chore: bump inference defaults from unsloth

.agents/backend-signing.md

@@ -16,7 +16,8 @@ side (`pkg/oci/cosignverify` plus the gallery YAML).
   per-arch manifest before checking signatures.
 - **Storage:** Signatures are written as OCI 1.1 referrers
   (`--registry-referrers-mode=oci-1-1`) in the new Sigstore bundle format
-  (`--new-bundle-format`). No `:sha256-<hex>.sig` tag clutter.
+  (current cosign releases do this by default; no `--new-bundle-format`
+  flag). No `:sha256-<hex>.sig` tag clutter.
 - **Consumer:** `pkg/oci/cosignverify` discovers the bundle via the
   referrers API, hands it to `sigstore-go`, and verifies it against the
   policy declared in the gallery YAML (`Gallery.Verification`).
@@ -33,15 +34,14 @@ to sign. The job needs:
 
 - `permissions: { id-token: write, contents: read }` at the job level so
   the runner can exchange its GitHub OIDC token for a Fulcio cert.
-- `sigstore/cosign-installer@v3` step (the pinned cosign v2 release needs
-  `--new-bundle-format` explicitly).
+- `sigstore/cosign-installer@v3` step (current cosign releases already
+  default to the new bundle format).
 - After each `docker buildx imagetools create`, resolve the resulting
   list digest with `docker buildx imagetools inspect <tag> --format
   '{{.Manifest.Digest}}'` and sign:
 
 ```sh
 cosign sign --yes --recursive \
-  --new-bundle-format \
   --registry-referrers-mode=oci-1-1 \
   "${REGISTRY_REPO}@${DIGEST}"
 ```
@@ -70,7 +70,7 @@ entry (`backend/index.yaml`):
   url: github:mudler/LocalAI/backend/index.yaml@master
   verification:
     issuer: "https://token.actions.githubusercontent.com"
-    identity_regex: "^https://github\\.com/mudler/LocalAI/\\.github/workflows/backend_merge\\.yml@refs/(heads/master|tags/.+)$"
+    identity_regex: "^https://github\\.com/mudler/LocalAI/\\.github/workflows/backend_merge\\.yml@refs/heads/master$"
     # Optional revocation cutoff; advance during incident response.
     # not_before: "2026-06-01T00:00:00Z"
 ```

.github/workflows/backend_merge.yml

@@ -71,8 +71,8 @@ jobs:
 
       # cosign signs each pushed manifest list with --recursive so the
       # index and every per-arch entry get an attached Sigstore bundle.
-      # The pinned cosign v2 release needs --new-bundle-format explicitly;
-      # the verifier only consumes OCI 1.1 Sigstore bundle referrers.
+      # Recent cosign releases always emit the new bundle format, so
+      # there's no extra CLI flag to opt into it.
       - name: Install cosign
         if: github.event_name != 'pull_request'
         uses: sigstore/cosign-installer@v3
@@ -159,7 +159,6 @@ jobs:
           # manifest before checking signatures need the per-arch
           # signatures, not just the list-level one.
           cosign sign --yes --recursive \
-            --new-bundle-format \
             --registry-referrers-mode=oci-1-1 \
             "quay.io/go-skynet/local-ai-backends@${digest}"
 
@@ -186,7 +185,6 @@ jobs:
           ' <<< "$DOCKER_METADATA_OUTPUT_JSON")
           digest=$(docker buildx imagetools inspect "$first_tag" --format '{{.Manifest.Digest}}')
           cosign sign --yes --recursive \
-            --new-bundle-format \
             --registry-referrers-mode=oci-1-1 \
             "localai/localai-backends@${digest}"
 

core/config/inference_defaults.json

@@ -41,12 +41,12 @@
     "glm-5": {"min_p":0.01,"repeat_penalty":1,"temperature":1,"top_k":-1,"top_p":0.95},
     "glm-4": {"min_p":0.01,"repeat_penalty":1,"temperature":1,"top_k":-1,"top_p":0.95},
     "nemotron": {"min_p":0.01,"repeat_penalty":1,"temperature":1,"top_k":-1,"top_p":1},
-    "minimax-m3": {"min_p":0.01,"repeat_penalty":1,"temperature":1,"top_k":40,"top_p":0.95},
     "minimax-m2.7": {"min_p":0.01,"repeat_penalty":1,"temperature":1,"top_k":40,"top_p":0.95},
     "minimax-m2.5": {"min_p":0.01,"repeat_penalty":1,"temperature":1,"top_k":40,"top_p":0.95},
     "minimax": {"min_p":0.01,"repeat_penalty":1,"temperature":1,"top_k":40,"top_p":0.95},
     "gpt-oss": {"min_p":0.01,"repeat_penalty":1,"temperature":1,"top_k":0,"top_p":1},
     "granite-4": {"min_p":0.01,"repeat_penalty":1,"temperature":0,"top_k":0,"top_p":1},
+    "kimi-k3": {"min_p":0,"repeat_penalty":1,"temperature":1,"top_k":-1,"top_p":0.95},
     "kimi-k2": {"min_p":0.01,"repeat_penalty":1,"temperature":0.6,"top_k":-1,"top_p":0.95},
     "kimi": {"min_p":0.01,"repeat_penalty":1,"temperature":0.6,"top_k":-1,"top_p":0.95},
     "lfm2": {"min_p":0.15,"repeat_penalty":1.05,"temperature":0.1,"top_k":50,"top_p":0.1},
@@ -58,5 +58,5 @@
     "grok": {"min_p":0.01,"repeat_penalty":1,"temperature":1,"top_k":-1,"top_p":0.95},
     "mimo": {"min_p":0.01,"repeat_penalty":1,"temperature":0.7,"top_k":-1,"top_p":0.95}
   },
-  "patterns": ["qwen3.6","qwen3.5","qwen3-coder","qwen3-next","qwen3-vl","qwen3","qwen2.5-coder","qwen2.5-vl","qwen2.5-omni","qwen2.5-math","qwen2.5","qwen2-vl","qwen2","qwq","gemma-4","gemma-3n","gemma-3","medgemma","gemma-2","llama-4","llama-3.3","llama-3.2","llama-3.1","llama-3","phi-4","phi-3","mistral-nemo","mistral-small","mistral-large","magistral","ministral","devstral","pixtral","deepseek-v4","deepseek-r1","deepseek-v3","deepseek-ocr","glm-5","glm-4","nemotron","minimax-m3","minimax-m2.7","minimax-m2.5","minimax","gpt-oss","granite-4","kimi-k2","kimi","lfm2","smollm","olmo","falcon","ernie","seed","grok","mimo"]
