(slog.DiscardHandler))
+	p := principal("k1", func(e *store.Effective) {
+		e.Chain = []store.Limits{
+			{Scope: store.ScopeProject, ScopeID: "proj", RPM: intp(100), TPM: intp(50000)},
+			{Scope: store.ScopeTeam, ScopeID: "team", RPM: intp(3)},
+		}
+	})
+	if _, err := a.Check(p, "m", 10); err != nil {
+		t.Fatal(err)
+	}
+	h := a.Headroom(p)
+	if h.RequestLimit != 3 || h.RequestsLeft != 2 {
+		t.Errorf("requests %d left of %d; expected 2 of the team's 3", h.RequestsLeft, h.RequestLimit)
+	}
+	if h.TokenLimit != 50000 || h.TokensLeft != 50000-10 {
+		t.Errorf("tokens %d left of %d", h.TokensLeft, h.TokenLimit)
+	}
+	if h.Reset <= 0 || h.Reset > time.Minute {
+		t.Errorf("reset %v", h.Reset)
+	}
+	if none := a.Headroom(principal("k2", nil)); none.RequestLimit != 0 || none.TokenLimit != 0 {
+		t.Errorf("a key with no limits advertised some: %+v", none)
+	}
+}
+
+func TestAFallbackIsChargedWhatTheModelThatAnsweredCosts(t *testing.T) {
+	a := New(pricing(t), nil, slog.New(slog.DiscardHandler))
+	p := inTree("fb-k", teamBudget("fb", 1_000_000))
+	res, err := a.Check(p, "paid", 400)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Asked for "paid", answered by "free": nothing is owed.
+	a.Record(res, store.Usage{KeyID: "fb-k", Model: "paid", ServedModel: "free", PromptTokens: 200, CompletionTokens: 200})
+	if spent, _, _ := a.Status(p); spent != 0 {
+		t.Errorf("charged %d for a request the free model answered", spent)
+	}
+	res, _ = a.Check(p, "paid", 400)
+	a.Record(res, store.Usage{KeyID: "fb-k", Model: "paid", ServedModel: "paid", PromptTokens: 200, CompletionTokens: 200})
+	if spent, _, _ := a.Status(p); spent == 0 {
+		t.Error("the paid model answering cost nothing")
+	}
+}
+
+func TestASpentBudgetTellsSomeoneOnce(t *testing.T) {
+	a := New(pricing(t), nil, slog.New(slog.DiscardHandler))
+	n, sent := notifytest.Catch(t)
+	a.SetNotifier(n)
+	p := principal("k1", func(e *store.Effective) {
+		e.Budget = i64p(100)
+		e.BudgetPeriod = store.PeriodMonth
+	})
+	res, err := a.Check(p, "paid", 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	a.Record(res, store.Usage{KeyID: "k1", PromptTokens: 1000})
+	for range 3 {
+		if _, err := a.Check(p, "paid", 10); !errors.Is(err, ErrBudgetSpent) {
+			t.Fatalf("not refused: %v", err)
+		}
+	}
+	got := sent()
+	if len(got) != 1 || got[0].Kind != notify.BudgetSpent || !strings.Contains(got[0].Message, "month") {
+		t.Fatalf("sent %+v, want one budget_spent", got)
+	}
+}

internal/accounting/people_test.go

@@ -0,0 +1,126 @@
+package accounting
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"gitea.mynodes.xyz/ilker/llmgw/internal/auth"
+	"gitea.mynodes.xyz/ilker/llmgw/internal/store"
+)
+
+// peopleStore has Acme/ml/training with two members, ayse and deniz.
+func peopleStore(t *testing.T) (*store.DB, string) {
+	t.Helper()
+	ctx := context.Background()
+	s, err := store.OpenSQLite(ctx, filepath.Join(t.TempDir(), "p.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = s.Close() })
+	org, _ := s.CreateOrg(ctx, "Acme")
+	team, _ := s.CreateTeam(ctx, org, "ml")
+	proj, _ := s.CreateProject(ctx, team, "training")
+	for _, id := range []string{"ayse", "deniz"} {
+		if err := s.CreateUser(ctx, store.User{ID: id, Email: id + "@x", Name: id,
+			PasswordHash: "h", State: store.UserPending, CreatedAt: time.Now()}); err != nil {
+			t.Fatal(err)
+		}
+		if err := s.ApproveUser(ctx, id, proj, "test", time.Now()); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return s, proj
+}
+
+// keyFor makes a key for a person and resolves it the way authentication does.
+func keyFor(t *testing.T, s *store.DB, id, user, project string) auth.Principal {
+	t.Helper()
+	ctx := context.Background()
+	_, k, _ := store.NewKey(id, id, project)
+	if err := s.CreateUserKey(ctx, user, k); err != nil {
+		t.Fatal(err)
+	}
+	e, err := s.Resolve(ctx, id)
+	if err != nil {
+		t.Fatalf("resolving %s: %v", id, err)
+	}
+	return auth.Principal{KeyID: id, UserID: e.UserID, ProjectID: e.ProjectID, Limits: e}
+}
+
+func TestAPersonsLimitIsOnePoolAcrossTheirKeys(t *testing.T) {
+	s, proj := peopleStore(t)
+	if err := s.PutLimits(context.Background(),
+		store.Limits{Scope: store.ScopeUser, ScopeID: "ayse", RPM: intp(2)}); err != nil {
+		t.Fatal(err)
+	}
+	a := New(pricing(t), nil, slog.New(slog.DiscardHandler))
+	personal := keyFor(t, s, "k-personal", "ayse", "")
+	inProject := keyFor(t, s, "k-project", "ayse", proj)
+
+	// Two requests, one on each key, use up the person's two a minute.
+	for _, p := range []auth.Principal{personal, inProject} {
+		if _, err := a.Check(p, "free", 1); err != nil {
+			t.Fatalf("%s: %v", p.KeyID, err)
+		}
+	}
+	if _, err := a.Check(personal, "free", 1); !errors.Is(err, ErrRateLimited) {
+		t.Errorf("a third request across her keys was allowed: %v", err)
+	}
+	// Deniz is somebody else.
+	if _, err := a.Check(keyFor(t, s, "k-deniz", "deniz", proj), "free", 1); err != nil {
+		t.Errorf("another person was limited by hers: %v", err)
+	}
+}
+
+func TestAPerMemberLimitCountsEachMemberApart(t *testing.T) {
+	s, proj := peopleStore(t)
+	if err := s.PutLimits(context.Background(),
+		store.Limits{Scope: store.ScopeProjectMember, ScopeID: proj, RPM: intp(1)}); err != nil {
+		t.Fatal(err)
+	}
+	a := New(pricing(t), nil, slog.New(slog.DiscardHandler))
+	ayse := keyFor(t, s, "k-a", "ayse", proj)
+	deniz := keyFor(t, s, "k-d", "deniz", proj)
+
+	if _, err := a.Check(ayse, "free", 1); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := a.Check(ayse, "free", 1); !errors.Is(err, ErrRateLimited) {
+		t.Errorf("her second request passed a one-a-minute per-member limit: %v", err)
+	}
+	// Her share is hers: Deniz still has his.
+	if _, err := a.Check(deniz, "free", 1); err != nil {
+		t.Errorf("one member's use counted against another: %v", err)
+	}
+	// And outside the project it does not apply at all.
+	if _, err := a.Check(keyFor(t, s, "k-a-own", "ayse", ""), "free", 1); err != nil {
+		t.Errorf("a project's per-member limit held her personal key: %v", err)
+	}
+}
+
+func TestAPersonsBudgetSurvivesARestart(t *testing.T) {
+	s, _ := peopleStore(t)
+	ctx := context.Background()
+	if err := s.PutLimits(ctx, store.Limits{Scope: store.ScopeUser, ScopeID: "ayse",
+		Budget: i64p(1000), BudgetPeriod: store.PeriodMonth}); err != nil {
+		t.Fatal(err)
+	}
+	// Spent before the restart, personally and on the chat page.
+	if err := s.WriteUsage(ctx, []store.Usage{
+		{At: time.Now(), KeyID: "k-old", UserID: "ayse", CostMicros: 600, Model: "paid", ServedModel: "paid"},
+		{At: time.Now(), KeyID: "session:ayse", UserID: "ayse", CostMicros: 500, Model: "paid", ServedModel: "paid"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	a := New(pricing(t), nil, slog.New(slog.DiscardHandler))
+	if err := a.RestoreBudgets(ctx, s, store.PeriodMonth); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := a.Check(keyFor(t, s, "k-new", "ayse", ""), "paid", 1); !errors.Is(err, ErrBudgetSpent) {
+		t.Errorf("a restart forgot what she had spent: %v", err)
+	}
+}

internal/agent/agent_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/tls"
 	"errors"
+	"fmt"
 	"log/slog"
 	"net"
 	"net/http"
@@ -22,6 +23,8 @@ import (
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/h2c"
 
+	llmgwv1 "gitea.mynodes.xyz/ilker/llmgw/api/gen/llmgw/v1"
+	"gitea.mynodes.xyz/ilker/llmgw/internal/agent/discovery"
 	"gitea.mynodes.xyz/ilker/llmgw/internal/agent/engines"
 	"gitea.mynodes.xyz/ilker/llmgw/internal/agent/supervisor"
 	"gitea.mynodes.xyz/ilker/llmgw/internal/control/agentsvc"
@@ -397,11 +400,16 @@ func TestHeartbeatKeepsNodeAlive(t *testing.T) {
 	n, _ := h.inv.Get("n1")
 	first := n.LastSeen
 
-	time.Sleep(200 * time.Millisecond)
-	n, _ = h.inv.Get("n1")
-	if !n.LastSeen.After(first) {
-		t.Error("heartbeats are not refreshing LastSeen; the node would be declared lost")
+	// Waited for rather than slept through: four heartbeat intervals was not
+	// always enough on a loaded runner for one to have landed.
+	deadline := time.Now().Add(3 * time.Second)
+	for time.Now().Before(deadline) {
+		if n, _ = h.inv.Get("n1"); n.LastSeen.After(first) {
+			return
+		}
+		time.Sleep(20 * time.Millisecond)
 	}
+	t.Error("heartbeats are not refreshing LastSeen; the node would be declared lost")
 }
 
 func TestStartAndStopShardEndToEnd(t *testing.T) {
@@ -756,3 +764,157 @@ func TestAFabricRateIsTheSlowestActiveLink(t *testing.T) {
 		}
 	}
 }
+
+func TestAPortGoingDownIsToldToTheControlPlaneOnce(t *testing.T) {
+	// Checked only at registration, a port going down went unnoticed until
+	// the agent restarted, and the node went on being offered multi-node
+	// work that would hang on its first collective.
+	root := ibTreeWithActivePorts(t, "mlx5_0")
+	h := start(t, func(c *Config) {
+		c.Discovery.IBRoot = root
+		c.Fabrics = []inventory.FabricAttachment{{Fabric: "ib-a", HCAs: []string{"mlx5_0"}}}
+	})
+	if n, _ := h.inv.Get("n1"); !n.HasFabric("ib-a") {
+		t.Fatalf("the fabric should be advertised at registration: %+v", n.Fabrics)
+	}
+
+	hb := h.ag.heartbeat().GetHeartbeat()
+	if hb.GetFabricsChanged() || len(hb.GetIbPorts()) != 1 || hb.GetIbPorts()[0].GetState() != "ACTIVE" {
+		t.Fatalf("a quiet heartbeat should carry the port and no change: %+v", hb)
+	}
+
+	if err := os.WriteFile(filepath.Join(root, "mlx5_0", "ports", "1", "state"), []byte("1: DOWN\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	hb = h.ag.heartbeat().GetHeartbeat()
+	if !hb.GetFabricsChanged() || len(hb.GetFabrics()) != 0 {
+		t.Errorf("the port going down should withdraw the fabric: changed=%v fabrics=%v",
+			hb.GetFabricsChanged(), hb.GetFabrics())
+	}
+	if hb = h.ag.heartbeat().GetHeartbeat(); hb.GetFabricsChanged() {
+		t.Error("the change should be sent once, not on every heartbeat")
+	}
+}
+
+func TestAShardUsesThisNodesInterfaceAndRoCEIndex(t *testing.T) {
+	// The control plane sends one interface name for every node; a node whose
+	// management network is on another had NCCL bind nothing. And which RoCE
+	// GID entry routes is a property of this node's adapters.
+	a := &Agent{cfg: Config{MgmtInterface: "ens3"}}
+	a.inv.HCAs = []discovery.HCA{{Name: "mlx5_0", Ports: []discovery.Port{
+		{Num: 1, State: "ACTIVE", LinkLayer: discovery.LinkEthernet, RoCEv2GID: 3}}}}
+	spec := engines.ShardSpec{MgmtInterface: "eth0", HCAs: []string{"mlx5_0"}}
+	a.localizeSpec(&spec)
+	if spec.MgmtInterface != "ens3" {
+		t.Errorf("interface = %q", spec.MgmtInterface)
+	}
+	if spec.GIDIndex == nil || *spec.GIDIndex != 3 {
+		t.Errorf("GID index = %v", spec.GIDIndex)
+	}
+
+	ib := engines.ShardSpec{HCAs: []string{"mlx5_1"}}
+	a.inv.HCAs = append(a.inv.HCAs, discovery.HCA{Name: "mlx5_1", Ports: []discovery.Port{
+		{Num: 1, State: "ACTIVE", LinkLayer: discovery.LinkInfiniBand, RoCEv2GID: -1}}})
+	a.localizeSpec(&ib)
+	if ib.GIDIndex != nil {
+		t.Error("an InfiniBand shard was given a GID index")
+	}
+}
+
+func TestTheManagementInterfaceIsFoundNotAssumed(t *testing.T) {
+	// It was defaulted to eth0 before it could be looked for, so it never
+	// was: a node on ens3 or bond0 had NCCL bootstrap over nothing.
+	cfg := DefaultConfig()
+	cfg.Server = "http://127.0.0.1:7443"
+	cfg.NodeID = "n1"
+	cfg.MgmtAddr = "127.0.0.1"
+	if err := cfg.normalize(); err != nil {
+		t.Fatal(err)
+	}
+	if cfg.MgmtInterface == "" || cfg.MgmtInterface == "eth0" {
+		t.Errorf("interface = %q, want the loopback interface holding 127.0.0.1", cfg.MgmtInterface)
+	}
+}
+
+func TestEachFabricsSubnetManagersAreAskedOnce(t *testing.T) {
+	// Two adapters on one fabric see one master. Its managers are listed
+	// through one of them — the same list twice is a query too many — and
+	// every port says which master it sees.
+	oldSM, oldSMs := querySM, querySMs
+	t.Cleanup(func() { querySM, querySMs = oldSM, oldSMs })
+	querySM = func(string, int) (*discovery.SMInfo, error) {
+		return &discovery.SMInfo{GUID: "0x01", LID: 1, State: "SMINFO_MASTER"}, nil
+	}
+	lists := 0
+	querySMs = func(string, int) ([]discovery.SMRecord, error) {
+		lists++
+		return []discovery.SMRecord{{GUID: "0x01", State: "master"}, {GUID: "0x02", State: "standby"}}, nil
+	}
+	h := start(t, func(c *Config) {
+		c.Discovery.IBRoot = ibTreeWithActivePorts(t, "mlx5_0", "mlx5_1")
+		c.Fabrics = []inventory.FabricAttachment{{Fabric: "ib-a", HCAs: []string{"mlx5_0", "mlx5_1"}}}
+	})
+	hb := h.ag.heartbeat().GetHeartbeat()
+	withList := 0
+	for _, p := range hb.GetIbPorts() {
+		if p.GetSmGuid() != "0x01" {
+			t.Errorf("%s sees master %q", p.GetHca(), p.GetSmGuid())
+		}
+		if len(p.GetSubnetManagers()) > 0 {
+			withList++
+		}
+	}
+	if lists != 1 || withList != 1 {
+		t.Errorf("listed %d times, carried on %d ports; want once, on one", lists, withList)
+	}
+}
+
+func TestAFabricScanIsAskedForAndAnswered(t *testing.T) {
+	// One node per fabric maps it; the control plane asks and parses.
+	old := scanFabric
+	t.Cleanup(func() { scanFabric = old })
+	var asked string
+	scanFabric = func(_ context.Context, hca string, port int) (string, error) {
+		asked = fmt.Sprintf("%s/%d", hca, port)
+		return "Switch\t36 \"S-00000000000000a1\"\t\t# \"MF0;leaf-a:QM8700/U1\" enhanced port 0 lid 1 lmc 0\n", nil
+	}
+	h := start(t)
+	r, err := h.svc.ScanFabric(t.Context(), "n1", "mlx5_0", 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if asked != "mlx5_0/1" || !strings.Contains(r.GetOutput(), "leaf-a") || r.GetError() != "" {
+		t.Errorf("asked %q, got %+v", asked, r)
+	}
+}
+
+func TestABandwidthTestIsRunOnTheAdapterAskedFor(t *testing.T) {
+	oldRun, oldHave := runWriteBW, haveWriteBW
+	t.Cleanup(func() { runWriteBW, haveWriteBW = oldRun, oldHave })
+	haveWriteBW = func() bool { return true }
+	var got discovery.WriteBW
+	runWriteBW = func(_ context.Context, w discovery.WriteBW) (float64, string, error) {
+		got = w
+		return 388.2, " #bytes  #iterations  BW peak[Gb/sec]  BW average[Gb/sec]\n", nil
+	}
+	h := start(t, func(c *Config) { c.Discovery.IBRoot = ibTreeWithActivePorts(t, "mlx5_0") })
+
+	r, err := h.svc.FabricTest(t.Context(), "n1", &llmgwv1.FabricTestRequest{
+		Role: "client", Hca: "mlx5_0", Port: 1, Peer: "10.0.0.2", TcpPort: 18515, Seconds: 3})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if r.GetGbps() != 388.2 || r.GetError() != "" {
+		t.Errorf("reply %+v", r)
+	}
+	if got.HCA != "mlx5_0" || got.Peer != "10.0.0.2" || got.TCPPort != 18515 || got.GIDIndex != -1 {
+		t.Errorf("ran %+v", got)
+	}
+
+	// An adapter the node does not have is said so, without running anything.
+	got = discovery.WriteBW{}
+	r, _ = h.svc.FabricTest(t.Context(), "n1", &llmgwv1.FabricTestRequest{Role: "server", Hca: "mlx5_9", Port: 1, Seconds: 1})
+	if !strings.Contains(r.GetError(), "no port mlx5_9/1") || got.HCA != "" {
+		t.Errorf("reply %+v, ran %+v", r, got)
+	}
+}

internal/agent/bindaddr_test.go

@@ -0,0 +1,30 @@
+package agent
+
+import (
+	"testing"
+
+	"gitea.mynodes.xyz/ilker/llmgw/internal/agent/engines"
+)
+
+func TestEnginesListenOnTheManagementAddressWhenItIsThisMachines(t *testing.T) {
+	cases := map[string]string{
+		"127.0.0.1":   "127.0.0.1", // one of this machine's
+		"203.0.113.9": "",          // not: every address rather than none
+		"gpu07.lan":   "",          // a name
+		"0.0.0.0":     "",
+		"":            "",
+	}
+	for mgmt, want := range cases {
+		a := &Agent{cfg: Config{MgmtAddr: mgmt}}
+		if got := a.bindAddr(); got != want {
+			t.Errorf("management address %q: listens on %q, expected %q", mgmt, got, want)
+		}
+	}
+	a := &Agent{}
+	if got := a.engineBase(engines.ShardSpec{HTTPPort: 8000}); got != "http://127.0.0.1:8000" {
+		t.Errorf("on every address, asked at %s", got)
+	}
+	if got := a.engineBase(engines.ShardSpec{HTTPPort: 8000, BindAddr: "10.0.0.147"}); got != "http://10.0.0.147:8000" {
+		t.Errorf("on one address, asked at %s", got)
+	}
+}

internal/agent/config.go

@@ -0,0 +1,294 @@
+package agent
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/url"
+	"os"
+	"slices"
+	"strings"
+	"time"
+
+	"gitea.mynodes.xyz/ilker/llmgw/internal/agent/discovery"
+	"gitea.mynodes.xyz/ilker/llmgw/internal/agent/engines"
+	"gitea.mynodes.xyz/ilker/llmgw/internal/agent/supervisor"
+	"gitea.mynodes.xyz/ilker/llmgw/internal/control/inventory"
+	"gitea.mynodes.xyz/ilker/llmgw/internal/obs"
+	"gitea.mynodes.xyz/ilker/llmgw/internal/tlsconf"
+)
+
+// Config configures the agent.
+type Config struct {
+	// NodeID defaults to the hostname. It must equal the common name of the
+	// agent's certificate, so set it only where the two differ.
+	NodeID string `koanf:"node_id"`
+	// Server is the control plane, and Servers is the same thing when there is
+	// more than one. Both are accepted: every configuration written before
+	// there could be a second control plane names one address, and none of
+	// them should have to change.
+	//
+	// The order is tried in order, and a refusal moves to the next. Only the
+	// leader accepts an agent, so a standby is skipped in the time it takes to
+	// be told so — which is what makes failover a reconnect rather than an
+	// edit to every node's configuration.
+	Server  string   `koanf:"server"`
+	Servers []string `koanf:"servers"`
+	// Hostname defaults to the machine's.
+	Hostname string `koanf:"hostname"`
+	// MgmtAddr is the address engines are reached on. It defaults to this
+	// machine's address on the route to the control plane, which is the one
+	// the control plane and the router can reach.
+	MgmtAddr string `koanf:"mgmt_addr"`
+	// Labels are free-form facts about a node for a profile's node_selector.
+	// Nothing needs them: memory, GPUs, engines and disk are measured, and a
+	// label restating one of those goes stale the day the machine changes.
+	Labels map[string]string `koanf:"labels"`
+
+	// MgmtInterface is the ethernet interface NCCL bootstraps over. It
+	// defaults to the interface holding MgmtAddr, then eth0.
+	MgmtInterface string `koanf:"mgmt_interface"`
+	// Fabrics labels this node's HCAs. It is explicit on purpose: OpenSM's
+	// default subnet prefix is the same on every fabric, so nothing can be
+	// inferred from the wire (plan §5.2).
+	Fabrics []inventory.FabricAttachment `koanf:"fabrics"`
+
+	HeartbeatInterval time.Duration `koanf:"heartbeat_interval"`
+	// ReconnectBase is the first reconnect delay; it backs off from there.
+	ReconnectBase time.Duration `koanf:"reconnect_base"`
+	ReconnectMax  time.Duration `koanf:"reconnect_max"`
+
+	// AdoptReadyTimeout bounds how long an adopted engine is given to answer a
+	// health check before the agent stops waiting on it.
+	//
+	// Shorter than a startup timeout on purpose: this engine is already
+	// running, so it is not loading a model, it is either serving or it is not.
+	AdoptReadyTimeout time.Duration `koanf:"adopt_ready_timeout"`
+
+	// TLS authenticates both ends of the control-plane stream. Leaving it unset
+	// keeps the plaintext behaviour, which only belongs on a trusted network.
+	TLS tlsconf.Config `koanf:"tls"`
+
+	// ModelDirs are the directories this node keeps model weights in, beyond
+	// WeightsCache, which is always looked in. Storage differs at every installation,
+	// so llmgw observes it rather than owning it: a Lustre mount, an image
+	// exported over the fabric, local NVMe and a copy made by hand all look
+	// identical from here, and placement only needs to know whether the file
+	// is present.
+	ModelDirs []string `koanf:"model_dirs"`
+
+	// EnginesDir is where the agent installs engines, one directory per
+	// build. Defaults to /opt/llmgw/engines.
+	EnginesDir string `koanf:"engines_dir"`
+
+	// WeightsCache is where a remote source is downloaded to. Defaults to the
+	// first entry of ModelDirs, because a node that says where its models live
+	// has already answered this question, and otherwise to
+	// /var/lib/llmgw-weights.
+	//
+	// Fetching is the simple arrangement: every node keeps its own copy. The
+	// exotic ones need no code — weights on a shared filer or an image exported
+	// over the fabric are simply present, and present means nothing is fetched.
+	WeightsCache string `koanf:"weights_cache"`
+
+	Discovery discovery.Options `koanf:"discovery"`
+	Engines   engines.Config    `koanf:"engines"`
+	Superv    supervisor.Config `koanf:"supervisor"`
+
+	// Tracing sends this node's part of each replica start — the weights
+	// fetched, the engine launched, the wait for it to answer — to an
+	// OpenTelemetry collector, inside the control plane's trace of that
+	// start. Give it the collector server.yaml's tracing names. Off unless
+	// an endpoint is set here or in OTEL_EXPORTER_OTLP_ENDPOINT.
+	Tracing obs.Tracing `koanf:"tracing"`
+
+	Version string
+}
+
+// DefaultConfig returns sensible defaults.
+func DefaultConfig() Config {
+	// No MgmtInterface: normalize finds the one holding the management
+	// address, and falls back to eth0 only when it cannot. Defaulted here, it
+	// was never found — every node said eth0 unless told otherwise, and a node
+	// on ens3 or bond0 had NCCL bootstrap over an interface it does not have.
+	return Config{
+		HeartbeatInterval: 5 * time.Second,
+		ReconnectBase:     time.Second,
+		ReconnectMax:      30 * time.Second,
+		AdoptReadyTimeout: 60 * time.Second,
+		Superv:            supervisor.DefaultConfig(),
+		// NVML gives NVLink topology, so prefer it when this build has it.
+		Discovery: discovery.Options{PreferNVML: true},
+	}
+}
+
+func (c *Config) normalize() error {
+	d := DefaultConfig()
+	if err := c.TLS.Validate(); err != nil {
+		return err
+	}
+	if err := c.normalizeServerURL(); err != nil {
+		return err
+	}
+	// Everything below is found rather than written. A file that has to say
+	// which machine it is on, and at what address, is a file that differs on
+	// every node — and a copy taken from one node to the next registers the
+	// second as the first.
+	host, _ := os.Hostname()
+	if c.NodeID == "" {
+		c.NodeID = host
+	}
+	if c.NodeID == "" {
+		return errors.New("node_id is not set and the hostname could not be read")
+	}
+	if c.Hostname == "" {
+		c.Hostname = host
+	}
+	if c.MgmtAddr == "" {
+		c.MgmtAddr = addrToward(c.Server)
+	}
+	if c.MgmtInterface == "" {
+		c.MgmtInterface = interfaceOf(c.MgmtAddr)
+	}
+	if c.MgmtInterface == "" {
+		c.MgmtInterface = "eth0"
+	}
+	// The directory downloads land in is always one that is looked in. When
+	// they were two settings, a node could fill its disk with fetched weights
+	// that placement never saw — which is what every node here was doing.
+	if c.WeightsCache == "" && len(c.ModelDirs) > 0 {
+		c.WeightsCache = c.ModelDirs[0]
+	}
+	if c.WeightsCache == "" {
+		c.WeightsCache = DefaultWeightsCache
+	}
+	if !slices.Contains(c.ModelDirs, c.WeightsCache) {
+		c.ModelDirs = append(c.ModelDirs, c.WeightsCache)
+	}
+	if c.HeartbeatInterval <= 0 {
+		c.HeartbeatInterval = d.HeartbeatInterval
+	}
+	if c.ReconnectBase <= 0 {
+		c.ReconnectBase = d.ReconnectBase
+	}
+	if c.AdoptReadyTimeout <= 0 {
+		c.AdoptReadyTimeout = d.AdoptReadyTimeout
+	}
+	if c.ReconnectMax < c.ReconnectBase {
+		c.ReconnectMax = max(c.ReconnectBase, d.ReconnectMax)
+	}
+	return nil
+}
+
+// normalizeServerURL makes the configured address a URL connect can use, and
+// refuses the combination that would quietly undo the certificates: a scheme
+// that says plaintext while TLS is configured. Silently connecting anyway would
+// mean a cluster believing it has mutual authentication when it has none.
+func (c *Config) normalizeServerURL() error {
+	// One list, however it was written. Server first when both are given,
+	// because an operator adding a standby to an existing file expects the
+	// one already there to stay preferred.
+	all := make([]string, 0, 1+len(c.Servers))
+	if c.Server != "" {
+		all = append(all, c.Server)
+	}
+	all = append(all, c.Servers...)
+
+	seen := map[string]struct{}{}
+	out := make([]string, 0, len(all))
+	for _, s := range all {
+		fixed, err := normalizeOne(s, c.TLS.Enabled())
+		if err != nil {
+			return err
+		}
+		// A duplicate would be tried twice in a row on failover, which reads
+		// as the rotation not working.
+		if _, dup := seen[fixed]; dup {
+			continue
+		}
+		seen[fixed] = struct{}{}
+		out = append(out, fixed)
+	}
+	if len(out) == 0 {
+		return errors.New("server is required")
+	}
+	c.Servers = out
+	c.Server = out[0]
+	return nil
+}
+
+// DefaultWeightsCache is where fetched weights go when nothing says otherwise.
+const DefaultWeightsCache = "/var/lib/llmgw-weights"
+
+// addrToward is this machine's address on the route to the control plane.
+//
+// The address engines are reached on is whichever one the control plane can
+// reach, and the kernel already knows which that is: a UDP "connection" picks
+// the source address for the route without sending a packet. Asking the
+// interfaces instead would have to guess among docker bridges, VPNs and
+// link-local addresses.
+func addrToward(server string) string {
+	u, err := url.Parse(server)
+	if err != nil || u.Host == "" {
+		return ""
+	}
+	host := u.Hostname()
+	port := u.Port()
+	if port == "" {
+		port = "443"
+	}
+	conn, err := net.Dial("udp", net.JoinHostPort(host, port))
+	if err != nil {
+		return ""
+	}
+	defer conn.Close()
+	if a, ok := conn.LocalAddr().(*net.UDPAddr); ok {
+		return a.IP.String()
+	}
+	return ""
+}
+
+// interfaceOf names the interface that holds an address, or "" when none does.
+func interfaceOf(addr string) string {
+	ip := net.ParseIP(addr)
+	if ip == nil {
+		return ""
+	}
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		return ""
+	}
+	for _, ifc := range ifaces {
+		addrs, err := ifc.Addrs()
+		if err != nil {
+			continue
+		}
+		for _, a := range addrs {
+			if n, ok := a.(*net.IPNet); ok && n.IP.Equal(ip) {
+				return ifc.Name
+			}
+		}
+	}
+	return ""
+}
+
+// normalizeOne applies the scheme rules to a single address.
+func normalizeOne(addr string, secure bool) (string, error) {
+	switch {
+	case strings.HasPrefix(addr, "https://"):
+		if !secure {
+			return "", fmt.Errorf("%s is an https:// address but no tls certificates are configured", addr)
+		}
+	case strings.HasPrefix(addr, "http://"):
+		if secure {
+			return "", fmt.Errorf("tls is configured but %s is an http:// address; use https://", addr)
+		}
+	case strings.Contains(addr, "://"):
+		return "", fmt.Errorf("server %q must be an http:// or https:// address", addr)
+	case secure:
+		return "https://" + addr, nil
+	default:
+		return "http://" + addr, nil
+	}
+	return addr, nil
+}

