cwschroeder · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026
diff --git a/.gitignore b/.gitignore
@@ -21,3 +21,6 @@ zig-out/
 
 # Versioned GUI build resources, generated app engines stay ignored in app/.gitignore.
 !app/build/
+# mHC fp64 qualification receipts.
+/receipts/
+*.log
diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/README.md b/README.md
@@ -28,7 +28,7 @@ It needs glibc 2.28 or newer and an NVIDIA driver providing `libcuda.so.1`. Keep
 See the [CUDA runbook](RUNBOOK.md#linux-and-cuda) for runtime libraries and supported GPUs.
 
 ```sh
-V=1.1.0
+V=1.1.1
 case "$(uname -m)" in
   aarch64|arm64) PLATFORM=linux-aarch64 ;;
   x86_64) PLATFORM=linux-x86_64 ;;
@@ -134,6 +134,7 @@ Conversions are explicitly marked: their upstream weights need the linked conver
 | Gemma 4 31B, MLX 4-bit | `tensorfold pull mlx-community/gemma-4-31B-it-4bit@696d436c404745a59f30e4939a658162b0a9e57f`<br>`tensorfold pull z-lab/gemma-4-31B-it-DFlash@eabd648301ce28583cc14757912e5e0f84e152e1` | One M5 Mac; M5 Ultra checked. M1-M4 refused. | [Native 31B](docs/recipes/gemma-4-native.md). Name the drafter with `--drafter`; images with `--vision`. |
 | Gemma 4 12B, converted MLX 4-bit | `hf download google/gemma-4-12B-it --revision 707f0a3b8a3c7ad586ed01e27eafbad8a27dd0f7 --local-dir ~/models/gemma-4-12b-hf`<br>`hf download google/gemma-4-12B-it-assistant --revision 46d4c6f13f0ac0ad827b915669b8df9b81c64c51 --local-dir ~/models/gemma-4-12b-assistant` | One M5 Mac; converted text weights 6.3 GB, image weights 100 MB, plus assistant/caches. M1-M4 refused. | [Convert and serve](docs/recipes/gemma-4-12b-native.md). Upstream download needs `hf`; conversion needs Python, mlx and mlx-lm. Serving is native. |
 | Step-5-Preview, converted affine | `hf download stepfun-ai/Step-5-Preview --local-dir ~/models/step5-preview-fp8` | One 256 GB Mac; text 166.9 GiB, MTP adds 2.5 GiB and vision 3.7 GiB. | [Convert and serve](docs/recipes/step-5-preview.md). The documented 256 GB setup serves converted affine weights; converting the upstream FP8 download needs Python and mlx. |
+| Kolibri-1, block FP8 (research) | `tensorfold pull Aleph-Alpha/Kolibri-1@e52eb4627d11516b0c01de49210ab5a4e4061444` | One NVIDIA GPU; GB10 measured; 74 GB checkpoint. | [Kolibri](docs/recipes/kolibri-1.md). Text only; copy drafts, no EAGLE-3/neural drafter. |
 | Liquid AI d1-3B, decisions | Not documented yet. | Native CUDA; RAM minimum not published. | [API section below](#serve-flags). `/v1/systemone` and `/v1/decisions`. |
 | Fish Audio Drama 3, speech | Not documented yet. | Native Metal or CUDA; GB10 measured. | [Release audio instructions](CHANGELOG.md#110). `/v1/audio/speech`; checkpoint and `codec.pth` required. |
 
@@ -231,6 +232,7 @@ The binary's `capabilities --json` response lists its supported flags and platfo
 | `--speed-up FILE` | Rank and link settings for two-Mac Flash Next or GLM serving. |
 | `--max-tokens N` | Default reply limit, 4096; requests can override it. |
 | `--temperature T` | Sampling temperature; zero requests greedy decoding. |
+| `--prompt-seed` | Use native prompt-derived keys instead of the fresh OS fallback; request and configured default seeds still win. |
 | `--top-p P`, `--top-k K`, `--min-p P` | Sampling defaults. |
 | `--thinking`, `--no-thinking` | Choose whether the chat template opens a reasoning block. |
 | `--reasoning-effort LEVEL` | Default template effort: `low`, `medium`, `high` or `xhigh`. |
@@ -375,7 +377,7 @@ Thank you to everyone who has sent TensorFold a pull request, a measurement or a