+  "patterns": ["qwen3.6","qwen3.5","qwen3-coder","qwen3-next","qwen3-vl","qwen3","qwen2.5-coder","qwen2.5-vl","qwen2.5-omni","qwen2.5-math","qwen2.5","qwen2-vl","qwen2","qwq","gemma-4","gemma-3n","gemma-3","medgemma","gemma-2","llama-4","llama-3.3","llama-3.2","llama-3.1","llama-3","phi-4","phi-3","mistral-nemo","mistral-small","mistral-large","magistral","ministral","devstral","pixtral","deepseek-v4","deepseek-r1","deepseek-v3","deepseek-ocr","glm-5","glm-4","nemotron","minimax-m2.7","minimax-m2.5","minimax","gpt-oss","granite-4","kimi-k3","kimi-k2","kimi","lfm2","smollm","olmo","falcon","ernie","seed","grok","mimo"]
 }

core/http/middleware/trace.go

@@ -60,7 +60,6 @@ type APIExchange struct {
 }
 
 var traceBuffer *circularbuffer.Queue[APIExchange]
-var inFlightTraces = make(map[string]APIExchange)
 var mu sync.Mutex
 var logChan = make(chan traceCommand, 100)
 var traceIDSeq atomic.Uint64
@@ -127,17 +126,16 @@ func initializeTracing(dataPath string, maxItems int) {
 					continue
 				}
 				exchange := *command.exchange
-				mu.Lock()
-				delete(inFlightTraces, exchange.ID)
-				if traceBuffer != nil {
-					traceBuffer.Enqueue(exchange)
-				}
-				mu.Unlock()
 				if command.store != nil {
 					if err := command.store.Append(exchange.ID, exchange); err != nil {
 						xlog.Warn("Failed to persist API trace", "error", err)
 					}
 				}
+				mu.Lock()
+				if traceBuffer != nil {
+					traceBuffer.Enqueue(exchange)
+				}
+				mu.Unlock()
 			}
 		}()
 	})
@@ -263,38 +261,6 @@ func TraceMiddleware(app *application.Application) echo.MiddlewareFunc {
 			// tens of MB, which then locks the admin Traces UI fetching the
 			// JSON dump faster than the 5s auto-refresh.
 			maxBodyBytes := app.ApplicationConfig().TracingMaxBodyBytes
-			requestHeaders := redactSensitiveHeaders(c.Request().Header)
-			requestBody, requestTruncated := truncateForTrace(body, maxBodyBytes)
-			exchange := APIExchange{
-				ID:        nextTraceID(),
-				Timestamp: startTime,
-				ClientIP:  c.RealIP(),
-				UserAgent: c.Request().UserAgent(),
-				Request: APIExchangeRequest{
-					Method:        c.Request().Method,
-					Path:          c.Path(),
-					Headers:       &requestHeaders,
-					Body:          &requestBody,
-					BodyTruncated: requestTruncated,
-					BodyBytes:     len(body),
-				},
-			}
-			if user := auth.GetUser(c); user != nil {
-				exchange.UserID = user.ID
-				exchange.UserName = user.Name
-			}
-			mu.Lock()
-			inFlightTraces[exchange.ID] = exchange
-			mu.Unlock()
-			queued := false
-			defer func() {
-				if queued {
-					return
-				}
-				mu.Lock()
-				delete(inFlightTraces, exchange.ID)
-				mu.Unlock()
-			}()
 
 			// Wrap response writer to capture body
 			resBody := new(bytes.Buffer)
@@ -321,27 +287,47 @@ func TraceMiddleware(app *application.Application) echo.MiddlewareFunc {
 			// the trace endpoint is admin-only but the buffer is also reachable
 			// via any heap-dump-style introspection, and tokens shouldn't
 			// outlive the request that carried them.
+			requestHeaders := redactSensitiveHeaders(c.Request().Header)
+			requestBody, requestTruncated := truncateForTrace(body, maxBodyBytes)
 			responseHeaders := redactSensitiveHeaders(c.Response().Header())
 			responseBody := make([]byte, resBody.Len())
 			copy(responseBody, resBody.Bytes())
-			exchange.Duration = time.Since(startTime)
-			exchange.Response = APIExchangeResponse{
-				Status:        status,
-				Headers:       &responseHeaders,
-				Body:          &responseBody,
-				BodyTruncated: mw.truncated,
-				BodyBytes:     mw.totalBytes,
+			exchange := APIExchange{
+				ID:        nextTraceID(),
+				Timestamp: startTime,
+				Duration:  time.Since(startTime),
+				ClientIP:  c.RealIP(),
+				UserAgent: c.Request().UserAgent(),
+				Request: APIExchangeRequest{
+					Method:        c.Request().Method,
+					Path:          c.Path(),
+					Headers:       &requestHeaders,
+					Body:          &requestBody,
+					BodyTruncated: requestTruncated,
+					BodyBytes:     len(body),
+				},
+				Response: APIExchangeResponse{
+					Status:        status,
+					Headers:       &responseHeaders,
+					Body:          &responseBody,
+					BodyTruncated: mw.truncated,
+					BodyBytes:     mw.totalBytes,
+				},
 			}
 			if handlerErr != nil {
 				exchange.Error = handlerErr.Error()
 			}
 
+			if user := auth.GetUser(c); user != nil {
+				exchange.UserID = user.ID
+				exchange.UserName = user.Name
+			}
+
 			mu.Lock()
 			store := traceStore
 			mu.Unlock()
 			select {
 			case logChan <- traceCommand{exchange: &exchange, store: store}:
-				queued = true
 			default:
 				xlog.Warn("Trace channel full, dropping trace")
 			}
@@ -359,10 +345,6 @@ func GetTraces() []APIExchange {
 		return []APIExchange{}
 	}
 	traces := traceBuffer.Values()
-	for _, exchange := range inFlightTraces {
-		exchange.Duration = time.Since(exchange.Timestamp)
-		traces = append(traces, exchange)
-	}
 	mu.Unlock()
 
 	slices.SortFunc(traces, func(a, b APIExchange) int {

core/http/middleware/trace_live_test.go

@@ -1,108 +0,0 @@
-// SPDX-License-Identifier: MIT
-
-package middleware
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"time"
-
-	"github.com/labstack/echo/v4"