internal/agent/controlplanes.go

@@ -0,0 +1,77 @@
+package agent
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"slices"
+
+	llmgwv1 "gitea.mynodes.xyz/ilker/llmgw/api/gen/llmgw/v1"
+)
+
+// controlPlanesFile keeps the control planes the leader last named, beside
+// the agent's configuration rather than in it: the configuration is the
+// operator's, and a list rewritten in it would be a file nobody wrote.
+var controlPlanesFile = "/var/lib/llmgw-agent/control-planes.json"
+
+// servers is every address to dial, in the order to try them: the
+// configuration's, then any the leader named that it lacks.
+func (a *Agent) servers() []string {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if len(a.serverList) == 0 {
+		return a.cfg.Servers
+	}
+	return a.serverList
+}
+
+// mergeServers puts the leader's list after the configured one, without
+// repeats, and says whether that changed anything.
+func mergeServers(configured, told []string, secure bool) []string {
+	out := slices.Clone(configured)
+	for _, s := range told {
+		fixed, err := normalizeOne(s, secure)
+		if err != nil {
+			continue
+		}
+		if !slices.Contains(out, fixed) {
+			out = append(out, fixed)
+		}
+	}
+	return out
+}
+
+// setControlPlanes takes the leader's list: used from the next reconnect,
+// and kept for the next start.
+func (a *Agent) setControlPlanes(m *llmgwv1.ControlPlanes) {
+	told := m.GetServers()
+	merged := mergeServers(a.cfg.Servers, told, a.cfg.TLS.Enabled())
+	a.mu.Lock()
+	changed := !slices.Equal(merged, a.serverList)
+	a.serverList = merged
+	a.mu.Unlock()
+	if !changed {
+		return
+	}
+	a.log.Info("the control planes to dial", "servers", merged)
+	b, _ := json.Marshal(told)
+	if err := os.MkdirAll(filepath.Dir(controlPlanesFile), 0o755); err == nil {
+		tmp := controlPlanesFile + ".new"
+		if err := os.WriteFile(tmp, b, 0o644); err == nil {
+			_ = os.Rename(tmp, controlPlanesFile)
+		}
+	}
+}
+
+// loadControlPlanes is the list kept from the last time the leader named it.
+func loadControlPlanes(configured []string, secure bool) []string {
+	b, err := os.ReadFile(controlPlanesFile)
+	if err != nil {
+		return configured
+	}
+	var told []string
+	if json.Unmarshal(b, &told) != nil {
+		return configured
+	}
+	return mergeServers(configured, told, secure)
+}

internal/agent/controlplanes_test.go

@@ -0,0 +1,41 @@
+package agent
+
+import (
+	"log/slog"
+	"path/filepath"
+	"slices"
+	"testing"
+
+	llmgwv1 "gitea.mynodes.xyz/ilker/llmgw/api/gen/llmgw/v1"
+	"gitea.mynodes.xyz/ilker/llmgw/internal/tlsconf"
+)
+
+func TestAControlPlaneTheLeaderNamesIsDialledAndRemembered(t *testing.T) {
+	old := controlPlanesFile
+	controlPlanesFile = filepath.Join(t.TempDir(), "control-planes.json")
+	t.Cleanup(func() { controlPlanesFile = old })
+
+	configured := []string{"https://10.0.0.140:7443"}
+	// TLS on, as every onboarded node has it: an agent without it refuses
+	// https:// addresses, and the leader's are https://.
+	a := &Agent{cfg: Config{Servers: configured, TLS: tlsconf.Config{CA: "/etc/llmgw/ca.pem"}}, log: slog.New(slog.DiscardHandler)}
+	if got := a.servers(); !slices.Equal(got, configured) {
+		t.Fatalf("before anything is named: %v", got)
+	}
+	// The configured one stays first; the new one is added after it, once.
+	a.setControlPlanes(&llmgwv1.ControlPlanes{Servers: []string{"https://10.0.0.140:7443", "https://10.0.0.150:7443"}})
+	want := []string{"https://10.0.0.140:7443", "https://10.0.0.150:7443"}
+	if got := a.servers(); !slices.Equal(got, want) {
+		t.Errorf("after the leader named two: %v", got)
+	}
+	// And after a restart, before the leader says anything.
+	if got := loadControlPlanes(configured, true); !slices.Equal(got, want) {
+		t.Errorf("after a restart: %v", got)
+	}
+	// A list that drops the configured one does not drop it: the
+	// configuration is the operator's.
+	a.setControlPlanes(&llmgwv1.ControlPlanes{Servers: []string{"https://10.0.0.150:7443"}})
+	if got := a.servers(); got[0] != "https://10.0.0.140:7443" {
+		t.Errorf("the configured server was dropped: %v", got)
+	}
+}

internal/agent/disabled_test.go

@@ -0,0 +1,32 @@
+package agent
+
+import (
+	"testing"
+
+	llmgwv1 "gitea.mynodes.xyz/ilker/llmgw/api/gen/llmgw/v1"
+	"gitea.mynodes.xyz/ilker/llmgw/internal/agent/engines"
+)
+
+func TestAnEngineDisabledOnTheNodeIsNeitherInstalledNorAdvertised(t *testing.T) {
+	a := &Agent{}
+	a.cfg.Engines.Disabled = []string{"vllm"}
+	a.setProvision(&llmgwv1.Provision{Engines: []*llmgwv1.EngineWant{
+		{Engine: "llamacpp", Version: "b1"}, {Engine: "vllm", Version: "0.30.0"},
+	}})
+	if len(a.provWants) != 1 || a.provWants[0].Engine != "llamacpp" {
+		t.Errorf("wants %+v: vLLM is disabled here and must not be installed", a.provWants)
+	}
+	a.configuredVers = map[string]string{"vllm": "0.25.0"}
+	a.installedVers = map[string]string{"llamacpp": "b1"}
+	if got := a.engineReportLocked(); got["vllm"] != "" || got["llamacpp"] != "b1" {
+		t.Errorf("advertised %v: a disabled engine found on disk is still not offered", got)
+	}
+}
+
+func TestAnEngineNamedByHandIsNotInstalledOverIt(t *testing.T) {
+	a := &Agent{reg: engines.NewRegistry(engines.Config{LlamaCpp: engines.LlamaCppConfig{Bin: "/opt/own/llama-server"}})}
+	a.setProvision(&llmgwv1.Provision{Engines: []*llmgwv1.EngineWant{{Engine: "llamacpp", Version: "b1"}}})
+	if len(a.provWants) != 0 {
+		t.Errorf("wants %+v: an installed build would be used over the operator's own", a.provWants)
+	}
+}

internal/agent/discovery/discover.go

@@ -21,8 +21,9 @@ type Options struct {
 	NvidiaSMI string `koanf:"nvidia_smi"`
 	// IBRoot is the sysfs InfiniBand directory.
 	IBRoot string `koanf:"ib_root"`
-	// PreferNVML uses the NVML backend when this binary has one. It is the only
-	// source of NVLink topology.
+	// PreferNVML uses the NVML backend when this binary has one. NVLink
+	// topology is read from nvidia-smi topo -m on every build; NVML, where it
+	// is used, is the more exact source of the peers.
 	PreferNVML bool `koanf:"prefer_nvml"`
 	// SkipGPUs omits GPU discovery. A node without nvidia-smi is already
 	// found to have none, so this is for one whose driver is broken.
@@ -64,8 +65,7 @@ func Discover(ctx context.Context, opts Options, log *slog.Logger) (Inventory, e
 				inv.GPUs, inv.Source = gpus, "nvml"
 				break
 			}
-			log.Warn("NVML discovery failed, falling back to nvidia-smi; "+
-				"NVLink topology will be unavailable", "err", err)
+			log.Warn("NVML discovery failed, falling back to nvidia-smi", "err", err)
 			fallthrough
 		default:
 			gpus, err := DiscoverGPUsSMI(ctx, opts.NvidiaSMI)
@@ -74,6 +74,26 @@ func Discover(ctx context.Context, opts Options, log *slog.Logger) (Inventory, e
 			}
 			inv.GPUs, inv.Source = gpus, "nvidia-smi"
 		}
+		// NVLink and which adapter sits nearest each card, for either path:
+		// NVML knows NVLink but not the adapters, nvidia-smi's query knows
+		// neither. A failure costs the topology and nothing else — the cards
+		// are still cards.
+		if len(inv.GPUs) > 0 {
+			topo, err := DiscoverTopology(ctx, opts.NvidiaSMI)
+			if err != nil {
+				log.Warn("could not read the GPU topology; tensor-parallel groups "+
+					"will be chosen without NVLink", "err", err)
+			} else {
+				topo.Apply(inv.GPUs)
+			}
+			// Multi-node NVLink: which domain each card has joined.
+			if fab, err := DiscoverGPUFabric(ctx, opts.NvidiaSMI); err != nil {
+				log.Warn("could not read the GPUs' NVLink fabric state", "err", err)
+			} else {
+				ApplyFabric(inv.GPUs, fab)
+			}
+			inv.IMEX = DiscoverIMEX(ctx)
+		}
 	}
 
 	hcas, err := DiscoverIB(opts.IBRoot)

internal/agent/discovery/fabrics.go

@@ -10,6 +10,8 @@ import (
 // has.
 type FabricCheck struct {
 	Fabric string
+	// Declared are the adapters the configuration names for it.
+	Declared []string
 	// Usable are the declared adapters that exist and have an active port.
 	Usable []string
 	// RateGbps is the slowest active port among them, because a collective
@@ -49,7 +51,7 @@ func CheckFabrics(declared map[string][]string, discovered []HCA) []FabricCheck
 
 	out := make([]FabricCheck, 0, len(names))
 	for _, fabric := range names {
-		c := FabricCheck{Fabric: fabric}
+		c := FabricCheck{Fabric: fabric, Declared: declared[fabric]}
 		for _, want := range declared[fabric] {
 			hca, found := byName[want]
 			if !found {

internal/agent/discovery/gpu.go

@@ -38,8 +38,20 @@ type GPU struct {
 	// NVLinkPeers are the indices of GPUs reachable over NVLink. Within a node
 	// a TP group should stay inside one NVLink domain.
 	NVLinkPeers []int `json:"nvlink_peers,omitempty"`
+	// NICPaths is how far each network adapter is from this GPU, by HCA name:
+	// PIX, PXB, PHB, NODE or SYS, as nvidia-smi topo reports it. What decides
+	// which adapter a GPU's share of a multi-node job should go through.
+	NICPaths map[string]string `json:"nic_paths,omitempty"`
+	// Fabric is the GPU's multi-node NVLink membership, nil where the
+	// driver reports none.
+	Fabric *GPUFabric `json:"fabric,omitempty"`
 	// Health carries anything that should keep the GPU out of placement.
 	Health GPUHealth `json:"health"`
+	// MIG is set when this is a MIG instance rather than a whole card: its
+	// Index is then MIGIndex's, its UUID the instance's (MIG-…), and its
+	// memory the instance's share. Utilisation stays unreported, because no
+	// driver measures it per instance.
+	MIG *MIGDevice `json:"mig,omitempty"`
 }
 
 // GPUHealth records conditions that make a GPU unsafe to schedule onto.
@@ -87,8 +99,30 @@ func (g GPU) Class() string {
 	}
 
 	// Round to the nearest GiB: vendors report 81559 MiB for an "80GB" card.
-	gb := int(math.Round(float64(g.MemoryTotalMB) / 1024))
-	return fmt.Sprintf("%s-%dg", model, gb)
+	// A MIG instance is named from its card's memory and then its profile,
+	// so two instances are one class only when both the card and the slice
+	// are the same.
+	mem := g.MemoryTotalMB
+	if g.MIG != nil {
+		mem = g.MIG.ParentMemoryTotalMB
+	}
+	gb := int(math.Round(float64(mem) / 1024))
+	class := fmt.Sprintf("%s-%dg", model, gb)
+	if g.MIG != nil {
+		return migClass(class, g.MIG.Profile)
+	}
+	return class
+}
+
+// normalizeBusID makes bus ids comparable: NVML reports them uppercase from one
+// call and lowercase from another, and sometimes with a shortened domain.
+func normalizeBusID(s string) string {
+	s = strings.ToLower(strings.TrimSpace(s))
+	// "0000:1b:00.0" and "00000000:1B:00.0" are the same device.
+	if i := strings.Index(s, ":"); i > 0 {
+		s = strings.TrimLeft(s[:i], "0") + s[i:]
+	}
+	return strings.TrimPrefix(s, ":")
 }
 
 // MarshalJSON adds the derived class, so a consumer of the JSON does not have
@@ -117,6 +151,9 @@ type Inventory struct {
 	// Storage is the disk behind those weights, one entry per filesystem.
 	// Empty means the same thing it means for Weights: not asked.
 	Storage []Storage `json:"storage,omitempty"`
+	// IMEX is the service a multi-node NVLink domain needs, read where the
+	// node has GPUs.
+	IMEX IMEX `json:"imex"`
 }
 
 // Classes returns the distinct GPU classes present, sorted.

internal/agent/discovery/gpu_fabric.go

@@ -0,0 +1,160 @@
+package discovery
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+// GPUFabric is a GPU's place in a multi-node NVLink domain, as the driver
+// reports it: the NVL72 rack, or the NVLink Switch system, it belongs to.
+type GPUFabric struct {
+	// State is Completed once the fabric manager has joined the GPU to its
+	// domain; In Progress, Not Started or Not Supported otherwise.
+	State string `json:"state"`
+	// Status is Success, or the reason the join failed.
+	Status string `json:"status,omitempty"`
+	// ClusterUUID and CliqueID name the domain: GPUs sharing both can reach
+	// each other over NVLink whatever node they are in.
+	ClusterUUID string `json:"cluster_uuid,omitempty"`
+	CliqueID    string `json:"clique_id,omitempty"`
+	// Bandwidth is Full, or how the domain's NVLink is degraded.
+	Bandwidth string `json:"bandwidth,omitempty"`
+}
+
+// Domain is the NVLink domain the GPU is joined to, empty when it is in none
+// that crosses nodes: a card with no fabric, one not joined, or one whose
+// cluster is all zeros, which is what a single machine's NVSwitch reports.
+func (f *GPUFabric) Domain() string {
+	if f == nil || !strings.EqualFold(f.State, "Completed") {
+		return ""
+	}
+	u := strings.ToLower(strings.TrimSpace(f.ClusterUUID))
+	if u == "" || strings.Trim(u, "0-") == "" {
+		return ""
+	}
+	return u + "/" + f.CliqueID
+}
+
+// ParseGPUFabric reads the Fabric sections of `nvidia-smi -q`, by the PCI
+// address each GPU's section starts with.
+func ParseGPUFabric(out string) map[string]GPUFabric {
+	res := map[string]GPUFabric{}
+	var bus string
+	fabricIndent := -1
+	var cur *GPUFabric
+	flush := func() {
+		if bus != "" && cur != nil && cur.State != "" {
+			res[bus] = *cur
+		}
+		cur, fabricIndent = nil, -1
+	}
+	for _, line := range strings.Split(out, "\n") {
+		trim := strings.TrimSpace(line)
+		indent := len(line) - len(strings.TrimLeft(line, " \t"))
+		if strings.HasPrefix(line, "GPU ") && indent == 0 {
+			flush()
+			bus = strings.ToLower(strings.TrimSpace(strings.TrimPrefix(line, "GPU ")))
+			continue
+		}
+		if trim == "Fabric" {
+			flush()
+			cur, fabricIndent = &GPUFabric{}, indent
+			continue
+		}
+		if cur == nil {
+			continue
+		}
+		if trim != "" && indent <= fabricIndent {
+			flush()
+			continue
+		}
+		k, v, ok := strings.Cut(trim, ":")
+		if !ok {
+			continue
+		}
+		k, v = strings.TrimSpace(k), strings.TrimSpace(v)
+		if strings.EqualFold(v, "N/A") {
+			v = ""
+		}
+		switch k {
+		case "State":
+			cur.State = v
+		case "Status":
+			cur.Status = v
+		case "ClusterUUID", "Cluster UUID":
+			cur.ClusterUUID = v
+		case "CliqueId", "Clique ID":
+			cur.CliqueID = v
+		case "Bandwidth":
+			cur.Bandwidth = v
+		}
+	}
+	flush()
+	return res
+}
+
+// DiscoverGPUFabric runs `nvidia-smi -q` for the Fabric sections. Nothing
+// is reported on a driver or a card without them.
+func DiscoverGPUFabric(ctx context.Context, binary string) (map[string]GPUFabric, error) {
+	if binary == "" {
+		if _, err := exec.LookPath("nvidia-smi"); err != nil {
+			return nil, nil
+		}
+		binary = "nvidia-smi"
+	}
+	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
+	defer cancel()
+	out, err := exec.CommandContext(ctx, binary, "-q").Output()
+	if err != nil {
+		return nil, err
+	}
+	return ParseGPUFabric(string(out)), nil
+}
+
+// ApplyFabric puts each GPU's fabric on it, matched by PCI address.
+func ApplyFabric(gpus []GPU, fab map[string]GPUFabric) {
+	for i := range gpus {
+		if f, ok := fab[strings.ToLower(gpus[i].PCIBusID)]; ok {
+			f := f
+			gpus[i].Fabric = &f
+		}
+	}
+}
+
+// IMEX is the service that lets GPUs in different nodes of one NVLink
+// domain share memory: without it, multi-node NVLink carries nothing.
+type IMEX struct {
+	// State is systemd's word for nvidia-imex: active, inactive, or empty
+	// where it is not installed.
+	State string `json:"state,omitempty"`
+	// Channels is how many IMEX channels exist; a process needs one.
+	Channels int `json:"channels"`
+}
+
+// DiscoverIMEX reads the IMEX service and its channels.
+func DiscoverIMEX(ctx context.Context) IMEX {
+	var m IMEX
+	if entries, err := os.ReadDir("/dev/nvidia-caps-imex-channels"); err == nil {
+		m.Channels = len(entries)
+	}
+	if _, err := exec.LookPath("systemctl"); err == nil {
+		ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+		defer cancel()
+		out, _ := exec.CommandContext(ctx, "systemctl", "is-active", "nvidia-imex").Output()
+		m.State = strings.TrimSpace(string(out))
+		if m.State == "inactive" {
+			// "inactive" is also what systemd says of a unit that does not
+			// exist; the binary says which.
+			if _, err := exec.LookPath("nvidia-imex"); err != nil {
+				if _, err := os.Stat(filepath.Join("/usr/bin", "nvidia-imex")); err != nil {
+					m.State = ""
+				}
+			}
+		}
+	}
+	return m
+}

internal/agent/discovery/gpu_fabric_test.go

@@ -0,0 +1,77 @@
+package discovery
+
+import "testing"
+
+// smiQ is an excerpt of `nvidia-smi -q` on a GB200 tray: two GPUs joined to
+// one NVL72 domain, then a PCIe card that has no fabric at all.
+const smiQ = `
+==============NVSMI LOG==============
+
+Timestamp                                 : Mon Sep 29 10:00:00 2026
+Driver Version                            : 570.86.15
+Attached GPUs                             : 3
+GPU 00000008:01:00.0
+    Product Name                          : NVIDIA GB200
+    Minor Number                          : 0
+    Fabric
+        State                             : Completed
+        Status                            : Success
+        CliqueId                          : 32766
+        ClusterUUID                       : 76B1AD76-7c24-4b6b-9f6c-2a1e0d8c11aa
+        Health
+            Bandwidth                     : Full
+    Processes                             : None
+
+GPU 00000009:01:00.0
+    Product Name                          : NVIDIA GB200
+    Fabric
+        State                             : In Progress
+        Status                            : N/A
+        CliqueId                          : N/A
+        ClusterUUID                       : N/A
+    Processes                             : None
+
+GPU 0000000A:01:00.0
+    Product Name                          : NVIDIA L40S
+    Fabric
+        State                             : N/A
+        Status                            : N/A
+`
+
+func TestAGPUsNVLinkDomainIsRead(t *testing.T) {
+	fab := ParseGPUFabric(smiQ)
+	a, ok := fab["00000008:01:00.0"]
+	if !ok {
+		t.Fatalf("fabric = %+v", fab)
+	}
+	if a.State != "Completed" || a.CliqueID != "32766" || a.Bandwidth != "Full" {
+		t.Errorf("GB200 = %+v", a)
+	}
+	if got := a.Domain(); got != "76b1ad76-7c24-4b6b-9f6c-2a1e0d8c11aa/32766" {
+		t.Errorf("domain = %q", got)
+	}
+	// Still joining: no domain yet, and said as such.
+	b := fab["00000009:01:00.0"]
+	if b.State != "In Progress" || b.Domain() != "" {
+		t.Errorf("joining GPU = %+v", b)
+	}
+	// A card with no fabric reports nothing rather than an empty one.
+	if _, ok := fab["0000000a:01:00.0"]; ok {
+		t.Error("a card without a fabric was given one")
+	}
+
+	gpus := []GPU{{Index: 0, PCIBusID: "00000008:01:00.0"}, {Index: 1, PCIBusID: "0000000A:01:00.0"}}
+	ApplyFabric(gpus, fab)
+	if gpus[0].Fabric == nil || gpus[1].Fabric != nil {
+		t.Errorf("applied = %+v %+v", gpus[0].Fabric, gpus[1].Fabric)
+	}
+}
+
+func TestASingleMachinesNVSwitchIsNoDomain(t *testing.T) {
+	// An eight-GPU HGX reports its fabric joined, with a cluster of zeros: its
+	// NVLink ends at the chassis.
+	f := &GPUFabric{State: "Completed", ClusterUUID: "00000000-0000-0000-0000-000000000000", CliqueID: "0"}
+	if f.Domain() != "" {
+		t.Errorf("a single machine read as a domain: %q", f.Domain())
+	}
+}

internal/agent/discovery/gpu_nvml.go

@@ -14,7 +14,6 @@ package discovery
 import (
 	"context"
 	"fmt"
-	"strings"
 
 	"github.com/NVIDIA/go-nvml/pkg/nvml"
 )
@@ -83,11 +82,18 @@ func DiscoverGPUsNVML(_ context.Context) ([]GPU, error) {
 		}
 
 		assessHealth(&g)
-		gpus = append(gpus, g)
+		// A card in MIG mode is its instances, not itself: CUDA will not
+		// open the whole card while MIG is on.
+		devs, _ := migFromNVML(g, nvmlCard{dev})
+		gpus = append(gpus, devs...)
 	}
 
-	// A second pass, because a link's remote end may be a GPU enumerated later.
+	// A second pass, because a link's remote end may be a GPU enumerated
+	// later. MIG instances have no NVLink of their own to use.
 	for i := range gpus {
+		if gpus[i].IsMIG() {
+			continue
+		}
 		dev, ret := nvml.DeviceGetHandleByIndex(gpus[i].Index)
 		if ret != nvml.SUCCESS {
 			continue
@@ -136,13 +142,73 @@ func busIDString(b []int8) string {
 	return string(buf)
 }
 
-// normalizeBusID makes bus ids comparable: NVML reports them uppercase from one
-// call and lowercase from another, and sometimes with a shortened domain.
-func normalizeBusID(s string) string {
-	s = strings.ToLower(strings.TrimSpace(s))
-	// "0000:1b:00.0" and "00000000:1B:00.0" are the same device.
-	if i := strings.Index(s, ":"); i > 0 {
-		s = strings.TrimLeft(s[:i], "0") + s[i:]
+// nvmlCard adapts an NVML device to what MIG discovery reads of it.
+type nvmlCard struct{ dev nvml.Device }
+
+func (c nvmlCard) MIGMode() (current, pending, ok bool) {
+	cur, pend, ret := c.dev.GetMigMode()
+	if ret != nvml.SUCCESS {
+		// NOT_SUPPORTED on a card without MIG, which is most of them.
+		return false, false, false
 	}
-	return strings.TrimPrefix(s, ":")
+	return cur == nvml.DEVICE_MIG_ENABLE, pend == nvml.DEVICE_MIG_ENABLE, true
+}
+
+func (c nvmlCard) MaxMIGDevices() int {
+	n, ret := c.dev.GetMaxMigDeviceCount()
+	if ret != nvml.SUCCESS {
+		return 0
+	}
+	return n
+}
+
+func (c nvmlCard) MIGDevice(i int) (nvmlMIGInstance, bool) {
+	h, ret := c.dev.GetMigDeviceHandleByIndex(i)
+	if ret != nvml.SUCCESS {
+		// NOT_FOUND for an index with no instance: the count is the most a
+		// card can hold, not how many it has.
+		return nil, false
+	}
+	return nvmlMIG{h}, true
+}
+
+// nvmlMIG adapts a MIG device handle.
+type nvmlMIG struct{ dev nvml.Device }
+
+func (m nvmlMIG) UUID() string {
+	u, _ := m.dev.GetUUID()
+	return u
+}
+
+func (m nvmlMIG) Name() string {
+	n, _ := m.dev.GetName()
+	return n
+}
+
+func (m nvmlMIG) Memory() (totalMB, usedMB int, ok bool) {
+	mem, ret := m.dev.GetMemoryInfo()
+	if ret != nvml.SUCCESS {
+		return 0, 0, false
+	}
+	return int(mem.Total / (1 << 20)), int(mem.Used / (1 << 20)), true
+}
+
+func (m nvmlMIG) Instances() (gpuInstance, computeInstance int) {
+	gi, ret := m.dev.GetGpuInstanceId()
+	if ret != nvml.SUCCESS {
+		gi = -1
+	}
+	ci, ret := m.dev.GetComputeInstanceId()
+	if ret != nvml.SUCCESS {
+		ci = -1
+	}
+	return gi, ci
+}
+
+func (m nvmlMIG) Attributes() (slices, memoryMB int, ok bool) {
+	a, ret := m.dev.GetAttributes()
+	if ret != nvml.SUCCESS {
+		return 0, 0, false
+	}
+	return int(a.GpuInstanceSliceCount), int(a.MemorySizeMB), true
 }

internal/agent/discovery/gpu_smi.go

@@ -40,8 +40,8 @@ const mandatorySMIFields = 10
 //
 // This is the cgo-free path (plan §3.2): the NVML bindings need cgo, which
 // would force the whole binary — server included — to be built with a C
-// toolchain. nvidia-smi gives everything except NVLink topology, which the
-// NVML build adds.
+// toolchain. The query gives everything except topology, which Discover
+// reads from `nvidia-smi topo -m` afterwards.
 func DiscoverGPUsSMI(ctx context.Context, binary string) ([]GPU, error) {
 	if binary == "" {
 		// Not configured and not installed is a node without an NVIDIA card,
@@ -60,7 +60,33 @@ func DiscoverGPUsSMI(ctx context.Context, binary string) ([]GPU, error) {
 	if err != nil {
 		return nil, fmt.Errorf("running %s: %w", binary, err)
 	}
-	return parseSMI(string(out))
+	cards, err := parseSMI(string(out))
+	if err != nil || len(cards) == 0 {
+		return cards, err
+	}
+	// The query lists whole cards, MIG mode or not. A card in MIG mode is
+	// replaced by its instances, which only -L names and only the full
+	// report sizes; asked only when some card could be in MIG mode, since
+	// the report is the slowest thing nvidia-smi does.
+	if !anyMIGCapable(cards) {
+		return cards, nil
+	}
+	listed, report := readMIG(ctx, binary)
+	return expandMIG(cards, listed, report), nil
+}
+
+// anyMIGCapable reports whether any card could be in MIG mode: MIG began
+// with compute capability 8.0 (the A100). The consumer cards of the same
+// generations have none, but telling them apart by name is guesswork, and
+// asking one costs only two more nvidia-smi runs at registration.
+func anyMIGCapable(cards []GPU) bool {
+	for _, c := range cards {
+		major, _, _ := strings.Cut(c.ComputeCapability, ".")
+		if n, err := strconv.Atoi(major); err == nil && n >= 8 {
+			return true
+		}
+	}
+	return false
 }
 
 func parseSMI(out string) ([]GPU, error) {
@@ -106,9 +132,27 @@ func parseSMI(out string) ([]GPU, error) {
 	return gpus, nil
 }
 