 [@johnymoo](https://github.com/johnymoo),
 [@JordiPosthumus](https://github.com/JordiPosthumus),
 [@JRaxworthy](https://github.com/JRaxworthy),
-[@jregan-beasley-smc](https://github.com/jregan-beasley-smc),
+[@jrb-ai](https://github.com/jrb-ai),
 [@jschmied](https://github.com/jschmied),
 [@juliankang4](https://github.com/juliankang4),
 [@kelchm](https://github.com/kelchm),

diff --git a/RELEASE-NOTES-1.0.0.md b/RELEASE-NOTES-1.0.0.md
@@ -120,7 +120,7 @@ Thank you to all 145 public contributors who have sent TensorFold a pull request
 [@johnymoo](https://github.com/johnymoo),
 [@JordiPosthumus](https://github.com/JordiPosthumus),
 [@JRaxworthy](https://github.com/JRaxworthy),
-[@jregan-beasley-smc](https://github.com/jregan-beasley-smc),
+[@jrb-ai](https://github.com/jrb-ai),
 [@jschmied](https://github.com/jschmied),
 [@juliankang4](https://github.com/juliankang4),
 [@kingjamez](https://github.com/kingjamez),

diff --git a/RUNBOOK.md b/RUNBOOK.md
@@ -170,6 +170,20 @@ zone at 94 C or more for most of the prompt (97.7 C at the top); `TF_HEAT_HIGH=9
 at 93.0 C or under, and the first token came 10% later.
 Archives whose names contain `host-only` are CPU verification artifacts and cannot serve CUDA inference.
 
+### GB10 CPU pinning for long CUDA runs
+
+In [#1033](https://github.com/ashhart/TensorFold/issues/1033), @Bizuayeu reports two CPU threads spinning per CUDA rank,
+even between requests, heating the CPU during long reply runs. Pinning each rank to efficiency cores reduced that heat.
+
+Logical CPUs `0-4,10-14` are the Cortex-A725 efficiency cores, confirmed on two GB10 units. Verify the CPU layout (`lscpu -e`) on
+each host. Add `taskset -c 0-4,10-14` before each rank's existing native launch,
+or add `--cpuset-cpus=0-4,10-14` after `docker run` and before the image name in each rank's container launch.
+Keep the existing model, GPU, network and rank options.
+
+On GLM-5.3-Flash NVFP4, version 1.0.12 plus #1016-#1018, TP=2, with heat bands of 92/88 C, @Bizuayeu's pinned run
+completed 40/40 replies, peaking at 85.1 C; the unrestricted run stopped at the seventh reply at 94.7 C.
+Decode throughput fell 1.1% and prefill throughput 2.7%. These are the contributor's measurements, not 1.1.0 results.
+
 ## Flash Next and paired Metal serving
 
 Flash Next reads its MLX 6-bit/group-32 checkpoint directly and creates its native layouts locally.

diff --git a/SECURITY.md b/SECURITY.md
@@ -24,7 +24,32 @@ Only the latest release gets security fixes. The Python 0.6.6 engine at the `v0.
 Out of scope: what a model writes, a model following instructions in text you gave it, and a client sending the server
 more work than its machine can do.
 
+
+## Native HTTP browser boundaries
+
+When API keys are configured, private native HTTP routes require a valid key by default. Only GET root, `/health`, `/slide`, its eight embedded scripts,
+and GET metrics explicitly opened by `--metrics-open` are public exceptions. Public health never resets memory peaks. This policy includes `/systemone` aliases.
+
+A loopback listener refuses a Host outside localhost and loopback IP names, preventing a DNS-rebinding site from
+using its own hostname to read the local API. `--allowed-host NAME` is repeatable and adds an explicit trusted name
+without changing the bind address. Names have no scheme, path or port; bracket IPv6 literals. Classification uses the
+resolved bound address, including mapped loopback addresses, rather than trusting a request header or peer address.