-	"github.com/mudler/LocalAI/core/application"
-	"github.com/mudler/LocalAI/core/config"
-	"github.com/mudler/LocalAI/pkg/system"
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-)
-
-var _ = Describe("live API traces", func() {
-	newApp := func(root string) *application.Application {
-		app, err := application.New(
-			config.EnableTracing,
-			config.WithDataPath(root),
-			config.WithDisableLocalAIAssistant(true),
-			config.WithDisableStats(true),
-			config.WithSystemState(&system.SystemState{
-				Model:   system.Model{ModelsPath: root},
-				Backend: system.Backend{BackendsPath: root},
-			}),
-		)
-		Expect(err).NotTo(HaveOccurred())
-		DeferCleanup(func() { Expect(app.Shutdown()).To(Succeed()) })
-		ClearTraces()
-		return app
-	}
-
-	It("lists a request while its handler is still running", func() {
-		root := GinkgoT().TempDir()
-		app := newApp(root)
-
-		started := make(chan struct{})
-		release := make(chan struct{})
-		DeferCleanup(func() {
-			select {
-			case <-release:
-			default:
-				close(release)
-			}
-		})
-		handler := TraceMiddleware(app)(func(c echo.Context) error {
-			close(started)
-			<-release
-			return c.NoContent(http.StatusNoContent)
-		})
-
-		e := echo.New()
-		req := httptest.NewRequest(http.MethodPost, "/slow", http.NoBody)
-		req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
-		rec := httptest.NewRecorder()
-		ctx := e.NewContext(req, rec)
-		ctx.SetPath("/slow")
-		done := make(chan error, 1)
-		go func() {
-			done <- handler(ctx)
-		}()
-		<-started
-
-		var running APIExchange
-		Eventually(func() bool {
-			traces := GetTraces()
-			if len(traces) != 1 {
-				return false
-			}
-			running = traces[0]
-			return running.Request.Path == "/slow"
-		}).Should(BeTrue())
-		Expect(running.Response.Status).To(Equal(0))
-		Expect(running.Duration).To(BeNumerically(">", 0))
-
-		close(release)
-		Expect(<-done).To(Succeed())
-		Eventually(func() []APIExchange { return GetTraces() }).Should(ConsistOf(
-			And(
-				HaveField("ID", running.ID),
-				HaveField("Response.Status", http.StatusNoContent),
-				HaveField("Duration", BeNumerically(">", time.Duration(0))),
-			),
-		))
-	})
-
-	It("removes an in-flight trace when the handler panics", func() {
-		app := newApp(GinkgoT().TempDir())
-		handler := TraceMiddleware(app)(func(echo.Context) error {
-			panic("handler panic")
-		})
-		e := echo.New()
-		req := httptest.NewRequest(http.MethodPost, "/panic", http.NoBody)
-		req.Header.Set(echo.HeaderContentType, echo.MIMEApplicationJSON)
-		ctx := e.NewContext(req, httptest.NewRecorder())
-		ctx.SetPath("/panic")
-
-		func() {
-			defer func() { _ = recover() }()
-			_ = handler(ctx)
-		}()
-
-		Expect(GetTraces()).To(BeEmpty())
-	})
-})

core/http/react-ui/e2e/traces-live.spec.js

@@ -1,22 +0,0 @@
-import { test, expect } from './coverage-fixtures.js'
-
-test('marks an API trace with no response status as in progress', async ({ page }) => {
-  await page.route('**/api/traces?*', route => route.fulfill({
-    json: [{
-      id: 'running-1',
-      timestamp: '2026-08-05T02:00:00Z',
-      duration: 2_000_000_000,
-      request: { method: 'POST', path: '/v1/chat/completions' },
-      response: { status: 0 },
-    }],
-    headers: { 'X-Total-Count': '1' },
-  }))
-  await page.route('**/api/backend-traces?*', route => route.fulfill({ json: [] }))
-
-  await page.goto('/app/traces')
-
-  const row = page.locator('tbody tr').filter({ hasText: '/v1/chat/completions' })
-  await expect(row.getByText('Running', { exact: true })).toBeVisible()
-  await expect(row.locator('[title="In progress"]')).toBeVisible()
-  await expect(row.locator('.fa-check-circle')).toHaveCount(0)
-})

core/http/react-ui/src/pages/Traces.jsx

@@ -664,16 +664,10 @@ export default function Traces() {
                     <td><span className="badge badge-info">{trace.request?.method || '-'}</span></td>
                     <td className="text-mono text-sm">{trace.request?.path || '-'}</td>
                     <td className="text-sub cell-clip" title={trace.user_name || trace.user_id || ''}>{trace.user_name || trace.user_id || '-'}</td>
-                    <td>
-                      {trace.response?.status === 0
-                        ? <span className="badge badge-info">Running</span>
-                        : <span className={`badge ${trace.response.status < 400 ? 'badge-success' : 'badge-error'}`}>{trace.response.status}</span>}
-                    </td>
+                    <td><span className={`badge ${(trace.response?.status || 0) < 400 ? 'badge-success' : 'badge-error'}`}>{trace.response?.status || '-'}</span></td>
                     <td><LatencyCell ns={trace.duration} max={slowestTrace} /></td>
                     <td className="text-center">
-                      {trace.response?.status === 0
-                        ? <i className="fas fa-spinner fa-spin text-primary" title="In progress" />
-                        : trace.error
+                      {trace.error
                         ? <i className="fas fa-times-circle text-error" title={trace.error} />
                         : <i className="fas fa-check-circle text-success" />}
                     </td>

docs/content/features/backends.md

@@ -72,44 +72,6 @@ tags:
   - "text-generation"
 ```
 
