fix(ds4): resolve repository imports to GGUF

Select a concrete DeepSeek V4 Flash GGUF from Hugging Face metadata while honoring quantization preference order. Reject unresolved repository imports instead of emitting an invalid bare URI.

Assisted-by: Codex:gpt-5

.agents/backend-signing.md

@@ -16,7 +16,8 @@ side (`pkg/oci/cosignverify` plus the gallery YAML).
   per-arch manifest before checking signatures.
 - **Storage:** Signatures are written as OCI 1.1 referrers
   (`--registry-referrers-mode=oci-1-1`) in the new Sigstore bundle format
-  (`--new-bundle-format`). No `:sha256-<hex>.sig` tag clutter.
+  (current cosign releases do this by default; no `--new-bundle-format`
+  flag). No `:sha256-<hex>.sig` tag clutter.
 - **Consumer:** `pkg/oci/cosignverify` discovers the bundle via the
   referrers API, hands it to `sigstore-go`, and verifies it against the
   policy declared in the gallery YAML (`Gallery.Verification`).
@@ -33,15 +34,14 @@ to sign. The job needs:
 
 - `permissions: { id-token: write, contents: read }` at the job level so
   the runner can exchange its GitHub OIDC token for a Fulcio cert.
-- `sigstore/cosign-installer@v3` step (the pinned cosign v2 release needs
-  `--new-bundle-format` explicitly).
+- `sigstore/cosign-installer@v3` step (current cosign releases already
+  default to the new bundle format).
 - After each `docker buildx imagetools create`, resolve the resulting
   list digest with `docker buildx imagetools inspect <tag> --format
   '{{.Manifest.Digest}}'` and sign:
 
 ```sh
 cosign sign --yes --recursive \
-  --new-bundle-format \
   --registry-referrers-mode=oci-1-1 \
   "${REGISTRY_REPO}@${DIGEST}"
 ```
@@ -70,7 +70,7 @@ entry (`backend/index.yaml`):
   url: github:mudler/LocalAI/backend/index.yaml@master
   verification:
     issuer: "https://token.actions.githubusercontent.com"
-    identity_regex: "^https://github\\.com/mudler/LocalAI/\\.github/workflows/backend_merge\\.yml@refs/(heads/master|tags/.+)$"
+    identity_regex: "^https://github\\.com/mudler/LocalAI/\\.github/workflows/backend_merge\\.yml@refs/heads/master$"
     # Optional revocation cutoff; advance during incident response.
     # not_before: "2026-06-01T00:00:00Z"
 ```

.docker/llama-cpp-build-target.sh

@@ -8,15 +8,8 @@ build_type=${2-}
 # ggml-cpu/arch/x86/repack.cpp at -march=sapphirerapids: the job sits on that one
 # translation unit until GitHub kills it at 6h. gcc builds the same file in
 # seconds, so only the SYCL images have to give up the CPU variant matrix.
-#
-# ROCm runs out of the same 6h budget for a different reason: volume, not a
-# stall. hipcc compiles ggml's HIP kernels once per entry in AMDGPU_TARGETS,
-# which is eleven architectures (gfx908 through gfx1201), and the CPU variant
-# matrix lands on top of that. The job built in 2h27m before it was added and
-# has been killed at exactly 6h00m on every run since, so no ROCm llama-cpp
-# image has been published since 2026-08-01.
 case "$build_type" in
-  sycl*|hipblas*)
+  sycl*)
     echo llama-cpp-fallback
     exit 0
     ;;

.github/workflows/backend_merge.yml

@@ -71,8 +71,8 @@ jobs:
 
       # cosign signs each pushed manifest list with --recursive so the
       # index and every per-arch entry get an attached Sigstore bundle.
-      # The pinned cosign v2 release needs --new-bundle-format explicitly;
-      # the verifier only consumes OCI 1.1 Sigstore bundle referrers.
+      # Recent cosign releases always emit the new bundle format, so
+      # there's no extra CLI flag to opt into it.
       - name: Install cosign
         if: github.event_name != 'pull_request'
         uses: sigstore/cosign-installer@v3
@@ -159,7 +159,6 @@ jobs:
           # manifest before checking signatures need the per-arch
           # signatures, not just the list-level one.
           cosign sign --yes --recursive \
-            --new-bundle-format \
             --registry-referrers-mode=oci-1-1 \
             "quay.io/go-skynet/local-ai-backends@${digest}"
 
@@ -186,7 +185,6 @@ jobs:
           ' <<< "$DOCKER_METADATA_OUTPUT_JSON")
           digest=$(docker buildx imagetools inspect "$first_tag" --format '{{.Manifest.Digest}}')
           cosign sign --yes --recursive \
-            --new-bundle-format \
             --registry-referrers-mode=oci-1-1 \
             "localai/localai-backends@${digest}"
 

backend/cpp/audio-cpp/Makefile

@@ -9,7 +9,7 @@
 # recipe is a make target (not a prepare.sh) so 'make purge && make' is a clean
 # rebuild and so the bump bot can see the pin.
 
-AUDIO_CPP_VERSION?=238ab6a9e321c17de8e120559f57efeedaeb1345
+AUDIO_CPP_VERSION?=5a8312ef7b8aa7cf14e9a24ac568cabd8725d68a
 AUDIO_CPP_REPO?=https://github.com/0xShug0/audio.cpp
 
 CURRENT_MAKEFILE_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))

backend/cpp/ds4/CMakeLists.txt

@@ -69,15 +69,7 @@ target_include_directories(hw_grpc_proto PUBLIC ${CMAKE_CURRENT_BINARY_DIR})
 
 set(DS4_OBJS "${DS4_DIR}/ds4.o")
 if(DS4_GPU STREQUAL "cuda")
-    list(APPEND DS4_OBJS
-        "${DS4_DIR}/ds4_cuda.o"
-        "${DS4_DIR}/cuda/mmq/ds4_ggml_stubs.o"
-        "${DS4_DIR}/cuda/mmq/ds4_mmq.o"
-        "${DS4_DIR}/cuda/mmq/ds4_mmq_d2r.o"
-        "${DS4_DIR}/cuda/mmq/quantize.o"
-        "${DS4_DIR}/cuda/mmq/mmid.o"
-        "${DS4_DIR}/cuda/mmq/mmvq.o"
-        "${DS4_DIR}/cuda/mmq/ds4_repack.o")
+    list(APPEND DS4_OBJS "${DS4_DIR}/ds4_cuda.o")
 elseif(DS4_GPU STREQUAL "metal")
     list(APPEND DS4_OBJS "${DS4_DIR}/ds4_metal.o")
 elseif(DS4_GPU STREQUAL "cpu")

backend/cpp/ds4/Makefile

@@ -1,10 +1,10 @@
 # ds4 backend Makefile.
 #
-# Upstream pin lives below as DS4_VERSION?=6747e7718dd08f00b680d0c16231f2d59ec3747e
+# Upstream pin lives below as DS4_VERSION?=54b36ed9ba42da31b24f2d1a5feb075c2475dbb1
 # (.github/bump_deps.sh) can find and update it - matches the
 # llama-cpp / ik-llama-cpp / turboquant convention.
 
-DS4_VERSION?=6747e7718dd08f00b680d0c16231f2d59ec3747e
+DS4_VERSION?=54b36ed9ba42da31b24f2d1a5feb075c2475dbb1
 DS4_REPO?=https://github.com/antirez/ds4
 
 CURRENT_MAKEFILE_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
@@ -23,9 +23,7 @@ CMAKE_ARGS ?= -DCMAKE_BUILD_TYPE=Release
 # are shared by every GPU mode, so append them unconditionally below.
 ifeq ($(BUILD_TYPE),cublas)
     CMAKE_ARGS += -DDS4_GPU=cuda
-    DS4_OBJ_TARGET := ds4.o ds4_cuda.o ds4_distributed.o ds4_tp.o ds4_ssd.o ds4_layer_pack.o \
-        cuda/mmq/ds4_ggml_stubs.o cuda/mmq/ds4_mmq.o cuda/mmq/ds4_mmq_d2r.o \
-        cuda/mmq/quantize.o cuda/mmq/mmid.o cuda/mmq/mmvq.o cuda/mmq/ds4_repack.o
+    DS4_OBJ_TARGET := ds4.o ds4_cuda.o ds4_distributed.o ds4_tp.o ds4_ssd.o ds4_layer_pack.o
 else ifeq ($(UNAME_S),Darwin)
     CMAKE_ARGS += -DDS4_GPU=metal
     DS4_OBJ_TARGET := ds4.o ds4_metal.o ds4_distributed.o ds4_tp.o ds4_ssd.o ds4_layer_pack.o
@@ -57,7 +55,7 @@ ds4:
 # the right per-platform compile flags (Objective-C/Metal on Darwin, nvcc on Linux+CUDA).
 ds4/ds4.o: ds4
 ifeq ($(BUILD_TYPE),cublas)
-	+$(MAKE) -C ds4 $(DS4_OBJ_TARGET)
+	+$(MAKE) -C ds4 ds4.o ds4_cuda.o ds4_distributed.o ds4_tp.o ds4_ssd.o ds4_layer_pack.o
 else ifeq ($(UNAME_S),Darwin)
 	+$(MAKE) -C ds4 ds4.o ds4_metal.o ds4_distributed.o ds4_tp.o ds4_ssd.o ds4_layer_pack.o
 else

backend/cpp/ik-llama-cpp/Makefile

@@ -1,5 +1,5 @@
 
-IK_LLAMA_VERSION?=6b55d2c7504f482e7c8ec6cbf22a19f3778c522b
+IK_LLAMA_VERSION?=cb9147fd0d9c08a9a84eee5ac405a73f4e10e3e1
 LLAMA_REPO?=https://github.com/ikawrakow/ik_llama.cpp
 
 CMAKE_ARGS?=

backend/go/crispasr/Makefile

@@ -8,7 +8,7 @@ JOBS?=$(shell nproc --ignore=1)
 
 # CrispASR version (release tag)
 CRISPASR_REPO?=https://github.com/CrispStrobe/CrispASR
-CRISPASR_VERSION?=ec730908a418b6032f9e69ded6186d3f042a7747
+CRISPASR_VERSION?=fcb79282a6bc52e13d858026c42b24fb6e63c97a
 SO_TARGET?=libgocrispasr.so
 
 CMAKE_ARGS+=-DBUILD_SHARED_LIBS=OFF

backend/go/stablediffusion-ggml/Makefile

@@ -8,7 +8,7 @@ JOBS?=$(shell nproc --ignore=1)
 
 # stablediffusion.cpp (ggml)
 STABLEDIFFUSION_GGML_REPO?=https://github.com/leejet/stable-diffusion.cpp
-STABLEDIFFUSION_GGML_VERSION?=ea7f0c87cfe4c673263b4c201c596c7f1cbe2528
+STABLEDIFFUSION_GGML_VERSION?=db99efdd6d2a43c7937fd55b3359206c680a75b0
 
 CMAKE_ARGS+=-DGGML_MAX_NAME=128
 

backend/go/vllm-cpp/Makefile

@@ -11,30 +11,7 @@ JOBS?=$(shell nproc --ignore=1 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || e
 
 # vllm.cpp version
 VLLM_CPP_REPO?=https://github.com/mudler/vllm.cpp
-VLLM_CPP_VERSION?=0757cac231ecd571a83c4fd2f50805c9251fc225
-
-# MLX GEMM provider (darwin/metal only; see the metal branch below for why).
-# Consumed as the prebuilt pip wheel: building MLX from source needs `xcrun
-# metal`, i.e. a full Xcode the macOS runners do not have, while the wheel ships
-# include/, lib/libmlx.dylib and the compiled mlx.metallib ready to link.
-#
-# DEFAULT ON, but ONLY because VLLM_CPP_VERSION above is pinned at or past
-# vllm.cpp 89c46aeb, which SHAPE-GATES the provider to prefill. The ordering is
-# load-bearing, not incidental:
-#
-#   pin >= 89c46aeb, MLX on   -> 99.1% of MLX-LM  (gated: prefill only)
-#   pin <  89c46aeb, MLX on   -> ~51%             (ungated: it also takes decode)
-#
-# MLX's steel GEMM wins prefill (537 ms TTFT against 602) and loses decode badly,
-# because the provider pays an mx::eval sync plus an output memcpy per call and
-# decode makes ~112 calls per TOKEN. Ungated it does both; gated it does only the
-# good half. So if this pin is ever moved BACKWARDS, this default must go with it.
-VLLM_CPP_MLX?=on
-MLX_VERSION?=0.29.4
-MLX_VENV?=$(abspath ./mlx-venv)
-# Resolved lazily (recursive `=`, not `:=`): the glob only matches once the venv
-# target has run, and the interpreter version in the path varies per runner.
-MLX_ROOT=$(shell echo $(MLX_VENV)/lib/python*/site-packages/mlx)
+VLLM_CPP_VERSION?=9e1c9025ae61167a3335454d7cc0de6093c21845
 
 # The backend consumes only the stable C ABI (libvllm + include/vllm.h), so the
 # server, examples and tests of the engine are never built here.
@@ -72,23 +49,6 @@ else ifeq ($(BUILD_TYPE),vulkan)
 	CMAKE_ARGS+=-DVLLM_CPP_VULKAN=ON -DVLLM_CPP_CUDA=OFF
 else ifeq ($(BUILD_TYPE),metal)
 	CMAKE_ARGS+=-DVLLM_CPP_METAL=ON
-	# The optional MLX GEMM provider. vllm.cpp keeps it OFF by default because it
-	# is a ~19 MB libmlx.dylib plus a ~105 MB mlx.metallib, and upstream's
-	# position is that it must earn that cost by measurement. It does, on the
-	# only hardware this build targets: measured on an Apple M4 against the
-	# native MSL GEMM in the SAME binary (arms toggled by
-	# VT_OP_PROVIDER_DISABLE=mlx), Qwen3-1.7B-bf16 p=512 g=128, it is 1.5x to
-	# 2.2x aggregate throughput and 2x to 3x faster TTFT, at equal peak memory
-	# and bit-identical output on every parity shape. See vllm.cpp
-	# docs/BENCHMARKS.md "MLX GEMM provider A/B on Apple M4".
-	#
-	# MLX delegates the dense GEMM ONLY: kPagedAttention stays vllm.cpp's own
-	# kernel, because MLX has no paged-KV primitive at all.
-	#
-	# Set VLLM_CPP_MLX=off for a Metal build without it (smaller image, slower).
-	ifeq ($(VLLM_CPP_MLX),on)
-		MLX_ENABLED=1
-	endif
 else
 	CMAKE_ARGS+=-DVLLM_CPP_CUDA=OFF
 endif
@@ -108,35 +68,10 @@ sources/vllm.cpp:
 	git fetch --depth 1 origin $(VLLM_CPP_VERSION) && \
 	git checkout FETCH_HEAD
 
-ifeq ($(MLX_ENABLED),1)
-# A stamp FILE, not a phony target: a phony prerequisite is always "newer" than
-# $(LIB) and would re-link libvllm on every invocation. Keyed on the version so
-# a MLX_VERSION bump reinstalls instead of silently reusing the old wheel.
-MLX_STAMP=$(MLX_VENV)/.mlx-$(MLX_VERSION).stamp
-MLX_CMAKE_ARGS=-DVLLM_CPP_MLX=ON -DMLX_ROOT=$(MLX_ROOT)
-
-$(MLX_STAMP):
-	@if [ ! -x "$(MLX_VENV)/bin/pip" ]; then \
-		python3 -m venv "$(MLX_VENV)" || { echo "vllm-cpp: python3 with venv is required to build the MLX provider; pass VLLM_CPP_MLX=off to build Metal without it" >&2; exit 1; }; \
-	fi
-	"$(MLX_VENV)"/bin/pip install --quiet --disable-pip-version-check "mlx==$(MLX_VERSION)"
-	@# Resolved in the SHELL, not by $(MLX_ROOT): make expands a whole recipe
-	@# before running its first line, so the glob would still be unmatched here.
-	@# Every later use (the cmake args, package.sh) expands after this target has
-	@# completed, where $(MLX_ROOT) does resolve.
-	@root=$$(echo "$(MLX_VENV)"/lib/python*/site-packages/mlx); \
-	test -f "$$root/lib/libmlx.dylib" -a -f "$$root/include/mlx/array.h" || \
-		{ echo "vllm-cpp: mlx==$(MLX_VERSION) did not provide lib/libmlx.dylib + include/mlx/array.h under $$root" >&2; exit 1; }
-	touch $@
-else
-MLX_STAMP=
-MLX_CMAKE_ARGS=
-endif
-
-$(LIB): sources/vllm.cpp $(MLX_STAMP)
+$(LIB): sources/vllm.cpp
 	mkdir -p build && \
 	cd build && \
-	cmake ../sources/vllm.cpp $(CMAKE_ARGS) $(MLX_CMAKE_ARGS) && \
+	cmake ../sources/vllm.cpp $(CMAKE_ARGS) && \
 	cmake --build . --config Release -j$(JOBS) --target vllm_shared
 	cp -fL build/$(LIB) ./$(LIB)
 
@@ -144,12 +79,12 @@ vllm-cpp: main.go govllmcpp.go backend.go options.go $(LIB)
 	CGO_ENABLED=0 $(GOCMD) build -tags "$(GO_TAGS)" -o vllm-cpp ./
 
 package: vllm-cpp
-	MLX_ROOT="$(MLX_ROOT)" bash package.sh
+	bash package.sh
 
 build: package
 
 clean: purge
-	rm -rf libvllm.so libvllm.dylib package sources/vllm.cpp vllm-cpp "$(MLX_VENV)"
+	rm -rf libvllm.so libvllm.dylib package sources/vllm.cpp vllm-cpp
 
 purge:
 	rm -rf build

backend/go/vllm-cpp/README.md

@@ -41,50 +41,5 @@ options:
 - max_num_seqs:16
 ```
 