-// residentMemoryToleranceMB is how much allocated memory is written off as
+// ForeignMemoryToleranceMB is how much allocated memory is written off as
 // driver overhead rather than a foreign process.
-const residentMemoryToleranceMB = 512
+const ForeignMemoryToleranceMB = 512
+
+// foreignMemorySuffix ends the problem a card with another tenant on it is
+// kept out of placement for. One phrase, so that the control plane can find
+// it again and drop it when the tenant leaves.
+const foreignMemorySuffix = " MiB already allocated by another process"
+
+// ForeignMemoryProblem is the problem for mb of memory held by something
+// that is not one of this agent's engines, or "" when that is too little to
+// count.
+func ForeignMemoryProblem(mb int) string {
+	if mb <= ForeignMemoryToleranceMB {
+		return ""
+	}
+	return fmt.Sprintf("%d%s", mb, foreignMemorySuffix)
+}
+
+// IsForeignMemoryProblem reports whether a problem is ForeignMemoryProblem's.
+func IsForeignMemoryProblem(p string) bool { return strings.HasSuffix(p, foreignMemorySuffix) }
 
 // assessHealth flags conditions that should keep a GPU out of placement.
 func assessHealth(g *GPU) {
@@ -119,8 +163,12 @@ func assessHealth(g *GPU) {
 	// Memory already in use means something else is on the card. Starting an
 	// engine there would either fail to allocate or quietly evict the other
 	// process's throughput.
-	if g.MemoryUsedMB > residentMemoryToleranceMB {
-		g.Health.Problems = append(g.Health.Problems,
-			fmt.Sprintf("%d MiB already allocated by another process", g.MemoryUsedMB))
+	//
+	// Only a first reading: this runs before the agent knows which processes
+	// are its own, so an engine still running from before a restart reads as
+	// foreign here. Every heartbeat measures it again, without the agent's
+	// own engines, and the control plane replaces this with that.
+	if p := ForeignMemoryProblem(g.MemoryUsedMB); p != "" {
+		g.Health.Problems = append(g.Health.Problems, p)
 	}
 }

internal/agent/discovery/gpuhealth.go

@@ -0,0 +1,280 @@
+package discovery
+
+import (
+	"context"
+	"encoding/xml"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+// GPUWear is what wears a card out or takes it down, beyond temperature:
+// read every minute, from nvidia-smi and the kernel's log. The early signs of
+// a card failing are here — a growing count of rows its memory had to remap,
+// PCIe link retries, XID errors — long before a replica on it fails.
+//
+// A count of -1 is not reported: a card without row remapping (before
+// Ampere) has no such count, which is not the same as none.
+type GPUWear struct {
+	Index int
+	// PCIeReplays are link-level retries on the card's PCIe link: a few are
+	// noise, a count that keeps climbing is a riser, slot or cable.
+	PCIeReplays int64
+	// RetiredSBE and RetiredDBE are memory pages retired for single and
+	// double bit errors (cards before Ampere); RetirePending is a page
+	// waiting for a reset to be retired.
+	RetiredSBE, RetiredDBE int64
+	RetirePending          bool
+	// RemappedCorrectable and RemappedUncorrectable are memory rows remapped
+	// (Ampere and later). RemapPending waits for a reset; RemapFailure is a
+	// card out of spare rows — it needs replacing.
+	RemappedCorrectable, RemappedUncorrectable int64
+	RemapPending, RemapFailure                 bool
+	// NVLink errors summed over the card's links, by kind.
+	NVLinkCRC, NVLinkReplay, NVLinkRecovery int64
+	// XIDs are the driver's error events for this card since the agent
+	// started, and the last of them.
+	XIDs        int64
+	LastXID     int
+	LastXIDText string
+	LastXIDAt   time.Time
+}
+
+// healthEvery is how often health is read: it changes over hours, and the
+// kernel log and nvidia-smi's full report are the heavier reads.
+const healthEvery = time.Minute
+
+// HealthSampler reads GPUWear, keeping the XID counts between reads.
+type HealthSampler struct {
+	run func(ctx context.Context, name string, args ...string) ([]byte, error)
+	now func() time.Time
+
+	mu      sync.Mutex
+	at      time.Time
+	last    []GPUWear
+	since   time.Time
+	xids    map[int]*GPUWear
+	started bool
+}
+
+// NewHealthSampler reads the machine's own nvidia-smi and kernel log.
+func NewHealthSampler() *HealthSampler {
+	return &HealthSampler{now: time.Now, xids: map[int]*GPUWear{},
+		run: func(ctx context.Context, name string, args ...string) ([]byte, error) {
+			return exec.CommandContext(ctx, name, args...).Output() //nolint:gosec // fixed tools
+		}}
+}
+
+// Sample is the cards' health, read again once healthEvery has passed. Nil
+// on a machine without nvidia-smi.
+func (h *HealthSampler) Sample(ctx context.Context) []GPUWear {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	now := h.now()
+	if !h.at.IsZero() && now.Sub(h.at) < healthEvery {
+		return h.last
+	}
+	h.at = now
+	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+	report, err := h.run(ctx, "nvidia-smi", "-q", "-x")
+	if err != nil {
+		h.last = nil
+		return nil
+	}
+	cards, bus := parseHealthReport(report)
+	if out, err := h.run(ctx, "nvidia-smi", "nvlink", "-e"); err == nil {
+		for i, e := range parseNVLinkErrors(string(out)) {
+			if i < len(cards) {
+				cards[i].NVLinkCRC, cards[i].NVLinkReplay, cards[i].NVLinkRecovery = e[0], e[1], e[2]
+			}
+		}
+	}
+	h.readXIDs(ctx, now, bus)
+	for i := range cards {
+		if x := h.xids[i]; x != nil {
+			cards[i].XIDs, cards[i].LastXID, cards[i].LastXIDText, cards[i].LastXIDAt = x.XIDs, x.LastXID, x.LastXIDText, x.LastXIDAt
+		}
+	}
+	h.last = cards
+	return cards
+}
+
+// readXIDs adds the XID events logged since the last read. The first read
+// starts from now: what happened before the agent started was before, and
+// counting the whole log would raise every alert on every restart.
+func (h *HealthSampler) readXIDs(ctx context.Context, now time.Time, bus map[string]int) {
+	if !h.started {
+		h.started, h.since = true, now
+		return
+	}
+	since := h.since
+	h.since = now
+	out, err := h.run(ctx, "journalctl", "-k", "--no-pager", "-o", "short-unix",
+		"--since", "@"+strconv.FormatInt(since.Unix(), 10), "-g", "NVRM: Xid")
+	if err != nil {
+		// No journal, or nothing matched (journalctl exits 1 for that).
+		return
+	}
+	for _, e := range parseXIDs(string(out)) {
+		i, ok := bus[e.bus]
+		if !ok {
+			continue
+		}
+		x := h.xids[i]
+		if x == nil {
+			x = &GPUWear{Index: i}
+			h.xids[i] = x
+		}
+		x.XIDs++
+		x.LastXID, x.LastXIDText = e.code, e.text
+		x.LastXIDAt = now
+		if e.at > 0 {
+			x.LastXIDAt = time.Unix(int64(e.at), 0)
+		}
+	}
+}
+
+// healthLog is the part of nvidia-smi's XML report health is read from.
+type healthLog struct {
+	GPUs []struct {
+		ID  string `xml:"id,attr"`
+		PCI struct {
+			Replay string `xml:"replay_counter"`
+		} `xml:"pci"`
+		Retired struct {
+			SBE     string `xml:"multiple_single_bit_retirement>retired_count"`
+			DBE     string `xml:"double_bit_retirement>retired_count"`
+			Pending string `xml:"pending_retirement"`
+			// Older drivers name it pending_blacklist.
+			Blacklist string `xml:"pending_blacklist"`
+		} `xml:"retired_pages"`
+		Remapped struct {
+			Corr    string `xml:"remapped_row_corr"`
+			Unc     string `xml:"remapped_row_unc"`
+			Pending string `xml:"remapped_row_pending"`
+			Failure string `xml:"remapped_row_failure"`
+		} `xml:"remapped_rows"`
+	} `xml:"gpu"`
+}
+
+// parseHealthReport reads each card's health, in index order, and maps each
+// card's PCI bus ("3b:00", as the kernel names it) to its index.
+func parseHealthReport(report []byte) ([]GPUWear, map[string]int) {
+	var log healthLog
+	if err := xml.Unmarshal(report, &log); err != nil {
+		return nil, nil
+	}
+	bus := map[string]int{}
+	out := make([]GPUWear, 0, len(log.GPUs))
+	for i, g := range log.GPUs {
+		bus[busOf(g.ID)] = i
+		out = append(out, GPUWear{
+			Index:                 i,
+			PCIeReplays:           count(g.PCI.Replay),
+			RetiredSBE:            count(g.Retired.SBE),
+			RetiredDBE:            count(g.Retired.DBE),
+			RetirePending:         yes(g.Retired.Pending) || yes(g.Retired.Blacklist),
+			RemappedCorrectable:   count(g.Remapped.Corr),
+			RemappedUncorrectable: count(g.Remapped.Unc),
+			RemapPending:          yes(g.Remapped.Pending),
+			RemapFailure:          yes(g.Remapped.Failure),
+		})
+	}
+	return out, bus
+}
+
+// busOf is a PCI address as the kernel's XID lines carry it: nvidia-smi
+// says "00000000:3B:00.0", the kernel "0000:3b:00".
+func busOf(id string) string {
+	id = strings.ToLower(strings.TrimSpace(id))
+	if i := strings.LastIndex(id, "."); i >= 0 {
+		id = id[:i]
+	}
+	parts := strings.Split(id, ":")
+	if len(parts) >= 2 {
+		return parts[len(parts)-2] + ":" + parts[len(parts)-1]
+	}
+	return id
+}
+
+func count(s string) int64 {
+	n, err := strconv.ParseInt(strings.TrimSpace(s), 10, 64)
+	if err != nil {
+		return -1
+	}
+	return n
+}
+
+func yes(s string) bool { return strings.EqualFold(strings.TrimSpace(s), "yes") }
+
+// nvlinkError matches a line of `nvidia-smi nvlink -e`, whose wording varies
+// by driver: "Link 0: Replay Errors: 0", "Link 0: CRC Errors: 0",
+// "Link 3: Data CRC Errors: 2".
+var (
+	nvlinkGPU   = regexp.MustCompile(`^GPU (\d+):`)
+	nvlinkError = regexp.MustCompile(`Link \d+:\s*(.*?)\s*Errors?\s*:\s*(\d+)`)
+)
+
+// parseNVLinkErrors sums each card's link errors by kind: CRC, replay,
+// recovery.
+func parseNVLinkErrors(out string) map[int][3]int64 {
+	res := map[int][3]int64{}
+	gpu := -1
+	for _, line := range strings.Split(out, "\n") {
+		if m := nvlinkGPU.FindStringSubmatch(strings.TrimSpace(line)); m != nil {
+			gpu, _ = strconv.Atoi(m[1])
+			continue
+		}
+		m := nvlinkError.FindStringSubmatch(line)
+		if m == nil || gpu < 0 {
+			continue
+		}
+		n, _ := strconv.ParseInt(m[2], 10, 64)
+		e := res[gpu]
+		kind := strings.ToLower(m[1])
+		switch {
+		case strings.Contains(kind, "crc"):
+			e[0] += n
+		case strings.Contains(kind, "replay"):
+			e[1] += n
+		case strings.Contains(kind, "recovery"):
+			e[2] += n
+		}
+		res[gpu] = e
+	}
+	return res
+}
+
+type xidEvent struct {
+	bus  string
+	code int
+	text string
+	at   float64
+}
+
+// xidLine matches the driver's report of an XID:
+// "NVRM: Xid (PCI:0000:3b:00): 79, pid=..., GPU has fallen off the bus."
+var xidLine = regexp.MustCompile(`NVRM: Xid \(PCI:([0-9a-fA-F:.]+)\): (\d+),\s*(.*)$`)
+
+// parseXIDs reads journalctl's short-unix lines: a timestamp, then the
+// message.
+func parseXIDs(out string) []xidEvent {
+	var evs []xidEvent
+	for _, line := range strings.Split(out, "\n") {
+		m := xidLine.FindStringSubmatch(line)
+		if m == nil {
+			continue
+		}
+		code, _ := strconv.Atoi(m[2])
+		e := xidEvent{bus: busOf(m[1]), code: code, text: strings.TrimSpace(m[3])}
+		if f := strings.Fields(line); len(f) > 0 {
+			e.at, _ = strconv.ParseFloat(f[0], 64)
+		}
+		evs = append(evs, e)
+	}
+	return evs
+}

internal/agent/discovery/gpuhealth_test.go

@@ -0,0 +1,101 @@
+package discovery
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+)
+
+const healthXML = `<?xml version="1.0" ?>
+<nvidia_smi_log>
+  <gpu id="00000000:3B:00.0">
+    <pci><replay_counter>0</replay_counter></pci>
+    <retired_pages>
+      <multiple_single_bit_retirement><retired_count>N/A</retired_count></multiple_single_bit_retirement>
+      <double_bit_retirement><retired_count>N/A</retired_count></double_bit_retirement>
+      <pending_retirement>N/A</pending_retirement>
+    </retired_pages>
+    <remapped_rows>
+      <remapped_row_corr>2</remapped_row_corr>
+      <remapped_row_unc>1</remapped_row_unc>
+      <remapped_row_pending>Yes</remapped_row_pending>
+      <remapped_row_failure>No</remapped_row_failure>
+    </remapped_rows>
+  </gpu>
+  <gpu id="00000000:5E:00.0">
+    <pci><replay_counter>4021</replay_counter></pci>
+    <retired_pages>
+      <multiple_single_bit_retirement><retired_count>3</retired_count></multiple_single_bit_retirement>
+      <double_bit_retirement><retired_count>1</retired_count></double_bit_retirement>
+      <pending_blacklist>Yes</pending_blacklist>
+    </retired_pages>
+    <remapped_rows>N/A</remapped_rows>
+  </gpu>
+</nvidia_smi_log>`
+
+const nvlinkOut = `GPU 0: NVIDIA H100 80GB HBM3 (UUID: GPU-aaa)
+	 Link 0: Replay Errors: 1
+	 Link 0: Recovery Errors: 0
+	 Link 0: CRC Errors: 5
+	 Link 1: Data CRC Errors: 2
+GPU 1: NVIDIA H100 80GB HBM3 (UUID: GPU-bbb)
+	 Link 0: Replay Errors: 0
+`
+
+func TestAGPUsWearAndFailuresAreReadAndCountedFromWhenTheAgentStarted(t *testing.T) {
+	now := time.Unix(1_800_000_000, 0)
+	journal := ""
+	h := &HealthSampler{now: func() time.Time { return now }, xids: map[int]*GPUWear{},
+		run: func(_ context.Context, name string, args ...string) ([]byte, error) {
+			switch {
+			case name == "nvidia-smi" && args[0] == "-q":
+				return []byte(healthXML), nil
+			case name == "nvidia-smi" && args[0] == "nvlink":
+				return []byte(nvlinkOut), nil
+			case name == "journalctl":
+				if journal == "" {
+					return nil, errors.New("exit status 1")
+				}
+				return []byte(journal), nil
+			}
+			return nil, errors.New("unexpected " + name)
+		}}
+	got := h.Sample(t.Context())
+	if len(got) != 2 {
+		t.Fatalf("%+v", got)
+	}
+	a, b := got[0], got[1]
+	if a.RemappedCorrectable != 2 || a.RemappedUncorrectable != 1 || !a.RemapPending || a.RemapFailure ||
+		a.RetiredSBE != -1 || a.PCIeReplays != 0 || a.NVLinkCRC != 7 || a.NVLinkReplay != 1 {
+		t.Errorf("card 0 %+v", a)
+	}
+	if b.PCIeReplays != 4021 || b.RetiredSBE != 3 || b.RetiredDBE != 1 || !b.RetirePending || b.RemappedCorrectable != -1 {
+		t.Errorf("card 1 %+v", b)
+	}
+
+	// An XID on card 1, logged after the agent started; read on the next
+	// sample a minute on.
+	journal = "1800000030.123456 gpu07 kernel: NVRM: Xid (PCI:0000:5e:00): 79, pid=1234, name=llama-server, GPU has fallen off the bus.\n"
+	now = now.Add(61 * time.Second)
+	got = h.Sample(t.Context())
+	if got[1].XIDs != 1 || got[1].LastXID != 79 || !strings.Contains(got[1].LastXIDText, "fallen off the bus") ||
+		got[1].LastXIDAt.Unix() != 1_800_000_030 || got[0].XIDs != 0 {
+		t.Errorf("after an XID: %+v / %+v", got[0], got[1])
+	}
+	// Within the minute, the last reading.
+	journal = ""
+	now = now.Add(10 * time.Second)
+	if again := h.Sample(t.Context()); again[1].XIDs != 1 {
+		t.Errorf("%+v", again[1])
+	}
+}
+
+func TestBusIDsAreReadAsTheKernelWritesThem(t *testing.T) {
+	for in, want := range map[string]string{"00000000:3B:00.0": "3b:00", "0000:3b:00": "3b:00", "0000:5e:00.0": "5e:00"} {
+		if got := busOf(in); got != want {
+			t.Errorf("%s: %s, want %s", in, got, want)
+		}
+	}
+}

internal/agent/discovery/gpuprocs.go

@@ -0,0 +1,142 @@
+package discovery
+
+import (
+	"context"
+	"encoding/xml"
+	"fmt"
+	"os/exec"
+	"slices"
+	"strconv"
+	"strings"
+)
+
+// GPUProcesses reports which processes hold memory on each GPU, by the GPU's
+// nvidia-smi index: what a process actually computes on, as opposed to what it
+// was told to use. A llama.cpp started with --n-gpu-layers on a GPU whose
+// backend did not load runs on the CPU without a word, and this is where that
+// shows — the process is on no GPU's list.
+//
+// From the full query rather than --query-compute-apps, which lists compute
+// processes only: llama.cpp's Vulkan build is listed as a graphics one, and
+// would have read as not on its GPU at all.
+//
+// A node with no nvidia-smi returns nil and no error, as discovery does.
+func GPUProcesses(ctx context.Context, binary string) (map[int][]int, error) {
+	if binary == "" {
+		if _, err := exec.LookPath("nvidia-smi"); err != nil {
+			return nil, nil
+		}
+		binary = "nvidia-smi"
+	}
+	out, err := exec.CommandContext(ctx, binary, "-q", "-x").Output()
+	if err != nil {
+		return nil, fmt.Errorf("running %s: %w", binary, err)
+	}
+	return parseGPUProcesses(out)
+}
+
+// GPUMemory is one device's memory as nvidia-smi reports it at a moment: what
+// is allocated on it, and which processes hold how much of that.
+//
+// A device is what discovery reports: a whole card, or each MIG instance of a
+// card in MIG mode, in the same order, so the readings line up with the
+// inventory one for one.
+type GPUMemory struct {
+	// Index is the device's number as placement knows it: the card's
+	// nvidia-smi index, or MIGIndex's for an instance.
+	Index  int
+	UsedMB int
+	Procs  []GPUProcess
+}
+
+// GPUProcess is one process holding memory on a card.
+type GPUProcess struct {
+	PID    int
+	UsedMB int
+}
+
+// GPUMemoryByProcess reports each GPU's memory, by index, with the processes
+// holding it — from the same report as GPUProcesses, so the two never
+// disagree about who is on a card.
+//
+// A node with no nvidia-smi returns nil and no error, as discovery does.
+func GPUMemoryByProcess(ctx context.Context, binary string) ([]GPUMemory, error) {
+	if binary == "" {
+		if _, err := exec.LookPath("nvidia-smi"); err != nil {
+			return nil, nil
+		}
+		binary = "nvidia-smi"
+	}
+	out, err := exec.CommandContext(ctx, binary, "-q", "-x").Output()
+	if err != nil {
+		return nil, fmt.Errorf("running %s: %w", binary, err)
+	}
+	return parseGPUMemory(out)
+}
+
+// parseGPUProcesses reads the report, by device as placement numbers them:
+// nvidia-smi's index for a whole card, MIGIndex's for a MIG instance.
+func parseGPUProcesses(report []byte) (map[int][]int, error) {
+	mem, err := parseGPUMemory(report)
+	if err != nil {
+		return nil, err
+	}
+	out := map[int][]int{}
+	for _, g := range mem {
+		for _, p := range g.Procs {
+			out[g.Index] = append(out[g.Index], p.PID)
+		}
+	}
+	return out, nil
+}
+
+// parseGPUMemory reads the report into each device's memory and its holders.
+//
+// Cards are listed in index order, which is nvidia-smi's own numbering. A
+// card in MIG mode is read as its instances, each with its own memory and
+// the processes nvidia-smi attributes to its GPU and compute instance: a
+// process on one instance is not on its neighbours, and the card's total
+// would have charged every instance with all of them.
+func parseGPUMemory(report []byte) ([]GPUMemory, error) {
+	var log migLog
+	if err := xml.Unmarshal(report, &log); err != nil {
+		return nil, fmt.Errorf("reading nvidia-smi's report: %w", err)
+	}
+	out := make([]GPUMemory, 0, len(log.GPUs))
+	for i, g := range log.GPUs {
+		procs := func(gi, ci int) []GPUProcess {
+			var ps []GPUProcess
+			for _, p := range g.Processes {
+				pid, err := strconv.Atoi(strings.TrimSpace(p.PID))
+				if err != nil {
+					continue
+				}
+				if gi >= 0 && (atoiOr(p.GPUInstance, -1) != gi || atoiOr(p.ComputeInstance, -1) != ci) {
+					continue
+				}
+				ps = append(ps, GPUProcess{PID: pid, UsedMB: mib(p.UsedMB)})
+			}
+			return ps
+		}
+		if !enabled(g.Current) || len(g.Devices) == 0 {
+			out = append(out, GPUMemory{Index: i, UsedMB: mib(g.Used), Procs: procs(-1, -1)})
+			continue
+		}
+		devs := slices.Clone(g.Devices)
+		slices.SortFunc(devs, func(a, b migLogDevice) int { return atoiOr(a.Index, -1) - atoiOr(b.Index, -1) })
+		for _, d := range devs {
+			out = append(out, GPUMemory{
+				Index:  MIGIndex(i, atoiOr(d.Index, 0)),
+				UsedMB: mib(d.Used),
+				Procs:  procs(atoiOr(d.GPUInstance, -1), atoiOr(d.ComputeInstance, -1)),
+			})
+		}
+	}
+	return out, nil
+}
+
+// mib reads "4932 MiB"; anything else, "N/A" included, is zero.
+func mib(s string) int {
+	n, _ := strconv.Atoi(strings.TrimSpace(strings.TrimSuffix(strings.TrimSpace(s), "MiB")))
+	return n
+}

internal/agent/discovery/gpuprocs_test.go

@@ -0,0 +1,78 @@
+package discovery
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestGPUProcessesOfEveryKindAreListedByIndex(t *testing.T) {
+	report := `<?xml version="1.0" ?>
+<nvidia_smi_log>
+  <driver_version>580.65.06</driver_version>
+  <gpu id="00000000:17:00.0"><product_name>Tesla V100-SXM2-32GB</product_name>
+    <processes></processes>
+  </gpu>
+  <gpu id="00000000:65:00.0"><product_name>Tesla V100-SXM2-32GB</product_name>
+    <processes>
+      <process_info><pid>4100</pid><type>C</type><process_name>llama-server</process_name></process_info>
+      <process_info><pid>4300</pid><type>G</type><process_name>llama-server</process_name></process_info>
+    </processes>
+  </gpu>
+  <gpu id="00000000:B3:00.0"><processes>
+      <process_info><pid>4200</pid><type>C+G</type></process_info>
+  </processes></gpu>
+</nvidia_smi_log>`
+	got, err := parseGPUProcesses([]byte(report))
+	if err != nil {
+		t.Fatal(err)
+	}
+	// A Vulkan engine is a graphics process ("G") and is on its GPU all the
+	// same; a compute-only query would have missed it.
+	want := map[int][]int{1: {4100, 4300}, 2: {4200}}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("got %v, want %v", got, want)
+	}
+	if _, err := parseGPUProcesses([]byte("not xml")); err == nil {
+		t.Error("a report that does not parse was read as no processes")
+	}
+}
+
+func TestGPUMemoryIsReadPerProcess(t *testing.T) {
+	report := `<?xml version="1.0" ?>
+<nvidia_smi_log>
+  <gpu id="00000000:01:00.0"><product_name>Quadro RTX 6000</product_name>
+    <fb_memory_usage><total>24576 MiB</total><used>14514 MiB</used><free>10062 MiB</free></fb_memory_usage>
+    <processes>
+      <process_info><pid>71315</pid><type>C</type><used_memory>4932 MiB</used_memory></process_info>
+      <process_info><pid>4100</pid><type>C</type><used_memory>9500 MiB</used_memory></process_info>
+    </processes>
+  </gpu>
+  <gpu id="00000000:02:00.0">
+    <fb_memory_usage><used>N/A</used></fb_memory_usage>
+    <processes></processes>
+  </gpu>
+</nvidia_smi_log>`
+	got, err := parseGPUMemory([]byte(report))
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []GPUMemory{
+		{Index: 0, UsedMB: 14514, Procs: []GPUProcess{{PID: 71315, UsedMB: 4932}, {PID: 4100, UsedMB: 9500}}},
+		{Index: 1},
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("got %+v, want %+v", got, want)
+	}
+}
+
+func TestForeignMemoryBelowTheToleranceIsNoProblem(t *testing.T) {
+	// A CUDA context that has let go of its model still holds a few hundred
+	// MiB: ComfyUI after /free held 324.
+	if p := ForeignMemoryProblem(330); p != "" {
+		t.Errorf("330 MiB is a problem: %q", p)
+	}
+	p := ForeignMemoryProblem(5014)
+	if !IsForeignMemoryProblem(p) || IsForeignMemoryProblem("2 uncorrected ECC errors") {
+		t.Errorf("%q is not recognised as the foreign memory problem, or ECC is", p)
+	}
+}

internal/agent/discovery/host.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"os"
 	"runtime"
+	"strconv"
 	"strings"
 )
 
@@ -26,6 +27,9 @@ type Host struct {
 	CPUFlags []string `json:"cpu_flags,omitempty"`
 	// NVIDIADriver is the loaded driver's version, empty when there is none.
 	NVIDIADriver string `json:"nvidia_driver,omitempty"`
+	// MinComputeCapability is the oldest GPU's, 0 when there are none or it
+	// is not known. Not read here but from the GPU inventory, by the agent.
+	MinComputeCapability float64 `json:"min_compute_capability,omitempty"`
 }
 