+
+On every listener, a browser Origin must have the same scheme, host and effective port as the request's Host.
+The native listener is HTTP. `--allowed-origin ORIGIN` is repeatable and adds a trusted HTTP or HTTPS origin, such as
+an HTTPS UI behind a TLS proxy. Origins have no path or userinfo. Opaque `null` origins, malformed values and duplicates
+are refused. Both checks run before authentication, body processing and routing, even when a valid API key is supplied.
+Their HTTP 403 replies name Host/Origin and the relevant exception flag.
+
+Clients without Origin keep working with a valid Host, and no Content-Type restriction is introduced.
+The server sends no CORS headers; an origin exception does not grant cross-origin browser reads.
+These browser checks do not replace `--api-key` for network access. See [API headers](docs/api.md#browser-request-headers).
+
 ## Release files
 
 Each release's archives have SHA-256 files beside them on the release page, and Homebrew checks the macOS archive's
 SHA-256. The Mac app is signed and notarized.
+
+Malformed or folded headers and unsupported request targets are refused before routing. Each request on a pooled
+connection is checked afresh. Rejections close before `100 Continue` and unread bodies are not dispatched. Key files
+must be regular files without group or other read/write permission; use `chmod 600`.
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
@@ -26,6 +26,12 @@ Copyright 2026 The Qwen Team and The HuggingFace Inc. team, Apache License 2.0.
 See [the license text](LICENSES/Apache-2.0.txt). The same helpers appear in mlx-vlm's
 `models/qwen4_exp/language.py`, MIT License, Copyright © 2025 Prince Canuma.
 
+The native engine's image and video input for Flash Next follows transformers' `get_rope_index` positions in
+`models/qwen4_exp/modeling_qwen4_exp.py` (`zig/src/families/flashnext/vis_prompt.zig`) and its Qwen3-VL video
+processor and processor in `models/qwen3_vl/` (frame sampling, `smart_resize`, pair times and the prompt layout;
+`zig/src/core/qwen_vl/video.zig`, `zig/src/server/images.zig`). Copyright 2025 and 2026 The Qwen Team and The
+HuggingFace Inc. team, Apache License 2.0; see [the license text](LICENSES/Apache-2.0.txt).
+
 ## GLM-5.3-Flash on Apple Silicon
 
 The native GLM-5.3-Flash engine (`zig/src/families/glm/`) runs the Python `glm5_next` family's decode kernels.
@@ -207,6 +213,13 @@ TensorFold ships no model weights. The `z-lab/Qwen3.8-27B-DFlash2` model card st
 The optional `incoai/GLM-5.3-Flash-DFlash2` model card states CC BY-NC-ND 4.0, for non-commercial use
 without derivatives; only the Python engine reads that drafter. Each checkpoint keeps its own license.
 
+The native `zig/src/families/deepseek_v41/` implementation and `zig/tests/deepseek_v41_reference/`
+follow [DeepSeek-V4.1-Flash's official inference](https://huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash/tree/2cba9e42aa026125f3ed06c6d98c1db82f7ca027/inference),
+MIT License, Copyright (c) 2023 DeepSeek: the reference's equations, the Engram normalization,
+PCG64 multipliers and prime bucket layout, and the pinned chat template come from that revision.
+The EXL3 checkpoint reads through the ExLlamaV3 format covered above; no captured CUDA/Triton
+kernel assets, full model shards or binary traces are bundled.
+
 ## Structured output: libtfgrammar
 
 `lib/libtfgrammar` in the release archives is `zig/src/grammar/tf_grammar.cc` compiled with the C++ sources of
@@ -316,3 +329,29 @@ TensorFold ships no Drama 3 weights and no codec weights. [fishaudio/drama-3](ht
 and its `codec.pth` are under the Fish Audio Community License Agreement v1.0: research and non-commercial use,
 commercial use below its revenue threshold, and no Hosted Service without a separate license from Fish Audio. Users
 obtain the checkpoint and accept that license themselves.