-## Apple Silicon: the MLX GEMM provider (ON by default, gated to prefill)
-
-`BUILD_TYPE=metal` builds vllm.cpp's MLX provider for the dense GEMM
-(`VLLM_CPP_MLX=on`, the default here). It is on because upstream now SHAPE-GATES
-it to prefill; it was briefly off in this branch's history, and that was correct
-at the time for an ungated provider.
-
-The gate matters more than the flag. MLX's steel GEMM wins prefill but loses
-decode, because the provider pays an `mx::eval` synchronisation plus an output
-memcpy on every call and decode makes ~112 calls *per token*. Measured on an
-Apple M4, Qwen3-1.7B-bf16 warm at p=512 g=128:
-
-| configuration | prefill TTFT | warm throughput |
-|---|--:|--:|
-| MLX **gated to prefill** (pin >= 89c46aeb) | **524.5 ms** | **24.37 tok/s, 97.6% of MLX-LM** |
-| MLX ungated (older pins) | 537 ms | 12.7 tok/s |
-| MLX off | 602 ms | 23.9 tok/s, 95.9% |
-
-Ratios are against an MLX-LM baseline measured INTERLEAVED with ours over four
-ABBA blocks (its spread 0.34%, ours 0.12%). An earlier revision of this file
-claimed 99.1%; that used a two-run MLX-LM baseline containing an outlier and
-overstated us by about 1.5 points.
-
-**`VLLM_CPP_VERSION` and this flag are coupled.** Moving the pin back before
-`89c46aeb` while leaving `VLLM_CPP_MLX=on` would take the middle row — roughly
-half throughput. If you roll the pin back, roll the default back with it.
-
-One caveat: MLX's GEMM is not bit-identical to the native kernel, so an MLX build
-produces a different greedy sequence than a non-MLX one. That is a property of the
-provider, not of the gate, and it predates this packaging. Full disposition in
-vllm.cpp `docs/BENCHMARKS.md`.
-
-Build knobs:
-
-- `VLLM_CPP_MLX=off` builds Metal without the provider: ~124 MB smaller, and
-  96.4% of MLX-LM instead of 99.1%.
-- `MLX_VERSION` pins the wheel (default `0.29.4`). MLX is consumed as the
-  prebuilt pip wheel because building it from source needs `xcrun metal`, i.e. a
-  full Xcode the macOS runners do not have.
-
-Packaging vendors `libmlx.dylib`, `mlx.metallib` and MLX's MIT license into
-`package/lib/`, and rewrites `libvllm.dylib`'s rpath to `@loader_path/lib`
-(re-signing it, since `install_name_tool` invalidates the signature). The
-metallib must stay beside `libmlx.dylib`: MLX looks for it there.
-
 Testing: `make test` runs the unit specs; export `VLLM_CPP_MODEL=<model>` (and
 optionally `VLLM_CPP_LIBRARY=<libvllm path>`) to enable the e2e specs.

backend/go/vllm-cpp/package.sh

@@ -43,50 +43,6 @@ elif [ -f "/lib/ld-linux-aarch64.so.1" ]; then
     cp -arfLv /lib/aarch64-linux-gnu/libpthread.so.0 $CURDIR/package/lib/libpthread.so.0
 elif [ $(uname -s) = "Darwin" ]; then
     echo "Detected Darwin"
-    # Vendor the optional MLX GEMM provider, when libvllm was built against it.
-    # Three facts drive every line below, each verified on an Apple M4 before it
-    # was written:
-    #   1. libvllm.dylib carries an LC_LOAD_DYLIB on @rpath/libmlx.dylib, and its
-    #      build-time LC_RPATH points inside the build venv. That path does not
-    #      exist on a user's machine, so it must become @loader_path/lib.
-    #   2. MLX finds its ~100 MB mlx.metallib beside its OWN dylib, so the two
-    #      files have to land in the same directory or every Metal op dies with
-    #      "Failed to load the default metallib".
-    #   3. install_name_tool invalidates the code signature, and macOS refuses to
-    #      load an arm64 image whose signature does not match, so the patched
-    #      library must be re-signed ad-hoc afterwards.
-    if otool -L "$CURDIR/package/libvllm.dylib" 2>/dev/null | grep -q "libmlx.dylib"; then
-        MLX_LIB_DIR="${MLX_ROOT}/lib"
-        if [ ! -f "$MLX_LIB_DIR/libmlx.dylib" ] || [ ! -f "$MLX_LIB_DIR/mlx.metallib" ]; then
-            echo "Error: libvllm.dylib links libmlx.dylib but $MLX_LIB_DIR is missing libmlx.dylib/mlx.metallib" >&2
-            exit 1
-        fi
-        echo "Vendoring the MLX GEMM provider from $MLX_LIB_DIR"
-        cp -fLv "$MLX_LIB_DIR/libmlx.dylib" "$CURDIR/package/lib/"
-        cp -fLv "$MLX_LIB_DIR/mlx.metallib" "$CURDIR/package/lib/"
-        # MLX is MIT and we redistribute its binaries, so its license ships with
-        # them. mlx-metal is the wheel carrying the dylib and the metallib.
-        MLX_LICENSE=$(ls "${MLX_ROOT}"/../mlx_metal-*.dist-info/licenses/LICENSE 2>/dev/null | head -1)
-        if [ -z "$MLX_LICENSE" ]; then
-            MLX_LICENSE=$(ls "${MLX_ROOT}"/../mlx-*.dist-info/licenses/LICENSE 2>/dev/null | head -1)
-        fi
-        if [ -z "$MLX_LICENSE" ]; then
-            echo "Error: could not find the MLX LICENSE to redistribute alongside libmlx.dylib" >&2
-            exit 1
-        fi
-        cp -fLv "$MLX_LICENSE" "$CURDIR/package/lib/LICENSE.mlx"
-        # Drop every build-tree rpath, then point at the packaged copy.
-        otool -l "$CURDIR/package/libvllm.dylib" | awk '/LC_RPATH/{f=1;next} f&&/ path /{print $2;f=0}' | while read -r rp; do
-            install_name_tool -delete_rpath "$rp" "$CURDIR/package/libvllm.dylib" 2>/dev/null || true
-        done
-        install_name_tool -add_rpath "@loader_path/lib" "$CURDIR/package/libvllm.dylib"
-        codesign -f -s - "$CURDIR/package/libvllm.dylib"
-        # A broken rpath must fail the BUILD, not the user's first inference.
-        if ! otool -l "$CURDIR/package/libvllm.dylib" | grep -q "@loader_path/lib"; then
-            echo "Error: libvllm.dylib did not get the @loader_path/lib rpath" >&2
-            exit 1
-        fi
-    fi
 else
     echo "Error: Could not detect architecture"
     exit 1