-### Verifying OCI Backends
-
-Backend galleries can require keyless Sigstore signatures for every OCI image
-they provide. Add a `verification` policy to the gallery configuration, then
-enable strict integrity mode:
-
-```bash
-export LOCALAI_BACKEND_GALLERIES='[{"name":"localai","url":"github:mudler/LocalAI/backend/index.yaml@master","verification":{"issuer":"https://token.actions.githubusercontent.com","identity_regex":"^https://github\\.com/mudler/LocalAI/\\.github/workflows/backend_merge\\.yml@refs/(heads/master|tags/.+)$"}}]'
-export LOCALAI_REQUIRE_BACKEND_INTEGRITY=1
-local-ai run
-```
-
-The policy pins the Fulcio issuer and the GitHub Actions workflow identity that
-signed the image. The identity expression covers development images produced
-from `master` and release images produced from tags. Use a narrower expression
-if your deployment only accepts one release channel.
-
-Without strict mode, an OCI gallery without a verification policy installs
-with a warning. With strict mode, LocalAI refuses galleries without a policy,
-images without a compatible Sigstore bundle, and signatures that do not match
-the configured identity. Existing images published before bundle signing was
-enabled must be rebuilt or re-signed before strict deployments can install
-them.
-
-An optional `not_before` RFC3339 value revokes signatures logged before that
-time. Advance it after a signing-workflow compromise, then rebuild or re-sign
-the trusted images:
-
-```json
-{
-  "verification": {
-    "issuer": "https://token.actions.githubusercontent.com",
-    "identity_regex": "^https://github\\.com/mudler/LocalAI/\\.github/workflows/backend_merge\\.yml@refs/(heads/master|tags/.+)$",
-    "not_before": "2026-08-05T00:00:00Z"
-  }
-}
-```
-
 ## Pre-installing Backends
 