 // Family is the packaging family: "deb", "rpm", or "" when neither is known.
@@ -152,3 +156,19 @@ func nvidiaDriverFrom(path string) string {
 	}
 	return ""
 }
+
+// MinComputeCapability is the oldest GPU's compute capability, 0 when none
+// is known: an engine built for newer GPUs is refused by the oldest.
+func MinComputeCapability(gpus []GPU) float64 {
+	low := 0.0
+	for _, g := range gpus {
+		cc, err := strconv.ParseFloat(strings.TrimSpace(g.ComputeCapability), 64)
+		if err != nil || cc <= 0 {
+			continue
+		}
+		if low == 0 || cc < low {
+			low = cc
+		}
+	}
+	return low
+}

internal/agent/discovery/ib.go

@@ -5,6 +5,7 @@ package discovery
 import (
 	"errors"
 	"fmt"
+	"net"
 	"os"
 	"path/filepath"
 	"slices"
@@ -42,8 +43,66 @@ type Port struct {
 	GIDPrefix string `json:"gid_prefix"`
 	LID       int    `json:"lid"`
 	SMLID     int    `json:"sm_lid"`
+	// Counters are the port's error and traffic counters, by their sysfs
+	// names, as far as the driver has them. The data counters are converted
+	// to bytes; sysfs counts them in four-byte words.
+	Counters map[string]uint64 `json:"counters,omitempty"`
+	// RoCEv2GID is the GID table index NCCL should use on a RoCE port: the
+	// first RoCE v2 entry holding an IPv4 address, else the first RoCE v2
+	// entry. -1 on InfiniBand, and on a RoCE port with no v2 entry. NCCL's
+	// default of 0 is a RoCE v1 link-local entry on most setups, which does
+	// not route, and a job on it hangs.
+	RoCEv2GID int `json:"rocev2_gid"`
+	// PortGUID is the port's own identifier, the interface half of its GID.
+	PortGUID string `json:"port_guid,omitempty"`
+	// SM is the subnet manager this port sees as master, from sminfo. Nil on
+	// RoCE, which has none, and when infiniband-diags is not installed.
+	SM *SMInfo `json:"sm,omitempty"`
+	// Network is, on RoCE, the IP network of the RoCE v2 address: the only
+	// thing that says two RoCE ports are on the same fabric.
+	Network string `json:"network,omitempty"`
 }
 
+// SMInfo is a subnet manager as a port sees it.
+type SMInfo struct {
+	GUID     string `json:"guid"`
+	LID      int    `json:"lid"`
+	Priority int    `json:"priority"`
+	// State is SMINFO_MASTER, SMINFO_STANDBY, ...
+	State string `json:"state"`
+}
+
+// FabricKey is what identifies the physical fabric this port is on: the
+// master subnet manager on InfiniBand, since every port on one fabric sees
+// the same one and ports on separate fabrics cannot; the IP network on RoCE.
+// Empty when neither is known, and for a port that is not up.
+func (p Port) FabricKey() string {
+	if !p.Active() {
+		return ""
+	}
+	switch {
+	case p.LinkLayer == LinkEthernet && p.Network != "":
+		return "roce:" + p.Network
+	case p.SM != nil && p.SM.GUID != "":
+		return "sm:" + p.SM.GUID
+	}
+	return ""
+}
+
+// PortCounters are the counters worth watching, from each port's counters/
+// directory. The errors are the ones that say a cable, a transceiver or a
+// switch port is going bad before a job fails on it; the data counters say
+// whether the fabric is carrying anything at all.
+var PortCounters = []string{
+	"symbol_error", "link_error_recovery", "link_downed", "port_rcv_errors",
+	"port_rcv_remote_physical_errors", "port_xmit_discards",
+	"local_link_integrity_errors", "excessive_buffer_overrun_errors",
+	"port_xmit_data", "port_rcv_data",
+}
+
+// dataCounter reports whether a counter counts data in four-byte words.
+func dataCounter(name string) bool { return name == "port_xmit_data" || name == "port_rcv_data" }
+
 // Active reports whether the port can carry traffic.
 func (p Port) Active() bool { return strings.EqualFold(p.State, "ACTIVE") }
 
@@ -56,6 +115,9 @@ type HCA struct {
 	// FirmwareVersion is reported by the driver; worth capturing because
 	// NCCL behaviour differs between firmware revisions.
 	FirmwareVersion string `json:"firmware_version,omitempty"`
+	// NodeGUID identifies the adapter on its fabric: it is the name a
+	// switch's view of the fabric, and every other tool, knows it by.
+	NodeGUID string `json:"node_guid,omitempty"`
 }
 
 // ActivePorts returns the ports that can carry traffic.
@@ -102,6 +164,7 @@ func DiscoverIB(root string) ([]HCA, error) {
 func readHCA(dir, name string) (HCA, error) {
 	h := HCA{Name: name, NUMANode: -1}
 	h.FirmwareVersion = readTrimmed(filepath.Join(dir, "fw_ver"))
+	h.NodeGUID = normalizeGUID(readTrimmed(filepath.Join(dir, "node_guid")))
 
 	// device is a symlink into the PCI tree; its target's base name is the
 	// bus address, and numa_node lives beside it.
@@ -138,6 +201,30 @@ func readPort(dir string, num int) Port {
 		LID:       parseMaybeHex(readTrimmed(filepath.Join(dir, "lid"))),
 		SMLID:     parseMaybeHex(readTrimmed(filepath.Join(dir, "sm_lid"))),
 	}
+	p.RoCEv2GID = -1
+	p.PortGUID = portGUID(readTrimmed(filepath.Join(dir, "gids", "0")))
+	if p.LinkLayer == LinkEthernet {
+		p.RoCEv2GID = rocev2GID(dir)
+		if p.RoCEv2GID >= 0 {
+			idx := strconv.Itoa(p.RoCEv2GID)
+			p.Network = RoCENetwork(readTrimmed(filepath.Join(dir, "gid_attrs", "ndevs", idx)),
+				readTrimmed(filepath.Join(dir, "gids", idx)))
+		}
+	}
+	for _, name := range PortCounters {
+		raw := readTrimmed(filepath.Join(dir, "counters", name))
+		v, err := strconv.ParseUint(raw, 10, 64)
+		if err != nil {
+			continue // not every driver has every counter
+		}
+		if dataCounter(name) {
+			v *= 4
+		}
+		if p.Counters == nil {
+			p.Counters = map[string]uint64{}
+		}
+		p.Counters[name] = v
+	}
 	return p
 }
 
@@ -201,3 +288,91 @@ func readTrimmed(path string) string {
 	}
 	return strings.TrimSpace(string(b))
 }
+
+// rocev2GID finds the GID index a RoCE port's traffic should use.
+func rocev2GID(dir string) int {
+	first := -1
+	for i := 0; i < 64; i++ {
+		typ := readTrimmed(filepath.Join(dir, "gid_attrs", "types", strconv.Itoa(i)))
+		if !strings.EqualFold(typ, "RoCE v2") {
+			continue
+		}
+		gid := strings.ToLower(readTrimmed(filepath.Join(dir, "gids", strconv.Itoa(i))))
+		if strings.HasPrefix(gid, "0000:0000:0000:0000:0000:ffff:") {
+			return i
+		}
+		if first < 0 {
+			first = i
+		}
+	}
+	return first
+}
+
+// normalizeGUID writes a GUID one way: sysfs says "0c42:a103:0045:bd6c",
+// sminfo and ibnetdiscover say "0x0c42a1030045bd6c".
+func normalizeGUID(g string) string {
+	g = strings.ToLower(strings.TrimSpace(g))
+	g = strings.TrimPrefix(g, "0x")
+	g = strings.ReplaceAll(g, ":", "")
+	if g == "" || strings.Trim(g, "0") == "" {
+		return ""
+	}
+	for len(g) < 16 {
+		g = "0" + g
+	}
+	return "0x" + g
+}
+
+// NormalizeGUID is normalizeGUID for other packages.
+func NormalizeGUID(g string) string { return normalizeGUID(g) }
+
+// portGUID is the interface identifier of a GID: its last four groups.
+func portGUID(gid string) string {
+	parts := strings.Split(gid, ":")
+	if len(parts) != 8 {
+		return ""
+	}
+	return normalizeGUID(strings.Join(parts[4:], ""))
+}
+
+// RoCENetwork is the IP network an IPv4-mapped RoCE GID's address sits in,
+// read from the interface that carries it. Replaced in tests.
+var RoCENetwork = func(ndev, gid string) string {
+	ip := gidIPv4(gid)
+	if ip == nil || ndev == "" {
+		return ""
+	}
+	ifc, err := net.InterfaceByName(ndev)
+	if err != nil {
+		return ""
+	}
+	addrs, _ := ifc.Addrs()
+	for _, a := range addrs {
+		if n, ok := a.(*net.IPNet); ok && n.IP.Equal(ip) {
+			return (&net.IPNet{IP: ip.Mask(n.Mask), Mask: n.Mask}).String()
+		}
+	}
+	return ""
+}
+
+// gidIPv4 is the IPv4 address in an IPv4-mapped GID, nil otherwise.
+func gidIPv4(gid string) net.IP {
+	g := strings.ToLower(gid)
+	const mapped = "0000:0000:0000:0000:0000:ffff:"
+	if !strings.HasPrefix(g, mapped) {
+		return nil
+	}
+	hex := strings.ReplaceAll(strings.TrimPrefix(g, mapped), ":", "")
+	if len(hex) != 8 {
+		return nil
+	}
+	b := make(net.IP, 4)
+	for i := range 4 {
+		v, err := strconv.ParseUint(hex[i*2:i*2+2], 16, 8)
+		if err != nil {
+			return nil
+		}
+		b[i] = byte(v)
+	}
+	return b
+}

internal/agent/discovery/ib_test.go

@@ -31,6 +31,9 @@ func fakeSysfs(t *testing.T) string {
 	write("ib/mlx5_0/ports/1/gids/0", "FEC0:0000:0000:000A:0002:C903:00A0:1234")
 	write("ib/mlx5_0/ports/1/lid", "0x1a")
 	write("ib/mlx5_0/ports/1/sm_lid", "1")
+	write("ib/mlx5_0/ports/1/counters/symbol_error", "3")
+	write("ib/mlx5_0/ports/1/counters/link_downed", "1")
+	write("ib/mlx5_0/ports/1/counters/port_xmit_data", "1000")
 
 	// mlx5_1: two ports, the second one down.
 	write("ib/mlx5_1/ports/1/state", "4: ACTIVE")
@@ -46,7 +49,13 @@ func fakeSysfs(t *testing.T) string {
 	write("ib/mlx5_2/ports/1/state", "4: ACTIVE")
 	write("ib/mlx5_2/ports/1/rate", "100 Gb/sec (4X EDR)")
 	write("ib/mlx5_2/ports/1/link_layer", "Ethernet")
-	write("ib/mlx5_2/ports/1/gids/0", "0000:0000:0000:0000:0000:ffff:0a00:0001")
+	write("ib/mlx5_2/ports/1/gids/0", "fe80:0000:0000:0000:0000:0000:0000:0001")
+	write("ib/mlx5_2/ports/1/gid_attrs/types/0", "IB/RoCE v1")
+	write("ib/mlx5_2/ports/1/gids/1", "fe80:0000:0000:0000:0000:0000:0000:0001")
+	write("ib/mlx5_2/ports/1/gid_attrs/types/1", "RoCE v2")
+	write("ib/mlx5_2/ports/1/gids/3", "0000:0000:0000:0000:0000:ffff:0a00:0001")
+	write("ib/mlx5_2/ports/1/gid_attrs/types/3", "RoCE v2")
+	write("ib/mlx5_2/ports/1/gid_attrs/ndevs/3", "ens1f0")
 
 	// A PCI device with a NUMA node, linked the way the driver does it.
 	pci := filepath.Join(root, "pci", "0000:0b:00.0")
@@ -214,3 +223,131 @@ func TestParseHelpers(t *testing.T) {
 		}
 	})
 }
+
+func TestAPortsCountersAreRead(t *testing.T) {
+	hcas, err := DiscoverIB(fakeSysfs(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	c := hcas[0].Ports[0].Counters
+	// Data in bytes: sysfs counts four-byte words.
+	if c["symbol_error"] != 3 || c["link_downed"] != 1 || c["port_xmit_data"] != 4000 {
+		t.Errorf("counters = %v", c)
+	}
+	if _, ok := c["port_rcv_errors"]; ok {
+		t.Error("a counter the driver does not have should be absent, not zero")
+	}
+}
+
+func TestRoCEFindsItsRoutableGID(t *testing.T) {
+	// NCCL's default GID index is a v1 link-local entry on most hosts, which
+	// does not route: the job hangs. The v2 entry holding an IPv4 address is
+	// the one to use, over an earlier v2 link-local one.
+	hcas, err := DiscoverIB(fakeSysfs(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, h := range hcas {
+		p := h.Ports[0]
+		switch h.Name {
+		case "mlx5_2":
+			if p.RoCEv2GID != 3 {
+				t.Errorf("RoCE GID index = %d, want 3", p.RoCEv2GID)
+			}
+		default:
+			if p.RoCEv2GID != -1 {
+				t.Errorf("%s is InfiniBand and has a GID index %d", h.Name, p.RoCEv2GID)
+			}
+		}
+	}
+}
+
+func TestTheSubnetManagerAPortSeesIsRead(t *testing.T) {
+	sm, err := ParseSMInfo("sminfo: sm lid 1 sm guid 0x98039B03009fcfd6, activity count 5452 priority 15 state 3 SMINFO_MASTER\n")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if sm.GUID != "0x98039b03009fcfd6" || sm.LID != 1 || sm.Priority != 15 || sm.State != "SMINFO_MASTER" {
+		t.Errorf("sm = %+v", sm)
+	}
+	if _, err := ParseSMInfo("ibwarn: [1234] mad_rpc_open_port: can't open UMAD port"); err == nil {
+		t.Error("an error from sminfo should not parse")
+	}
+}
+
+func TestAPortsFabricIsItsSubnetManagerOrItsNetwork(t *testing.T) {
+	// Two ports on one InfiniBand fabric see one master SM, and on separate
+	// fabrics cannot; RoCE has no SM, and is its IP network.
+	hcas, err := DiscoverIB(fakeSysfs(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if hcas[0].NodeGUID != "" {
+		t.Errorf("no node_guid file, yet %q", hcas[0].NodeGUID)
+	}
+	err = AttachSM(hcas, func(hca string, port int) (*SMInfo, error) {
+		return &SMInfo{GUID: "0x00000000000000aa", LID: 1, State: "SMINFO_MASTER"}, nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := hcas[0].Ports[0].FabricKey(); got != "sm:0x00000000000000aa" {
+		t.Errorf("IB key = %q", got)
+	}
+	if got := hcas[1].Ports[1].FabricKey(); got != "" {
+		t.Errorf("a port that is down is on no fabric, got %q", got)
+	}
+	if hcas[2].Ports[0].SM != nil {
+		t.Error("RoCE was asked for a subnet manager")
+	}
+	if got := hcas[0].Ports[0].PortGUID; got != "0x0002c90300a01234" {
+		t.Errorf("port GUID = %q", got)
+	}
+}
+
+func TestARoCEPortsNetworkIsItsFabric(t *testing.T) {
+	old := RoCENetwork
+	t.Cleanup(func() { RoCENetwork = old })
+	RoCENetwork = func(ndev, gid string) string {
+		if ip := gidIPv4(gid); ip != nil && ip.String() == "10.0.0.1" {
+			return "10.0.0.0/24"
+		}
+		return ""
+	}
+	hcas, err := DiscoverIB(fakeSysfs(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	roce := hcas[2].Ports[0]
+	if roce.Network != "10.0.0.0/24" || roce.FabricKey() != "roce:10.0.0.0/24" {
+		t.Errorf("RoCE network %q key %q", roce.Network, roce.FabricKey())
+	}
+}
+
+// smirDump is `saquery SMIR` on a fabric with a master and a standby, in the
+// layout infiniband-diags prints.
+const smirDump = "SMInfoRecord dump:\n\t\tRID\n\t\tLID...................1\n\t\tSMInfo dump:\n" +
+	"\t\tGUID..................0x248a07030030f0c0\n\t\tSM_Key................0x0000000000000000\n" +
+	"\t\tActCount..............386773\n\t\tPriority..............15\n\t\tSMState...............3\n" +
+	"SMInfoRecord dump:\n\t\tRID\n\t\tLID...................12\n\t\tSMInfo dump:\n" +
+	"\t\tGUID..................0x248a07030030f1d4\n\t\tSM_Key................0x0000000000000000\n" +
+	"\t\tActCount..............12\n\t\tPriority..............14\n\t\tSMState...............2\n"
+
+func TestEverySubnetManagerOnAFabricIsListed(t *testing.T) {
+	recs, err := ParseSMIR(smirDump)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(recs) != 2 {
+		t.Fatalf("records = %+v", recs)
+	}
+	if recs[0].GUID != "0x248a07030030f0c0" || recs[0].State != "master" || recs[0].Priority != 15 || recs[0].LID != 1 {
+		t.Errorf("master = %+v", recs[0])
+	}
+	if recs[1].State != "standby" || recs[1].LID != 12 {
+		t.Errorf("standby = %+v", recs[1])
+	}
+	if _, err := ParseSMIR("ibwarn: can't open UMAD port"); err == nil {
+		t.Error("an error should not parse")
+	}
+}

internal/agent/discovery/load.go

@@ -0,0 +1,260 @@
+package discovery
+
+import (
+	"bufio"
+	"bytes"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+// Load is how busy a node is: the machine as a whole, and each engine's share.
+type Load struct {
+	CPUPercent float64
+	CPUCount   int
+	Load1      float64
+	Load5      float64
+	Load15     float64
+	MemUsed    int64
+	MemAvail   int64
+	Shards     []ShardLoad
+}
+
+// ShardLoad is one engine process group's use.
+type ShardLoad struct {
+	ID       string
+	CPUCores float64
+	RSSBytes int64
+}
+
+// userHZ is the unit /proc counts CPU time in. Fixed at 100 by the kernel's
+// ABI on every architecture a node runs, whatever the internal tick rate.
+const userHZ = 100
+
+// LoadSampler measures load as the difference between two readings of /proc.
+//
+// CPU time is a counter, so a percentage needs two samples and the time
+// between them. The sampler keeps the previous one; the first call has
+// nothing to compare with and reports no load at all, rather than a zero that
+// would read as an idle machine.
+//
+// Linux only, like every node. Elsewhere the files are missing and it reports
+// nothing, as an older agent does.
+type LoadSampler struct {
+	root string
+	now  func() time.Time
+
+	mu      sync.Mutex
+	prevAt  time.Time
+	prevCPU cpuTimes
+	prevPG  map[int]groupUse // process group -> what it has used
+}
+
+// groupUse is a process group's CPU time so far and its resident memory now.
+type groupUse struct {
+	jiffies  uint64
+	rssPages int64
+}
+
+type cpuTimes struct{ total, idle uint64 }
+
+// NewLoadSampler reads the real /proc.
+func NewLoadSampler() *LoadSampler { return newLoadSampler("/proc", time.Now) }
+
+func newLoadSampler(root string, now func() time.Time) *LoadSampler {
+	return &LoadSampler{root: root, now: now}
+}
+
+// Sample reads the machine and the process groups led by the given shards'
+// PIDs, keyed by shard ID. False when there is nothing to report yet.
+func (s *LoadSampler) Sample(shards map[string]int) (Load, bool) {
+	cpu, ok := s.cpu()
+	if !ok {
+		return Load{}, false
+	}
+	groups := s.groups()
+	at := s.now()
+
+	s.mu.Lock()
+	prevAt, prevCPU, prevPG := s.prevAt, s.prevCPU, s.prevPG
+	s.prevAt, s.prevCPU, s.prevPG = at, cpu, groups
+	s.mu.Unlock()
+
+	if prevAt.IsZero() || cpu.total <= prevCPU.total {
+		return Load{}, false
+	}
+	l := Load{CPUCount: s.cpuCount()}
+	dTotal := float64(cpu.total - prevCPU.total)
+	dIdle := float64(cpu.idle - prevCPU.idle)
+	l.CPUPercent = clamp((dTotal-dIdle)/dTotal*100, 0, 100)
+	l.Load1, l.Load5, l.Load15 = s.loadavg()
+	total, avail := s.meminfo()
+	if total > 0 {
+		l.MemUsed, l.MemAvail = total-avail, avail
+	}
+
+	secs := at.Sub(prevAt).Seconds()
+	for id, pid := range shards {
+		if pid <= 0 {
+			continue
+		}
+		now := groups[pid]
+		sl := ShardLoad{ID: id, RSSBytes: now.rssPages * int64(os.Getpagesize())}
+		if before, ok := prevPG[pid]; ok && secs > 0 && now.jiffies >= before.jiffies {
+			sl.CPUCores = float64(now.jiffies-before.jiffies) / userHZ / secs
+		}
+		l.Shards = append(l.Shards, sl)
+	}
+	return l, true
+}
+
+func clamp(v, lo, hi float64) float64 { return max(lo, min(v, hi)) }
+
+// cpu reads the aggregate line of /proc/stat. Idle includes iowait: a core
+// waiting on the disk is not doing work.
+func (s *LoadSampler) cpu() (cpuTimes, bool) {
+	b, err := os.ReadFile(filepath.Join(s.root, "stat"))
+	if err != nil {
+		return cpuTimes{}, false
+	}
+	line, _, _ := bytes.Cut(b, []byte("\n"))
+	f := strings.Fields(string(line))
+	if len(f) < 5 || f[0] != "cpu" {
+		return cpuTimes{}, false
+	}
+	var t cpuTimes
+	for i, v := range f[1:] {
+		// guest and guest_nice are already counted in user and nice.
+		if i >= 8 {
+			break
+		}
+		n, _ := strconv.ParseUint(v, 10, 64)
+		t.total += n
+		if i == 3 || i == 4 {
+			t.idle += n
+		}
+	}
+	return t, true
+}
+
+func (s *LoadSampler) cpuCount() int {
+	b, err := os.ReadFile(filepath.Join(s.root, "stat"))
+	if err != nil {
+		return 0
+	}
+	n := 0
+	for _, line := range strings.Split(string(b), "\n") {
+		if strings.HasPrefix(line, "cpu") && len(line) > 3 && line[3] >= '0' && line[3] <= '9' {
+			n++
+		}
+	}
+	return n
+}
+
+func (s *LoadSampler) loadavg() (l1, l5, l15 float64) {
+	b, err := os.ReadFile(filepath.Join(s.root, "loadavg"))
+	if err != nil {
+		return 0, 0, 0
+	}
+	f := strings.Fields(string(b))
+	if len(f) < 3 {
+		return 0, 0, 0
+	}
+	l1, _ = strconv.ParseFloat(f[0], 64)
+	l5, _ = strconv.ParseFloat(f[1], 64)
+	l15, _ = strconv.ParseFloat(f[2], 64)
+	return l1, l5, l15
+}
+
+// meminfo returns MemTotal and MemAvailable in bytes.
+func (s *LoadSampler) meminfo() (total, avail int64) {
+	f, err := os.Open(filepath.Join(s.root, "meminfo"))
+	if err != nil {
+		return 0, 0
+	}
+	defer f.Close()
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		k, v, ok := strings.Cut(sc.Text(), ":")
+		if !ok {
+			continue
+		}
+		fields := strings.Fields(v)
+		if len(fields) == 0 {
+			continue
+		}
+		kb, _ := strconv.ParseInt(fields[0], 10, 64)
+		switch k {
+		case "MemTotal":
+			total = kb * 1024
+		case "MemAvailable":
+			avail = kb * 1024
+		}
+	}
+	return total, avail
+}
+
+// procStat is what one /proc/<pid>/stat says that load needs.
+type procStat struct {
+	pgrp     int
+	jiffies  uint64
+	rssPages int64
+}
+
+// readProcStat parses /proc/<pid>/stat. The command name is in parentheses
+// and may itself hold spaces and parentheses, so fields are counted from the
+// last closing one.
+func readProcStat(path string) (procStat, bool) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return procStat{}, false
+	}
+	i := bytes.LastIndexByte(b, ')')
+	if i < 0 {
+		return procStat{}, false
+	}
+	f := strings.Fields(string(b[i+1:]))
+	// After the name: state(0) ppid(1) pgrp(2) ... utime(11) stime(12) ... rss(21)
+	if len(f) < 22 {
+		return procStat{}, false
+	}
+	var st procStat
+	st.pgrp, _ = strconv.Atoi(f[2])
+	ut, _ := strconv.ParseUint(f[11], 10, 64)
+	stt, _ := strconv.ParseUint(f[12], 10, 64)
+	st.jiffies = ut + stt
+	st.rssPages, _ = strconv.ParseInt(f[21], 10, 64)
+	return st, true
+}
+
+// groups totals CPU time and memory per process group, in one pass over
+// /proc. An engine is started as the leader of its own group, so its workers
+// — vLLM starts several — are counted with it.
+func (s *LoadSampler) groups() map[int]groupUse {
+	out := map[int]groupUse{}
+	s.eachProc(func(st procStat) {
+		g := out[st.pgrp]
+		g.jiffies += st.jiffies
+		g.rssPages += st.rssPages
+		out[st.pgrp] = g
+	})
+	return out
+}
+
+func (s *LoadSampler) eachProc(fn func(procStat)) {
+	entries, err := os.ReadDir(s.root)
+	if err != nil {
+		return
+	}
+	for _, e := range entries {
+		if _, err := strconv.Atoi(e.Name()); err != nil {
+			continue
+		}
+		if st, ok := readProcStat(filepath.Join(s.root, e.Name(), "stat")); ok {
+			fn(st)
+		}
+	}
+}

internal/agent/discovery/load_test.go

@@ -0,0 +1,96 @@
+package discovery
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+// fakeProc is a /proc with two CPUs, a memory picture and processes.
+type fakeProc struct {
+	t    *testing.T
+	root string
+}
+
+func newFakeProc(t *testing.T) *fakeProc {
+	f := &fakeProc{t: t, root: t.TempDir()}
+	f.write("loadavg", "1.50 0.75 0.25 2/300 4242\n")
+	f.write("meminfo", "MemTotal:       8000000 kB\nMemFree:        1000000 kB\nMemAvailable:   3000000 kB\n")
+	return f
+}
+
+func (f *fakeProc) write(name, body string) {
+	f.t.Helper()
+	p := filepath.Join(f.root, name)
+	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+		f.t.Fatal(err)
+	}
+	if err := os.WriteFile(p, []byte(body), 0o644); err != nil {
+		f.t.Fatal(err)
+	}
+}
+
+// cpu sets the aggregate counters: user and idle, the rest zero.
+func (f *fakeProc) cpu(user, idle uint64) {
+	f.write("stat", fmt.Sprintf("cpu  %d 0 0 %d 0 0 0 0 0 0\ncpu0 0 0 0 0 0 0 0 0 0 0\ncpu1 0 0 0 0 0 0 0 0 0 0\nintr 1\n", user, idle))
+}
+
+// proc sets one process: its group, CPU jiffies (as utime) and RSS in pages.
+func (f *fakeProc) proc(pid, pgrp int, jiffies uint64, rss int64) {
+	// The name holds a space and a parenthesis, as real ones can.
+	f.write(fmt.Sprintf("%d/stat", pid), fmt.Sprintf(
+		"%d (llama-server (x)) S 1 %d %d 0 -1 0 0 0 0 0 %d 0 0 0 20 0 1 0 100 1000 %d 0\n",
+		pid, pgrp, pgrp, jiffies, rss))
+}
+
+func TestLoadIsTheDifferenceBetweenTwoReadings(t *testing.T) {
+	p := newFakeProc(t)
+	at := time.Unix(1000, 0)
+	s := newLoadSampler(p.root, func() time.Time { return at })
+
+	p.cpu(100, 900)
+	p.proc(42, 42, 1000, 10)
+	p.proc(43, 42, 500, 5) // a worker in the engine's group
+	p.proc(7, 7, 99999, 1) // something else entirely
+	if _, ok := s.Sample(map[string]int{"shard-a": 42}); ok {
+		t.Fatal("the first reading has nothing to compare with and should report nothing")
+	}
+
+	// Two seconds later: 300 of the 400 jiffies that passed were busy, and
+	// the engine's group used 400 of them.
+	at = at.Add(2 * time.Second)
+	p.cpu(400, 1000)
+	p.proc(42, 42, 1300, 10)
+	p.proc(43, 42, 600, 6)
+	l, ok := s.Sample(map[string]int{"shard-a": 42})
+	if !ok {
+		t.Fatal("the second reading should report")
+	}
+	if l.CPUPercent != 75 || l.CPUCount != 2 {
+		t.Errorf("cpu %.1f%% of %d, want 75%% of 2", l.CPUPercent, l.CPUCount)
+	}
+	if l.Load1 != 1.5 || l.Load15 != 0.25 {
+		t.Errorf("load %v %v", l.Load1, l.Load15)
+	}
+	if l.MemUsed != 5000000*1024 || l.MemAvail != 3000000*1024 {
+		t.Errorf("memory used %d available %d", l.MemUsed, l.MemAvail)
+	}
+	if len(l.Shards) != 1 {
+		t.Fatalf("shards = %+v", l.Shards)
+	}
+	sh := l.Shards[0]
+	// 400 jiffies over 2 seconds at 100 a second is two cores.
+	if sh.ID != "shard-a" || sh.CPUCores != 2 || sh.RSSBytes != 16*int64(os.Getpagesize()) {
+		t.Errorf("shard = %+v", sh)
+	}
+}
+
+func TestNoProcMeansNoLoad(t *testing.T) {
+	s := newLoadSampler(filepath.Join(t.TempDir(), "missing"), time.Now)
+	s.Sample(nil)
+	if _, ok := s.Sample(nil); ok {
+		t.Error("a system without /proc should report nothing, not zeros")
+	}
+}