backend/go/whisper/Makefile

@@ -8,7 +8,7 @@ JOBS?=$(shell nproc --ignore=1)
 
 # whisper.cpp version
 WHISPER_REPO?=https://github.com/ggml-org/whisper.cpp
-WHISPER_CPP_VERSION?=306c88f4d1286aec1bf96e544632897886af5501
+WHISPER_CPP_VERSION?=2ca53bb45e38748d07b310eeb36245a7157ac882
 SO_TARGET?=libgowhisper.so
 
 CMAKE_ARGS+=-DBUILD_SHARED_LIBS=OFF

backend/index.yaml

@@ -193,22 +193,12 @@
   alias: "vllm-cpp"
   license: apache-2.0
   description: |
-    ALPHA development builds. Try it, but llama-cpp stays the recommendation for
-    production use.
-
-    vllm.cpp is an Apache-2.0 C++20 inference engine maintained by the LocalAI team,
-    developed in its own repository and usable without LocalAI. It began as a port of
-    vLLM and keeps vLLM as its reference implementation, checking output against it and
-    benchmarking against it, while growing a featureset of its own. It implements vLLM's
-    V1 architecture (paged KV cache, continuous batching, prefix caching, scheduler,
-    sampler) on a portable tensor runtime with no Python, PyTorch or ggml at inference
-    time. It loads GGUF as well as Hugging Face safetensors, supports structured output
-    (JSON schema / regex / choice / GBNF grammar) enforced in-engine, ships speculative
-    decoding and KV offload, and runs on CPU, NVIDIA CUDA (Blackwell-family), Apple
-    Metal and Vulkan.
-
-    The project is expected to be renamed as it diverges further from vLLM; the new
-    name is still to be decided.
+    vllm.cpp is a from-scratch C++20 port of vLLM created and maintained by the LocalAI team.
+    It mirrors vLLM's V1 architecture (paged KV cache, continuous batching, prefix caching,
+    scheduler, sampler) on a portable tensor runtime with no Python, PyTorch or ggml at
+    inference time. It loads Hugging Face safetensors and GGUF checkpoints, supports
+    structured output (JSON schema / regex / choice / GBNF grammar) enforced in-engine,
+    and runs on CPU, NVIDIA CUDA (Blackwell-family), Apple Metal and Vulkan.
   urls:
     - https://github.com/mudler/vllm.cpp
   tags:

core/gallery/importers/ds4.go

@@ -2,6 +2,7 @@ package importers
 
 import (
 	"encoding/json"
+	"fmt"
 	"path/filepath"
 	"strings"
 
@@ -10,6 +11,7 @@ import (
 	"github.com/mudler/LocalAI/core/schema"
 	"github.com/mudler/LocalAI/pkg/downloader"
 	"github.com/mudler/LocalAI/pkg/functions"
+	hfapi "github.com/mudler/LocalAI/pkg/huggingface-api"
 	"go.yaml.in/yaml/v2"
 )
 
@@ -115,7 +117,48 @@ func (i *DS4Importer) Import(details Details) (gallery.ModelConfig, error) {
 	// filename to "ds4flash.gguf" to match ds4's own convention (its CLI
 	// defaults to that path), so users can run the model without extra
 	// config.
-	uri := downloader.URI(details.URI)
+	selectedURI := details.URI
+	uriFilename, _ := downloader.URI(details.URI).FilenameFromUrl()
+	if !strings.HasSuffix(strings.ToLower(uriFilename), ".gguf") {
+		if details.HuggingFace == nil {
+			return gallery.ModelConfig{}, fmt.Errorf("cannot select a compatible GGUF from repository %q without HuggingFace file metadata", details.URI)
+		}
+
+		quantizations, _ := preferencesMap["quantizations"].(string)
+		var compatible []hfapi.ModelFile
+		for _, file := range details.HuggingFace.Files {
+			base := strings.ToLower(filepath.Base(file.Path))
+			if strings.HasPrefix(base, "deepseek-v4-flash-") && strings.HasSuffix(base, ".gguf") {
+				compatible = append(compatible, file)
+			}
+		}
+		if len(compatible) == 0 {
+			return gallery.ModelConfig{}, fmt.Errorf("no compatible GGUF found in repository %q", details.URI)
+		}
+
+		selected := compatible[0].URL
+		if quantizations != "" {
+			selected = compatible[len(compatible)-1].URL
+			matched := false
+			for _, quantization := range strings.Split(quantizations, ",") {
+				quantization = strings.ToLower(strings.TrimSpace(quantization))
+				for _, file := range compatible {
+					base := strings.ToLower(filepath.Base(file.Path))
+					if quantTokenMatches(base, quantization) {
+						selected = file.URL
+						matched = true
+						break
+					}
+				}
+				if matched {
+					break
+				}
+			}
+		}
+		selectedURI = selected
+	}
+
+	uri := downloader.URI(selectedURI)
 	cfg.Files = append(cfg.Files, gallery.File{
 		Filename: "ds4flash.gguf",
 		URI:      string(uri),

core/gallery/importers/ds4_test.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 
 	. "github.com/mudler/LocalAI/core/gallery/importers"
+	hfapi "github.com/mudler/LocalAI/pkg/huggingface-api"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 )
@@ -65,5 +66,71 @@ var _ = Describe("DS4Importer", func() {
 				"ConfigFile must specify backend: ds4, got: %s", cfg.ConfigFile)
 			Expect(strings.Contains(cfg.ConfigFile, "use_tokenizer_template: true")).To(BeTrue())
 		})
+
+		It("preserves an explicit GGUF URI with a query string", func() {
+			uri := "https://huggingface.co/antirez/deepseek-v4-gguf/resolve/main/DeepSeek-V4-Flash-UD-IQ3_XXS.gguf?download=true"
+
+			cfg, err := importer.Import(Details{URI: uri})
+
+			Expect(err).NotTo(HaveOccurred())
+			Expect(cfg.Files).To(HaveLen(1))
+			Expect(cfg.Files[0].URI).To(Equal(uri))
+		})
+
+		It("selects the highest-priority requested quantization from a repository", func() {
+			details := Details{
+				URI:         "huggingface://antirez/deepseek-v4-gguf",
+				Preferences: json.RawMessage(`{"quantizations":"UD-IQ3_XXS,IQ2_XXS"}`),
+				HuggingFace: &hfapi.ModelDetails{Files: []hfapi.ModelFile{
+					{Path: "DeepSeek-V4-Flash-IQ2_XXS.gguf", URL: "https://huggingface.co/antirez/deepseek-v4-gguf/resolve/main/DeepSeek-V4-Flash-IQ2_XXS.gguf"},
+					{Path: "DeepSeek-V4-Flash-UD-IQ3_XXS.gguf", URL: "https://huggingface.co/antirez/deepseek-v4-gguf/resolve/main/DeepSeek-V4-Flash-UD-IQ3_XXS.gguf"},
+				}},
+			}
+
+			cfg, err := importer.Import(details)
+
+			Expect(err).NotTo(HaveOccurred())
+			Expect(cfg.Files).To(HaveLen(1))
+			Expect(cfg.Files[0].URI).To(Equal("https://huggingface.co/antirez/deepseek-v4-gguf/resolve/main/DeepSeek-V4-Flash-UD-IQ3_XXS.gguf"))
+		})
+
+		It("falls back to the last compatible GGUF when requested quantizations do not match", func() {
+			details := Details{
+				URI:         "huggingface://antirez/deepseek-v4-gguf",
+				Preferences: json.RawMessage(`{"quantizations":"F16"}`),
+				HuggingFace: &hfapi.ModelDetails{Files: []hfapi.ModelFile{
+					{Path: "DeepSeek-V4-Flash-BF16.gguf", URL: "https://huggingface.co/antirez/deepseek-v4-gguf/resolve/main/DeepSeek-V4-Flash-BF16.gguf"},
+					{Path: "README.md", URL: "https://huggingface.co/antirez/deepseek-v4-gguf/resolve/main/README.md"},
+					{Path: "DeepSeek-V4-Flash-Q8_0.gguf", URL: "https://huggingface.co/antirez/deepseek-v4-gguf/resolve/main/DeepSeek-V4-Flash-Q8_0.gguf"},
+				}},
+			}
+
+			cfg, err := importer.Import(details)
+
+			Expect(err).NotTo(HaveOccurred())
+			Expect(cfg.Files).To(HaveLen(1))
+			Expect(cfg.Files[0].URI).To(Equal("https://huggingface.co/antirez/deepseek-v4-gguf/resolve/main/DeepSeek-V4-Flash-Q8_0.gguf"))
+		})
+
+		It("rejects a repository URI when no HuggingFace file metadata is available", func() {
+			_, err := importer.Import(Details{URI: "huggingface://antirez/deepseek-v4-gguf"})
+
+			Expect(err).To(MatchError(ContainSubstring("compatible GGUF")))
+		})
+
+		It("rejects repository metadata without a compatible GGUF", func() {
+			details := Details{
+				URI: "huggingface://antirez/deepseek-v4-gguf",
+				HuggingFace: &hfapi.ModelDetails{Files: []hfapi.ModelFile{
+					{Path: "README.md", URL: "https://huggingface.co/antirez/deepseek-v4-gguf/resolve/main/README.md"},
+					{Path: "unrelated.gguf", URL: "https://huggingface.co/antirez/deepseek-v4-gguf/resolve/main/unrelated.gguf"},
+				}},
+			}
+
+			cfg, err := importer.Import(details)
+
+			Expect(err).To(MatchError(ContainSubstring("compatible GGUF")))
+			Expect(cfg.Files).To(BeEmpty())
+		})
 	})
 })

