Selective execution blocker-resolution pass#

Latest scoped result: bounded MoE batch. Qwen35 independently completed fixture and UTC with full collection; Gemma passed a safe fixture but its UTC response exhausted output. Qwen27 remains preserved and was not rerun. Both pilots and general routing stay disabled. Earlier sections retain historical scope.

Historical bounded qualification: qwen3:4b-instruct outcome. Real SDK tool calls worked, but generated code failed protected acceptance; the useful repository task remained gated for that configuration. New terminal/collector controls preserve failed evidence and do not activate implementation or either pilot. Earlier model results below remain historical, configuration-specific evidence.

Latest status: see the scoped OpenHands qualification. It supersedes earlier installation, transport and model-safety blockers; the historical results below retain their original identities. Pilots and production implementation remain inactive.

Historical 2026-10-08 evidence. The installed-model follow-up supersedes its four-model inventory and timings, records the fresh nine-tag screen, and retains the unresolved real SDK/context/transport gates and separate approval packages. It also records later unintended Ollama cache and GPT tag changes.

This is a continuation on codex/selective-local-execution, based on 0b817c572a81a22c94988cdbf163d214957985b7. No runtime, test, dependency pin, production default or security gate changed in this pass. Only qualification documentation changed. No installation, image pull, model download, driver change, commit, push, merge or publication occurred. Both pilots remain inactive.

Private evidence is in workspace data/selective-blockers-20261008/ (B below). Earlier evidence remains in data/selective-egpu-qualification-20261008/ (Q).

Regression closure and exact candidate#

The complete source suite passed: 508 passed, 1 skipped, 795.89 seconds. All 225 cases from Q/regression-complete.xml are present and passed in this run; they are a subset, not an additional count. The one skip is the existing Windows symlink privilege condition. Coverage includes legacy bridge, auto/direct/workflow routing, profiles/skills/budgets, durable recovery and real crash boundaries, cancellation, native Tk controls, research fixtures, selective providers/contracts/review/integration and MCP/process tests. Model services in these automated tests are synthetic.

Source manifest at execution: 5651d4c8172c411c2771c6e2f9704695920af92e4abd48338bfbaa3a9e999e2d. B/source-before.json records every file hash. B/full-regression-summary.json confirms no source changed during the run and no old subset cases were missing.

97 selective tests passed in 28.82 seconds against the installed final wheel, outside the checkout. This overlaps source coverage and is not added to it. Wheel SHA-256: 42de265e805c4b2216f40cb5db5bea5f6fe238275f45eccf49b26768785c4233. B/installed-runtime-identity.json records the actual import directory and zero byte mismatches against every packaged runtime file, including executor assets. This is final-artifact testing, not an inference from normalized line endings. An initial command pointed to a nonexistent copied-test directory; it ran no tests, is retained in installed-final.log, and is not counted as a regression.

The existing 15-second crash-fixture allowance changed no production deadline. The complete run includes actual lease-expiry recovery and late-result guards. An additional deterministic diagnostic on the installed workflow store advances only that module's clock: ownership works immediately before the actual expiry; reserve, result and finish all reject at and after expiry; recovery preserves the spent reservation and hands off as interrupted. It neither sleeps nor changes the stored expiry. See B/deterministic-expiry.json. These diagnostic assertions are not added to pytest counts. No further timeout increase or weakened assertion was needed.

Ruff, all 43 Markdown/config/CLI documentation checks, the 217-file public-source audit and git diff --check passed after the documentation update. The final preservation record confirms unchanged clean original development/release trees and no remaining owned probe containers. Runtime and tests remain byte-identical to the full regression and installed-wheel runs. Updated source-distribution identity/contents are recorded separately; the tested executable wheel stays fixed.

Live environment findings#

Read-only recheck at 2026-10-08T20:34:43.8579744Z confirms 34,139,435,008 bytes installed RAM, RTX 12,288 MiB, driver 560.94, PCI 07:00.0 and the same NVIDIA UUID (retained privately). Idle GPU allocation was 511 MiB. Available physical memory was 20,216,584 KiB; free storage was 135,002,558,464 bytes on C and 2,978,172,481,536 bytes on D. This idle snapshot is not a combined model/SDK memory qualification. See B/hardware-final.json.

The model directory currently contains gpt-oss:20b, qwen3:14b-q4_K_M, qwen3:4b-instruct and qwen3-vl:4b. In particular, the earlier qwen3:4b manifest is absent. qwen3:4b-instruct is a possible small fixture candidate, subject to fresh exact-binding, tool-schema, context and real SDK qualification; its name and shared weights, if any, do not transfer acceptance from another tag. No model was created, deleted, renamed or substituted by this pass.

Read-only inspection of the existing Ollama 0.40.1 service at 2026-10-08T20:37:10Z confirmed the 4b-instruct tag digest matches its on-disk manifest. It reports Qwen3 4.0B / Q4_K_M, tools/thinking/completion capabilities and a 262,144 model context ceiling; no model was resident. Those advertised capabilities and ceiling do not prove reliable tool use or feasible context on this machine. Keep the proposed fixture at 16,384 pending actual SDK measurement. No generation or service change was requested. See B/existing-ollama-model-capabilities.json.