internal/agent/discovery/mig.go

@@ -0,0 +1,560 @@
+package discovery
+
+// MIG — Multi-Instance GPU — carves one A100, H100 or later card into up to
+// seven instances, each with its own memory, its own share of the
+// multiprocessors and its own UUID. To CUDA an instance is a device of its
+// own, and to placement it is one too: a card in MIG mode is reported as its
+// instances instead of as the whole card, each a GPU of a class named from
+// the card's and the instance's profile ("a100-80g-mig-3g.40gb").
+//
+// llmgw does not create instances. Which split a card gets is an operator's
+// decision, made with nvidia-smi mig; discovery reads what is there.
+//
+// Two facts about MIG shape everything below. A process is given one MIG
+// device: CUDA enumerates a single instance however many are made visible.
+// And instances have no NVLink or peer-to-peer access between them. A replica
+// on MIG therefore runs on exactly one instance, never a tensor-parallel group
+// of them, and the catalog refuses a profile that asks for more.
+
+import (
+	"context"
+	"encoding/xml"
+	"fmt"
+	"math"
+	"os/exec"
+	"regexp"
+	"slices"
+	"strconv"
+	"strings"
+)
+
+// MIGDevice is what a MIG instance carries beyond any GPU's fields: which
+// card it is carved from, and how.
+type MIGDevice struct {
+	// ParentIndex is the card's nvidia-smi index, which is what its sensors,
+	// topology and wear are reported by.
+	ParentIndex int    `json:"parent_index"`
+	ParentUUID  string `json:"parent_uuid,omitempty"`
+	// ParentMemoryTotalMB is the whole card's memory: the class is named from
+	// the card, so an instance of an 80 GB card is not mistaken for one of a
+	// 40 GB card that happens to have the same profile name.
+	ParentMemoryTotalMB int `json:"parent_memory_total_mb"`
+	// Device is the instance's number on its card, as nvidia-smi -L lists it.
+	Device int `json:"device"`
+	// Profile is NVIDIA's name for the slice, like "3g.40gb": three of the
+	// card's seven compute slices and forty gigabytes of its memory.
+	Profile string `json:"profile"`
+	// GPUInstance and ComputeInstance are the instance's ids in nvidia-smi
+	// mig -lgi and -lci, which is how nvidia-smi attributes processes to it.
+	GPUInstance     int `json:"gpu_instance"`
+	ComputeInstance int `json:"compute_instance"`
+}
+
+// migIndexBase starts the numbers MIG instances are given.
+//
+// Placement, the agent protocol and every running shard name a node's devices
+// by an integer, which for a whole card is its nvidia-smi index. An instance
+// has none of its own, so it is given 1000 + 100 × card + device: card 0's
+// instance 2 is 1002, card 3's instance 0 is 1300. Readable, stable while the
+// instances are, and never one a whole card could have.
+const migIndexBase = 1000
+
+// MIGIndex is the device number placement knows a MIG instance by.
+func MIGIndex(card, device int) int { return migIndexBase + 100*card + device }
+
+// IsMIGIndex reports whether a device number names a MIG instance.
+func IsMIGIndex(i int) bool { return i >= migIndexBase }
+
+// DeviceLabel is how a device number is shown to people: "3" for a whole
+// card, "0/mig2" for card 0's MIG instance 2.
+func DeviceLabel(i int) string {
+	if !IsMIGIndex(i) {
+		return strconv.Itoa(i)
+	}
+	i -= migIndexBase
+	return fmt.Sprintf("%d/mig%d", i/100, i%100)
+}
+
+// DeviceLabels is DeviceLabel for each of a list.
+func DeviceLabels(is []int) []string {
+	out := make([]string, len(is))
+	for k, i := range is {
+		out[k] = DeviceLabel(i)
+	}
+	return out
+}
+
+// IsMIG reports whether this GPU is a MIG instance rather than a whole card.
+func (g GPU) IsMIG() bool { return g.MIG != nil }
+
+// CardIndex is the nvidia-smi index of the physical card this GPU is on: its
+// own index for a whole card, its parent's for a MIG instance.
+func (g GPU) CardIndex() int {
+	if g.MIG != nil {
+		return g.MIG.ParentIndex
+	}
+	return g.Index
+}
+
+// migClassMarker joins a card's class to an instance's profile in a MIG
+// class: "a100-80g" + "-mig-" + "3g.40gb".
+const migClassMarker = "-mig-"
+
+// IsMIGClass reports whether a GPU class names MIG instances.
+func IsMIGClass(class string) bool { return strings.Contains(class, migClassMarker) }
+
+// migProfileClean keeps a profile name to what a class may hold: "1g.10gb+me"
+// becomes "1g.10gb-me".
+var migProfileClean = regexp.MustCompile(`[^a-z0-9.]+`)
+
+// migClass is the class of a MIG instance: the card's class and the profile.
+func migClass(parentClass, profile string) string {
+	p := migProfileClean.ReplaceAllString(strings.ToLower(strings.TrimSpace(profile)), "-")
+	return parentClass + migClassMarker + strings.Trim(p, "-")
+}
+
+// MIGProfileMemoryGB reads the memory out of a MIG class or profile:
+// 40 from "a100-80g-mig-3g.40gb" or "3g.40gb". Zero when there is none.
+func MIGProfileMemoryGB(s string) int {
+	if i := strings.LastIndex(s, migClassMarker); i >= 0 {
+		s = s[i+len(migClassMarker):]
+	}
+	m := migProfileMemory.FindStringSubmatch(strings.ToLower(s))
+	if m == nil {
+		return 0
+	}
+	gb, _ := strconv.Atoi(m[1])
+	return gb
+}
+
+var migProfileMemory = regexp.MustCompile(`^\d+g\.(\d+)gb`)
+
+// --- nvidia-smi -L ---
+
+// listedMIG is one MIG instance as nvidia-smi -L lists it.
+type listedMIG struct {
+	Device  int
+	Profile string
+	UUID    string
+}
+
+var (
+	// "GPU 0: NVIDIA A100-SXM4-80GB (UUID: GPU-5d5ba0d6-...)"
+	smiListGPU = regexp.MustCompile(`^GPU (\d+):`)
+	// "  MIG 3g.40gb     Device  0: (UUID: MIG-c6d4f1ef-...)". Drivers before
+	// R470 name the instance MIG-GPU-<card uuid>/<gi>/<ci>, which CUDA of that
+	// era takes in the same place, so the UUID is read as whatever it is.
+	smiListMIG = regexp.MustCompile(`^\s+MIG\s+(\S+)\s+Device\s+(\d+):\s*\(UUID:\s*([^)\s]+)\)`)
+)
+
+// parseSMIList reads nvidia-smi -L into each card's MIG instances, by the
+// card's index, in device order. A card with none is absent.
+func parseSMIList(out string) map[int][]listedMIG {
+	res := map[int][]listedMIG{}
+	card := -1
+	for _, line := range strings.Split(out, "\n") {
+		if m := smiListGPU.FindStringSubmatch(line); m != nil {
+			card, _ = strconv.Atoi(m[1])
+			continue
+		}
+		m := smiListMIG.FindStringSubmatch(line)
+		if m == nil || card < 0 {
+			continue
+		}
+		dev, _ := strconv.Atoi(m[2])
+		res[card] = append(res[card], listedMIG{Device: dev, Profile: m[1], UUID: m[3]})
+	}
+	for c := range res {
+		slices.SortFunc(res[c], func(a, b listedMIG) int { return a.Device - b.Device })
+	}
+	return res
+}
+
+// --- nvidia-smi -q -x ---
+
+// migLog is the part of nvidia-smi's XML report MIG is read from: each card's
+// mode, and each instance's ids and memory.
+type migLog struct {
+	GPUs []migLogGPU `xml:"gpu"`
+}
+
+type migLogGPU struct {
+	ID      string         `xml:"id,attr"`
+	Current string         `xml:"mig_mode>current_mig"`
+	Pending string         `xml:"mig_mode>pending_mig"`
+	Devices []migLogDevice `xml:"mig_devices>mig_device"`
+	// Processes carry the GPU and compute instance they run in on a card
+	// in MIG mode, and "N/A" for both otherwise.
+	Processes []struct {
+		GPUInstance     string `xml:"gpu_instance_id"`
+		ComputeInstance string `xml:"compute_instance_id"`
+		PID             string `xml:"pid"`
+		UsedMB          string `xml:"used_memory"`
+	} `xml:"processes>process_info"`
+	Used string `xml:"fb_memory_usage>used"`
+}
+
+type migLogDevice struct {
+	Index           string `xml:"index"`
+	GPUInstance     string `xml:"gpu_instance_id"`
+	ComputeInstance string `xml:"compute_instance_id"`
+	Total           string `xml:"fb_memory_usage>total"`
+	Used            string `xml:"fb_memory_usage>used"`
+}
+
+// migState is one card's MIG mode and instances from the report.
+type migState struct {
+	BusID          string
+	Enabled        bool
+	PendingEnabled bool
+	Devices        []migReported
+}
+
+// migReported is one instance as the report describes it.
+type migReported struct {
+	Device, GPUInstance, ComputeInstance int
+	TotalMB, UsedMB                      int
+}
+
+// enabled reads nvidia-smi's mode words: "Enabled", "Disabled", "N/A".
+func enabled(s string) bool { return strings.EqualFold(strings.TrimSpace(s), "Enabled") }
+
+func atoiOr(s string, def int) int {
+	n, err := strconv.Atoi(strings.TrimSpace(s))
+	if err != nil {
+		return def
+	}
+	return n
+}
+
+// parseMIGReport reads each card's MIG state from the XML report, in the
+// report's order, which is nvidia-smi's index order.
+func parseMIGReport(report []byte) ([]migState, error) {
+	var log migLog
+	if err := xml.Unmarshal(report, &log); err != nil {
+		return nil, fmt.Errorf("reading nvidia-smi's report: %w", err)
+	}
+	out := make([]migState, len(log.GPUs))
+	for i, g := range log.GPUs {
+		out[i] = migState{BusID: g.ID, Enabled: enabled(g.Current), PendingEnabled: enabled(g.Pending)}
+		for _, d := range g.Devices {
+			out[i].Devices = append(out[i].Devices, migReported{
+				Device: atoiOr(d.Index, -1), GPUInstance: atoiOr(d.GPUInstance, -1),
+				ComputeInstance: atoiOr(d.ComputeInstance, -1),
+				TotalMB:         mib(d.Total), UsedMB: mib(d.Used),
+			})
+		}
+		slices.SortFunc(out[i].Devices, func(a, b migReported) int { return a.Device - b.Device })
+	}
+	return out, nil
+}
+
+// --- putting it together ---
+
+// migProblemNoInstances keeps a card in MIG mode with nothing carved from it
+// out of placement: CUDA cannot use the whole card while MIG is on, and
+// there is no instance to use instead.
+const migProblemNoInstances = "MIG is enabled with no instances created: nothing can run on it " +
+	"until instances are created (nvidia-smi mig -cgi … -C) or MIG is turned off"
+
+// migProblemUnnamed is a card whose instances exist but could not be named:
+// an engine is given an instance by its UUID, and without one it cannot be.
+const migProblemUnnamed = "MIG is enabled and has instances, but nvidia-smi -L did not name them, " +
+	"so none can be given to an engine"
+
+// expandMIG replaces each card in MIG mode with its instances.
+//
+// listed is nvidia-smi -L's instances by card, which names them; report is
+// the XML report's state per card, which gives their memory and ids. Either
+// may be missing: -L alone still says which instances exist, and the report
+// alone still says a card is in MIG mode, so a card it says has instances
+// that -L did not name is kept as the whole card with the reason, rather
+// than placed as a card CUDA will not open.
+func expandMIG(cards []GPU, listed map[int][]listedMIG, report []migState) []GPU {
+	if len(listed) == 0 && !slices.ContainsFunc(report, func(s migState) bool { return s.Enabled }) {
+		return cards
+	}
+	byBus := map[string]migState{}
+	for _, s := range report {
+		byBus[normalizeBusID(s.BusID)] = s
+	}
+	out := make([]GPU, 0, len(cards))
+	for pos, c := range cards {
+		st, ok := byBus[normalizeBusID(c.PCIBusID)]
+		if !ok && pos < len(report) {
+			st = report[pos]
+		}
+		devs := listed[c.Index]
+		if !st.Enabled && len(devs) == 0 {
+			out = append(out, c)
+			continue
+		}
+		if len(devs) == 0 {
+			p := migProblemNoInstances
+			if len(st.Devices) > 0 {
+				p = migProblemUnnamed
+			}
+			c.Health.Problems = append(c.Health.Problems, p)
+			out = append(out, c)
+			continue
+		}
+		for _, d := range devs {
+			var rep migReported
+			found := false
+			for _, r := range st.Devices {
+				if r.Device == d.Device {
+					rep, found = r, true
+				}
+			}
+			mig := migInstance(c, d.Device, d.Profile, d.UUID)
+			if found {
+				mig.MIG.GPUInstance, mig.MIG.ComputeInstance = rep.GPUInstance, rep.ComputeInstance
+				mig.MemoryTotalMB, mig.MemoryUsedMB = rep.TotalMB, rep.UsedMB
+			}
+			if mig.MemoryTotalMB == 0 {
+				// The profile says it to the gigabyte, which is close enough
+				// to place by when the report could not be read.
+				mig.MemoryTotalMB = MIGProfileMemoryGB(d.Profile) * 1024
+			}
+			assessHealth(&mig)
+			out = append(out, mig)
+		}
+	}
+	return out
+}
+
+// migInstance builds a MIG instance of card: everything about the card that
+// is shared — driver, compute capability, NUMA node, bus, temperature and
+// ECC errors — and nothing that is not. Not NVLink, which an instance cannot
+// use; not utilisation, which no driver reports per instance; and not the
+// card's memory or problems, which the instance's own replace.
+func migInstance(card GPU, device int, profile, uuid string) GPU {
+	g := GPU{
+		Index: MIGIndex(card.Index, device), UUID: uuid,
+		Name:              strings.TrimSpace(card.Name + " MIG " + profile),
+		ComputeCapability: card.ComputeCapability, NUMANode: card.NUMANode,
+		PCIBusID: card.PCIBusID, DriverVersion: card.DriverVersion, CUDAVersion: card.CUDAVersion,
+		NICPaths: card.NICPaths, Fabric: card.Fabric,
+		Health: GPUHealth{ECCErrors: card.Health.ECCErrors, TemperatureC: card.Health.TemperatureC},
+		MIG: &MIGDevice{
+			ParentIndex: card.Index, ParentUUID: card.UUID, ParentMemoryTotalMB: card.MemoryTotalMB,
+			Device: device, Profile: profile, GPUInstance: -1, ComputeInstance: -1,
+		},
+	}
+	return g
+}
+
+// readMIG asks nvidia-smi for what expandMIG needs. A failure of either
+// command leaves its half empty, which expandMIG is written to take.
+func readMIG(ctx context.Context, binary string) (map[int][]listedMIG, []migState) {
+	var listed map[int][]listedMIG
+	if out, err := exec.CommandContext(ctx, binary, "-L").Output(); err == nil {
+		listed = parseSMIList(string(out))
+	}
+	var report []migState
+	if out, err := exec.CommandContext(ctx, binary, "-q", "-x").Output(); err == nil {
+		report, _ = parseMIGReport(out)
+	}
+	return listed, report
+}
+
+// --- NVML ---
+
+// nvmlMIGCard is the part of an NVML device MIG discovery reads, behind an
+// interface so the logic is tested without a driver: gpu_nvml.go adapts
+// nvml.Device to it.
+type nvmlMIGCard interface {
+	// MIGMode is nvmlDeviceGetMigMode; ok is false on a card without MIG.
+	MIGMode() (current, pending, ok bool)
+	// MaxMIGDevices is nvmlDeviceGetMaxMigDeviceCount.
+	MaxMIGDevices() int
+	// MIGDevice is nvmlDeviceGetMigDeviceHandleByIndex; ok is false for an
+	// index with no instance behind it, which is how NVML says so.
+	MIGDevice(i int) (nvmlMIGInstance, bool)
+}
+
+// nvmlMIGInstance is one MIG device handle.
+type nvmlMIGInstance interface {
+	UUID() string
+	// Name is "NVIDIA A100-SXM4-80GB MIG 3g.40gb" on the drivers that name
+	// MIG devices, which is where the profile is read from.
+	Name() string
+	Memory() (totalMB, usedMB int, ok bool)
+	Instances() (gpuInstance, computeInstance int)
+	// Slices and MemoryMB are the instance's attributes, which name the
+	// profile on a driver whose device name does not.
+	Attributes() (slices, memoryMB int, ok bool)
+}
+
+var nvmlMIGName = regexp.MustCompile(`MIG\s+(\S+)\s*$`)
+
+// migFromNVML is what one card is to placement under NVML: its instances if
+// it is in MIG mode, itself if it is not. isMIG says which.
+func migFromNVML(card GPU, dev nvmlMIGCard) (out []GPU, isMIG bool) {
+	current, _, ok := dev.MIGMode()
+	if !ok || !current {
+		return []GPU{card}, false
+	}
+	n := dev.MaxMIGDevices()
+	for i := range n {
+		h, ok := dev.MIGDevice(i)
+		if !ok {
+			continue
+		}
+		profile := ""
+		if m := nvmlMIGName.FindStringSubmatch(h.Name()); m != nil {
+			profile = m[1]
+		} else if n, mem, ok := h.Attributes(); ok {
+			// The convention NVIDIA's names follow: compute slices, then the
+			// memory in whole gigabytes.
+			profile = fmt.Sprintf("%dg.%dgb", n, int(math.Round(float64(mem)/1024)))
+		}
+		g := migInstance(card, i, profile, h.UUID())
+		g.MIG.GPUInstance, g.MIG.ComputeInstance = h.Instances()
+		if total, used, ok := h.Memory(); ok {
+			g.MemoryTotalMB, g.MemoryUsedMB = total, used
+		} else {
+			g.MemoryTotalMB = MIGProfileMemoryGB(profile) * 1024
+		}
+		assessHealth(&g)
+		out = append(out, g)
+	}
+	if len(out) == 0 {
+		card.Health.Problems = append(card.Health.Problems, migProblemNoInstances)
+		return []GPU{card}, true
+	}
+	return out, true
+}
+
+// --- what the doctor reports ---
+
+// MIGCard is one card's MIG state, as `llmgw doctor` reports it.
+type MIGCard struct {
+	Index int    `json:"index"`
+	Name  string `json:"name,omitempty"`
+	// Enabled is the mode in force; PendingEnabled the mode after the next
+	// reset of the card, which differs from it until the card is reset.
+	Enabled        bool `json:"enabled"`
+	PendingEnabled bool `json:"pending_enabled"`
+	// Instances are the MIG devices an engine can be given, as nvidia-smi -L
+	// lists them.
+	Instances []MIGListed `json:"instances,omitempty"`
+	// GPUInstances and ComputeInstances are nvidia-smi mig -lgi and -lci: a
+	// GPU instance with no compute instance in it is not a device yet.
+	GPUInstances     []MIGInstance `json:"gpu_instances,omitempty"`
+	ComputeInstances []MIGInstance `json:"compute_instances,omitempty"`
+}
+
+// MIGListed is one instance an engine can be given.
+type MIGListed struct {
+	Device  int    `json:"device"`
+	Profile string `json:"profile"`
+	UUID    string `json:"uuid"`
+}
+
+// MIGInstance is one row of nvidia-smi mig -lgi or -lci.
+type MIGInstance struct {
+	GPU     int    `json:"gpu"`
+	Profile string `json:"profile"`
+	// ProfileID is NVIDIA's number for the profile.
+	ProfileID int `json:"profile_id"`
+	// GPUInstance is the GPU instance's id; ComputeInstance the compute
+	// instance's within it, -1 in a -lgi row.
+	GPUInstance     int    `json:"gpu_instance"`
+	ComputeInstance int    `json:"compute_instance"`
+	Placement       string `json:"placement,omitempty"`
+}
+
+var (
+	// -lgi: "|   0  MIG 3g.40gb          9        2          4:4     |"
+	migLGIRow = regexp.MustCompile(`^\|\s*(\d+)\s+MIG\s+(\S+)\s+(\d+)\s+(\d+)\s+(\d+:\d+)\s*\|`)
+	// -lci: "|   0      1       MIG 3g.40gb          2         0          0:3     |"
+	migLCIRow = regexp.MustCompile(`^\|\s*(\d+)\s+(\d+)\s+MIG\s+(\S+)\s+(\d+)\s+(\d+)\s+(\d+:\d+)\s*\|`)
+)
+
+// ParseMIGInstances reads nvidia-smi mig -lgi or -lci, whichever it is
+// given: the two tables differ by the GPU instance column -lci adds. "No GPU
+// instances found" and the like are no rows, not an error.
+func ParseMIGInstances(out string) []MIGInstance {
+	var res []MIGInstance
+	for _, line := range strings.Split(out, "\n") {
+		line = strings.TrimSpace(line)
+		if m := migLCIRow.FindStringSubmatch(line); m != nil {
+			res = append(res, MIGInstance{
+				GPU: atoiOr(m[1], -1), GPUInstance: atoiOr(m[2], -1), Profile: m[3],
+				ProfileID: atoiOr(m[4], -1), ComputeInstance: atoiOr(m[5], -1), Placement: m[6],
+			})
+			continue
+		}
+		if m := migLGIRow.FindStringSubmatch(line); m != nil {
+			res = append(res, MIGInstance{
+				GPU: atoiOr(m[1], -1), Profile: m[2], ProfileID: atoiOr(m[3], -1),
+				GPUInstance: atoiOr(m[4], -1), ComputeInstance: -1, Placement: m[5],
+			})
+		}
+	}
+	return res
+}
+
+// DiscoverMIG reads every card's MIG state for the doctor: the mode from the
+// XML report, the devices from -L, the instances from nvidia-smi mig. Only
+// cards that support MIG are listed, and an error is returned only when the
+// report itself cannot be read.
+func DiscoverMIG(ctx context.Context, binary string) ([]MIGCard, error) {
+	out, err := exec.CommandContext(ctx, binary, "-q", "-x").Output()
+	if err != nil {
+		return nil, fmt.Errorf("running %s -q -x: %w", binary, err)
+	}
+	var list, lgi, lci string
+	if b, err := exec.CommandContext(ctx, binary, "-L").Output(); err == nil {
+		list = string(b)
+	}
+	// nvidia-smi mig exits non-zero when there is nothing to list, with the
+	// table or the reason on its output either way.
+	b, _ := exec.CommandContext(ctx, binary, "mig", "-lgi").CombinedOutput()
+	lgi = string(b)
+	b, _ = exec.CommandContext(ctx, binary, "mig", "-lci").CombinedOutput()
+	lci = string(b)
+	return buildMIGCards(out, list, lgi, lci)
+}
+
+// buildMIGCards is DiscoverMIG from the commands' output.
+func buildMIGCards(report []byte, list, lgi, lci string) ([]MIGCard, error) {
+	var log struct {
+		GPUs []struct {
+			Name    string `xml:"product_name"`
+			Current string `xml:"mig_mode>current_mig"`
+			Pending string `xml:"mig_mode>pending_mig"`
+		} `xml:"gpu"`
+	}
+	if err := xml.Unmarshal(report, &log); err != nil {
+		return nil, fmt.Errorf("reading nvidia-smi's report: %w", err)
+	}
+	listed := parseSMIList(list)
+	gis, cis := ParseMIGInstances(lgi), ParseMIGInstances(lci)
+	var out []MIGCard
+	for i, g := range log.GPUs {
+		cur, pend := strings.TrimSpace(g.Current), strings.TrimSpace(g.Pending)
+		// A card without MIG says N/A, or nothing on a driver that predates
+		// it; neither is worth a line.
+		if !enabled(cur) && !enabled(pend) && !strings.EqualFold(cur, "Disabled") {
+			continue
+		}
+		c := MIGCard{Index: i, Name: strings.TrimSpace(g.Name), Enabled: enabled(cur), PendingEnabled: enabled(pend)}
+		for _, l := range listed[i] {
+			c.Instances = append(c.Instances, MIGListed(l))
+		}
+		for _, gi := range gis {
+			if gi.GPU == i && gi.ComputeInstance < 0 {
+				c.GPUInstances = append(c.GPUInstances, gi)
+			}
+		}
+		for _, ci := range cis {
+			if ci.GPU == i && ci.ComputeInstance >= 0 {
+				c.ComputeInstances = append(c.ComputeInstances, ci)
+			}
+		}
+		out = append(out, c)
+	}
+	return out, nil
+}