core/http/middleware/trace.go

@@ -60,7 +60,6 @@ type APIExchange struct {
 }
 
 var traceBuffer *circularbuffer.Queue[APIExchange]
-var inFlightTraces = make(map[string]APIExchange)
 var mu sync.Mutex
 var logChan = make(chan traceCommand, 100)
 var traceIDSeq atomic.Uint64
@@ -127,17 +126,16 @@ func initializeTracing(dataPath string, maxItems int) {
 					continue
 				}
 				exchange := *command.exchange
-				mu.Lock()
-				delete(inFlightTraces, exchange.ID)
-				if traceBuffer != nil {
-					traceBuffer.Enqueue(exchange)
-				}
-				mu.Unlock()
 				if command.store != nil {
 					if err := command.store.Append(exchange.ID, exchange); err != nil {
 						xlog.Warn("Failed to persist API trace", "error", err)
 					}
 				}
+				mu.Lock()
+				if traceBuffer != nil {
+					traceBuffer.Enqueue(exchange)
+				}
+				mu.Unlock()
 			}
 		}()
 	})
@@ -263,38 +261,6 @@ func TraceMiddleware(app *application.Application) echo.MiddlewareFunc {
 			// tens of MB, which then locks the admin Traces UI fetching the
 			// JSON dump faster than the 5s auto-refresh.
 			maxBodyBytes := app.ApplicationConfig().TracingMaxBodyBytes
-			requestHeaders := redactSensitiveHeaders(c.Request().Header)
-			requestBody, requestTruncated := truncateForTrace(body, maxBodyBytes)
-			exchange := APIExchange{
-				ID:        nextTraceID(),
-				Timestamp: startTime,
-				ClientIP:  c.RealIP(),
-				UserAgent: c.Request().UserAgent(),
-				Request: APIExchangeRequest{
-					Method:        c.Request().Method,
-					Path:          c.Path(),
-					Headers:       &requestHeaders,
-					Body:          &requestBody,
-					BodyTruncated: requestTruncated,
-					BodyBytes:     len(body),
-				},
-			}
-			if user := auth.GetUser(c); user != nil {
-				exchange.UserID = user.ID
-				exchange.UserName = user.Name
-			}
-			mu.Lock()
-			inFlightTraces[exchange.ID] = exchange
-			mu.Unlock()
-			queued := false
-			defer func() {
-				if queued {
-					return
-				}
-				mu.Lock()
-				delete(inFlightTraces, exchange.ID)
-				mu.Unlock()
-			}()
 
 			// Wrap response writer to capture body
 			resBody := new(bytes.Buffer)
@@ -321,27 +287,47 @@ func TraceMiddleware(app *application.Application) echo.MiddlewareFunc {
 			// the trace endpoint is admin-only but the buffer is also reachable
 			// via any heap-dump-style introspection, and tokens shouldn't
 			// outlive the request that carried them.
+			requestHeaders := redactSensitiveHeaders(c.Request().Header)
+			requestBody, requestTruncated := truncateForTrace(body, maxBodyBytes)
 			responseHeaders := redactSensitiveHeaders(c.Response().Header())
 			responseBody := make([]byte, resBody.Len())
 			copy(responseBody, resBody.Bytes())
-			exchange.Duration = time.Since(startTime)
-			exchange.Response = APIExchangeResponse{
-				Status:        status,
-				Headers:       &responseHeaders,
-				Body:          &responseBody,
-				BodyTruncated: mw.truncated,
-				BodyBytes:     mw.totalBytes,
+			exchange := APIExchange{
+				ID:        nextTraceID(),
+				Timestamp: startTime,
+				Duration:  time.Since(startTime),
+				ClientIP:  c.RealIP(),
+				UserAgent: c.Request().UserAgent(),
+				Request: APIExchangeRequest{
+					Method:        c.Request().Method,
+					Path:          c.Path(),
+					Headers:       &requestHeaders,
+					Body:          &requestBody,
+					BodyTruncated: requestTruncated,
+					BodyBytes:     len(body),
+				},
+				Response: APIExchangeResponse{
+					Status:        status,
+					Headers:       &responseHeaders,
+					Body:          &responseBody,
+					BodyTruncated: mw.truncated,
+					BodyBytes:     mw.totalBytes,
+				},
 			}
 			if handlerErr != nil {
 				exchange.Error = handlerErr.Error()
 			}
 
+			if user := auth.GetUser(c); user != nil {
+				exchange.UserID = user.ID
+				exchange.UserName = user.Name
+			}
+
 			mu.Lock()
 			store := traceStore
 			mu.Unlock()
 			select {
 			case logChan <- traceCommand{exchange: &exchange, store: store}:
-				queued = true
 			default:
 				xlog.Warn("Trace channel full, dropping trace")
 			}
@@ -359,10 +345,6 @@ func GetTraces() []APIExchange {
 		return []APIExchange{}
 	}
 	traces := traceBuffer.Values()
-	for _, exchange := range inFlightTraces {
-		exchange.Duration = time.Since(exchange.Timestamp)
-		traces = append(traces, exchange)
-	}
 	mu.Unlock()
 
 	slices.SortFunc(traces, func(a, b APIExchange) int {

core/http/middleware/trace_live_test.go

@@ -1,108 +0,0 @@
-// SPDX-License-Identifier: MIT
-
-package middleware
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"time"
-
-	"github.com/labstack/echo/v4"
-	"github.com/mudler/LocalAI/core/application"
-	"github.com/mudler/LocalAI/core/config"
-	"github.com/mudler/LocalAI/pkg/system"
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-)
-
-var _ = Describe("live API traces", func() {
-	newApp := func(root string) *application.Application {
-		app, err := application.New(
-			config.EnableTracing,
-			config.WithDataPath(root),
-			config.WithDisableLocalAIAssistant(true),
-			config.WithDisableStats(true),
-			config.WithSystemState(&system.SystemState{
-				Model:   system.Model{ModelsPath: root},
-				Backend: system.Backend{BackendsPath: root},
-			}),
-		)
-		Expect(err).NotTo(HaveOccurred())
-		DeferCleanup(func() { Expect(app.Shutdown()).To(Succeed()) })
-		ClearTraces()
-		return app
-	}
-
-	It("lists a request while its handler is still running", func() {
-		root := GinkgoT().TempDir()
-		app := newApp(root)
-
-		started := make(chan struct{})
-		release := make(chan struct{})
-		DeferCleanup(func() {
-			select {
-			case <-release:
-			default:
-				close(release)
-			}
-		})
-		handler := TraceMiddleware(app)(func(c echo.Context) error {
-			close(started)
-			<-release
-			return c.NoContent(http.StatusNoContent)
-		})
-
-		e := echo.New()
-		req := httptest.NewRequest(http.MethodPost, "/slow", http.NoBody)
-		req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
-		rec := httptest.NewRecorder()
-		ctx := e.NewContext(req, rec)
-		ctx.SetPath("/slow")
-		done := make(chan error, 1)
-		go func() {
-			done <- handler(ctx)
-		}()
-		<-started
-
-		var running APIExchange
-		Eventually(func() bool {
-			traces := GetTraces()
-			if len(traces) != 1 {
-				return false
-			}
-			running = traces[0]
-			return running.Request.Path == "/slow"
-		}).Should(BeTrue())
-		Expect(running.Response.Status).To(Equal(0))
-		Expect(running.Duration).To(BeNumerically(">", 0))
-
-		close(release)
-		Expect(<-done).To(Succeed())
-		Eventually(func() []APIExchange { return GetTraces() }).Should(ConsistOf(
-			And(
-				HaveField("ID", running.ID),
-				HaveField("Response.Status", http.StatusNoContent),
-				HaveField("Duration", BeNumerically(">", time.Duration(0))),
-			),
-		))
-	})
-
-	It("removes an in-flight trace when the handler panics", func() {
-		app := newApp(GinkgoT().TempDir())
-		handler := TraceMiddleware(app)(func(echo.Context) error {
-			panic("handler panic")
-		})
-		e := echo.New()
-		req := httptest.NewRequest(http.MethodPost, "/panic", http.NoBody)
-		req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
-		ctx := e.NewContext(req, httptest.NewRecorder())
-		ctx.SetPath("/panic")
-
-		func() {
-			defer func() { _ = recover() }()
-			_ = handler(ctx)
-		}()
-
-		Expect(GetTraces()).To(BeEmpty())
-	})
-})

core/http/react-ui/e2e/traces-live.spec.js

@@ -1,22 +0,0 @@
-import { test, expect } from './coverage-fixtures.js'
-
-test('marks an API trace with no response status as in progress', async ({ page }) => {
-  await page.route('**/api/traces?*', route => route.fulfill({
-    json: [{
-      id: 'running-1',
-      timestamp: '2026-08-05T02:00:00Z',
-      duration: 2_000_000_000,
-      request: { method: 'POST', path: '/v1/chat/completions' },
-      response: { status: 0 },
-    }],
-    headers: { 'X-Total-Count': '1' },
-  }))
-  await page.route('**/api/backend-traces?*', route => route.fulfill({ json: [] }))
-
-  await page.goto('/app/traces')
-
-  const row = page.locator('tbody tr').filter({ hasText: '/v1/chat/completions' })
-  await expect(row.getByText('Running', { exact: true })).toBeVisible()
-  await expect(row.locator('[title="In progress"]')).toBeVisible()
-  await expect(row.locator('.fa-check-circle')).toHaveCount(0)
-})

core/http/react-ui/package-lock.json

@@ -21,10 +21,9 @@
         "@fortawesome/fontawesome-free": "^6.7.2",
         "@lezer/highlight": "^1.2.1",
         "@modelcontextprotocol/ext-apps": "^1.2.2",
-        "@modelcontextprotocol/sdk": "^1.30.0",
+        "@modelcontextprotocol/sdk": "^1.25.1",
         "dompurify": "^3.4.12",
         "highlight.js": "^11.11.1",
-        "hono": "4.12.34",
         "i18next": "^26.0.8",
         "i18next-browser-languagedetector": "^8.2.1",
         "i18next-http-backend": "^3.0.6",
@@ -636,12 +635,12 @@
       }
     },
     "node_modules/@hono/node-server": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.0.tgz",
-      "integrity": "sha512-XovyyCCnBzW+zKu+z/zq8hwNs4KOR5rEMAOxo2f40Q5xoOI37IMm6MIg2COOUtUApo0i6850MTBKH2u4QLGIqg==",
+      "version": "1.19.14",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
+      "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==",
       "license": "MIT",
       "engines": {
-        "node": ">=20"
+        "node": ">=18.14.1"
       },
       "peerDependencies": {
         "hono": "^4"
@@ -945,12 +944,11 @@
       }
     },
     "node_modules/@modelcontextprotocol/sdk": {
-      "version": "1.30.0",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.30.0.tgz",
-      "integrity": "sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==",
-      "license": "MIT",
+      "version": "1.27.1",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.27.1.tgz",
+      "integrity": "sha512-sr6GbP+4edBwFndLbM60gf07z0FQ79gaExpnsjMGePXqFcSSb7t6iscpjk9DhFhwd+mTEQrzNafGP8/iGGFYaA==",
       "dependencies": {
-        "@hono/node-server": "^1.19.9 || ^2.0.5",
+        "@hono/node-server": "^1.19.9",
         "ajv": "^8.17.1",
         "ajv-formats": "^3.0.1",
         "content-type": "^1.0.5",
@@ -1720,11 +1718,10 @@
       "dev": true
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
       "dev": true,
-      "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
         "concat-map": "0.0.1"
@@ -2879,9 +2876,9 @@
       "dev": true
     },
     "node_modules/fast-uri": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
-      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
+      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
       "funding": [
         {
           "type": "github",
@@ -3435,9 +3432,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.34",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.34.tgz",
-      "integrity": "sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==",
+      "version": "4.12.31",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.31.tgz",
+      "integrity": "sha512-zJIHFrl6bq3RDd2YusFNCDlM8qUprxKswyi/OPzPyzKDdyBXDqWx8bZlZ7R+saTdSTatUmb3O7K4SspGPaEOQg==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -4196,9 +4193,9 @@
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
     },
     "node_modules/ip-address": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
+      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -4386,16 +4383,16 @@
       }
     },
     "node_modules/istanbul-lib-processinfo/node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/istanbul-lib-processinfo/node_modules/glob": {
@@ -5281,16 +5278,16 @@
       }
     },
     "node_modules/nyc/node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/nyc/node_modules/convert-source-map": {
@@ -5977,11 +5974,10 @@
       }
     },
     "node_modules/quick-temp/node_modules/brace-expansion": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
-      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
+      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
       "dev": true,
-      "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
       }
@@ -6573,16 +6569,16 @@
       }
     },
     "node_modules/spawn-wrap/node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/spawn-wrap/node_modules/foreground-child": {
@@ -6906,16 +6902,16 @@
       }
     },
     "node_modules/test-exclude/node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       }
     },
     "node_modules/test-exclude/node_modules/glob": {
@@ -7138,9 +7134,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
-      "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
+      "version": "7.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz",
+      "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==",
       "dev": true,
       "license": "MIT",
       "engines": {