+
+## DeepSeek-V4.1 shared checkpoint forms
+
+The DeepSeek-V4.1 config and checkpoint planning combine @jayleaton’s chain (#727) and
+@akol1’s #825 admission. The reference is DeepSeek AI’s MIT licensed inference at revision
+2cba9e42aa026125f3ed06c6d98c1db82f7ca027, Copyright (c) 2023 DeepSeek.
+EXL3 scanning reuses the common checkpoint scanner and retains its ExLlamaV3 attribution.
+
+The shared Engram host code and token-map builder combine @jayleaton’s #668 and @akol1’s
+#824, #825 and #826. Normalization, PCG64 and bucket metadata follow the pinned DeepSeek MIT reference
+above. nfkd_data.zig is generated Unicode decomposition data from #824; it is kept verbatim.
+
+## DeepSeek-V4.1 CUDA sources
+
+The CUDA sources and loading combine @jayleaton’s #671, #674 and #727 contributions. Source comments retain
+the original TensorFold Python-kernel blob receipts. Generic EXL3 variants extend the one
+common EXL3 operators and their per-slot epilogues; tile decoding is shared.
+The ExLlamaV3 MIT attribution, Copyright (c) 2025 Turboderp, applies as described above.
+No external reference, captured cubin, model shard or CUDA compiler is bundled by this patch.
+
+The tensor-parallel fabric also uses the RoCE design described above (`zig/src/fabric/tp/mailbox.cu`, `roce.zig`, `roce_verbs.zig`).
+
+## Shared EXL3 resolver setup
+
+The shared EXL3 resolver split and CUDA lane option forwarding retain work from PR #728 by @ajensenwaud,
+with the common EXL3 and DeepSeek contributor credits preserved.
diff --git a/app/electron/agent/engine/downloads.ts b/app/electron/agent/engine/downloads.ts
@@ -0,0 +1,85 @@
+import type { EngineEvent, ModelPreflight, PullProgress } from '../types'
+import { assertRepoId, type EngineBinary } from './paths'
+import { isLocalModelId } from './library'
+import { startPull, type PullHandle } from './pull'
+import type { ModelRevisions } from './model-revisions'
+
+export type RunningPull = { handle: PullHandle; last: PullProgress }
+interface DownloadOptions {
+  running: Map<string, RunningPull>
+  revisions: ModelRevisions
+  env: NodeJS.ProcessEnv
+  hub: () => string
+  binary: () => EngineBinary
+  assertIdle: (repo: string) => void
+  cached: (key: string) => ModelPreflight | undefined
+  preflight: (repo: string, revision: string | null) => Promise<ModelPreflight>
+  invalidate: (repo: string) => void
+  invalidateInstalled: () => void
+  refreshInstalled: () => Promise<unknown>
+  emit: (event: EngineEvent) => void
+  pollMs?: number
+}
+
+// Completion becomes visible only after the immutable revision selection is durable.
+export class EngineDownloads {
+  private readonly finished = new Map<string, PullProgress>()
+  private readonly lastPullEmit = new Map<string, number>()
+  constructor(private readonly options: DownloadOptions) {}
+  forget(repo: string): void { this.finished.delete(repo) }
+
+  list(): PullProgress[] {
+    const running = [...this.options.running.values()].map((p) => p.last)
+    return [...running, ...[...this.finished.values()].filter((p) => !this.options.running.has(p.repo))]
+  }
+
+  async pull(repo: string, revision: string | null = null): Promise<PullProgress> {
+    if (isLocalModelId(repo)) throw new Error('Local library checkpoints load in place and cannot be downloaded by their library ID.')
+    if (this.options.running.has(assertRepoId(repo))) return this.options.running.get(repo)!.last
+    await this.options.revisions.read() // Preserve invalid registry bytes and refuse before starting a child.
+    this.options.assertIdle(repo)
+    const pre = this.options.cached(JSON.stringify([repo, revision])) ?? await this.options.preflight(repo, revision)
+    this.options.assertIdle(repo)
+    if (this.options.running.has(repo)) return this.options.running.get(repo)!.last
+    if (!['ok', 'installed'].includes(pre.verdict)) throw new Error(pre.reasons[0] ?? `${repo} cannot be downloaded for the built-in engine.`)
+    if (!pre.resolvedRevision || (pre.drafter && !pre.drafter.resolvedRevision)) throw new Error('Retry the model checks to resolve an immutable checkpoint before downloading.')