Selected sandbox plan and measured limits#

Prefer the existing Linux engine with a read-only root and bounded writable mounts for the small fixture. No global Docker storage migration, WSL change, GPU passthrough, host mount or broad inference listener is required.

Diagnostic limits were workspace 64 MiB, temporary files 32 MiB, home/state 32 MiB, exchange 16 MiB and shared memory 8 MiB: 152 MiB total data capacity. Each allocation wrote real nonzero bytes until ENOSPC; st_blocks matched bytes allocated, not sparse size. Root writes failed with EROFS; creating a file in /dev failed for the worker. The default /dev tmpfs is 64 MiB and root-owned; proc/sys/cgroup protections and all actual mount flags are recorded. POSIX message queues, pipes and process/kernel memory also need their cgroup/ulimit bounds preserved. No filesystem is left as an unlimited worker scratch area.

The diagnostic used 512 MiB memory, swap disabled, 0.5 CPU and 32 PIDs. Peak sampled memory.current during its largest sequential allocation was about 86.4 MB. Tmpfs is charged inside the memory cgroup, not extra memory. For the SDK fixture propose the existing 2 GiB RAM / 2 CPU / 128 PID limits, 152 MiB writable data, 8 MiB shm, no swap, bounded file sizes, file descriptors and message queues. Windows, WSL, LAB, Ollama and KV headroom still require a fresh combined measurement; the old 17.66 GB host-headroom sample excludes SDK execution. Keep one inference job and one active sandbox at a time.

The probe selected Docker's none logging driver, so container stdout cannot grow daemon log files. Controller diagnostics/artifact capture must remain bounded by the contract and a proposed 128 MiB total fixture-artifact allowance; that aggregate allowance still needs implementation/testing with the new profile. Existing historical evidence is not pruned to make room.

Compatibility failure is concrete: docker cp into either / or /workspace fails with a read-only-root error. Copying out observes the underlying image path, not the live tmpfs content. Do not enable this profile just by dropping --storage-opt. A trusted, fixed initialization command through docker exec successfully creates protected root-owned files; UID 10001 can edit only the permitted file, cannot write/chmod the root-owned acceptance file, and a bounded exec-based read collects the changed bytes and hashes. Diagnostic acceptance ran with exit 0. This uses ordinary Python, not SDK tool calls.

Before activation, adapt the existing sandbox transport to fixed, bounded exec-based initialization/mailbox/collection, keep the container alive until artifacts are durably collected, and reconcile interrupted collection without replaying the agent. A lost tmpfs after container/VM shutdown must escalate, not claim recoverable output. Run scope/ownership/cancellation/restart tests and independent verifier checks against this exact profile. The existing overlay2/XFS gate stays unchanged until that replacement passes. No unrestricted host fallback or broader permissions are proposed.

OpenHands approval manifest — independent of Strata#

This is a prepared approval package, not permission to install.

Archive payload sizes above come from package metadata and range-read ZIP directories, not an installation. The 0.5 GB and 2 GiB values are planning estimates/reservations, not measured installed/peak usage. B/dependency-validation.json reports no unsatisfied base requirements; requested extras were resolved from the pinned upstream lock. No browser, browser download, autonomous subagent or hosted provider is activated by installing transitive packages.

Registry investigation independently resolved the published 1.53.0-python Linux/amd64 manifest to sha256:a6865fc1da99c6e1038c70fde59df237d16d48ac30aadcc9a98916dc56bcf7a0, with 1,202,198,853 bytes of compressed layers. Its config records the same SDK source revision, but launches a packaged agent-server executable. It is not selected as a drop-in Python SDK environment and is not a required download. No mutable latest tag or SDK upgrade is proposed.

Rollback: stop only verified owned jobs/containers, remove the newly recorded image/build references and private wheelhouse/SDK directory, and keep the pre-existing image, user containers, models and durable evidence. No system configuration change or administrator driver action is part of this approval.

Strata approval manifest — separate and deferred#

Pinned source: fb58e0dbc8399662c0e47c76578c6e878b14f6cf; engine 0.1.41. Only Coder IQ1_M at model revision 5348543e0147355ac9cbcb031184a3546350988e is proposed, with Apache-2.0 weights. IQ1_M is the variant's name; upstream describes mixed precision and expert pruning, so do not interpret it as uniformly one-bit weights.

Total planned payload: 64,439,597,563 bytes standard, or 64,652,937,028 bytes experimental CUDA 12, excluding HTTP overhead and any separately approved driver package. Source totals use raw blobs to make the transfer budget explicit, not an unmeasured compressed archive. Asset integrity must be checked after approved retrieval; metadata hashes alone are not a local artifact verification.