core/http/react-ui/package.json

@@ -19,7 +19,7 @@
     "coverage:report": "nyc report"
   },
   "overrides": {
-    "hono": "4.12.34"
+    "hono": "4.12.25"
   },
   "dependencies": {
     "@codemirror/autocomplete": "^6.18.6",
@@ -35,10 +35,10 @@
     "@fortawesome/fontawesome-free": "^6.7.2",
     "@lezer/highlight": "^1.2.1",
     "@modelcontextprotocol/ext-apps": "^1.2.2",
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.25.1",
     "dompurify": "^3.4.12",
     "highlight.js": "^11.11.1",
-    "hono": "4.12.34",
+    "hono": "4.12.25",
     "i18next": "^26.0.8",
     "i18next-browser-languagedetector": "^8.2.1",
     "i18next-http-backend": "^3.0.6",

core/http/react-ui/src/pages/Traces.jsx

@@ -664,16 +664,10 @@ export default function Traces() {
                     <td><span className="badge badge-info">{trace.request?.method || '-'}</span></td>
                     <td className="text-mono text-sm">{trace.request?.path || '-'}</td>
                     <td className="text-sub cell-clip" title={trace.user_name || trace.user_id || ''}>{trace.user_name || trace.user_id || '-'}</td>
-                    <td>
-                      {trace.response?.status === 0
-                        ? <span className="badge badge-info">Running</span>
-                        : <span className={`badge ${trace.response.status < 400 ? 'badge-success' : 'badge-error'}`}>{trace.response.status}</span>}
-                    </td>
+                    <td><span className={`badge ${(trace.response?.status || 0) < 400 ? 'badge-success' : 'badge-error'}`}>{trace.response?.status || '-'}</span></td>
                     <td><LatencyCell ns={trace.duration} max={slowestTrace} /></td>
                     <td className="text-center">
-                      {trace.response?.status === 0
-                        ? <i className="fas fa-spinner fa-spin text-primary" title="In progress" />
-                        : trace.error
+                      {trace.error
                         ? <i className="fas fa-times-circle text-error" title={trace.error} />
                         : <i className="fas fa-check-circle text-success" />}
                     </td>

core/services/advisorylock/leader_loop_test.go

@@ -54,57 +54,62 @@ var _ = Describe("RunLeaderLoop", func() {
 				close(done)
 			}()
 
-			Eventually(func() int32 {
-				return atomic.LoadInt32(&callCount)
-			}, 500*time.Millisecond, 10*time.Millisecond).Should(BeNumerically(">=", 1))
+			// Let it run a bit then cancel
+			time.Sleep(150 * time.Millisecond)
 			cancel()
 
+			// RunLeaderLoop should return
 			Eventually(done, 500*time.Millisecond).Should(BeClosed())
+
+			// Record count after cancellation
+			countAfterCancel := atomic.LoadInt32(&callCount)
+			time.Sleep(150 * time.Millisecond)
+			countLater := atomic.LoadInt32(&callCount)
+
+			Expect(countLater).To(Equal(countAfterCancel),
+				"function should stop being called after context cancellation")
 		})
 
 		It("only one leader executes at a time (two concurrent loops)", func() {
 			db := testutil.SetupTestDB()
 			const lockKey int64 = 5002
 
-			var running int32
-			entered := make(chan struct{}, 2)
-			release := make(chan struct{})
-			var releaseOnce sync.Once
+			var (
+				mu         sync.Mutex
+				maxRunning int32
+				running    int32
+			)
 
 			ctx, cancel := context.WithCancel(context.Background())
-			done := make(chan struct{}, 2)
-			DeferCleanup(func() {
-				cancel()
-				releaseOnce.Do(func() { close(release) })
-			})
+			defer cancel()
 
 			fn := func() {
-				atomic.AddInt32(&running, 1)
-				select {
-				case entered <- struct{}{}:
-				default:
+				cur := atomic.AddInt32(&running, 1)
+				mu.Lock()
+				if cur > maxRunning {
+					maxRunning = cur
 				}
-				<-release
+				mu.Unlock()
+
+				time.Sleep(30 * time.Millisecond)
+
 				atomic.AddInt32(&running, -1)
 			}
 
-			for range 2 {
-				go func() {
-					RunLeaderLoop(ctx, db, lockKey, 1*time.Millisecond, fn)
-					done <- struct{}{}
-				}()
-			}
-
-			Eventually(entered, 500*time.Millisecond).Should(Receive())
-			Consistently(func() int32 {
-				return atomic.LoadInt32(&running)
-			}, 50*time.Millisecond, 5*time.Millisecond).Should(Equal(int32(1)),
-				"expected only the lock holder to run while both loops tick")
+			// Start two competing leader loops with the same lock key
+			go RunLeaderLoop(ctx, db, lockKey, 50*time.Millisecond, fn)
+			go RunLeaderLoop(ctx, db, lockKey, 50*time.Millisecond, fn)
 
+			// Let them run for a while
+			time.Sleep(400 * time.Millisecond)
 			cancel()
-			releaseOnce.Do(func() { close(release) })
-			Eventually(done, 500*time.Millisecond).Should(Receive())
-			Eventually(done, 500*time.Millisecond).Should(Receive())
+
+			mu.Lock()
+			observed := maxRunning
+			mu.Unlock()
+
+			Expect(observed).To(BeNumerically("<=", 1),
+				"expected at most 1 goroutine running the leader function at a time")
 		})
 	})
 })