+    const steps = [{ repo, revision: pre.resolvedRevision }, ...(pre.drafter ? [{ repo: pre.drafter.repo, revision: pre.drafter.resolvedRevision! }] : [])]
+    this.finished.delete(repo)
+    const handle = startPull({
+      binary: this.options.binary(),
+      env: this.options.env,
+      hub: this.options.hub(),
+      steps,
+      totalBytes: pre.totalBytes,
+      pollMs: this.options.pollMs ? Math.max(50, this.options.pollMs) : 1000,
+      onUpdate: (progress) => this.onPullUpdate(progress),
+    })
+    this.options.running.set(repo, { handle, last: handle.progress() })
+    this.options.emit({ kind: 'pull', pull: handle.progress() })
+    void handle.done.then(async (final) => {
+      if (final.state === 'done') {
+        try { await this.options.revisions.commit(steps) } catch (error) {
+          final = { ...final, state: 'failed', phase: 'Failed', message: (error as Error).message }
+        }
+      }
+      this.options.running.delete(repo)
+      this.finished.set(repo, final)
+      this.options.invalidate(repo)
+      this.options.invalidateInstalled()
+      this.options.emit({ kind: 'pull', pull: final })
+      if (final.state === 'done') await this.options.refreshInstalled().catch(() => {})
+    })
+    return handle.progress()
+  }
+
+  private onPullUpdate(progress: PullProgress): void {
+    if (progress.state !== 'running') return // Completion is emitted only after the selection is durable.
+    const job = this.options.running.get(progress.repo)
+    if (job) job.last = progress
+    const now = Date.now()
+    if (progress.state === 'running' && now - (this.lastPullEmit.get(progress.repo) ?? 0) < 250) return
+    this.lastPullEmit.set(progress.repo, now)
+    this.options.emit({ kind: 'pull', pull: progress })
+  }
+
+}
diff --git a/app/electron/agent/engine/engine-env.ts b/app/electron/agent/engine/engine-env.ts
@@ -0,0 +1,29 @@
+import os from 'node:os'
+import { resolveHubEndpoint } from './hub-network'
+
+const CHILD_ENV_KEYS = ['HOME', 'PATH', 'TMPDIR', 'LANG', 'LC_ALL', 'LC_CTYPE', 'USER', 'LOGNAME', 'SHELL', 'HF_HOME', 'HF_HUB_CACHE', 'HF_HUB_OFFLINE', 'HF_ENDPOINT']
+
+// The engine gets ordinary OS values and the Hugging Face cache settings, never the app's provider keys.
+export function engineChildEnv(base: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = {}
+  for (const key of CHILD_ENV_KEYS) if (typeof base[key] === 'string') env[key] = base[key]
+  if (env.HF_ENDPOINT) env.HF_ENDPOINT = resolveHubEndpoint(env.HF_ENDPOINT)
+  env.HOME = env.HOME || os.homedir()
+  env.PATH = env.PATH || '/usr/bin:/bin:/usr/sbin:/sbin'
+  return env
+}
+
+// A child's view of `base`: the Hub origin that authorized its checks, and no Hub token.
+export function pinnedEngineEnv(base: NodeJS.ProcessEnv, endpoint: string): NodeJS.ProcessEnv {
+  const child = { ...base }
+  delete child.HF_TOKEN
+  child.HF_ENDPOINT = endpoint
+  return Object.freeze(child)
+}
+
+// Snapshot before filtering so Hub checks and native pulls cannot select different origins.
+export function engineLaunchEnv(options: { childEnv?: NodeJS.ProcessEnv; env?: NodeJS.ProcessEnv }) {
+  const source = { ...(options.childEnv ?? options.env ?? process.env) }
+  const endpoint = resolveHubEndpoint(source.HF_ENDPOINT)
+  return { env: pinnedEngineEnv(options.childEnv ? source : engineChildEnv(source), endpoint), endpoint }
+}