 You can pre-install backends when starting LocalAI using the `LOCALAI_EXTERNAL_BACKENDS` environment variable:

docs/content/features/tracing.md

@@ -9,11 +9,6 @@ LocalAI can retain recent API exchanges and backend operations for inspection
 on the **Traces** page in the management interface. Enable tracing in runtime
 settings or with the existing tracing configuration.
 
-API requests appear while they are still running. Their elapsed duration
-updates when the page refreshes, and the result column marks them as in
-progress until the response completes. In-flight requests live only in memory;
-the completed exchange is what LocalAI adds to the bounded, persistent history.
-
 API and backend trace histories are persisted in separate directories below
 the configured data path. They are restored after a clean service restart,
 whether or not authentication is enabled.

gallery/index.yaml

@@ -2091,83 +2091,6 @@
     - filename: llama-cpp/models/Qwen-AgentWorld-35B-A3B-GGUF/Qwen-AgentWorld-35B-A3B-UD-Q4_K_M.gguf
       sha256: e7a8eafdd8013443b6bcc4b6fb47b2d2025f772d359650b9ceb7d75971e22cad
       uri: https://huggingface.co/unsloth/Qwen-AgentWorld-35B-A3B-GGUF/resolve/main/Qwen-AgentWorld-35B-A3B-UD-Q4_K_M.gguf
-- &agents-a1-4b
-  name: "agents-a1-4b"
-  variants:
-    - model: agents-a1-4b-q8
-  url: "github:mudler/LocalAI/gallery/virtual.yaml@master"
-  urls:
-    - https://huggingface.co/InternScience/Agents-A1-4B
-    - https://huggingface.co/InternScience/Agents-A1-4B-Q4_K_M-GGUF
-  description: |
-    Agents-A1-4B is InternScience's Apache-2.0 dense 4B agentic model, based on
-    Qwen3.5. It is trained for long-horizon search, engineering and scientific
-    research, instruction following, tool use, and multimodal tasks. This entry
-    uses the official Q4_K_M GGUF quantization and vision projector.
-  license: "apache-2.0"
-  tags:
-    - llm
-    - gguf
-    - vision
-    - multimodal
-    - gpu
-    - cpu
-  icon: https://huggingface.co/InternScience/Agents-A1-4B/resolve/main/figures/logo_nobg.png
-  overrides:
-    backend: llama-cpp
-    function:
-      automatic_tool_parsing_fallback: true
-      grammar:
-        disable: true
-    known_usecases:
-      - chat
-    mmproj: llama-cpp/mmproj/Agents-A1-4B-Q4_K_M/Agents-A1-4B-mmproj.gguf
-    options:
-      - use_jinja:true
-    parameters:
-      model: llama-cpp/models/Agents-A1-4B-Q4_K_M/Agents-A1-4B-Q4_K_M.gguf
-    template:
-      use_tokenizer_template: true
-  files:
-    - filename: llama-cpp/models/Agents-A1-4B-Q4_K_M/Agents-A1-4B-Q4_K_M.gguf
-      sha256: d93c393a9bd5139a4b5cfe24d31ef553c5a497bfb8afec178a354ecbf508f062
-      uri: huggingface://InternScience/Agents-A1-4B-Q4_K_M-GGUF/Agents-A1-4B-Q4_K_M.gguf
-    - filename: llama-cpp/mmproj/Agents-A1-4B-Q4_K_M/Agents-A1-4B-mmproj.gguf
-      sha256: 254145e7e03e9e8d3120813fac8033ffa04e411eb6d70a198833504935681084
-      uri: huggingface://InternScience/Agents-A1-4B-Q4_K_M-GGUF/Agents-A1-4B-mmproj.gguf
-- !!merge <<: *agents-a1-4b
-  name: "agents-a1-4b-q8"
-  variants: []
-  urls:
-    - https://huggingface.co/InternScience/Agents-A1-4B
-    - https://huggingface.co/InternScience/Agents-A1-4B-Q8_0-GGUF
-  description: |
-    Agents-A1-4B is InternScience's Apache-2.0 dense 4B agentic model, based on
-    Qwen3.5. It is trained for long-horizon search, engineering and scientific
-    research, instruction following, tool use, and multimodal tasks. This entry
-    uses the official Q8_0 GGUF quantization and vision projector.
-  overrides:
-    backend: llama-cpp
-    function:
-      automatic_tool_parsing_fallback: true
-      grammar:
-        disable: true
-    known_usecases:
-      - chat
-    mmproj: llama-cpp/mmproj/Agents-A1-4B-Q8_0/Agents-A1-4B-mmproj.gguf
-    options:
-      - use_jinja:true
-    parameters:
-      model: llama-cpp/models/Agents-A1-4B-Q8_0/Agents-A1-4B-Q8_0.gguf
-    template:
-      use_tokenizer_template: true
-  files:
-    - filename: llama-cpp/models/Agents-A1-4B-Q8_0/Agents-A1-4B-Q8_0.gguf
-      sha256: c327f66e820dae550bd230394595071c79f48c88d411b452d013ee4b5999fcea
-      uri: huggingface://InternScience/Agents-A1-4B-Q8_0-GGUF/Agents-A1-4B-Q8_0.gguf
-    - filename: llama-cpp/mmproj/Agents-A1-4B-Q8_0/Agents-A1-4B-mmproj.gguf
-      sha256: 254145e7e03e9e8d3120813fac8033ffa04e411eb6d70a198833504935681084
-      uri: huggingface://InternScience/Agents-A1-4B-Q8_0-GGUF/Agents-A1-4B-mmproj.gguf
 - name: "ornith-1.0-9b"
   variants:
     - model: ornith-1.0-9b-mtp