docs/content/features/backends.md

@@ -72,44 +72,6 @@ tags:
   - "text-generation"
 ```
 
-### Verifying OCI Backends
-
-Backend galleries can require keyless Sigstore signatures for every OCI image
-they provide. Add a `verification` policy to the gallery configuration, then
-enable strict integrity mode:
-
-```bash
-export LOCALAI_BACKEND_GALLERIES='[{"name":"localai","url":"github:mudler/LocalAI/backend/index.yaml@master","verification":{"issuer":"https://token.actions.githubusercontent.com","identity_regex":"^https://github\\.com/mudler/LocalAI/\\.github/workflows/backend_merge\\.yml@refs/(heads/master|tags/.+)$"}}]'
-export LOCALAI_REQUIRE_BACKEND_INTEGRITY=1
-local-ai run
-```
-
-The policy pins the Fulcio issuer and the GitHub Actions workflow identity that
-signed the image. The identity expression covers development images produced
-from `master` and release images produced from tags. Use a narrower expression
-if your deployment only accepts one release channel.
-
-Without strict mode, an OCI gallery without a verification policy installs
-with a warning. With strict mode, LocalAI refuses galleries without a policy,
-images without a compatible Sigstore bundle, and signatures that do not match
-the configured identity. Existing images published before bundle signing was
-enabled must be rebuilt or re-signed before strict deployments can install
-them.
-
-An optional `not_before` RFC3339 value revokes signatures logged before that
-time. Advance it after a signing-workflow compromise, then rebuild or re-sign
-the trusted images:
-
-```json
-{
-  "verification": {
-    "issuer": "https://token.actions.githubusercontent.com",
-    "identity_regex": "^https://github\\.com/mudler/LocalAI/\\.github/workflows/backend_merge\\.yml@refs/(heads/master|tags/.+)$",
-    "not_before": "2026-08-05T00:00:00Z"
-  }
-}
-```
-
 ## Pre-installing Backends
 
 You can pre-install backends when starting LocalAI using the `LOCALAI_EXTERNAL_BACKENDS` environment variable:

docs/content/features/tracing.md

@@ -9,11 +9,6 @@ LocalAI can retain recent API exchanges and backend operations for inspection
 on the **Traces** page in the management interface. Enable tracing in runtime
 settings or with the existing tracing configuration.
 
-API requests appear while they are still running. Their elapsed duration
-updates when the page refreshes, and the result column marks them as in
-progress until the response completes. In-flight requests live only in memory;
-the completed exchange is what LocalAI adds to the bounded, persistent history.
-
 API and backend trace histories are persisted in separate directories below
 the configured data path. They are restored after a clean service restart,
 whether or not authentication is enabled.

gallery/index.yaml

@@ -785,18 +785,35 @@
 - name: "qwen3.6-35b-a3b-uncensored-genesis-hermes-v6"
   url: "github:mudler/LocalAI/gallery/virtual.yaml@master"
   urls:
-    - https://huggingface.co/HauhauCS/Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive
     - https://huggingface.co/LuffyTheFox/Qwen3.6-35B-A3B-Uncensored-Genesis-Hermes-V6-GGUF
   description: |
-    Qwen3.6-35B-A3B Uncensored Genesis Hermes V6 is LuffyTheFox's multimodal,
-    agentic derivative of HauhauCS's uncensored Qwen3.6-35B-A3B model. It
-    combines Genesis tensor calibration with Hermes function-calling data while
-    retaining the 35B mixture-of-experts architecture, roughly 3B active
-    parameters per token, and the native 262K-token context window.
+    # Qwen3.6-35B-A3B-Uncensored-HauhauCS-Aggressive
 
-    This entry installs the Q8_0 GGUF together with its F16 multimodal projector
-    for llama.cpp. The model card recommends Jinja chat templates and at least a
-    128K context for its thinking behavior. License: Apache-2.0.
+    > **Join the Discord** for updates, roadmaps, projects, or just to chat.
+
+    Qwen3.6-35B-A3B uncensored by HauhauCS. **0/465 Refusals.**
+
+    > **HuggingFace's "Hardware Compatibility" widget doesn't recognize K_P quants** — it may show fewer files than actually exist. Click **"View +X variants"** or go to **Files and versions** to see all available downloads.
+
+    ## About
+
+    No changes to datasets or capabilities. Fully functional, 100% of what the original authors intended - just without the refusals.
+
+    These are meant to be the best lossless uncensored models out there.
+
+    ## Aggressive Variant
+
+    Stronger uncensoring — model is fully unlocked and won't refuse prompts. May occasionally append short disclaimers (baked into base model training, not refusals) but full content is always generated.
+
+    For a more conservative uncensor that keeps some safety guardrails, check the Balanced variant when it's available.
+
+    ## Downloads
+
+    All quants generated with importance matrix (imatrix) for optimal quality preservation on abliterated weights.
+
+    ## What are K_P quants?
+
+    ...
   license: "apache-2.0"
   tags:
     - llm
@@ -1992,7 +2009,7 @@
   files:
     - filename: ds4flash.gguf
       uri: https://huggingface.co/unsloth/DeepSeek-V4-Flash-GGUF
-      sha256: ba1d64ad8d77038124839956b614db2e889daa1a4ddc83060bb06ccb5a1d7461
+      sha256: 1bfdafd1c288eb1b2bcb629ee9e1b7567dcf0abbe4d20995905a3c3465e9bd1e
 - name: "qwopus3.6-35b-a3b-coder-mtp"
   url: "github:mudler/LocalAI/gallery/virtual.yaml@master"
   urls:
@@ -2091,83 +2108,6 @@
     - filename: llama-cpp/models/Qwen-AgentWorld-35B-A3B-GGUF/Qwen-AgentWorld-35B-A3B-UD-Q4_K_M.gguf
       sha256: e7a8eafdd8013443b6bcc4b6fb47b2d2025f772d359650b9ceb7d75971e22cad
       uri: https://huggingface.co/unsloth/Qwen-AgentWorld-35B-A3B-GGUF/resolve/main/Qwen-AgentWorld-35B-A3B-UD-Q4_K_M.gguf
-- &agents-a1-4b
-  name: "agents-a1-4b"
-  variants:
-    - model: agents-a1-4b-q8
-  url: "github:mudler/LocalAI/gallery/virtual.yaml@master"
-  urls:
-    - https://huggingface.co/InternScience/Agents-A1-4B
-    - https://huggingface.co/InternScience/Agents-A1-4B-Q4_K_M-GGUF
-  description: |
-    Agents-A1-4B is InternScience's Apache-2.0 dense 4B agentic model, based on
-    Qwen3.5. It is trained for long-horizon search, engineering and scientific
-    research, instruction following, tool use, and multimodal tasks. This entry
-    uses the official Q4_K_M GGUF quantization and vision projector.
-  license: "apache-2.0"
-  tags:
-    - llm
-    - gguf
-    - vision
-    - multimodal
-    - gpu
-    - cpu
-  icon: https://huggingface.co/InternScience/Agents-A1-4B/resolve/main/figures/logo_nobg.png
-  overrides:
-    backend: llama-cpp
-    function:
-      automatic_tool_parsing_fallback: true
-      grammar:
-        disable: true
-    known_usecases:
-      - chat
-    mmproj: llama-cpp/mmproj/Agents-A1-4B-Q4_K_M/Agents-A1-4B-mmproj.gguf
-    options:
-      - use_jinja:true
-    parameters:
-      model: llama-cpp/models/Agents-A1-4B-Q4_K_M/Agents-A1-4B-Q4_K_M.gguf
-    template:
-      use_tokenizer_template: true
-  files:
-    - filename: llama-cpp/models/Agents-A1-4B-Q4_K_M/Agents-A1-4B-Q4_K_M.gguf
-      sha256: d93c393a9bd5139a4b5cfe24d31ef553c5a497bfb8afec178a354ecbf508f062
-      uri: huggingface://InternScience/Agents-A1-4B-Q4_K_M-GGUF/Agents-A1-4B-Q4_K_M.gguf
-    - filename: llama-cpp/mmproj/Agents-A1-4B-Q4_K_M/Agents-A1-4B-mmproj.gguf
-      sha256: 254145e7e03e9e8d3120813fac8033ffa04e411eb6d70a198833504935681084
-      uri: huggingface://InternScience/Agents-A1-4B-Q4_K_M-GGUF/Agents-A1-4B-mmproj.gguf
-- !!merge <<: *agents-a1-4b
-  name: "agents-a1-4b-q8"
-  variants: []
-  urls:
-    - https://huggingface.co/InternScience/Agents-A1-4B
-    - https://huggingface.co/InternScience/Agents-A1-4B-Q8_0-GGUF
-  description: |
-    Agents-A1-4B is InternScience's Apache-2.0 dense 4B agentic model, based on
-    Qwen3.5. It is trained for long-horizon search, engineering and scientific
-    research, instruction following, tool use, and multimodal tasks. This entry
-    uses the official Q8_0 GGUF quantization and vision projector.
-  overrides:
-    backend: llama-cpp
-    function:
-      automatic_tool_parsing_fallback: true
-      grammar:
-        disable: true
-    known_usecases:
-      - chat
-    mmproj: llama-cpp/mmproj/Agents-A1-4B-Q8_0/Agents-A1-4B-mmproj.gguf
-    options:
-      - use_jinja:true
-    parameters:
-      model: llama-cpp/models/Agents-A1-4B-Q8_0/Agents-A1-4B-Q8_0.gguf
-    template:
-      use_tokenizer_template: true
-  files:
-    - filename: llama-cpp/models/Agents-A1-4B-Q8_0/Agents-A1-4B-Q8_0.gguf
-      sha256: c327f66e820dae550bd230394595071c79f48c88d411b452d013ee4b5999fcea
-      uri: huggingface://InternScience/Agents-A1-4B-Q8_0-GGUF/Agents-A1-4B-Q8_0.gguf
-    - filename: llama-cpp/mmproj/Agents-A1-4B-Q8_0/Agents-A1-4B-mmproj.gguf
-      sha256: 254145e7e03e9e8d3120813fac8033ffa04e411eb6d70a198833504935681084
-      uri: huggingface://InternScience/Agents-A1-4B-Q8_0-GGUF/Agents-A1-4B-mmproj.gguf
 - name: "ornith-1.0-9b"
   variants:
     - model: ornith-1.0-9b-mtp
@@ -2691,83 +2631,6 @@
     - filename: llama-cpp/models/LFM2.5-1.2B-Instruct-GGUF/LFM2.5-1.2B-Instruct-Q4_K_M.gguf
       sha256: b1b3de114215d9507409a662a501a631095a479a419584e8a2ded6304b19b4f5
       uri: https://huggingface.co/LiquidAI/LFM2.5-1.2B-Instruct-GGUF/resolve/main/LFM2.5-1.2B-Instruct-Q4_K_M.gguf
-- &lfm2-5-2-6b
-  name: "lfm2.5-2.6b"
-  url: "github:mudler/LocalAI/gallery/virtual.yaml@master"
-  urls:
-    - https://huggingface.co/LiquidAI/LFM2.5-2.6B
-    - https://huggingface.co/LiquidAI/LFM2.5-2.6B-GGUF
-  description: |
-    LFM2.5-2.6B is LiquidAI's compact, text-only reasoning model for on-device
-    agentic workloads. It has 2.69B parameters, a 128K-token context window,
-    multilingual support, and post-training for tool use, instruction following,
-    data extraction, RAG, and multi-step agents. This entry uses the recommended
-    Q4_K_M GGUF quantization from LiquidAI's official repository.
-  license: "other"
-  tags:
-    - llm
-    - gguf
-    - reasoning
-    - cpu
-    - gpu
-  icon: https://cdn-uploads.huggingface.co/production/uploads/61b8e2ba285851687028d395/2b08LKpev0DNEk6DlnWkY.png
-  variants:
-    - model: lfm2.5-2.6b-q8
-  overrides:
-    backend: llama-cpp
-    context_size: 131072
-    function:
-      automatic_tool_parsing_fallback: true
-      grammar:
-        disable: true
-    known_usecases:
-      - chat
-      - completion
-    options:
-      - use_jinja:true
-    parameters:
-      model: llama-cpp/models/LFM2.5-2.6B-GGUF/LFM2.5-2.6B-Q4_K_M.gguf
-      repeat_penalty: 1.1
-      temperature: 0.1
-      top_k: 50
-    template:
-      use_tokenizer_template: true
-  files:
-    - filename: llama-cpp/models/LFM2.5-2.6B-GGUF/LFM2.5-2.6B-Q4_K_M.gguf
-      sha256: 79fdf00351b46cf26f020aead28d01889886be87c55fa0eb907e6f9b00bfee14
-      uri: https://huggingface.co/LiquidAI/LFM2.5-2.6B-GGUF/resolve/main/LFM2.5-2.6B-Q4_K_M.gguf
-- !!merge <<: *lfm2-5-2-6b
-  name: "lfm2.5-2.6b-q8"
-  description: |
-    LFM2.5-2.6B is LiquidAI's compact, text-only reasoning model for on-device
-    agentic workloads. It has 2.69B parameters, a 128K-token context window,
-    multilingual support, and post-training for tool use, instruction following,
-    data extraction, RAG, and multi-step agents. This entry uses the higher-quality
-    Q8_0 GGUF quantization from LiquidAI's official repository.
-  variants: null
-  overrides:
-    backend: llama-cpp
-    context_size: 131072
-    function:
-      automatic_tool_parsing_fallback: true
-      grammar:
-        disable: true
-    known_usecases:
-      - chat
-      - completion
-    options:
-      - use_jinja:true
-    parameters:
-      model: llama-cpp/models/LFM2.5-2.6B-GGUF/LFM2.5-2.6B-Q8_0.gguf
-      repeat_penalty: 1.1
-      temperature: 0.1
-      top_k: 50
-    template:
-      use_tokenizer_template: true
-  files:
-    - filename: llama-cpp/models/LFM2.5-2.6B-GGUF/LFM2.5-2.6B-Q8_0.gguf
-      sha256: 36587fdf27bdfc69caf2637273679a0870ec155162161bde6fd16e8c70bdb757
-      uri: https://huggingface.co/LiquidAI/LFM2.5-2.6B-GGUF/resolve/main/LFM2.5-2.6B-Q8_0.gguf
 - name: "qwopus3.6-27b-coder-compat-mtp"
   url: "github:mudler/LocalAI/gallery/virtual.yaml@master"
   urls:

scripts/build/backend-signing_test.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-WORKFLOW="$(dirname "$(realpath "$0")")/../../.github/workflows/backend_merge.yml"
-
-sign_commands=$(grep -Ec -- '^[[:space:]]+cosign sign([[:space:]]|$)' "$WORKFLOW" || true)
-bundle_flags=$(grep -Ec -- '^[[:space:]]+--new-bundle-format([[:space:]]|$)' "$WORKFLOW" || true)
-if [ "$sign_commands" -ne 2 ] || [ "$bundle_flags" -ne "$sign_commands" ]; then
-  echo "FAIL: every backend signing command must request the new bundle format (commands=$sign_commands flags=$bundle_flags)"
-  exit 1
-fi
-
-echo "PASS: backend signing emits Sigstore bundles for both registries"

scripts/build/llama-cpp-build-target_test.sh

@@ -29,11 +29,4 @@ assert_target arm64 "" llama-cpp-cpu-all
 assert_target amd64 sycl_f16 llama-cpp-fallback
 assert_target amd64 sycl_f32 llama-cpp-fallback
 
-# ROCm exhausts the same 6h budget through volume rather than a stall: hipcc
-# compiles ggml's HIP kernels once per AMDGPU target, eleven of them, and the
-# CPU variant matrix goes on top. 2h27m before it was added, killed at exactly
-# 6h00m on every run since.
-assert_target amd64 hipblas llama-cpp-fallback
-assert_target arm64 hipblas llama-cpp-fallback
-
 echo "PASS: llama.cpp build target preserves CPU variants where supported"

website/content/blog/what-landed-in-localai-4-8.md

@@ -1,14 +1,14 @@
 ---
 title: "What landed in LocalAI 4.8"
-date: 2026-08-04
+date: 2026-08-01
 author: "Ettore Di Giacinto"
 category: "Release"
 tags: ["release", "vllm.cpp", "audio.cpp", "3d", "gallery", "distributed", "performance"]
-summary: "A new inference engine, 3D generation, one backend that serves six audio endpoints, and a web interface 3.48x lighter. 374 pull requests in twenty-one days."
+summary: "A new inference engine, 3D generation, one backend that serves six audio endpoints, and a web interface 3.48x lighter. 321 pull requests in eighteen days."
 extracss: ["blog.css"]
 ---
 
-LocalAI 4.8.0 is out, after twenty-one days and 374 merged pull requests. There are three new things LocalAI can do, and a lot of repair work on things it already did.
+LocalAI 4.8.0 is out. It took eighteen days and 321 merged pull requests, and it pulls in two directions at once: three new things LocalAI can do that it could not do before, and a long list of places where it now does the old things without lying to you.
 
 The full notes list everything. This post covers the parts that change what you do day to day, with the pull request numbers so you can read the diffs.
 
@@ -36,11 +36,6 @@ The third one was `/api/traces` returning a 21 MB unpaginated blob that the UI p
 
 ## One gallery entry, several builds
 
-<figure>
-<img src="/media/v4-8-0-ui-model-variants.png" alt="The model detail pane listing every variant">
-<figcaption>One entry, four builds. LocalAI picks the largest that fits and marks it auto-selected.</figcaption>
-</figure>
-
 Installing a model no longer means reading a list of quantizations and guessing which one your card will hold. A gallery entry can now declare `variants:`, a list of references to other entries that are alternative builds of the same weights:
 