internal/agent/discovery/mig_test.go

@@ -0,0 +1,418 @@
+package discovery
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+)
+
+// Two A100 80GB cards: card 0 in MIG mode, cut into two 3g.40gb instances,
+// card 1 whole. What nvidia-smi prints for that machine, by command. None of
+// it is from real MIG hardware, which this was written without; the shapes
+// follow NVIDIA's documentation and the output of drivers R470 to R550.
+const (
+	migQuery = `0, GPU-5d5ba0d6-d33d-2b2c-524d-9e3d8d2b8a77, NVIDIA A100-SXM4-80GB, 81920, 0, 8.0, 00000000:07:00.0, 550.54.15, 31, 0, [N/A]
+1, GPU-1f2e3d4c-5b6a-7980-a1b2-c3d4e5f60718, NVIDIA A100-SXM4-80GB, 81920, 0, 8.0, 00000000:0F:00.0, 550.54.15, 33, 0, 0
+`
+	migList = `GPU 0: NVIDIA A100-SXM4-80GB (UUID: GPU-5d5ba0d6-d33d-2b2c-524d-9e3d8d2b8a77)
+  MIG 3g.40gb     Device  0: (UUID: MIG-c6d4f1ef-42e4-5de3-91c7-45d71c87eb3f)
+  MIG 3g.40gb     Device  1: (UUID: MIG-0f7c3a2e-9d1b-5a8e-b3c4-1e2f3a4b5c6d)
+GPU 1: NVIDIA A100-SXM4-80GB (UUID: GPU-1f2e3d4c-5b6a-7980-a1b2-c3d4e5f60718)
+`
+	migReport = `<?xml version="1.0" ?>
+<nvidia_smi_log>
+  <driver_version>550.54.15</driver_version>
+  <gpu id="00000000:07:00.0">
+    <product_name>NVIDIA A100-SXM4-80GB</product_name>
+    <mig_mode><current_mig>Enabled</current_mig><pending_mig>Enabled</pending_mig></mig_mode>
+    <mig_devices>
+      <mig_device>
+        <index>1</index>
+        <gpu_instance_id>1</gpu_instance_id>
+        <compute_instance_id>0</compute_instance_id>
+        <device_attributes><shared><multiprocessor_count>42</multiprocessor_count></shared></device_attributes>
+        <fb_memory_usage><total>40192 MiB</total><reserved>0 MiB</reserved><used>21000 MiB</used><free>19192 MiB</free></fb_memory_usage>
+      </mig_device>
+      <mig_device>
+        <index>0</index>
+        <gpu_instance_id>2</gpu_instance_id>
+        <compute_instance_id>0</compute_instance_id>
+        <fb_memory_usage><total>40192 MiB</total><reserved>0 MiB</reserved><used>37 MiB</used><free>40155 MiB</free></fb_memory_usage>
+      </mig_device>
+    </mig_devices>
+    <fb_memory_usage><total>81920 MiB</total><used>21037 MiB</used></fb_memory_usage>
+    <processes>
+      <process_info>
+        <gpu_instance_id>1</gpu_instance_id>
+        <compute_instance_id>0</compute_instance_id>
+        <pid>4100</pid><type>C</type><process_name>vllm</process_name>
+        <used_memory>20900 MiB</used_memory>
+      </process_info>
+    </processes>
+  </gpu>
+  <gpu id="00000000:0F:00.0">
+    <product_name>NVIDIA A100-SXM4-80GB</product_name>
+    <mig_mode><current_mig>Disabled</current_mig><pending_mig>Disabled</pending_mig></mig_mode>
+    <mig_devices>None</mig_devices>
+    <fb_memory_usage><total>81920 MiB</total><used>300 MiB</used></fb_memory_usage>
+    <processes>
+      <process_info>
+        <gpu_instance_id>N/A</gpu_instance_id>
+        <compute_instance_id>N/A</compute_instance_id>
+        <pid>5200</pid><type>C</type><used_memory>250 MiB</used_memory>
+      </process_info>
+    </processes>
+  </gpu>
+</nvidia_smi_log>`
+	migLGI = `+-------------------------------------------------------+
+| GPU instances:                                        |
+| GPU   Name             Profile  Instance   Placement  |
+|                          ID       ID       Start:Size |
+|=======================================================|
+|   0  MIG 3g.40gb          9        1          4:4     |
++-------------------------------------------------------+
+|   0  MIG 3g.40gb          9        2          0:4     |
++-------------------------------------------------------+
+`
+	migLCI = `+--------------------------------------------------------------------+
+| Compute instances:                                                 |
+| GPU     GPU       Name             Profile   Instance   Placement  |
+|       Instance                       ID        ID       Start:Size |
+|         ID                                                         |
+|====================================================================|
+|   0      1       MIG 3g.40gb          2         0          0:3     |
++--------------------------------------------------------------------+
+|   0      2       MIG 3g.40gb          2         0          0:3     |
++--------------------------------------------------------------------+
+`
+)
+
+func migMachine(t *testing.T) []GPU {
+	t.Helper()
+	cards, err := parseSMI(migQuery)
+	if err != nil {
+		t.Fatal(err)
+	}
+	report, err := parseMIGReport([]byte(migReport))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return expandMIG(cards, parseSMIList(migList), report)
+}
+
+func TestACardInMIGModeIsReportedAsItsInstancesInsteadOfItself(t *testing.T) {
+	gpus := migMachine(t)
+	var got []string
+	for _, g := range gpus {
+		got = append(got, DeviceLabel(g.Index)+" "+g.Class())
+	}
+	want := []string{"0/mig0 a100-80g-mig-3g.40gb", "0/mig1 a100-80g-mig-3g.40gb", "1 a100-80g"}
+	if !slices.Equal(got, want) {
+		t.Fatalf("devices = %q, want %q", got, want)
+	}
+
+	mig := gpus[1]
+	if mig.Index != 1001 || mig.UUID != "MIG-0f7c3a2e-9d1b-5a8e-b3c4-1e2f3a4b5c6d" {
+		t.Errorf("instance 1 is %d %s; an engine is given it by that UUID", mig.Index, mig.UUID)
+	}
+	if mig.MemoryTotalMB != 40192 || mig.MemoryUsedMB != 21000 {
+		t.Errorf("instance 1 memory %d/%d, want its own 21000/40192 rather than the card's",
+			mig.MemoryUsedMB, mig.MemoryTotalMB)
+	}
+	if m := mig.MIG; m == nil || m.ParentIndex != 0 || m.Device != 1 || m.Profile != "3g.40gb" ||
+		m.GPUInstance != 1 || m.ComputeInstance != 0 || m.ParentUUID != "GPU-5d5ba0d6-d33d-2b2c-524d-9e3d8d2b8a77" {
+		t.Errorf("instance 1's parentage: %+v", mig.MIG)
+	}
+	if mig.ComputeCapability != "8.0" || mig.DriverVersion != "550.54.15" || mig.Health.TemperatureC != 31 {
+		t.Errorf("what the card and its instances share was not carried: %+v", mig)
+	}
+	// Twenty gigabytes in use on an instance is a foreign tenant there, and
+	// only there: instance 0 next to it is free.
+	if mig.Health.OK() || !gpus[0].Health.OK() {
+		t.Errorf("foreign memory judged per instance: 0 %v, 1 %v", gpus[0].Health.Problems, mig.Health.Problems)
+	}
+	// No driver reports utilisation per instance, and none is made up.
+	if mig.UtilizationPercent != 0 {
+		t.Errorf("an instance reported utilisation %d", mig.UtilizationPercent)
+	}
+	if gpus[2].IsMIG() || gpus[2].Index != 1 || gpus[2].CardIndex() != 1 || gpus[0].CardIndex() != 0 {
+		t.Errorf("the whole card beside it changed: %+v", gpus[2])
+	}
+}
+
+func TestAMIGInstanceSurvivesTheTripToTheControlPlaneWithItsClass(t *testing.T) {
+	g := migMachine(t)[0]
+	b, err := json.Marshal(g)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(b), `"class":"a100-80g-mig-3g.40gb"`) {
+		t.Errorf("the JSON carries no class for the instance: %s", b)
+	}
+	var back GPU
+	if err := json.Unmarshal(b, &back); err != nil {
+		t.Fatal(err)
+	}
+	if back.Class() != g.Class() || !reflect.DeepEqual(back.MIG, g.MIG) {
+		t.Errorf("came back as %s %+v", back.Class(), back.MIG)
+	}
+}
+
+func TestMIGClassesAreNamedFromTheCardAndTheProfile(t *testing.T) {
+	for _, c := range []struct {
+		name    string
+		cardMB  int
+		profile string
+		want    string
+	}{
+		{"NVIDIA A100-SXM4-80GB MIG 3g.40gb", 81920, "3g.40gb", "a100-80g-mig-3g.40gb"},
+		// The same profile name on a 40 GB card is another class: its
+		// instance is the same size, but the card is not, and neither is
+		// the set of profiles that card can be cut to.
+		{"NVIDIA A100-SXM4-40GB MIG 3g.20gb", 40960, "3g.20gb", "a100-40g-mig-3g.20gb"},
+		{"NVIDIA H100 80GB HBM3 MIG 1g.10gb+me", 81559, "1g.10gb+me", "h100-80g-mig-1g.10gb-me"},
+		{"NVIDIA H100 80GB HBM3 MIG 7g.80gb", 81559, "7g.80gb", "h100-80g-mig-7g.80gb"},
+	} {
+		g := GPU{Name: c.name, MemoryTotalMB: 10000, MIG: &MIGDevice{ParentMemoryTotalMB: c.cardMB, Profile: c.profile}}
+		if got := g.Class(); got != c.want {
+			t.Errorf("%s -> %s, want %s", c.name, got, c.want)
+		}
+		if !IsMIGClass(g.Class()) {
+			t.Errorf("%s is not recognised as a MIG class", g.Class())
+		}
+	}
+	if IsMIGClass("a100-80g") || IsMIGClass("6000-24g") {
+		t.Error("a whole card's class was taken for a MIG one")
+	}
+	if MIGProfileMemoryGB("a100-80g-mig-3g.40gb") != 40 || MIGProfileMemoryGB("1g.10gb+me") != 10 || MIGProfileMemoryGB("a100-80g") != 0 {
+		t.Error("the instance's memory is misread from its profile")
+	}
+}
+
+func TestDeviceNumbersAreShownAsCardAndInstance(t *testing.T) {
+	for i, want := range map[int]string{0: "0", 7: "7", MIGIndex(0, 2): "0/mig2", MIGIndex(3, 0): "3/mig0", 1302: "3/mig2"} {
+		if got := DeviceLabel(i); got != want {
+			t.Errorf("DeviceLabel(%d) = %s, want %s", i, got, want)
+		}
+	}
+	if IsMIGIndex(15) || !IsMIGIndex(MIGIndex(0, 0)) {
+		t.Error("whole cards and instances are told apart wrongly")
+	}
+}
+
+func TestACardInMIGModeWithNoInstancesIsKeptOutOfPlacement(t *testing.T) {
+	cards, _ := parseSMI(migQuery)
+	report, _ := parseMIGReport([]byte(strings.Replace(migReport,
+		migReport[strings.Index(migReport, "<mig_devices>"):strings.Index(migReport, "</mig_devices>")+len("</mig_devices>")],
+		"<mig_devices>None</mig_devices>", 1)))
+	gpus := expandMIG(cards, parseSMIList("GPU 0: NVIDIA A100-SXM4-80GB (UUID: GPU-x)\nGPU 1: NVIDIA A100-SXM4-80GB (UUID: GPU-y)\n"), report)
+	if len(gpus) != 2 || gpus[0].IsMIG() {
+		t.Fatalf("got %+v", gpus)
+	}
+	// CUDA will not open the whole card while MIG is on, and there is no
+	// instance to open instead: placing anything here fails at start.
+	if gpus[0].Health.OK() || !strings.Contains(gpus[0].Health.Problems[0], "no instances") {
+		t.Errorf("card 0's problems: %v", gpus[0].Health.Problems)
+	}
+	if !gpus[1].Health.OK() {
+		t.Errorf("card 1, not in MIG mode, was flagged: %v", gpus[1].Health.Problems)
+	}
+
+	// Instances the report sees but -L could not name cannot be given to an
+	// engine either; the card says why.
+	report, _ = parseMIGReport([]byte(migReport))
+	gpus = expandMIG(cards, nil, report)
+	if len(gpus) != 2 || gpus[0].Health.OK() || !strings.Contains(gpus[0].Health.Problems[0], "did not name") {
+		t.Errorf("with -L failing: %+v", gpus)
+	}
+}
+
+func TestInstancesAreFoundFromTheListAloneWhenTheReportCannotBeRead(t *testing.T) {
+	cards, _ := parseSMI(migQuery)
+	gpus := expandMIG(cards, parseSMIList(migList), nil)
+	if len(gpus) != 3 || !gpus[0].IsMIG() || gpus[0].MemoryTotalMB != 40*1024 {
+		t.Errorf("without the report: %+v", gpus)
+	}
+}
+
+func TestAnOlderDriversInstanceUUIDIsTakenAsItIs(t *testing.T) {
+	// R450 and R460 name an instance by its card and ids, and CUDA of that
+	// era takes exactly that in CUDA_VISIBLE_DEVICES.
+	l := parseSMIList("GPU 0: A100-SXM4-40GB (UUID: GPU-5d5ba0d6-d33d-2b2c-524d-9e3d8d2b8a77)\n" +
+		"  MIG 1g.5gb Device 0: (UUID: MIG-GPU-5d5ba0d6-d33d-2b2c-524d-9e3d8d2b8a77/7/0)\n")
+	if len(l[0]) != 1 || l[0][0].UUID != "MIG-GPU-5d5ba0d6-d33d-2b2c-524d-9e3d8d2b8a77/7/0" || l[0][0].Profile != "1g.5gb" {
+		t.Errorf("parsed %+v", l)
+	}
+}
+
+func TestProcessesOnAMIGCardAreChargedToTheirOwnInstance(t *testing.T) {
+	mem, err := parseGPUMemory([]byte(migReport))
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []GPUMemory{
+		{Index: 1000, UsedMB: 37},
+		{Index: 1001, UsedMB: 21000, Procs: []GPUProcess{{PID: 4100, UsedMB: 20900}}},
+		{Index: 1, UsedMB: 300, Procs: []GPUProcess{{PID: 5200, UsedMB: 250}}},
+	}
+	if !reflect.DeepEqual(mem, want) {
+		t.Errorf("got %+v\nwant %+v", mem, want)
+	}
+	// In the order discovery reports the devices, so a heartbeat's readings
+	// line up with the inventory one for one.
+	gpus := migMachine(t)
+	for i := range gpus {
+		if mem[i].Index != gpus[i].Index {
+			t.Errorf("reading %d is for device %d, inventory has %d", i, mem[i].Index, gpus[i].Index)
+		}
+	}
+	procs, _ := parseGPUProcesses([]byte(migReport))
+	if !reflect.DeepEqual(procs, map[int][]int{1001: {4100}, 1: {5200}}) {
+		t.Errorf("processes by device: %v", procs)
+	}
+}
+
+func TestAMIGInstanceTakesItsCardsPlaceInTheTopologyButNoNVLink(t *testing.T) {
+	gpus := migMachine(t)
+	topo := Topology{
+		NVLink:  map[int]map[int]int{0: {1: 12}, 1: {0: 12}},
+		NUMA:    map[int]int{0: 0, 1: 1},
+		NICPath: map[int]map[string]string{0: {"mlx5_0": "PIX"}},
+	}
+	topo.Apply(gpus)
+	if len(gpus[0].NVLinkPeers) != 0 || len(gpus[1].NVLinkPeers) != 0 {
+		t.Errorf("MIG instances were given NVLink peers: %v %v", gpus[0].NVLinkPeers, gpus[1].NVLinkPeers)
+	}
+	if gpus[1].NUMANode != 0 || gpus[1].NICPaths["mlx5_0"] != "PIX" {
+		t.Errorf("instance 1 did not take its card's NUMA node and adapters: %+v", gpus[1])
+	}
+	if gpus[2].NUMANode != 1 || !slices.Equal(gpus[2].NVLinkPeers, []int{0}) {
+		t.Errorf("the whole card's topology: %+v", gpus[2])
+	}
+}
+
+func TestMIGInstancesAreDiscoveredThroughNvidiaSMI(t *testing.T) {
+	// The real code path against a stub binary that answers each command as
+	// the machine above would.
+	dir := t.TempDir()
+	stub := filepath.Join(dir, "nvidia-smi")
+	script := "#!/bin/sh\ncase \"$1\" in\n" +
+		"-L) cat <<'EOF'\n" + migList + "EOF\n;;\n" +
+		"-q) cat <<'EOF'\n" + migReport + "\nEOF\n;;\n" +
+		"*) cat <<'EOF'\n" + migQuery + "EOF\n;;\nesac\n"
+	if err := os.WriteFile(stub, []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	gpus, err := DiscoverGPUsSMI(t.Context(), stub)
+	if err != nil {
+		t.Fatal(err)
+	}
+	inv := Inventory{GPUs: gpus}
+	if !slices.Equal(inv.Classes(), []string{"a100-80g", "a100-80g-mig-3g.40gb"}) || len(gpus) != 3 {
+		t.Errorf("classes %v from %d devices", inv.Classes(), len(gpus))
+	}
+}
+
+// fakeMIGCard is NVML's view of one card, as nvmlDeviceGetMigMode,
+// nvmlDeviceGetMaxMigDeviceCount and nvmlDeviceGetMigDeviceHandleByIndex
+// would give it.
+type fakeMIGCard struct {
+	mode, pending, supported bool
+	max                      int
+	devs                     map[int]fakeMIGInstance
+}
+
+func (c fakeMIGCard) MIGMode() (bool, bool, bool) { return c.mode, c.pending, c.supported }
+func (c fakeMIGCard) MaxMIGDevices() int          { return c.max }
+func (c fakeMIGCard) MIGDevice(i int) (nvmlMIGInstance, bool) {
+	d, ok := c.devs[i]
+	return d, ok
+}
+
+type fakeMIGInstance struct {
+	uuid, name      string
+	total, used     int
+	gi, ci          int
+	slices, attrMem int
+}
+
+func (m fakeMIGInstance) UUID() string { return m.uuid }
+func (m fakeMIGInstance) Name() string { return m.name }
+func (m fakeMIGInstance) Memory() (int, int, bool) {
+	return m.total, m.used, m.total > 0
+}
+func (m fakeMIGInstance) Instances() (int, int) { return m.gi, m.ci }
+func (m fakeMIGInstance) Attributes() (int, int, bool) {
+	return m.slices, m.attrMem, m.slices > 0
+}
+
+func TestNVMLReportsACardInMIGModeAsItsInstances(t *testing.T) {
+	card := GPU{Index: 2, UUID: "GPU-card", Name: "NVIDIA H100 80GB HBM3", MemoryTotalMB: 81559,
+		ComputeCapability: "9.0", NUMANode: 1, Health: GPUHealth{TemperatureC: 40}}
+	// Seven slots, three filled, one of them on a driver that does not put
+	// the profile in the device's name.
+	dev := fakeMIGCard{mode: true, pending: true, supported: true, max: 7, devs: map[int]fakeMIGInstance{
+		0: {uuid: "MIG-aaa", name: "NVIDIA H100 80GB HBM3 MIG 3g.40gb", total: 40448, used: 10, gi: 2, ci: 0},
+		1: {uuid: "MIG-bbb", name: "NVIDIA H100 80GB HBM3 MIG 3g.40gb", total: 40448, used: 10, gi: 1, ci: 0},
+		4: {uuid: "MIG-ccc", name: "NVIDIA H100 80GB HBM3", total: 9984, gi: 9, ci: 0, slices: 1, attrMem: 9984},
+	}}
+	gpus, isMIG := migFromNVML(card, dev)
+	if !isMIG || len(gpus) != 3 {
+		t.Fatalf("got %d devices, MIG %v", len(gpus), isMIG)
+	}
+	var classes []string
+	for _, g := range gpus {
+		classes = append(classes, DeviceLabel(g.Index)+" "+g.UUID+" "+g.Class())
+	}
+	want := []string{"2/mig0 MIG-aaa h100-80g-mig-3g.40gb", "2/mig1 MIG-bbb h100-80g-mig-3g.40gb",
+		"2/mig4 MIG-ccc h100-80g-mig-1g.10gb"}
+	if !slices.Equal(classes, want) {
+		t.Errorf("devices %q, want %q", classes, want)
+	}
+	if g := gpus[1]; g.MemoryTotalMB != 40448 || g.MIG.GPUInstance != 1 || g.NUMANode != 1 ||
+		g.Health.TemperatureC != 40 || len(g.NVLinkPeers) != 0 {
+		t.Errorf("instance 1: %+v", g)
+	}
+
+	// MIG on and nothing carved: the card, kept out of placement.
+	gpus, isMIG = migFromNVML(card, fakeMIGCard{mode: true, supported: true, max: 7})
+	if !isMIG || len(gpus) != 1 || gpus[0].IsMIG() || gpus[0].Health.OK() {
+		t.Errorf("an empty MIG card: %+v", gpus)
+	}
+	// MIG off, or a card without it: the card, as it always was.
+	for _, d := range []fakeMIGCard{{supported: true, max: 7}, {}} {
+		gpus, isMIG = migFromNVML(card, d)
+		if isMIG || len(gpus) != 1 || !reflect.DeepEqual(gpus[0], card) {
+			t.Errorf("a card not in MIG mode came back as %+v", gpus)
+		}
+	}
+}
+
+func TestMIGInstanceTablesAreRead(t *testing.T) {
+	gis := ParseMIGInstances(migLGI)
+	if len(gis) != 2 || gis[0] != (MIGInstance{GPU: 0, Profile: "3g.40gb", ProfileID: 9, GPUInstance: 1,
+		ComputeInstance: -1, Placement: "4:4"}) {
+		t.Errorf("-lgi: %+v", gis)
+	}
+	cis := ParseMIGInstances(migLCI)
+	if len(cis) != 2 || cis[1] != (MIGInstance{GPU: 0, GPUInstance: 2, Profile: "3g.40gb", ProfileID: 2,
+		ComputeInstance: 0, Placement: "0:3"}) {
+		t.Errorf("-lci: %+v", cis)
+	}
+	if got := ParseMIGInstances("No GPU instances found: Not Found\n"); len(got) != 0 {
+		t.Errorf("nothing to list read as %+v", got)
+	}
+
+	cards, err := buildMIGCards([]byte(migReport), migList, migLGI, migLCI)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(cards) != 2 || !cards[0].Enabled || len(cards[0].Instances) != 2 || len(cards[0].GPUInstances) != 2 ||
+		len(cards[0].ComputeInstances) != 2 || cards[1].Enabled {
+		t.Errorf("cards: %+v", cards)
+	}
+}

internal/agent/discovery/perftest.go

@@ -0,0 +1,133 @@
+package discovery
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// WriteBW is one side of an ib_write_bw run, from perftest: an RDMA write
+// bandwidth test between two adapters, which is what a collective spanning
+// nodes rides on.
+type WriteBW struct {
+	HCA  string
+	Port int
+	// GIDIndex is the RoCE v2 GID to use; negative on InfiniBand, where the
+	// port's LID is used.
+	GIDIndex int
+	// Peer is the server's address, for the client; empty makes the server.
+	Peer    string
+	TCPPort int
+	Seconds int
+}
+
+// Args are the command line: a duration rather than a count, so the test
+// takes as long on a slow link as a fast one, and results in Gb/s.
+func (w WriteBW) Args() []string {
+	args := []string{"-d", w.HCA, "-i", strconv.Itoa(max(w.Port, 1)),
+		"-p", strconv.Itoa(w.TCPPort), "-D", strconv.Itoa(max(w.Seconds, 1)),
+		"-F", "--report_gbits"}
+	if w.GIDIndex >= 0 {
+		args = append(args, "-x", strconv.Itoa(w.GIDIndex))
+	}
+	if w.Peer != "" {
+		args = append(args, w.Peer)
+	}
+	return args
+}
+
+// RunWriteBW runs one side and returns the average bandwidth the output
+// reports, in Gb/s, and the output. The client retries its connection for a
+// while: the server is started first, but a few seconds may pass before it
+// listens.
+func RunWriteBW(ctx context.Context, w WriteBW) (float64, string, error) {
+	bin, err := exec.LookPath("ib_write_bw")
+	if err != nil {
+		return 0, "", errors.New("ib_write_bw is not installed (the perftest package)")
+	}
+	limit := time.Duration(w.Seconds+60) * time.Second
+	var out []byte
+	for attempt := 0; ; attempt++ {
+		cctx, cancel := context.WithTimeout(ctx, limit)
+		out, err = exec.CommandContext(cctx, bin, w.Args()...).CombinedOutput() //nolint:gosec // fixed tool
+		cancel()
+		if err == nil || w.Peer == "" || !refused(string(out)) || attempt >= 10 {
+			break
+		}
+		select {
+		case <-ctx.Done():
+			return 0, string(out), ctx.Err()
+		case <-time.After(time.Second):
+		}
+	}
+	text := string(out)
+	if err != nil {
+		return 0, text, fmt.Errorf("ib_write_bw: %v: %s", err, lastNonEmpty(text))
+	}
+	gbps, perr := ParseWriteBW(text)
+	if perr != nil && w.Peer != "" {
+		// Only the client is sure to print the result; a server that does not
+		// is not a failure.
+		return 0, text, perr
+	}
+	return gbps, text, nil
+}
+
+func refused(out string) bool {
+	for _, s := range []string{"Couldn't connect", "Unable to init the socket connection", "Connection refused"} {
+		if strings.Contains(out, s) {
+			return true
+		}
+	}
+	return false
+}
+
+var columnSplit = regexp.MustCompile(`\s{2,}`)
+
+// ParseWriteBW finds the average bandwidth in perftest's result table:
+//
+//	#bytes     #iterations    BW peak[Gb/sec]    BW average[Gb/sec]   MsgRate[Mpps]
+//	65536      887036           0.00               96.93               0.184877
+//
+// by the heading's position rather than a fixed column, since versions add
+// columns and the peak reads 0.00 when the test runs for a duration.
+func ParseWriteBW(out string) (float64, error) {
+	lines := strings.Split(out, "\n")
+	for i, l := range lines {
+		if !strings.Contains(l, "BW average") {
+			continue
+		}
+		heads := columnSplit.Split(strings.TrimSpace(l), -1)
+		col := -1
+		for j, h := range heads {
+			if strings.HasPrefix(h, "BW average") {
+				col = j
+			}
+		}
+		for _, d := range lines[i+1:] {
+			f := strings.Fields(d)
+			if len(f) == 0 || strings.HasPrefix(f[0], "-") {
+				continue
+			}
+			if len(f) != len(heads) || col < 0 {
+				return 0, fmt.Errorf("perftest's result table has a shape this does not know: %q / %q", l, d)
+			}
+			v, err := strconv.ParseFloat(f[col], 64)
+			if err != nil {
+				return 0, fmt.Errorf("reading the average bandwidth %q: %w", f[col], err)
+			}
+			return v, nil
+		}
+	}
+	return 0, errors.New("perftest printed no result")
+}
+
+func lastNonEmpty(s string) string {
+	lines := strings.Split(strings.TrimSpace(s), "\n")
+	return strings.TrimSpace(lines[len(lines)-1])
+}

internal/agent/discovery/perftest_test.go

@@ -0,0 +1,49 @@
+package discovery
+
+import (
+	"slices"
+	"testing"
+)
+
+// The client's output of perftest 24.x, with a duration.
+const writeBWClient = `---------------------------------------------------------------------------------------
+                    RDMA_Write BW Test
+ Dual-port       : OFF		Device         : mlx5_0
+ Number of qps   : 1		Transport type : IB
+ Connection type : RC		Using SRQ      : OFF
+ TX depth        : 128
+ CQ Moderation   : 100
+ Mtu             : 4096[B]
+ Link type       : IB
+ Max inline data : 0[B]
+ rdma_cm QPs	 : OFF
+ Data ex. method : Ethernet
+---------------------------------------------------------------------------------------
+ local address: LID 0x05 QPN 0x0112 PSN 0x7b1f02 RKey 0x1fffbd VAddr 0x007f1d2a5f0000
+ remote address: LID 0x09 QPN 0x0113 PSN 0x2c1e44 RKey 0x1ffeaf VAddr 0x007fa4e1a60000
+---------------------------------------------------------------------------------------
+ #bytes     #iterations    BW peak[Gb/sec]    BW average[Gb/sec]   MsgRate[Mpps]
+ 65536      1851214          0.00               388.21		   0.740422
+---------------------------------------------------------------------------------------
+`
+
+func TestTheAverageBandwidthIsReadFromPerftest(t *testing.T) {
+	got, err := ParseWriteBW(writeBWClient)
+	if err != nil || got != 388.21 {
+		t.Errorf("got %v, %v", got, err)
+	}
+	if _, err := ParseWriteBW(" Couldn't connect to 10.0.0.2:18515\n"); err == nil {
+		t.Error("output with no result table gave a number")
+	}
+}
+
+func TestWriteBWArguments(t *testing.T) {
+	ib := WriteBW{HCA: "mlx5_0", Port: 1, GIDIndex: -1, TCPPort: 18515, Seconds: 3}.Args()
+	if slices.Contains(ib, "-x") {
+		t.Errorf("InfiniBand was given a GID index: %v", ib)
+	}
+	roce := WriteBW{HCA: "mlx5_0", Port: 1, GIDIndex: 3, Peer: "10.0.0.2", TCPPort: 18515, Seconds: 3}.Args()
+	if !slices.Contains(roce, "-x") || roce[len(roce)-1] != "10.0.0.2" {
+		t.Errorf("RoCE client: %v", roce)
+	}
+}