scripts/build/backend-signing_test.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-WORKFLOW="$(dirname "$(realpath "$0")")/../../.github/workflows/backend_merge.yml"
-
-sign_commands=$(grep -Ec -- '^[[:space:]]+cosign sign([[:space:]]|$)' "$WORKFLOW" || true)
-bundle_flags=$(grep -Ec -- '^[[:space:]]+--new-bundle-format([[:space:]]|$)' "$WORKFLOW" || true)
-if [ "$sign_commands" -ne 2 ] || [ "$bundle_flags" -ne "$sign_commands" ]; then
-  echo "FAIL: every backend signing command must request the new bundle format (commands=$sign_commands flags=$bundle_flags)"
-  exit 1
-fi
-
-echo "PASS: backend signing emits Sigstore bundles for both registries"

website/content/blog/what-landed-in-localai-4-8.md

@@ -36,11 +36,6 @@ The third one was `/api/traces` returning a 21 MB unpaginated blob that the UI p
 
 ## One gallery entry, several builds
 
-<figure>
-<img src="/media/v4-8-0-ui-model-variants.png" alt="The model detail pane listing every variant">
-<figcaption>One entry, four builds. LocalAI picks the largest that fits and marks it auto-selected.</figcaption>
-</figure>
-
 Installing a model no longer means reading a list of quantizations and guessing which one your card will hold. A gallery entry can now declare `variants:`, a list of references to other entries that are alternative builds of the same weights:
 
 ```yaml
@@ -68,11 +63,6 @@ It has grown features vLLM does not have, which is most of the reason the port e
 
 Tool calling is at llama.cpp parity by construction, because chat deliberately reuses the same autoparser path: full minja chat templates, `tool_choice: auto` lowered to a lazy structural-tag decode constraint, 30 tool dialects, 7 reasoning parsers, and streamed `ChatDelta` and `ToolCallDelta`.
 
-<figure>
-<img src="/media/v4-8-0-vllm-cpp-scoreboard.png" alt="Throughput of vllm.cpp relative to each reference engine, drawn as deviation from parity">
-<figcaption>llama.cpp is left out because its 1.18x is a prefill ratio, and putting that on the same axis as throughput would compare two different measurements.</figcaption>
-</figure>
-
 Numbers from the project's own [scoreboard](https://github.com/mudler/vllm.cpp/blob/master/docs/BENCHMARKS.md), which calls ties ties and losses losses. Above 1.0 means vllm.cpp is ahead:
 
 <div class="tw">
@@ -83,19 +73,16 @@ Numbers from the project's own [scoreboard](https://github.com/mudler/vllm.cpp/b
 <tr><td>vLLM</td><td>Qwen3.6-35B-A3B NVFP4, GB10</td><td>1.010x at c16 and 1.013x at c32, behind from c1 to c8 (0.817x at c1)</td></tr>
 <tr><td>llama.cpp</td><td>Qwen3.5-2B GGUF, CPU aarch64</td><td>prefill 1.18x, decode a tie, memory parity</td></tr>
 <tr><td>MLX-LM</td><td>Qwen3-0.6B, Apple M4</td><td>97.6% of warm total, prefill ahead</td></tr>
-<tr><td>DwarfStar (ds4)</td><td>DeepSeek-V4-Flash IQ2_XXS, one DGX Spark</td><td>18.69 vs 16.33 tok/s decode, <b>1.144x</b>, same output</td></tr>
-<tr><td>vLLM</td><td>Laguna-XS-2.1 NVFP4, GB10</td><td>44.46 vs 43.10 tok/s, <b>1.03x</b>, same output</td></tr>
+<tr><td>DwarfStar (ds4)</td><td>DeepSeek-V4-Flash IQ2_XXS, one DGX Spark</td><td>16.28 vs 16.33 tok/s decode, 0.997x, a parity result</td></tr>
 </tbody>
 </table>
 </div>
 
 The upstream page is careful about its own noise: on the 27B grid the run-to-run spread is 0.5% and c2 through c32 land between 0.7% and 1.7%, so it calls those five ties rather than wins. The concurrency-1 result is the one it stands behind.
 
-The DeepSeek-V4-Flash row is the one that shows how far this has moved from being a vLLM port. It runs DeepSeek-V4-Flash at roughly 2-bit (IQ2_XXS mixed, about 80 GB) on a single DGX Spark, decoding at 18.69 tok/s against DwarfStar's 16.33. At 300B+ total parameters even a 4-bit checkpoint is 156 GB or more, so a 2-bit GGUF is what fits inside the Spark's 119 GiB unified pool, and reading GGUF is what makes that possible.
+The DeepSeek-V4-Flash row is the one that shows how far this has moved from being a vLLM port. It runs DeepSeek-V4-Flash at roughly 2-bit (IQ2_XXS mixed, about 80 GB) on a single DGX Spark, decoding at 16.28 tok/s against DwarfStar's 16.33. At 300B+ total parameters even a 4-bit checkpoint is 156 GB or more, so a 2-bit GGUF is what fits inside the Spark's 119 GiB unified pool, and reading GGUF is what makes that possible.
 