 ```yaml
@@ -60,43 +55,12 @@ Every surface can override the choice: `variant` on `POST /models/apply`, `local
 
 One gap worth knowing about: in distributed mode `InstallModel` resolves against the frontend rather than the worker that will serve the model, so a cluster with a small frontend and large workers selects conservatively. PRs [#10943](https://github.com/mudler/LocalAI/pull/10943), [#10983](https://github.com/mudler/LocalAI/pull/10983), [#10992](https://github.com/mudler/LocalAI/pull/10992), [#11027](https://github.com/mudler/LocalAI/pull/11027) and [#11139](https://github.com/mudler/LocalAI/pull/11139).
 
-## A new engine: vllm.cpp (alpha)
+## A new engine: vllm.cpp
 
-[vllm.cpp](https://github.com/mudler/vllm.cpp) is Apache-2.0 and maintained by the LocalAI team. We want it community-first rather than a LocalAI-only engine, so it lives in its own repository with its own docs, benchmark record and issue tracker, and it runs without LocalAI anywhere in the picture. It began as a C++20 port of vLLM. It ships here as the `vllm-cpp` backend ([#11100](https://github.com/mudler/LocalAI/pull/11100)). It implements vLLM's V1 architecture, so paged KV cache, continuous batching, prefix caching, scheduler and sampler, on a portable tensor runtime with no Python, no PyTorch and no ggml at inference. vLLM stays its reference implementation: correctness is checked by comparing output against it, and the benchmark scoreboard is kept against it.
-
-It has grown features vLLM does not have, which is most of the reason the port exists. It loads GGUF as well as safetensors, runs on CPU, Apple Metal and Vulkan alongside CUDA 12 and 13 and L4T for GB10, and ships speculative decoding and KV offload. Its benchmark page now measures against llama.cpp, MLX-LM and DwarfStar as well as vLLM, because on that hardware those are the engines it competes with. The project is expected to be renamed, with the new name still to be decided; it is drifting far enough that vllm.cpp will eventually mislead.
+[vllm.cpp](https://github.com/mudler/vllm.cpp) is a from-scratch C++20 port of vLLM, written and maintained by the LocalAI team under Apache-2.0, and it ships here as the `vllm-cpp` backend ([#11100](https://github.com/mudler/LocalAI/pull/11100)). It mirrors vLLM's V1 architecture, so paged KV cache, continuous batching, prefix caching, scheduler and sampler, on a portable tensor runtime with no Python, no PyTorch and no ggml at inference. It loads Hugging Face safetensors and GGUF, enforces structured output inside the engine (JSON schema, regex, choice, GBNF), and builds for CPU amd64 and arm64, CUDA 12 and 13 including Blackwell, L4T for GB10, Vulkan and Darwin Metal.
 
 Tool calling is at llama.cpp parity by construction, because chat deliberately reuses the same autoparser path: full minja chat templates, `tool_choice: auto` lowered to a lazy structural-tag decode constraint, 30 tool dialects, 7 reasoning parsers, and streamed `ChatDelta` and `ToolCallDelta`.
 
-<figure>
-<img src="/media/v4-8-0-vllm-cpp-scoreboard.png" alt="Throughput of vllm.cpp relative to each reference engine, drawn as deviation from parity">
-<figcaption>llama.cpp is left out because its 1.18x is a prefill ratio, and putting that on the same axis as throughput would compare two different measurements.</figcaption>
-</figure>
-
-Numbers from the project's own [scoreboard](https://github.com/mudler/vllm.cpp/blob/master/docs/BENCHMARKS.md), which calls ties ties and losses losses. Above 1.0 means vllm.cpp is ahead:
-
-<div class="tw">
-<table>
-<thead><tr><th>Reference</th><th>Workload</th><th>Result</th></tr></thead>
-<tbody>
-<tr><td>vLLM</td><td>Qwen3.6-27B NVFP4, GB10</td><td>1.045x at concurrency 1, 1.007x to 1.017x from c2 to c32, output token-for-token identical</td></tr>
-<tr><td>vLLM</td><td>Qwen3.6-35B-A3B NVFP4, GB10</td><td>1.010x at c16 and 1.013x at c32, behind from c1 to c8 (0.817x at c1)</td></tr>
-<tr><td>llama.cpp</td><td>Qwen3.5-2B GGUF, CPU aarch64</td><td>prefill 1.18x, decode a tie, memory parity</td></tr>
-<tr><td>MLX-LM</td><td>Qwen3-0.6B, Apple M4</td><td>97.6% of warm total, prefill ahead</td></tr>
-<tr><td>DwarfStar (ds4)</td><td>DeepSeek-V4-Flash IQ2_XXS, one DGX Spark</td><td>18.69 vs 16.33 tok/s decode, <b>1.144x</b>, same output</td></tr>
-<tr><td>vLLM</td><td>Laguna-XS-2.1 NVFP4, GB10</td><td>44.46 vs 43.10 tok/s, <b>1.03x</b>, same output</td></tr>
-</tbody>
-</table>
-</div>
-
-The upstream page is careful about its own noise: on the 27B grid the run-to-run spread is 0.5% and c2 through c32 land between 0.7% and 1.7%, so it calls those five ties rather than wins. The concurrency-1 result is the one it stands behind.
-
-The DeepSeek-V4-Flash row is the one that shows how far this has moved from being a vLLM port. It runs DeepSeek-V4-Flash at roughly 2-bit (IQ2_XXS mixed, about 80 GB) on a single DGX Spark, decoding at 18.69 tok/s against DwarfStar's 16.33. At 300B+ total parameters even a 4-bit checkpoint is 156 GB or more, so a 2-bit GGUF is what fits inside the Spark's 119 GiB unified pool, and reading GGUF is what makes that possible.
-
-That number moved twice in a week, and the second move came from one lever. The dense Q8_0 projection tower was being read from the GGUF mmap over unified memory, which the GB10 reads about 20% slower per-GEMV than device memory. Staging that 6 GiB tower device-resident once at load, same bytes and same kernels, took decode from 16.23 to 18.69, generating the same tokens and using no more peak memory. The same change took Laguna-XS-2.1 from 87% of vLLM to 1.03x ahead of it.
-
-Speculative decoding is in similar shape: MTP on Qwen3.6-27B NVFP4 generates the same tokens as vLLM's MTP and runs about 4% faster at concurrency 1.
-
 Configuration is a normal backend install:
 
 ```yaml
@@ -109,24 +73,9 @@ options:
 - max_num_seqs:16      # also: block_size:<n>, num_blocks:<n>
 ```
 
-**Treat these as alpha development builds, not a released backend.** vllm.cpp is early, and shipping it in 4.8 is about getting it in front of people who want to try it, not about recommending it for anything you care about. `llama-cpp` stays the default for real use.
+The CPU path is verified end to end against `Qwen3.5-2B-UD-Q8_K_XL.gguf` with the full Ginkgo suite, covering blocking and streaming byte-parity, greedy determinism, stop words, GBNF-constrained generation, concurrent streams, reasoning split and both `required` and `auto` tool calls. The maturity statement from the release notes is worth repeating in full:
 
-The CPU path is verified end to end against `Qwen3.5-2B-UD-Q8_K_XL.gguf` with the full Ginkgo suite, covering blocking and streaming byte-parity, greedy determinism, stop words, GBNF-constrained generation, concurrent streams, reasoning split and both `required` and `auto` tool calls. The GPU images build and ship, but their runtime behavior has not been through that gate. No throughput comparison against upstream vLLM is claimed. Expect rough edges, and please report what breaks.
-
-On Apple Silicon the image now ships vllm.cpp's MLX GEMM provider ([#11137](https://github.com/mudler/LocalAI/pull/11137)). Upstream keeps it off by default because it adds about 124 MB, so we measured before turning it on. Qwen3-1.7B-bf16 on an M4, p=512 g=128, both arms toggled on one binary so a build difference cannot explain the gap:
-
-<div class="tw">
-<table>
-<thead><tr><th>Batch</th><th>MLX tok/s</th><th>native tok/s</th><th>speedup</th><th>MLX TTFT</th><th>native TTFT</th></tr></thead>
-<tbody>
-<tr><td>1</td><td>5.79</td><td>3.08</td><td><b>1.88x</b></td><td>3.32 s</td><td>7.68 s</td></tr>
-<tr><td>4</td><td>15.75</td><td>10.24</td><td><b>1.54x</b></td><td>9.63 s</td><td>18.77 s</td></tr>
-<tr><td>16</td><td>38.65</td><td>17.69</td><td><b>2.19x</b></td><td>18.33 s</td><td>54.48 s</td></tr>
-</tbody>
-</table>
-</div>
-
-Two reps, with rep spread reaching 9.4%, so treat the multipliers as +/-10%. Time to first token roughly halves across the range.
+> The GPU images build and ship, but their runtime behavior has not been through the same e2e gate yet. This is a first release of a young engine: no throughput comparison against upstream vLLM is claimed here, and `llama-cpp` remains the default recommendation for general use. Try it, and please report what breaks.
 