internal/agent/discovery/sensors.go

@@ -0,0 +1,287 @@
+package discovery
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+// Sensors is what a node's own hardware says about heat and power: the CPUs,
+// the board where it has an inlet sensor, and each GPU. A zero is not
+// measured, never a reading of zero — a VM has none of these, and must not
+// look like a machine running at 0 °C on no power.
+type Sensors struct {
+	// CPUTempC is the hottest CPU sensor: the package, or the hottest core
+	// where no package reading exists.
+	CPUTempC float64
+	// CPUPowerW is the CPU packages' draw, from RAPL: the change in their
+	// energy counters over the time between two samples.
+	CPUPowerW float64
+	// InletTempC is the air coming in, where the board has a sensor it calls
+	// that. Most do not, and a CPU's temperature is not a substitute: it
+	// follows the load, not the room.
+	InletTempC float64
+	GPUs       []GPUSensor
+}
+
+// GPUSensor is one card's heat, power and whether it is slowing itself down.
+type GPUSensor struct {
+	Index       int
+	TempC       float64
+	MemoryTempC float64
+	PowerW      float64
+	PowerLimitW float64
+	// Throttle names what is holding the card's clocks down now:
+	// sw_power_cap, hw_slowdown, sw_thermal, hw_thermal, power_brake. Empty
+	// is running free. Idle and application clock settings are left out;
+	// they are not the card being held back.
+	Throttle []string
+	// How busy it is, read with the rest every sample. Discovery reads the
+	// same once, at start, which made a busy card look as idle as it was
+	// when the agent came up. -1 is not reported by the driver; zero
+	// MemoryTotalMB is a sample without these at all.
+	UtilPercent, MemUtilPercent float64
+	MemoryUsedMB, MemoryTotalMB float64
+	SMClockMHz                  float64
+	ECCUncorrected              float64
+}
+
+// sensorEvery bounds how often nvidia-smi is run. Heartbeats come more often
+// than temperatures change, and each run costs a few hundred milliseconds.
+const sensorEvery = 10 * time.Second
+
+// SensorSampler reads Sensors. The first sample has no CPU power, which needs
+// two readings of the energy counters.
+type SensorSampler struct {
+	sys string // /sys, or a test's copy of it
+	smi func(ctx context.Context, fields string) ([]byte, error)
+	now func() time.Time
+
+	mu         sync.Mutex
+	last       Sensors
+	lastAt     time.Time
+	prevEnergy map[string]uint64
+	prevAt     time.Time
+}
+
+// NewSensorSampler reads this machine.
+func NewSensorSampler() *SensorSampler {
+	return &SensorSampler{sys: "/sys", smi: runSMI, now: time.Now}
+}
+
+func runSMI(ctx context.Context, fields string) ([]byte, error) {
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	//nolint:gosec // fixed binary, fields from this file
+	return exec.CommandContext(ctx, "nvidia-smi", "--query-gpu="+fields,
+		"--format=csv,noheader,nounits").Output()
+}
+
+// Sample reads the sensors, or returns the last reading when that is recent.
+func (s *SensorSampler) Sample(ctx context.Context) Sensors {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	now := s.now()
+	if !s.lastAt.IsZero() && now.Sub(s.lastAt) < sensorEvery {
+		return s.last
+	}
+	out := Sensors{}
+	out.CPUTempC, out.InletTempC = s.hwmon()
+	out.CPUPowerW = s.rapl(now)
+	out.GPUs = s.gpus(ctx)
+	s.last, s.lastAt = out, now
+	return out
+}
+
+// hwmon reads the hottest CPU sensor and an inlet sensor, from every hwmon
+// device the kernel exposes — what lm_sensors reads, without it installed.
+func (s *SensorSampler) hwmon() (cpu, inlet float64) {
+	devs, _ := filepath.Glob(filepath.Join(s.sys, "class/hwmon/hwmon*"))
+	var pkg, core float64
+	for _, d := range devs {
+		name := readTrim(filepath.Join(d, "name"))
+		inputs, _ := filepath.Glob(filepath.Join(d, "temp*_input"))
+		for _, in := range inputs {
+			milli, err := strconv.ParseFloat(readTrim(in), 64)
+			if err != nil || milli <= 0 {
+				continue
+			}
+			c := milli / 1000
+			label := strings.ToLower(readTrim(strings.TrimSuffix(in, "_input") + "_label"))
+			switch {
+			case isCPUSensor(name) && (strings.HasPrefix(label, "package") || label == "tctl" || label == "tdie"):
+				pkg = max(pkg, c)
+			case isCPUSensor(name):
+				core = max(core, c)
+			case label == "cpu":
+				// A board's own reading of the CPU, as Dell's SMM gives.
+				core = max(core, c)
+			case strings.Contains(label, "inlet") || strings.Contains(label, "ambient") ||
+				strings.Contains(label, "intake") || label == "systin":
+				inlet = max(inlet, c)
+			}
+		}
+	}
+	if pkg > 0 {
+		return pkg, inlet
+	}
+	return core, inlet
+}
+
+func isCPUSensor(name string) bool {
+	switch name {
+	case "coretemp", "k10temp", "zenpower", "cpu_thermal":
+		return true
+	}
+	return false
+}
+
+// rapl is the CPU packages' power from their energy counters. Package
+// domains only: the dram and core subdomains are parts of a package, and
+// adding them would count the same energy twice.
+func (s *SensorSampler) rapl(now time.Time) float64 {
+	doms, _ := filepath.Glob(filepath.Join(s.sys, "class/powercap/intel-rapl:*"))
+	energy := map[string]uint64{}
+	wrap := map[string]uint64{}
+	for _, d := range doms {
+		if strings.Count(filepath.Base(d), ":") != 1 {
+			continue // intel-rapl:0:0 is a subdomain of intel-rapl:0
+		}
+		e, err := strconv.ParseUint(readTrim(filepath.Join(d, "energy_uj")), 10, 64)
+		if err != nil {
+			continue // unreadable without root on newer kernels
+		}
+		energy[d] = e
+		wrap[d], _ = strconv.ParseUint(readTrim(filepath.Join(d, "max_energy_range_uj")), 10, 64)
+	}
+	prev, prevAt := s.prevEnergy, s.prevAt
+	s.prevEnergy, s.prevAt = energy, now
+	dt := now.Sub(prevAt).Seconds()
+	if prev == nil || dt <= 0 || len(energy) == 0 {
+		return 0
+	}
+	var joules float64
+	for d, e := range energy {
+		p, ok := prev[d]
+		if !ok {
+			return 0 // a domain appeared: no fair difference this time
+		}
+		if e < p { // the counter wrapped
+			e += wrap[d]
+		}
+		joules += float64(e-p) / 1e6
+	}
+	return joules / dt
+}
+
+// The throttle reasons nvidia-smi reports, as bits. Only those that mean the
+// card is being held back are named.
+var throttleBits = []struct {
+	bit  uint64
+	name string
+}{
+	{0x4, "sw_power_cap"},
+	{0x8, "hw_slowdown"},
+	{0x20, "sw_thermal"},
+	{0x40, "hw_thermal"},
+	{0x80, "power_brake"},
+}
+
+// gpus asks nvidia-smi for each card's heat and power. The memory temperature
+// is not known to every driver, and a field nvidia-smi does not know fails the
+// whole query, so it is asked for first and dropped on failure.
+// gpuFields are what each sample asks nvidia-smi for, in order. The busy
+// figures follow the throttle reasons; the memory temperature is last, being
+// the one field a driver may reject outright.
+const (
+	gpuBase  = "index,temperature.gpu,power.draw,enforced.power.limit,clocks_throttle_reasons.active"
+	gpuBusy  = ",utilization.gpu,utilization.memory,memory.used,memory.total,clocks.sm,ecc.errors.uncorrected.volatile.total"
+	gpuHBMTC = ",temperature.memory"
+)
+
+func (s *SensorSampler) gpus(ctx context.Context) []GPUSensor {
+	// Most fields first, fewer on a driver that refuses one: a query naming
+	// a field the driver does not know fails as a whole.
+	var out []byte
+	var busy bool
+	for _, q := range []struct {
+		fields string
+		busy   bool
+	}{{gpuBase + gpuBusy + gpuHBMTC, true}, {gpuBase + gpuBusy, true}, {gpuBase + gpuHBMTC, false}, {gpuBase, false}} {
+		var err error
+		if out, err = s.smi(ctx, q.fields); err == nil {
+			busy = q.busy
+			break
+		}
+		out = nil
+	}
+	if out == nil {
+		return nil
+	}
+	var gs []GPUSensor
+	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		f := strings.Split(line, ",")
+		if len(f) < 5 {
+			continue
+		}
+		for i := range f {
+			f[i] = strings.TrimSpace(f[i])
+		}
+		idx, err := strconv.Atoi(f[0])
+		if err != nil {
+			continue
+		}
+		g := GPUSensor{Index: idx, TempC: num(f[1]), PowerW: num(f[2]), PowerLimitW: num(f[3])}
+		if bits, err := strconv.ParseUint(strings.TrimPrefix(f[4], "0x"), 16, 64); err == nil {
+			for _, b := range throttleBits {
+				if bits&b.bit != 0 {
+					g.Throttle = append(g.Throttle, b.name)
+				}
+			}
+		}
+		rest := f[5:]
+		if busy && len(rest) >= 6 {
+			g.UtilPercent, g.MemUtilPercent = numOrUnknown(rest[0]), numOrUnknown(rest[1])
+			g.MemoryUsedMB, g.MemoryTotalMB = num(rest[2]), num(rest[3])
+			g.SMClockMHz, g.ECCUncorrected = num(rest[4]), numOrUnknown(rest[5])
+			rest = rest[6:]
+		}
+		if len(rest) > 0 {
+			g.MemoryTempC = num(rest[0])
+		}
+		gs = append(gs, g)
+	}
+	return gs
+}
+
+// numOrUnknown is a figure, or -1 where nvidia-smi says it has none: a card
+// without ECC has no error count, which is not the same as none.
+func numOrUnknown(s string) float64 {
+	v, err := strconv.ParseFloat(s, 64)
+	if err != nil || v < 0 {
+		return -1
+	}
+	return v
+}
+
+// num reads a figure nvidia-smi may give as "[N/A]" or "N/A".
+func num(s string) float64 {
+	v, err := strconv.ParseFloat(s, 64)
+	if err != nil || v < 0 {
+		return 0
+	}
+	return v
+}
+
+func readTrim(path string) string {
+	b, err := os.ReadFile(path) //nolint:gosec // sysfs
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(b))
+}

internal/agent/discovery/sensors_test.go

@@ -0,0 +1,210 @@
+package discovery
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func put(t *testing.T, root, rel, body string) {
+	t.Helper()
+	p := filepath.Join(root, rel)
+	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(p, []byte(body+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// dellHost is the layout of the Proxmox host these tests were written
+// against: Dell's SMM with a CPU and SODIMM sensors, coretemp with a package
+// and cores, and RAPL with a package and its dram subdomain.
+func dellHost(t *testing.T) string {
+	root := t.TempDir()
+	put(t, root, "class/hwmon/hwmon0/name", "dell_smm")
+	put(t, root, "class/hwmon/hwmon0/temp1_input", "55000")
+	put(t, root, "class/hwmon/hwmon0/temp1_label", "CPU")
+	put(t, root, "class/hwmon/hwmon0/temp2_input", "47000")
+	put(t, root, "class/hwmon/hwmon0/temp2_label", "SODIMM")
+	put(t, root, "class/hwmon/hwmon1/name", "coretemp")
+	put(t, root, "class/hwmon/hwmon1/temp1_input", "58000")
+	put(t, root, "class/hwmon/hwmon1/temp1_label", "Package id 0")
+	put(t, root, "class/hwmon/hwmon1/temp10_input", "61000")
+	put(t, root, "class/hwmon/hwmon1/temp10_label", "Core 8")
+	put(t, root, "class/powercap/intel-rapl:0/energy_uj", "1000000000")
+	put(t, root, "class/powercap/intel-rapl:0/max_energy_range_uj", "262143328850")
+	put(t, root, "class/powercap/intel-rapl:0:0/energy_uj", "5000000")
+	return root
+}
+
+func sampler(sys string, smi func(context.Context, string) ([]byte, error), clock *time.Time) *SensorSampler {
+	return &SensorSampler{sys: sys, smi: smi, now: func() time.Time { return *clock }}
+}
+
+func noSMI(context.Context, string) ([]byte, error) { return nil, errors.New("not found") }
+
+func TestAHostsCPUHeatAndPowerAreReadAsLmSensorsWould(t *testing.T) {
+	root := dellHost(t)
+	now := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	s := sampler(root, noSMI, &now)
+
+	first := s.Sample(t.Context())
+	// The package reading, not the hotter core: the package is what the
+	// chip itself reports as its temperature.
+	if first.CPUTempC != 58 {
+		t.Errorf("CPU %.1f °C, expected the package's 58", first.CPUTempC)
+	}
+	if first.CPUPowerW != 0 {
+		t.Error("power from one reading of a counter is invented")
+	}
+	if first.InletTempC != 0 || first.GPUs != nil {
+		t.Errorf("sensors this host does not have were reported: %+v", first)
+	}
+
+	// 10 s later the package has used 650 J, and its dram subdomain some of
+	// that — counted once.
+	put(t, root, "class/powercap/intel-rapl:0/energy_uj", "1650000000")
+	put(t, root, "class/powercap/intel-rapl:0:0/energy_uj", "99000000")
+	now = now.Add(10 * time.Second)
+	if got := s.Sample(t.Context()).CPUPowerW; got < 64.9 || got > 65.1 {
+		t.Errorf("CPU power %.2f W, expected 65", got)
+	}
+}
+
+func TestACounterThatWrapsIsNotANegativeDraw(t *testing.T) {
+	root := dellHost(t)
+	now := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	put(t, root, "class/powercap/intel-rapl:0/energy_uj", "262143000000")
+	s := sampler(root, noSMI, &now)
+	s.Sample(t.Context())
+	// 328,850 µJ to the wrap, then 499,671,150 past it: 500 J in 10 s.
+	put(t, root, "class/powercap/intel-rapl:0/energy_uj", "499671150")
+	now = now.Add(10 * time.Second)
+	if got := s.Sample(t.Context()).CPUPowerW; got < 49.9 || got > 50.1 {
+		t.Errorf("across a wrap: %.2f W, expected 50", got)
+	}
+}
+
+func TestAVMHasNoSensorsAndSaysNothing(t *testing.T) {
+	root := t.TempDir()
+	put(t, root, "class/thermal/cooling_device0/type", "Processor")
+	now := time.Now()
+	got := sampler(root, noSMI, &now).Sample(t.Context())
+	if got.CPUTempC != 0 || got.CPUPowerW != 0 || got.InletTempC != 0 || got.GPUs != nil {
+		t.Errorf("a machine with no sensors reported %+v", got)
+	}
+}
+
+func TestABoardsInletSensorIsTheRoomNotTheCPU(t *testing.T) {
+	root := t.TempDir()
+	put(t, root, "class/hwmon/hwmon2/name", "nct6798")
+	put(t, root, "class/hwmon/hwmon2/temp1_input", "24500")
+	put(t, root, "class/hwmon/hwmon2/temp1_label", "SYSTIN")
+	put(t, root, "class/hwmon/hwmon3/name", "k10temp")
+	put(t, root, "class/hwmon/hwmon3/temp1_input", "71250")
+	put(t, root, "class/hwmon/hwmon3/temp1_label", "Tctl")
+	now := time.Now()
+	got := sampler(root, noSMI, &now).Sample(t.Context())
+	if got.InletTempC != 24.5 || got.CPUTempC != 71.25 {
+		t.Errorf("inlet %.2f, CPU %.2f", got.InletTempC, got.CPUTempC)
+	}
+}
+
+func TestEachGPUSaysHowHotHowHungryAndWhatHoldsItBack(t *testing.T) {
+	var asked []string
+	smi := func(_ context.Context, fields string) ([]byte, error) {
+		asked = append(asked, fields)
+		return []byte(
+			"0, 71, 612.45, 700.00, 0x0000000000000000, 84\n" +
+				"1, 88, 698.10, 700.00, 0x0000000000000024, 95\n" + // sw_power_cap + sw_thermal
+				"2, 45, [N/A], 700.00, 0x0000000000000001, [N/A]\n"), nil // idle only
+	}
+	now := time.Now()
+	ss := sampler(t.TempDir(), smi, &now)
+	got := ss.Sample(t.Context())
+	if len(got.GPUs) != 3 {
+		t.Fatalf("%+v", got.GPUs)
+	}
+	g0, g1, g2 := got.GPUs[0], got.GPUs[1], got.GPUs[2]
+	if g0.TempC != 71 || g0.PowerW != 612.45 || g0.PowerLimitW != 700 || g0.MemoryTempC != 84 || g0.Throttle != nil {
+		t.Errorf("card 0 %+v", g0)
+	}
+	if strings.Join(g1.Throttle, ",") != "sw_power_cap,sw_thermal" {
+		t.Errorf("card 1 throttled by %v", g1.Throttle)
+	}
+	if g2.PowerW != 0 || g2.MemoryTempC != 0 || g2.Throttle != nil {
+		t.Errorf("card 2: N/A is not a reading, and idle is not being held back: %+v", g2)
+	}
+	// Within ten seconds the last reading is reused rather than running
+	// nvidia-smi on every heartbeat; after, it is asked again.
+	now = now.Add(5 * time.Second)
+	ss.Sample(t.Context())
+	if len(asked) != 1 {
+		t.Errorf("nvidia-smi was asked %d times within ten seconds", len(asked))
+	}
+	now = now.Add(6 * time.Second)
+	ss.Sample(t.Context())
+	if len(asked) != 2 {
+		t.Errorf("nvidia-smi was asked %d times after eleven seconds, expected 2", len(asked))
+	}
+}
+
+func TestADriverThatDoesNotKnowMemoryTemperatureStillReportsTheRest(t *testing.T) {
+	smi := func(_ context.Context, fields string) ([]byte, error) {
+		if strings.Contains(fields, "temperature.memory") {
+			return nil, errors.New(`Field "temperature.memory" is not a valid field to query.`)
+		}
+		return []byte("0, 66, 250.0, 300.0, 0x0000000000000040\n"), nil
+	}
+	now := time.Now()
+	got := sampler(t.TempDir(), smi, &now).Sample(t.Context())
+	if len(got.GPUs) != 1 || got.GPUs[0].TempC != 66 || strings.Join(got.GPUs[0].Throttle, ",") != "hw_thermal" {
+		t.Errorf("%+v", got.GPUs)
+	}
+}
+
+func TestEachSampleSaysHowBusyEachGPUIs(t *testing.T) {
+	// What the card is doing now, every sample: discovery read it once, at
+	// start, and a card busy since looked as idle as it was then.
+	smi := func(_ context.Context, fields string) ([]byte, error) {
+		if !strings.Contains(fields, "utilization.gpu") {
+			return nil, errors.New("asked without how busy the cards are")
+		}
+		return []byte(
+			"0, 71, 612.45, 700.00, 0x0000000000000000, 97, 64, 71234, 81559, 1980, 0, 84\n" +
+				"1, 30, 70.10, 700.00, 0x0000000000000001, 0, 0, 512, 81559, 345, [N/A], [N/A]\n"), nil
+	}
+	now := time.Now()
+	got := sampler(t.TempDir(), smi, &now).Sample(t.Context()).GPUs
+	if len(got) != 2 {
+		t.Fatalf("%+v", got)
+	}
+	g0, g1 := got[0], got[1]
+	if g0.UtilPercent != 97 || g0.MemUtilPercent != 64 || g0.MemoryUsedMB != 71234 || g0.MemoryTotalMB != 81559 ||
+		g0.SMClockMHz != 1980 || g0.ECCUncorrected != 0 || g0.MemoryTempC != 84 {
+		t.Errorf("card 0 %+v", g0)
+	}
+	// Idle is zero; a count the card does not keep is unknown, not zero.
+	if g1.UtilPercent != 0 || g1.ECCUncorrected != -1 || g1.MemoryTempC != 0 {
+		t.Errorf("card 1 %+v", g1)
+	}
+}
+
+func TestADriverThatDoesNotKnowTheBusyFieldsStillReportsHeatAndPower(t *testing.T) {
+	smi := func(_ context.Context, fields string) ([]byte, error) {
+		if strings.Contains(fields, "utilization.gpu") {
+			return nil, errors.New(`Field "ecc.errors.uncorrected.volatile.total" is not a valid field to query.`)
+		}
+		return []byte("0, 66, 250.0, 300.0, 0x0000000000000000, 70\n"), nil
+	}
+	now := time.Now()
+	got := sampler(t.TempDir(), smi, &now).Sample(t.Context()).GPUs
+	if len(got) != 1 || got[0].TempC != 66 || got[0].MemoryTempC != 70 || got[0].MemoryTotalMB != 0 {
+		t.Errorf("%+v", got)
+	}
+}

internal/agent/discovery/sminfo.go

@@ -0,0 +1,172 @@
+package discovery
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os/exec"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// ErrNoDiags means infiniband-diags is not installed, so the subnet manager
+// cannot be asked who it is.
+var ErrNoDiags = errors.New("sminfo not found: install infiniband-diags")
+
+// smLine is sminfo's one line of answer:
+//
+//	sminfo: sm lid 1 sm guid 0x98039b03009fcfd6, activity count 5452 priority 15 state 3 SMINFO_MASTER
+var smLine = regexp.MustCompile(`sm lid (\d+) sm guid (0x[0-9a-fA-F]+), activity count \d+ priority (\d+) state \d+ (\S+)`)
+
+// ParseSMInfo reads sminfo's output.
+func ParseSMInfo(out string) (*SMInfo, error) {
+	m := smLine.FindStringSubmatch(out)
+	if m == nil {
+		return nil, fmt.Errorf("unrecognised sminfo output: %q", strings.TrimSpace(out))
+	}
+	lid, _ := strconv.Atoi(m[1])
+	prio, _ := strconv.Atoi(m[3])
+	return &SMInfo{GUID: normalizeGUID(m[2]), LID: lid, Priority: prio, State: m[4]}, nil
+}
+
+// QuerySM asks, through one port, which subnet manager is master. It is a
+// management datagram to the SM, not a scan: cheap, but not free, which is
+// why the agent asks once a minute rather than every heartbeat.
+func QuerySM(ctx context.Context, hca string, port int) (*SMInfo, error) {
+	bin, err := exec.LookPath("sminfo")
+	if err != nil {
+		return nil, ErrNoDiags
+	}
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	out, err := exec.CommandContext(ctx, bin, "-C", hca, "-P", strconv.Itoa(port)).CombinedOutput()
+	if err != nil {
+		return nil, fmt.Errorf("sminfo on %s/%d: %w: %s", hca, port, err, strings.TrimSpace(string(out)))
+	}
+	return ParseSMInfo(string(out))
+}
+
+// AttachSM fills in the subnet manager each active InfiniBand port sees.
+// RoCE has none. The first error is returned for reporting; the ports it
+// could answer for keep their answer.
+func AttachSM(hcas []HCA, query func(hca string, port int) (*SMInfo, error)) error {
+	var first error
+	for i := range hcas {
+		for j := range hcas[i].Ports {
+			p := &hcas[i].Ports[j]
+			if !p.Active() || p.LinkLayer == LinkEthernet {
+				continue
+			}
+			sm, err := query(hcas[i].Name, p.Num)
+			if err != nil {
+				if first == nil {
+					first = err
+				}
+				continue
+			}
+			p.SM = sm
+		}
+	}
+	return first
+}
+
+// SMRecord is one subnet manager on a fabric, as the subnet administrator
+// lists them: master and standbys alike.
+type SMRecord struct {
+	GUID     string `json:"guid"`
+	LID      int    `json:"lid"`
+	Priority int    `json:"priority"`
+	// State is master, standby, discovering or not active.
+	State string `json:"state"`
+}
+
+// smStates are SMInfo's state numbers.
+var smStates = map[string]string{"0": "not active", "1": "discovering", "2": "standby", "3": "master"}
+
+// smirField is one line of saquery's record dump: "LID.........1".
+var smirField = regexp.MustCompile(`^\s*([A-Za-z_]+)\.{2,}\s*(\S+)`)
+
+// ParseSMIR reads `saquery SMIR`: every subnet manager the fabric's subnet
+// administrator knows of, one "SMInfoRecord dump:" block each.
+func ParseSMIR(out string) ([]SMRecord, error) {
+	var recs []SMRecord
+	var cur *SMRecord
+	for _, line := range strings.Split(out, "\n") {
+		if strings.Contains(line, "SMInfoRecord dump") {
+			recs = append(recs, SMRecord{})
+			cur = &recs[len(recs)-1]
+			continue
+		}
+		m := smirField.FindStringSubmatch(line)
+		if m == nil || cur == nil {
+			continue
+		}
+		switch strings.ToLower(m[1]) {
+		case "lid":
+			cur.LID, _ = strconv.Atoi(m[2])
+		case "guid":
+			cur.GUID = normalizeGUID(m[2])
+		case "priority":
+			cur.Priority, _ = strconv.Atoi(m[2])
+		case "smstate":
+			cur.State = smStates[m[2]]
+			if cur.State == "" {
+				cur.State = m[2]
+			}
+		}
+	}
+	out2 := recs[:0]
+	for _, r := range recs {
+		if r.GUID != "" {
+			out2 = append(out2, r)
+		}
+	}
+	if len(out2) == 0 {
+		return nil, fmt.Errorf("no subnet manager records in saquery output")
+	}
+	return out2, nil
+}
+
+// QuerySMs asks the subnet administrator, through one port, for every subnet
+// manager on the fabric.
+func QuerySMs(ctx context.Context, hca string, port int) ([]SMRecord, error) {
+	bin, err := exec.LookPath("saquery")
+	if err != nil {
+		return nil, ErrNoDiags
+	}
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	out, err := exec.CommandContext(ctx, bin, "-C", hca, "-P", strconv.Itoa(port), "SMIR").CombinedOutput()
+	if err != nil {
+		return nil, fmt.Errorf("saquery on %s/%d: %w: %s", hca, port, err, strings.TrimSpace(string(out)))
+	}
+	return ParseSMIR(string(out))
+}
+
+// ScanFabric maps the fabric a port is on with ibnetdiscover: every switch,
+// adapter and link. It can take a while on a large fabric, so it is bounded,
+// and its output is capped: a fabric of thousands of ports is a few
+// megabytes of text.
+func ScanFabric(ctx context.Context, hca string, port int) (string, error) {
+	bin, err := exec.LookPath("ibnetdiscover")
+	if err != nil {
+		return "", ErrNoDiags
+	}
+	ctx, cancel := context.WithTimeout(ctx, 2*time.Minute)
+	defer cancel()
+	out, err := exec.CommandContext(ctx, bin, "-C", hca, "-P", strconv.Itoa(port)).Output()
+	if err != nil {
+		var ee *exec.ExitError
+		if errors.As(err, &ee) {
+			return "", fmt.Errorf("ibnetdiscover on %s/%d: %w: %s", hca, port, err, strings.TrimSpace(string(ee.Stderr)))
+		}
+		return "", fmt.Errorf("ibnetdiscover on %s/%d: %w", hca, port, err)
+	}
+	const limit = 16 << 20
+	if len(out) > limit {
+		return "", fmt.Errorf("ibnetdiscover printed %d MB, more than the %d MB a scan may send", len(out)>>20, limit>>20)
+	}
+	return string(out), nil
+}