-That number moved twice in a week, and the second move came from one lever. The dense Q8_0 projection tower was being read from the GGUF mmap over unified memory, which the GB10 reads about 20% slower per-GEMV than device memory. Staging that 6 GiB tower device-resident once at load, same bytes and same kernels, took decode from 16.23 to 18.69, generating the same tokens and using no more peak memory. The same change took Laguna-XS-2.1 from 87% of vLLM to 1.03x ahead of it.
-
-Speculative decoding is in similar shape: MTP on Qwen3.6-27B NVFP4 generates the same tokens as vLLM's MTP and runs about 4% faster at concurrency 1.
+Speculative decoding is in similar shape: MTP on Qwen3.6-27B NVFP4 is token-identical to vLLM's MTP and about 4% faster at concurrency 1.
 
 Configuration is a normal backend install:
 
@@ -181,11 +168,6 @@ The `bonsai` backend serves the 1-bit (Q1_0) and ternary (Q2_0) Bonsai quantizat
 
 ## The operations bar became a page
 
-<figure>
-<img src="/media/v4-8-0-ui-activity.png" alt="The Activity page with four installs running">
-<figcaption>Four backend installs in flight, and the record of what already finished.</figcaption>
-</figure>
-
 The old operations bar rendered one row per in-flight operation above every page. Queue four model installs and a backend and it took most of the viewport, on every route, until the last one finished. It was doing two jobs at once. A global "something is happening" signal only needs one line, and the detail of what is happening needs a page of its own.
 
 The strip is now one line, permanently, showing a failure first and otherwise the least-advanced running operation, with a `+N more` pill. Its `✕` hides the strip and no longer cancels anything. That is a deliberate behavior change worth knowing about before you click it out of habit: the same glyph used to cancel a 17 GB download in one row and dismiss a message in the next. Cancelling moved to the new page, behind a button that says so.

website/layouts/index.html

@@ -39,8 +39,7 @@
     <p class="kicker rv">The runtime</p>
     <h2 class="rv mt1" style="max-width:21ch">Everything else plugs into LocalAI.</h2>
     <p class="lede rv mt2">One binary with an OpenAI-compatible API in front of it. Point an existing client at it and the calls keep working, except now the model is on your machine. It also speaks the Anthropic, Ollama and ElevenLabs APIs, so most tools need a URL change and nothing else.</p>
-    <p class="lede rv mt2">The engine behind that API is swappable. One model can run on llama.cpp while the next loads on vLLM, SGLang or MLX, and the client never notices: same endpoint, same request, different engine underneath. Switching is one line in the model's config.</p>
-    <p class="lede rv mt2">A small core pulls each engine in as a separate backend, only when a model asks for it. That is why one install covers this much ground without becoming a 9 GB download.</p>
+    <p class="lede rv mt2">Underneath, a small core pulls each engine in as a separate backend, only when a model asks for it. That is why one install covers this much ground without becoming a 9 GB download.</p>
     <div class="apis rv">
       <span>OpenAI API</span><span>Anthropic API</span><span>Ollama API</span><span>ElevenLabs API</span><span>Realtime over WebRTC</span>
     </div>

website/static/media/v4-8-0-vllm-cpp-scoreboard.html

@@ -1,100 +0,0 @@
-<!doctype html>
-<html>
-<head>
-<meta charset="utf-8">
-<style>
-  /* palette lifted from the two logos:
-     LocalAI  #0E2632 navy, #385360 slate, #469AAF teal, #90A8AE haze
-     vllm.cpp #3AB4CA teal, #95C4D1 light                              */
-  :root{
-    --bg:#0b1c25; --ink:#e8f1f4; --dim:#90a8ae; --faint:#5d757f;
-    --teal:#3ab4ca; --teal-hi:#7fd4e2; --amber:#e0a944; --rule:#1d3440;
-  }
-  *{margin:0;padding:0;box-sizing:border-box}
-  html,body{width:1600px;height:900px}
-  body{
-    background:radial-gradient(1250px 720px at 80% -12%, #143140 0%, var(--bg) 62%);