 <figure>
 <video src="/media/vllm-race.mp4" muted loop playsinline preload="none" data-lazy aria-label="vllm.cpp generating tokens"></video>
@@ -135,7 +84,7 @@ Two reps, with rep spread reaching 9.4%, so treat the multipliers as +/-10%. Tim
 
 ## LocalAI generates 3D models now
 
-3D generation is a new modality, so it had to be wired through the whole stack: a `Generate3D` RPC in `backend.proto`, a `FLAG_3D` capability so the loader knows which backends can serve it, and `POST /v1/3d/generations`.
+This is a new modality rather than a new backend under an existing one, so it goes through the whole stack: a `Generate3D` RPC in `backend.proto`, a `FLAG_3D` capability so the loader knows which backends can serve it, and `POST /v1/3d/generations`.
 
 The first engine behind it is `trellis2cpp`, an image-to-3D backend over TRELLIS.2. You give it an image, you get a GLB back. The web UI has a page for it with a native GLB viewer, so you can turn the result around in the browser instead of downloading it to find out whether it worked, history kept in IndexedDB so a reload does not lose your generations, and previewable print remeshing for output you actually intend to send to a printer ([#10979](https://github.com/mudler/LocalAI/pull/10979)).
 
@@ -146,7 +95,7 @@ The first engine behind it is `trellis2cpp`, an image-to-3D backend over TRELLIS
 
 ## One backend, six audio endpoints
 
-The usual shape for audio is one backend per model family, which means a process per capability and a config file for each. `audio-cpp` wraps [audio.cpp](https://github.com/0xShug0/audio.cpp), a multi-family ggml audio engine. One backend process serves several unrelated families through a single runtime vocabulary, and works out which family a checkpoint belongs to from the GGUF's own `audiocpp.model_spec.family` metadata key. There is nothing backend-specific to write in the model config.
+The usual shape for audio is one backend per model family, which means a process per capability and a config file for each. `audio-cpp` wraps [audio.cpp](https://github.com/0xShug0/audio.cpp), a multi-family ggml audio engine, and inverts that: one backend process serves several unrelated families through a single runtime vocabulary, and works out which family a checkpoint belongs to from the GGUF's own `audiocpp.model_spec.family` metadata key. There is nothing backend-specific to write in the model config.
 
 <div class="tw">
 <table>
@@ -181,12 +130,7 @@ The `bonsai` backend serves the 1-bit (Q1_0) and ternary (Q2_0) Bonsai quantizat
 
 ## The operations bar became a page
 
-<figure>
-<img src="/media/v4-8-0-ui-activity.png" alt="The Activity page with four installs running">
-<figcaption>Four backend installs in flight, and the record of what already finished.</figcaption>
-</figure>
-
-The old operations bar rendered one row per in-flight operation above every page. Queue four model installs and a backend and it took most of the viewport, on every route, until the last one finished. It was doing two jobs at once. A global "something is happening" signal only needs one line, and the detail of what is happening needs a page of its own.
+The old operations bar rendered one row per in-flight operation above every page. Queue four model installs and a backend and it took most of the viewport, on every route, until the last one finished. Two things were conflated there: a global "something is happening" signal, which needs one line, and the detail of what is happening, which needs somewhere to put it.
 
 The strip is now one line, permanently, showing a failure first and otherwise the least-advanced running operation, with a `+N more` pill. Its `✕` hides the strip and no longer cancels anything. That is a deliberate behavior change worth knowing about before you click it out of habit: the same glyph used to cancel a 17 GB download in one row and dismiss a message in the next. Cancelling moved to the new page, behind a button that says so.
 
@@ -235,6 +179,6 @@ Valkey Search joins the vector store options as the `valkey-store` backend ([#11
 
 This is also the release where localai.io split in two: the project site at the root, and the documentation under `/docs/`. Every URL that was published before still resolves, through 214 generated redirect stubs, because GitHub Pages has no server-side rewrites to do it properly ([#11243](https://github.com/mudler/LocalAI/pull/11243)).
 
-Twenty-five people contributed to this release, eleven of them for the first time. The gallery went from 1,221 entries to 1,515.
+Twenty-four people contributed to this release, eleven of them for the first time. The gallery went from 1,221 entries to 1,505.
 
 To upgrade, pull `localai/localai:latest` or re-run the install script. The [full changelog](https://github.com/mudler/LocalAI/compare/v4.7.1...v4.8.0) has everything this post left out.

website/layouts/index.html

@@ -39,8 +39,7 @@
     <p class="kicker rv">The runtime</p>
     <h2 class="rv mt1" style="max-width:21ch">Everything else plugs into LocalAI.</h2>
     <p class="lede rv mt2">One binary with an OpenAI-compatible API in front of it. Point an existing client at it and the calls keep working, except now the model is on your machine. It also speaks the Anthropic, Ollama and ElevenLabs APIs, so most tools need a URL change and nothing else.</p>
-    <p class="lede rv mt2">The engine behind that API is swappable. One model can run on llama.cpp while the next loads on vLLM, SGLang or MLX, and the client never notices: same endpoint, same request, different engine underneath. Switching is one line in the model's config.</p>
-    <p class="lede rv mt2">A small core pulls each engine in as a separate backend, only when a model asks for it. That is why one install covers this much ground without becoming a 9 GB download.</p>
+    <p class="lede rv mt2">Underneath, a small core pulls each engine in as a separate backend, only when a model asks for it. That is why one install covers this much ground without becoming a 9 GB download.</p>
     <div class="apis rv">
       <span>OpenAI API</span><span>Anthropic API</span><span>Ollama API</span><span>ElevenLabs API</span><span>Realtime over WebRTC</span>
     </div>

website/static/media/v4-8-0-vllm-cpp-scoreboard.html

@@ -1,100 +0,0 @@
-<!doctype html>
-<html>
-<head>
-<meta charset="utf-8">
-<style>
-  /* palette lifted from the two logos:
-     LocalAI  #0E2632 navy, #385360 slate, #469AAF teal, #90A8AE haze
-     vllm.cpp #3AB4CA teal, #95C4D1 light                              */
-  :root{
-    --bg:#0b1c25; --ink:#e8f1f4; --dim:#90a8ae; --faint:#5d757f;
-    --teal:#3ab4ca; --teal-hi:#7fd4e2; --amber:#e0a944; --rule:#1d3440;
-  }
-  *{margin:0;padding:0;box-sizing:border-box}
-  html,body{width:1600px;height:900px}
-  body{
-    background:radial-gradient(1250px 720px at 80% -12%, #143140 0%, var(--bg) 62%);
-    color:var(--ink);
-    font-family:-apple-system,"SF Pro Display","Segoe UI",Helvetica,Arial,sans-serif;
-    -webkit-font-smoothing:antialiased; padding:58px 84px; position:relative;
-  }
-  .eyebrow{display:flex;align-items:center;gap:14px;color:var(--teal);
-    font-weight:600;font-size:23px;letter-spacing:.14em;text-transform:uppercase}
-  .eyebrow .dot{width:11px;height:11px;border-radius:50%;background:var(--teal);
-    box-shadow:0 0 16px 2px var(--teal)}
-  h1{font-size:56px;line-height:1.06;font-weight:760;margin:16px 0 6px;letter-spacing:-.02em}
-  h1 .grad{background:linear-gradient(92deg,var(--teal),var(--teal-hi));
-    -webkit-background-clip:text;background-clip:text;color:transparent}
-  .sub{color:var(--dim);font-size:23px;margin-bottom:14px}
-  svg{width:100%;height:auto;display:block}
-  .foot{position:absolute;left:84px;right:84px;bottom:40px;display:flex;
-    justify-content:space-between;align-items:center;color:var(--faint);
-    font-size:21px;border-top:1px solid var(--rule);padding-top:16px}
-  .foot .link{color:var(--ink);font-weight:600}
-</style>
-</head>
-<body>
-  <div class="eyebrow"><span class="dot"></span>vllm.cpp &middot; throughput vs the reference engine</div>
-  <h1>Measured against <span class="grad">what each workload actually runs on</span></h1>
-  <div class="sub">Throughput relative to the reference. 1.00 is parity, bars run from it. Higher is faster.</div>
-
-  <svg id="c" viewBox="0 0 1432 585"></svg>
-
-  <div class="foot">
-    <span class="link">github.com/mudler/vllm.cpp</span>
-    <span>GB10 unless noted &middot; greedy, reference in its own production config &middot; docs/BENCHMARKS.md</span>
-  </div>
-
-<script>
-const rows = [
-  {ref:'DwarfStar (ds4)', work:'DeepSeek-V4-Flash IQ2_XXS', v:1.144, note:'18.69 vs 16.33 tok/s'},
-  {ref:'vLLM',            work:'Qwen3.6-27B NVFP4, c1',     v:1.045, note:'86.05 vs 82.32 tok/s'},
-  {ref:'vLLM',            work:'Laguna-XS-2.1 NVFP4',       v:1.030, note:'44.46 vs 43.10 tok/s'},
-  {ref:'vLLM',            work:'Qwen3.6-35B-A3B, c32',      v:1.013, note:'3030.5 vs 2993.0 tok/s'},
-  {ref:'MLX-LM',          work:'Qwen3-0.6B, Apple M4',      v:0.976, note:'97.6% of warm total'},
-];
-
-const W=1432, H=585;
-const AX=64;                   // axis strip reserved at the bottom
-const LBL=470;                 // left label gutter
-const R=150;                   // right gutter for the value
-const lo=-0.055, hi=0.165;     // deviation domain around parity
-const pw=W-LBL-R;
-const x = d => LBL + pw*((d-lo)/(hi-lo));
-const zero = x(0);
-const rowH = (H-AX)/rows.length;
-const barH = 46;
-
-let g='';
-// faint engineering grid at 2% steps
-for(let d=-0.04; d<=0.16001; d+=0.02){
-  const gx=x(d), on0=Math.abs(d)<1e-9;
-  g+=`<line x1="${gx}" y1="4" x2="${gx}" y2="${H-AX+10}" stroke="${on0?'#4a6b78':'#16303c'}" stroke-width="${on0?2:1}"/>`;
-  g+=`<text x="${gx}" y="${H-22}" fill="${on0?'#90a8ae':'#4d6570'}" font-size="17" text-anchor="middle"
-       font-weight="${on0?'700':'400'}">${(1+d).toFixed(2)}</text>`;
-}
-
-rows.forEach((r,i)=>{
-  const cy = i*rowH + rowH/2;
-  const d  = r.v-1;
-  const ahead = d>=0;
-  const col = ahead ? '#3ab4ca' : '#e0a944';
-  const x0 = ahead ? zero : x(d);
-  const w  = Math.abs(x(d)-zero);
-
-  // reference + workload, two weights on one line
-  g+=`<text x="${LBL-26}" y="${cy-4}" fill="#e8f1f4" font-size="25" font-weight="670" text-anchor="end">${r.ref}</text>`;
-  g+=`<text x="${LBL-26}" y="${cy+22}" fill="#5d757f" font-size="19" text-anchor="end">${r.work}</text>`;
-
-  g+=`<rect x="${x0}" y="${cy-barH/2}" width="${Math.max(w,2)}" height="${barH}" rx="4" fill="${col}" opacity="0.92"/>`;
-
-  // value, then the raw measurement under it
-  const vx = ahead ? x(d)+18 : zero+18;
-  g+=`<text x="${vx}" y="${cy+1}" fill="${col}" font-size="27" font-weight="700"
-       font-variant-numeric="tabular-nums">${r.v.toFixed(3)}&times;</text>`;
-  g+=`<text x="${vx}" y="${cy+23}" fill="#5d757f" font-size="17">${r.note}</text>`;
-});
-document.getElementById('c').innerHTML=g;
-</script>
-</body>
-</html>