internal/agent/discovery/topo.go

@@ -0,0 +1,191 @@
+package discovery
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+// Topology is what `nvidia-smi topo -m` says about how a node's GPUs and
+// network adapters are wired together.
+//
+// Read from nvidia-smi rather than NVML so the portable, cgo-free binary knows
+// it too. Without it that binary saw no NVLink at all: every GPU reported no
+// peers, and a tensor-parallel group was chosen by index on machines where
+// NVLink decides whether it runs at full speed.
+type Topology struct {
+	// NVLink is, per GPU, the GPUs it reaches over NVLink and how many links
+	// are bonded to each.
+	NVLink map[int]map[int]int
+	// NICPath is, per GPU, how far each network adapter is, by its HCA name:
+	// PIX, PXB, PHB, NODE or SYS, nearest first. A GPU should talk to the
+	// fabric through the adapter nearest it; one across the socket costs a
+	// trip over the processor interconnect on every transfer.
+	NICPath map[int]map[string]string
+	// NUMA is the NUMA node each GPU is attached to, where reported.
+	NUMA map[int]int
+}
+
+// PathRank orders the relations nvidia-smi reports, nearest first. Lower is
+// closer; an unknown relation ranks last.
+func PathRank(rel string) int {
+	switch strings.ToUpper(rel) {
+	case "PIX":
+		return 0
+	case "PXB":
+		return 1
+	case "PHB":
+		return 2
+	case "NODE":
+		return 3
+	case "SYS":
+		return 4
+	}
+	return 5
+}
+
+// DiscoverTopology runs `nvidia-smi topo -m`. A node without nvidia-smi has
+// no topology to report, which is not an error.
+func DiscoverTopology(ctx context.Context, binary string) (Topology, error) {
+	if binary == "" {
+		if _, err := exec.LookPath("nvidia-smi"); err != nil {
+			return Topology{}, nil
+		}
+		binary = "nvidia-smi"
+	}
+	out, err := exec.CommandContext(ctx, binary, "topo", "-m").Output()
+	if err != nil {
+		return Topology{}, fmt.Errorf("running %s topo -m: %w", binary, err)
+	}
+	return parseTopo(string(out))
+}
+
+// ParseTopology reads `nvidia-smi topo -m` output.
+func ParseTopology(out string) (Topology, error) { return parseTopo(out) }
+
+var (
+	ansi       = regexp.MustCompile(`\x1b\[[0-9;]*m`)
+	nvLinks    = regexp.MustCompile(`^NV(\d+)$`)
+	nicLegend  = regexp.MustCompile(`^\s*(NIC\d+)\s*:\s*(\S+)\s*$`)
+	gpuColumn  = regexp.MustCompile(`^GPU(\d+)$`)
+	numaColumn = "NUMA Affinity"
+)
+
+// parseTopo reads the matrix. Columns are tab-separated; the header names
+// each one — GPUn, then the adapters, as NICn with a legend below on newer
+// drivers or by HCA name on older ones — then CPU and NUMA affinity.
+func parseTopo(out string) (Topology, error) {
+	out = ansi.ReplaceAllString(out, "")
+	lines := strings.Split(out, "\n")
+
+	legend := map[string]string{}
+	for _, l := range lines {
+		if m := nicLegend.FindStringSubmatch(l); m != nil {
+			legend[m[1]] = m[2]
+		}
+	}
+
+	var header []string
+	start := -1
+	for i, l := range lines {
+		cells := splitTabs(l)
+		if len(cells) > 1 && cells[0] == "" && gpuColumn.MatchString(cells[1]) {
+			header, start = cells, i
+			break
+		}
+	}
+	if start < 0 {
+		return Topology{}, fmt.Errorf("no GPU matrix in nvidia-smi topo output")
+	}
+
+	t := Topology{NVLink: map[int]map[int]int{}, NICPath: map[int]map[string]string{}, NUMA: map[int]int{}}
+	for _, l := range lines[start+1:] {
+		cells := splitTabs(l)
+		if len(cells) < 2 {
+			// The matrix ends at the first blank line, before the legend.
+			if strings.TrimSpace(l) == "" {
+				break
+			}
+			continue
+		}
+		m := gpuColumn.FindStringSubmatch(cells[0])
+		if m == nil {
+			continue // an adapter's row: its view of the GPUs is the same matrix
+		}
+		gpu, _ := strconv.Atoi(m[1])
+		for c := 1; c < len(cells) && c < len(header); c++ {
+			col, v := header[c], strings.TrimSpace(cells[c])
+			switch {
+			case gpuColumn.MatchString(col):
+				peer, _ := strconv.Atoi(gpuColumn.FindStringSubmatch(col)[1])
+				if n := nvLinks.FindStringSubmatch(v); n != nil && peer != gpu {
+					links, _ := strconv.Atoi(n[1])
+					if t.NVLink[gpu] == nil {
+						t.NVLink[gpu] = map[int]int{}
+					}
+					t.NVLink[gpu][peer] = links
+				}
+			case col == numaColumn:
+				if n, err := strconv.Atoi(v); err == nil {
+					t.NUMA[gpu] = n
+				}
+			case col == "CPU Affinity" || col == "GPU NUMA ID" || col == "":
+			default:
+				// An adapter: NICn named by the legend, or an HCA by name.
+				hca := col
+				if name, ok := legend[col]; ok {
+					hca = name
+				}
+				if PathRank(v) < 5 {
+					if t.NICPath[gpu] == nil {
+						t.NICPath[gpu] = map[string]string{}
+					}
+					t.NICPath[gpu][hca] = strings.ToUpper(v)
+				}
+			}
+		}
+	}
+	if len(t.NVLink) == 0 && len(t.NICPath) == 0 && len(t.NUMA) == 0 {
+		return t, fmt.Errorf("the nvidia-smi topo matrix had no rows")
+	}
+	return t, nil
+}
+
+func splitTabs(l string) []string {
+	l = strings.TrimRight(l, "\r")
+	cells := strings.Split(l, "\t")
+	for i := range cells {
+		cells[i] = strings.TrimSpace(cells[i])
+	}
+	return cells
+}
+
+// Apply puts the topology on the GPUs it describes. What a GPU already knows
+// — NVLink peers from NVML, which is the more exact source — is kept.
+//
+// The matrix is of whole cards. A MIG instance takes its card's NUMA node and
+// adapters, and none of its NVLink: instances cannot reach each other or any
+// other card over it, and peers listed for one would draw a tensor-parallel
+// group onto it.
+func (t Topology) Apply(gpus []GPU) {
+	for i := range gpus {
+		g := &gpus[i]
+		card := g.CardIndex()
+		if len(g.NVLinkPeers) == 0 && !g.IsMIG() {
+			for peer := range t.NVLink[card] {
+				g.NVLinkPeers = append(g.NVLinkPeers, peer)
+			}
+			sort.Ints(g.NVLinkPeers)
+		}
+		if n, ok := t.NUMA[card]; ok {
+			g.NUMANode = n
+		}
+		if paths := t.NICPath[card]; len(paths) > 0 {
+			g.NICPaths = paths
+		}
+	}
+}

internal/agent/discovery/topo_test.go

@@ -0,0 +1,113 @@
+package discovery
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+)
+
+// row joins cells the way nvidia-smi prints them: tab-separated, each padded.
+func row(cells ...string) string { return strings.Join(cells, "\t") }
+
+// dgxH100 is `nvidia-smi topo -m` on an eight-GPU NVSwitch machine with two
+// adapters, as newer drivers print it: NICn columns and a legend naming them.
+var dgxH100 = strings.Join([]string{
+	row("\x1b[4m", "GPU0", "GPU1", "GPU2", "GPU3", "NIC0", "NIC1", "CPU Affinity", "NUMA Affinity", "GPU NUMA ID\x1b[0m"),
+	row("GPU0", " X ", "NV18", "NV18", "NV18", "PXB", "SYS", "0-55,112-167", "0", "N/A"),
+	row("GPU1", "NV18", " X ", "NV18", "NV18", "PXB", "SYS", "0-55,112-167", "0", "N/A"),
+	row("GPU2", "NV18", "NV18", " X ", "NV18", "SYS", "PXB", "56-111,168-223", "1", "N/A"),
+	row("GPU3", "NV18", "NV18", "NV18", " X ", "SYS", "PIX", "56-111,168-223", "1", "N/A"),
+	row("NIC0", "PXB", "PXB", "SYS", "SYS", " X ", "SYS"),
+	row("NIC1", "SYS", "SYS", "PXB", "PIX", "SYS", " X "),
+	"",
+	"Legend:",
+	"",
+	"  X    = Self",
+	"  SYS  = Connection traversing PCIe as well as the SMP interconnect between NUMA nodes (e.g., QPI/UPI)",
+	"  NV#  = Connection traversing a bonded set of # NVLinks",
+	"",
+	"NIC Legend:",
+	"",
+	"  NIC0: mlx5_0",
+	"  NIC1: mlx5_1",
+	"",
+}, "\n")
+
+func TestNVLinkAndAdapterDistanceAreReadFromTopo(t *testing.T) {
+	topo, err := parseTopo(dgxH100)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := topo.NVLink[0]; !reflect.DeepEqual(got, map[int]int{1: 18, 2: 18, 3: 18}) {
+		t.Errorf("GPU0's NVLink peers = %v", got)
+	}
+	// The legend turns NIC1 into the adapter's own name.
+	if got := topo.NICPath[3]; !reflect.DeepEqual(got, map[string]string{"mlx5_0": "SYS", "mlx5_1": "PIX"}) {
+		t.Errorf("GPU3's adapters = %v", got)
+	}
+	if topo.NUMA[2] != 1 || topo.NUMA[0] != 0 {
+		t.Errorf("NUMA = %v", topo.NUMA)
+	}
+
+	gpus := []GPU{{Index: 0}, {Index: 3}}
+	topo.Apply(gpus)
+	if !reflect.DeepEqual(gpus[0].NVLinkPeers, []int{1, 2, 3}) || gpus[1].NUMANode != 1 ||
+		gpus[1].NICPaths["mlx5_1"] != "PIX" {
+		t.Errorf("applied = %+v", gpus)
+	}
+}
+
+func TestOlderDriversNameAdaptersInTheHeader(t *testing.T) {
+	// No legend: the columns are the adapters' own names, and NVLink between
+	// pairs only, as on an A100 PCIe box with bridges.
+	out := strings.Join([]string{
+		row("", "GPU0", "GPU1", "GPU2", "GPU3", "mlx5_0", "CPU Affinity", "NUMA Affinity"),
+		row("GPU0", " X ", "NV12", "SYS", "SYS", "NODE", "0-31", "0"),
+		row("GPU1", "NV12", " X ", "SYS", "SYS", "NODE", "0-31", "0"),
+		row("GPU2", "SYS", "SYS", " X ", "NV12", "SYS", "32-63", "1"),
+		row("GPU3", "SYS", "SYS", "NV12", " X ", "SYS", "32-63", "1"),
+		row("mlx5_0", "NODE", "NODE", "SYS", "SYS", " X "),
+		"",
+	}, "\n")
+	topo, err := parseTopo(out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(topo.NVLink[2], map[int]int{3: 12}) || len(topo.NVLink[0]) != 1 {
+		t.Errorf("NVLink = %v", topo.NVLink)
+	}
+	if topo.NICPath[0]["mlx5_0"] != "NODE" {
+		t.Errorf("adapters = %v", topo.NICPath)
+	}
+}
+
+func TestAPCIeMachineHasNoNVLink(t *testing.T) {
+	out := strings.Join([]string{
+		row("", "GPU0", "GPU1", "CPU Affinity", "NUMA Affinity"),
+		row("GPU0", " X ", "PHB", "0-15", "0"),
+		row("GPU1", "PHB", " X ", "0-15", "0"),
+		"",
+	}, "\n")
+	topo, err := parseTopo(out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(topo.NVLink) != 0 {
+		t.Errorf("NVLink on a PCIe machine: %v", topo.NVLink)
+	}
+}
+
+func TestNVMLPeersAreKeptOverTopo(t *testing.T) {
+	topo, _ := parseTopo(dgxH100)
+	gpus := []GPU{{Index: 0, NVLinkPeers: []int{1}}}
+	topo.Apply(gpus)
+	if !reflect.DeepEqual(gpus[0].NVLinkPeers, []int{1}) {
+		t.Errorf("NVML's answer was replaced: %v", gpus[0].NVLinkPeers)
+	}
+}
+
+func TestSomethingThatIsNotAMatrixIsAnError(t *testing.T) {
+	if _, err := parseTopo("NVIDIA-SMI has failed because it couldn't communicate with the NVIDIA driver."); err == nil {
+		t.Error("expected an error")
+	}
+}

internal/agent/engines/engine.go

@@ -9,6 +9,7 @@
 package engines
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"slices"
@@ -40,6 +41,12 @@ type Profile struct {
 	ModelPath string
 	// ServedModelName is the name clients use, which need not match the path.
 	ServedModelName string
+	// Adapters are LoRA adapters to load beside the model, in order: an
+	// adapter's index is the id requests apply it by.
+	Adapters []Adapter
+	// KVEvents has the engine publish its KV cache events to the agent,
+	// for the router's precise index. vLLM only.
+	KVEvents bool `json:"kv_events,omitempty"`
 }
 
 // ShardSpec is one shard of one replica on this node.
@@ -58,18 +65,48 @@ type ShardSpec struct {
 
 	// GPUIndices are the local GPUs this shard uses.
 	GPUIndices []int
+	// GPUUUIDs name the same devices by UUID, in the same order, and are set
+	// by the agent only when one of them is a MIG instance. An instance has
+	// no index CUDA knows: CUDA_VISIBLE_DEVICES=MIG-<uuid> is the only way to
+	// give a process one, and the indices placement uses for it (1000 and
+	// up) mean nothing to CUDA.
+	GPUUUIDs []string `json:"gpu_uuids,omitempty"`
 	// HCAs are the adapters of the chosen fabric, and only that fabric. A shard
 	// must never be given HCAs from two fabrics.
 	HCAs []string
 	// MgmtInterface is the ethernet interface used for bootstrap traffic.
 	MgmtInterface string
+	// GIDIndex is the RoCE v2 GID index for the HCAs, set by the agent when
+	// they are RoCE; nil on InfiniBand, where NCCL needs none.
+	GIDIndex *int
 
 	HTTPPort int
 	Profile  Profile
+	// BindAddr is the address the engine listens on: the node's management
+	// address, which is what the router reaches it on, set by the agent.
+	// Empty listens on every address.
+	BindAddr string `json:"bind_addr,omitempty"`
+
+	// APIKey is what the engine demands of every request. Engines listen on
+	// the node's management address; without a key anybody who can reach it
+	// talks to the model directly, past the gateway's authentication, quotas
+	// and accounting. Given to the engine in its environment rather than on
+	// its command line, which every user on the node can read.
+	APIKey string `json:"api_key,omitempty"`
+	// KVEventsPort is the loopback port the agent receives this shard's KV
+	// cache events on, chosen by the agent; zero when it publishes none.
+	// Kept with the spec so an agent that restarts listens where the engine
+	// it adopts is still sending.
+	KVEventsPort int `json:"kv_events_port,omitempty"`
+	// Threads is the CPU cores placement reserved for a shard with no GPU,
+	// and so what its engine computes on. Zero leaves it to the engine's own
+	// configuration.
+	Threads int `json:"threads,omitempty"`
 
 	// Pool and Fabric are control plane concepts the agent cannot derive. They
-	// are carried so the agent can report them back after a restart, and are
-	// not used when building a command.
+	// are carried so the agent can report them back after a restart; Fabric
+	// also says, with an "nvl:" prefix, that the replica is inside a
+	// multi-node NVLink domain, which changes NCCL's environment.
 	Pool   string
 	Fabric string
 	// ProfileFP identifies the version of the profile this shard was started
@@ -79,6 +116,14 @@ type ShardSpec struct {
 	ProfileFP string
 }
 
+// Host is where the engine listens.
+func (s ShardSpec) Host() string {
+	if s.BindAddr == "" {
+		return "0.0.0.0"
+	}
+	return s.BindAddr
+}
+
 // Leader reports whether this shard serves HTTP for the replica.
 func (s ShardSpec) Leader() bool { return s.Rank == 0 }
 
@@ -128,6 +173,22 @@ type Engine interface {
 	MetricsPath() string
 }
 
+// CPUFallback is an engine that can come up on the CPU when it was placed on
+// GPUs, and keep serving there without an error. The agent checks such a shard
+// is on its GPUs before calling it ready.
+type CPUFallback interface {
+	FallsBackToCPU() bool
+	// Devices lists the GPUs the engine's build can see, for saying why.
+	Devices(ctx context.Context) ([]string, error)
+}
+
+// HelpCommand is an engine whose program is not asked for its help by
+// running the command's path with --help, because the path is an interpreter
+// starting it through a launcher.
+type HelpCommand interface {
+	HelpCommand(c Command) (path string, args []string)
+}
+
 // GPUInfo is the subset of GPU facts validation needs.
 type GPUInfo struct {
 	Index             int
@@ -147,6 +208,7 @@ func NewRegistry(cfg Config) *Registry {
 	r.Add(&VLLM{cfg: cfg.VLLM})
 	r.Add(&SGLang{cfg: cfg.SGLang})
 	r.Add(&LlamaCpp{cfg: cfg.LlamaCpp})
+	r.Add(&TRTLLM{cfg: cfg.TRTLLM})
 	r.Add(&Sim{cfg: cfg.Sim})
 	return r
 }
@@ -185,14 +247,25 @@ func (r *Registry) Names() []string {
 
 // Config configures the engine adapters.
 type Config struct {
+	// Disabled are engines this node never installs or advertises, whatever
+	// the control plane asks: vLLM on a node of cards no build of it runs on,
+	// that is meant for llama.cpp alone.
+	Disabled []string       `koanf:"disabled"`
 	VLLM     VLLMConfig     `koanf:"vllm"`
 	SGLang   SGLangConfig   `koanf:"sglang"`
 	LlamaCpp LlamaCppConfig `koanf:"llamacpp"`
-	Sim      SimConfig      `koanf:"sim"`
+	// TRTLLM is TensorRT-LLM, which the agent does not install: a node
+	// offers it only when its interpreter is named here.
+	TRTLLM TRTLLMConfig `koanf:"trtllm"`
+	Sim    SimConfig    `koanf:"sim"`
 }
 
 // --- shared helpers ---
 
+// NCCLEnv is the environment a shard with this spec is given, for a tool that
+// shows an operator what an engine would see.
+func NCCLEnv(s ShardSpec) map[string]string { return baseEnv(s) }
+
 // baseEnv builds the environment every engine shares.
 //
 // This is the part of §5.3 the plan marks critical. The rules encoded here:
@@ -209,17 +282,35 @@ type Config struct {
 //     one instead of timing out.
 func baseEnv(s ShardSpec) map[string]string {
 	env := map[string]string{
-		"CUDA_VISIBLE_DEVICES": joinInts(s.GPUIndices),
+		"CUDA_VISIBLE_DEVICES": visibleDevices(s),
+		// The indices above are nvidia-smi's, which counts by PCI bus. CUDA
+		// counts fastest first unless told otherwise, and on a node with two
+		// kinds of GPU the shard would get a different card than placement
+		// gave it — one another shard may hold.
+		"CUDA_DEVICE_ORDER": "PCI_BUS_ID",
 	}
 
 	if len(s.HCAs) > 0 {
 		env["NCCL_IB_HCA"] = strings.Join(s.HCAs, ",")
 		env["NCCL_IB_DISABLE"] = "0"
+		// RoCE: the index of the routable RoCE v2 entry. NCCL's default is a
+		// v1 link-local one on most hosts, and a job on it hangs.
+		if s.GIDIndex != nil {
+			env["NCCL_IB_GID_INDEX"] = strconv.Itoa(*s.GIDIndex)
+		}
 	} else {
 		// Single node, or a node with no fabric. Either way IB is not the path.
 		env["NCCL_IB_DISABLE"] = "1"
 	}
 
+	// Placed inside a multi-node NVLink domain: NCCL is to carry the
+	// replica's collectives over NVLink between its nodes, which it only
+	// does when told to, and needs IMEX for.
+	if s.NNodes > 1 && strings.HasPrefix(s.Fabric, "nvl:") {
+		env["NCCL_MNNVL_ENABLE"] = "1"
+		env["NCCL_CUMEM_ENABLE"] = "1"
+	}
+
 	if s.MgmtInterface != "" {
 		env["NCCL_SOCKET_IFNAME"] = s.MgmtInterface
 		env["GLOO_SOCKET_IFNAME"] = s.MgmtInterface
@@ -228,6 +319,11 @@ func baseEnv(s ShardSpec) map[string]string {
 	// Profile overrides win: they are the escape hatch for the per-cluster
 	// tuning no adapter can guess.
 	for k, v := range s.Profile.Env {
+		// Checked again here, not only where the model was defined: this is
+		// the process about to run as root, whatever sent the profile.
+		if bad, _ := UnsafeEnv(k); bad {
+			continue
+		}
 		env[k] = v
 	}
 	return env
@@ -258,6 +354,21 @@ func materializeEnv(generated map[string]string) []string {
 	return out
 }
 
+// visibleDevices is CUDA_VISIBLE_DEVICES for a shard: the indices placement
+// gave it, or their UUIDs when the agent named them, which it does for a MIG
+// instance.
+func visibleDevices(s ShardSpec) string {
+	if len(s.GPUUUIDs) > 0 {
+		return strings.Join(s.GPUUUIDs, ",")
+	}
+	return joinInts(s.GPUIndices)
+}
+
+// OnMIG reports whether the shard was given a MIG instance.
+func (s ShardSpec) OnMIG() bool {
+	return slices.ContainsFunc(s.GPUUUIDs, func(u string) bool { return strings.HasPrefix(u, "MIG-") })
+}
+
 func joinInts(v []int) string {
 	parts := make([]string, len(v))
 	for i, n := range v {
@@ -336,3 +447,10 @@ func quantizationOf(args []string) string {
 	}
 	return ""
 }
+
+// Adapter is a LoRA adapter an engine loads beside its model. Path is a
+// source until the agent has fetched it, a local file after.
+type Adapter struct {
+	Name string `json:"name"`
+	Path string `json:"path"`
+}

internal/agent/engines/engines_test.go

@@ -3,6 +3,7 @@ package engines
 import (
 	"fmt"
 	"slices"
+	"strconv"
 	"strings"
 	"testing"
 )
@@ -243,14 +244,41 @@ func TestVLLMRayWorkerRunsOnlyRay(t *testing.T) {
 }
 
 func TestVLLMMPMode(t *testing.T) {
+	// vLLM's multi-node launch: every node the same serve with its rank and
+	// the leader's address, workers headless. Workers used to be given the
+	// leader's address as their own VLLM_HOST_IP, and no rank at all.
 	v := &VLLM{cfg: VLLMConfig{LaunchMode: "mp"}}
-	cmd := buildOne(t, v, multiNodeSpec(0))
-	if argValue(cmd.Args, "--distributed-executor-backend") != "mp" {
-		t.Errorf("backend not set: %v", cmd.Args)
+	for _, rank := range []int{0, 1} {
+		cmd := buildOne(t, v, multiNodeSpec(rank))
+		for flag, want := range map[string]string{
+			"--distributed-executor-backend": "mp", "--nnodes": "2",
+			"--node-rank": strconv.Itoa(rank), "--master-addr": "10.0.0.10", "--master-port": "20001",
+		} {
+			if got := argValue(cmd.Args, flag); got != want {
+				t.Errorf("rank %d: %s = %q, want %q (%v)", rank, flag, got, want, cmd.Args)
+			}
+		}
+		if headless := slices.Contains(cmd.Args, "--headless"); headless != (rank > 0) {
+			t.Errorf("rank %d: headless = %v", rank, headless)
+		}
+		if ip, ok := envMap(cmd.Env)["VLLM_HOST_IP"]; ok && ip == "10.0.0.10" && rank > 0 {
+			t.Errorf("a worker was told the leader's address is its own")
+		}
 	}
-	env := envMap(cmd.Env)
-	if env["VLLM_HOST_IP"] != "10.0.0.10" || env["VLLM_PORT"] != "20001" {
-		t.Errorf("dist init not configured: %q %q", env["VLLM_HOST_IP"], env["VLLM_PORT"])
+}
+
+func TestRoCEGetsItsGIDIndex(t *testing.T) {
+	s := multiNodeSpec(0)
+	idx := 3
+	s.GIDIndex = &idx
+	env := envMap(buildOne(t, &VLLM{cfg: VLLMConfig{LaunchMode: "mp"}}, s).Env)
+	if env["NCCL_IB_GID_INDEX"] != "3" {
+		t.Errorf("NCCL_IB_GID_INDEX = %q", env["NCCL_IB_GID_INDEX"])
+	}
+	// InfiniBand needs none, and must not be given one.
+	env = envMap(buildOne(t, &VLLM{cfg: VLLMConfig{LaunchMode: "mp"}}, multiNodeSpec(0)).Env)
+	if _, ok := env["NCCL_IB_GID_INDEX"]; ok {
+		t.Error("an InfiniBand shard was given a GID index")
 	}
 }
 
@@ -295,8 +323,8 @@ func TestSGLangMultiNodeArgs(t *testing.T) {
 	if cmd.Path != "/opt/sglang/bin/python" {
 		t.Errorf("Path=%q", cmd.Path)
 	}
-	if cmd.Args[0] != "-m" || cmd.Args[1] != "sglang.launch_server" {
-		t.Errorf("not launched as a module: %v", cmd.Args[:2])
+	if cmd.Args[0] != "-c" || !strings.Contains(cmd.Args[1], `run_module("sglang.launch_server"`) {
+		t.Errorf("not launched as the module: %v", cmd.Args[:2])
 	}
 	if argValue(cmd.Args, "--nnodes") != "2" || argValue(cmd.Args, "--node-rank") != "1" {
 		t.Errorf("multi-node flags wrong: %v", cmd.Args)
@@ -306,6 +334,58 @@ func TestSGLangMultiNodeArgs(t *testing.T) {
 	}
 }
 
+func TestSGLangsKeyIsNotOnItsCommandLine(t *testing.T) {
+	s := singleNodeSpec()
+	s.APIKey = "k1"
+	cmd := buildOne(t, &SGLang{}, s)
+	if slices.Contains(cmd.Args, "k1") || slices.Contains(cmd.Args, "--api-key") {
+		t.Errorf("the key is in the arguments: %v", cmd.Args)
+	}
+	if !slices.Contains(cmd.Env, sglangKeyEnv+"=k1") {
+		t.Errorf("the key is not in the environment")
+	}
+	// A worker serves no HTTP, and is not given it.
+	w := multiNodeSpec(1)
+	w.APIKey = "k1"
+	if cmd := buildOne(t, &SGLang{}, w); slices.Contains(cmd.Env, sglangKeyEnv+"=k1") {
+		t.Error("a worker was given the key")
+	}
+}
+
+func TestEnginesListenOnTheAddressTheyAreGiven(t *testing.T) {
+	s := singleNodeSpec()
+	for _, e := range []Engine{&VLLM{}, &SGLang{}} {
+		s.BindAddr = ""
+		if got := argValue(buildOne(t, e, s).Args, "--host"); got != "0.0.0.0" {
+			t.Errorf("%s: without an address listens on %q", e.Name(), got)
+		}
+		s.BindAddr = "10.0.0.147"
+		if got := argValue(buildOne(t, e, s).Args, "--host"); got != "10.0.0.147" {
+			t.Errorf("%s: listens on %q, expected the management address", e.Name(), got)
+		}
+	}
+}
+
+func TestSGLangIsStartedServingItsMetrics(t *testing.T) {
+	// Without --enable-metrics SGLang has no /metrics, and every scrape of
+	// the replica fails as though it were unreachable.
+	if cmd := buildOne(t, &SGLang{}, singleNodeSpec()); !slices.Contains(cmd.Args, "--enable-metrics") {
+		t.Errorf("not started with its metrics: %v", cmd.Args)
+	}
+}
+
+func TestSGLangIsAskedForItsHelpThroughItsModule(t *testing.T) {
+	g := &SGLang{cfg: SGLangConfig{Python: "/opt/sglang/bin/python"}}
+	g.UseInstalled("/opt/llmgw/engines/sglang/0.5.21-cu13/bin/python")
+	path, args := g.HelpCommand(Command{})
+	if path != "/opt/llmgw/engines/sglang/0.5.21-cu13/bin/python" {
+		t.Errorf("asked %s, not the interpreter it was installed into", path)
+	}
+	if !slices.Equal(args, []string{"-m", "sglang.launch_server", "--help"}) {
+		t.Errorf("asked %v", args)
+	}
+}
+
 func TestSGLangSingleNodeOmitsMultiNodeFlags(t *testing.T) {
 	cmd := buildOne(t, &SGLang{}, singleNodeSpec())
 	for _, flag := range []string{"--nnodes", "--node-rank", "--dist-init-addr"} {
@@ -397,14 +477,14 @@ func TestValidateRequiresModelPath(t *testing.T) {
 
 func TestRegistry(t *testing.T) {
 	r := NewRegistry(Config{})
-	if got := r.Names(); !slices.Equal(got, []string{"llamacpp", "sglang", "sim", "vllm"}) {
+	if got := r.Names(); !slices.Equal(got, []string{"llamacpp", "sglang", "sim", "trtllm", "vllm"}) {
 		t.Errorf("registry contents: %v", got)
 	}
 	if _, err := r.Get("vllm"); err != nil {
 		t.Errorf("vllm missing: %v", err)
 	}
 	err := func() error { _, err := r.Get("nope"); return err }()
-	if err == nil || !strings.Contains(err.Error(), "llamacpp, sglang, sim, vllm") {
+	if err == nil || !strings.Contains(err.Error(), "llamacpp, sglang, sim, trtllm, vllm") {
 		t.Errorf("an unknown engine should list what is available: %v", err)
 	}
 }
@@ -423,3 +503,28 @@ func TestQuantizationOf(t *testing.T) {
 		t.Errorf("a dangling flag should yield nothing, got %q", got)
 	}
 }
+
+func TestAReplicaInAnNVLinkDomainIsToldToUseIt(t *testing.T) {
+	s := multiNodeSpec(0)
+	s.Fabric = "nvl:76b1ad76-7c24-4b6b-9f6c-2a1e0d8c11aa/7"
+	env := envMap(buildOne(t, &VLLM{cfg: VLLMConfig{LaunchMode: "mp"}}, s).Env)
+	if env["NCCL_MNNVL_ENABLE"] != "1" {
+		t.Errorf("NCCL_MNNVL_ENABLE = %q", env["NCCL_MNNVL_ENABLE"])
+	}
+	if env := envMap(buildOne(t, &VLLM{cfg: VLLMConfig{LaunchMode: "mp"}}, multiNodeSpec(0)).Env); env["NCCL_MNNVL_ENABLE"] != "" {
+		t.Error("a replica on InfiniBand was told to use multi-node NVLink")
+	}
+}
+
+func TestMultiNodeVLLMDefaultsToItsOwnLaunch(t *testing.T) {
+	// mp is what vLLM documents and needs nothing but vLLM; Ray was the
+	// default and was never checked against a real cluster.
+	cmds, err := (&VLLM{}).Commands(multiNodeSpec(1))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(cmds) != 1 || cmds[0].Name != "vllm" || argValue(cmds[0].Args, "--distributed-executor-backend") != "mp" ||
+		!slices.Contains(cmds[0].Args, "--headless") {
+		t.Errorf("default worker = %+v", cmds)
+	}
+}