Estimated retained install is 90–95 GB, estimated preparation peak about 100 GB; reserve 120 GiB before starting. Generated pack/filesystem overhead and actual peak cannot be measured without preparation. These estimates are not proof of RAM fit. No extra model family, vision asset, compiler, CUDA toolkit or silent newer-release fallback is included.

No administrator privileges for the private directories/venv. Keep loopback binding, disable Strata tools/MCP, use the RTX UUID alone, initially propose 16,384 context / int8 KV / vision off / low-RAM mmap, and measure actual Windows + LAB + Strata + cache/KV headroom before adding the SDK sandbox. Rollback removes only newly approved task-owned source/runtime/model/pack directories after owned-process shutdown; retain Ollama assets and evidence. Do not activate this package until the driver/runtime choice below is resolved.

Driver investigation and recommendation#

Windows 10 Home 19045 is unchanged. The RTX device is PCI VEN_10DE/DEV_2503, the Dell GTX 1060 Max-Q is VEN_10DE/DEV_1C20, subsystem 08251028. The GTX reports Code 31 and NTSTATUS 0xC0000182 (device configuration error). Its assigned package is oem80.inf / 582.66; the RTX uses oem42.inf / 560.94. The shared nvlddmkm service points to the 560.94 DriverStore binary. SetupAPI records Windows Update installing the RTX 560.94 package on October 8 and modifying that existing service. Available logs do not contain a definitive GTX failure transition. A driver mismatch is a supported hypothesis; neither a broken GPU nor a proven cause is established.

NVIDIA's 581.80 release notes list Windows 10 1803+ x64, desktop RTX 3060 and notebook GTX 1060. This common WHQL package meets Strata's numerical >=580 requirement for the RTX alone. The official desktop DCH installer HEAD reports 896,544,928 bytes. Exact Dell subsystem binding still needs package-INF/OEM confirmation before installation; generic product support is not Dell certification.

Do not use this as a routine driver-upgrade recommendation. NVIDIA's May 2026 bulletin identifies pre-582.53 R580 versions as affected for Pascal. The installed newer 582.66 security package lists legacy GPUs, not RTX 3060. A single currently security-maintained official GeForce package covering both exact devices was not verified. Prefer keeping the working RTX configuration for Ollama/OpenHands and obtaining Dell/NVIDIA guidance on a common supported package before changing drivers.

A driver change would be a separate administrator/reboot operation. Before approval: verify both hardware IDs in the proposed signed package, preserve oem42/oem80 exports and the working 560.94 installer, record current bindings and create an appropriate restore/recovery point. If the RTX qualification regresses, restore the recorded working package/bindings and repeat its short exact-model check. No driver cleanup, device disabling, BIOS change or automatic rollback was performed.

Strata's experimental CUDA 12 guidance allows explicit CUDA 12 on an RTX and gives a Windows floor of 528, while saying such older drivers were not tested upstream. Current 560.94 passes that numerical floor but is not qualified for this engine. It avoids a driver change but is a separately approved experimental route, not equivalent to the standard route. Do not select both GPUs or pool their VRAM.

Next decision and pilot readiness#

No real OpenHands/Ollama implementation task succeeded: none was submitted because the required SDK environment is not installed and the new restricted transport is not yet implemented/qualified. Environment diagnostics are not substituted for that result. Model tool-use, SDK protocol, candidate review/integration and bounded correction behavior remain live qualification gates.

The smallest next approval is OpenHands only: the 101,666,057-byte pinned dependency set and isolated image build, with 2 GiB preparation allowance. It requires no Strata, GPU driver update or system reconfiguration. Then qualify the restricted adapter and actual terminal/editor/acceptance loop with an existing exact model, inspect the real diff, independently verify it, and bind supervisor acceptance to its candidate hash. Keep implementation disabled until all pass.

A future Codex-only versus Ollama-hybrid comparison can run without Strata once this combination qualifies. It must be an explicitly approved, separately named protocol with fresh independent starting revisions and the same acceptance checks. The original eight-case/three-lane protocol is unchanged and inactive. Neither smoke checks nor this regression result establish token savings, quality equivalence or release readiness.

Gemma-only follow-up, 2026-10-10: the single scoped comparison stopped its fixture during loading at the unchanged GPU-memory ceiling. No Gemma implementation was accepted; UTC was not run. This is a resource/configuration blocker, not a model-quality failure. Qwen's independently accepted isolated UTC patch is preserved. No runtime code, installation, production default or pilot changed; a further Gemma configuration requires a new scoped authorization.

Current batch changes and validation (2026-10-10): optional scoped native Ollama draft_num_predict forwarding/validation in inference.py and selective_config.py, three deterministic cases and setup/report documentation. Codex performed this bootstrap directly; the local model generated its isolated UTC patch. Full source 564 passed / 1 skipped; 153 overlapping extracted-wheel checks passed; copied v0.4.1 upgrade retention passed. No install or schema change. Final identities, cleanup and storage are in data/openhands-moe-20261010. Both original checkouts and the accepted Qwen27 patch remain unchanged. Human dock checks remain untested.