-    color:var(--ink);
-    font-family:-apple-system,"SF Pro Display","Segoe UI",Helvetica,Arial,sans-serif;
-    -webkit-font-smoothing:antialiased; padding:58px 84px; position:relative;
-  }
-  .eyebrow{display:flex;align-items:center;gap:14px;color:var(--teal);
-    font-weight:600;font-size:23px;letter-spacing:.14em;text-transform:uppercase}
-  .eyebrow .dot{width:11px;height:11px;border-radius:50%;background:var(--teal);
-    box-shadow:0 0 16px 2px var(--teal)}
-  h1{font-size:56px;line-height:1.06;font-weight:760;margin:16px 0 6px;letter-spacing:-.02em}
-  h1 .grad{background:linear-gradient(92deg,var(--teal),var(--teal-hi));
-    -webkit-background-clip:text;background-clip:text;color:transparent}
-  .sub{color:var(--dim);font-size:23px;margin-bottom:14px}
-  svg{width:100%;height:auto;display:block}
-  .foot{position:absolute;left:84px;right:84px;bottom:40px;display:flex;
-    justify-content:space-between;align-items:center;color:var(--faint);
-    font-size:21px;border-top:1px solid var(--rule);padding-top:16px}
-  .foot .link{color:var(--ink);font-weight:600}
-</style>
-</head>
-<body>
-  <div class="eyebrow"><span class="dot"></span>vllm.cpp &middot; throughput vs the reference engine</div>
-  <h1>Measured against <span class="grad">what each workload actually runs on</span></h1>
-  <div class="sub">Throughput relative to the reference. 1.00 is parity, bars run from it. Higher is faster.</div>
-
-  <svg id="c" viewBox="0 0 1432 585"></svg>
-
-  <div class="foot">
-    <span class="link">github.com/mudler/vllm.cpp</span>
-    <span>GB10 unless noted &middot; greedy, reference in its own production config &middot; docs/BENCHMARKS.md</span>
-  </div>
-
-<script>
-const rows = [
-  {ref:'DwarfStar (ds4)', work:'DeepSeek-V4-Flash IQ2_XXS', v:1.144, note:'18.69 vs 16.33 tok/s'},
-  {ref:'vLLM',            work:'Qwen3.6-27B NVFP4, c1',     v:1.045, note:'86.05 vs 82.32 tok/s'},
-  {ref:'vLLM',            work:'Laguna-XS-2.1 NVFP4',       v:1.030, note:'44.46 vs 43.10 tok/s'},
-  {ref:'vLLM',            work:'Qwen3.6-35B-A3B, c32',      v:1.013, note:'3030.5 vs 2993.0 tok/s'},
-  {ref:'MLX-LM',          work:'Qwen3-0.6B, Apple M4',      v:0.976, note:'97.6% of warm total'},
-];
-
-const W=1432, H=585;
-const AX=64;                   // axis strip reserved at the bottom
-const LBL=470;                 // left label gutter
-const R=150;                   // right gutter for the value
-const lo=-0.055, hi=0.165;     // deviation domain around parity
-const pw=W-LBL-R;
-const x = d => LBL + pw*((d-lo)/(hi-lo));
-const zero = x(0);
-const rowH = (H-AX)/rows.length;
-const barH = 46;
-
-let g='';
-// faint engineering grid at 2% steps
-for(let d=-0.04; d<=0.16001; d+=0.02){
-  const gx=x(d), on0=Math.abs(d)<1e-9;
-  g+=`<line x1="${gx}" y1="4" x2="${gx}" y2="${H-AX+10}" stroke="${on0?'#4a6b78':'#16303c'}" stroke-width="${on0?2:1}"/>`;
-  g+=`<text x="${gx}" y="${H-22}" fill="${on0?'#90a8ae':'#4d6570'}" font-size="17" text-anchor="middle"
-       font-weight="${on0?'700':'400'}">${(1+d).toFixed(2)}</text>`;
-}
-
-rows.forEach((r,i)=>{
-  const cy = i*rowH + rowH/2;
-  const d  = r.v-1;
-  const ahead = d>=0;
-  const col = ahead ? '#3ab4ca' : '#e0a944';
-  const x0 = ahead ? zero : x(d);
-  const w  = Math.abs(x(d)-zero);
-
-  // reference + workload, two weights on one line
-  g+=`<text x="${LBL-26}" y="${cy-4}" fill="#e8f1f4" font-size="25" font-weight="670" text-anchor="end">${r.ref}</text>`;
-  g+=`<text x="${LBL-26}" y="${cy+22}" fill="#5d757f" font-size="19" text-anchor="end">${r.work}</text>`;
-
-  g+=`<rect x="${x0}" y="${cy-barH/2}" width="${Math.max(w,2)}" height="${barH}" rx="4" fill="${col}" opacity="0.92"/>`;
-
-  // value, then the raw measurement under it
-  const vx = ahead ? x(d)+18 : zero+18;
-  g+=`<text x="${vx}" y="${cy+1}" fill="${col}" font-size="27" font-weight="700"
-       font-variant-numeric="tabular-nums">${r.v.toFixed(3)}&times;</text>`;
-  g+=`<text x="${vx}" y="${cy+23}" fill="#5d757f" font-size="17">${r.note}</text>`;
-});
-document.getElementById('c').innerHTML=g;
-</script>
-</body>
-</html>