Field Manual No.11 · August 2026
The Bootleg Frontier Local Dev Stack
Frontier plans it. Iron builds it. Frontier judges it. 4x Opus speed, Fable-audited output, 99.6% cheaper tokens, under my desk.
Judgment stays expensive and rare. Tokens get cheap and parallel. Gates keep everyone honest. Evidence included.
A software factory in your house. Almost frontier. Almost free.
In February, Opus 4.6 was the best coding model on the planet. Six months later, a 27B open-weight model trades blows with it on the coding benchmarks that matter, runs at 206 tokens a second on one consumer GPU, and costs you electricity. This manual is the blueprint for turning that fact into a production build line.
The six things this manual gives you
- The claim, with sources. Where the local engine genuinely matches February's frontier, where it doesn't, and why the gaps don't matter once the gates are in place.
- The honest money. Leasing GPUs to run this loses to a stack of Claude Max accounts. Hardware you already own flips the math. We show both sides.
- The machine, and its two modes. One high-end gaming PC or a big-RAM Mac, one inference server, one tailnet. Swarm mode fans out parallel agents; serial mode runs one deep agent with a fat context. Same iron, different factory.
- The discipline. Three tiers, four gates, mechanical tripwires, a two-strike escalation rule, and a serial merge queue. The factory, not the vibe.
- The setup. Appendix A stands the engine up on Blackwell, older NVIDIA, or Apple Silicon, and separates the flags that matter from the version pins that rot.
- The ledger. The metrics that prove or kill the whole thesis, and the burn-in protocol to get your own numbers.
Your frontier model of choice plans the work and judges the work. The local engine burns 90 percent or more of the tokens for free. Deterministic gates sit between every handoff so nobody gets to grade their own homework.
Who this is for
Builders who already own a serious GPU or a big-memory Mac and are tired of watching API meters spin on grunt work. You do not need two machines, a server rack, or a computer science degree. You need one good box, a weekend, and the discipline to let the gates say no.
Lineage: No.08 gave you loops. No.09 gave you Strike. No.10 gave you graphs and promised the gate layer would get its own manual. This is that manual, welded to iron you own.
It was frontier in February.
Opus 4.6 shipped February 5, 2026. Adaptive thinking, a million-token context, the best agentic coding scores anyone had posted. It held the crown for ten weeks before 4.7 took over, and the line has since run through 4.8 to the Fable 5 generation. February's king is three generations back. That's the model a 27B open-weight release now trades blows with.
Alibaba's own comparison chart, run inside the Claude Code harness at temp 1.0, puts Qwen3.8-27B against Opus 4.6 Max like this:
| Benchmark | What it measures | Qwen3.8-27B | Opus 4.6 Max |
|---|---|---|---|
| SWE-bench Pro | Real-repo bug fixing | 61.7 | 53.4 |
| LiveCodeBench v6 | Competitive coding | 90.3 | 88.8 |
| IFBench | Instruction following | 79.5 | 62.5 |
| Terminal Bench 2.1 | Long tool-use sessions | 73.0 | 78.2 |
| NL2Repo-Bench | Repo-level generation | 42.3 | 47.6 |
| GPQA Diamond | Scientific reasoning | 89.2 | 91.3 |
| HLE | Frontier reasoning | 30.8 | 40.0 |
Read that honestly. The local engine wins the two coding rows that map to shipping packets of work, and it takes instruction following by seventeen points, the widest gap on the chart in either direction. That third win is the quiet one that matters most: this entire factory rests on a model obeying tight packet specs, and IFBench is the proof that this one does. Opus keeps the endurance row (Terminal Bench), the repo-scale row, and both hard reasoning rows. Two of Qwen's other headline wins came on Alibaba's own in-house benchmarks, so we don't lean on those.
The 27B executes well-specified work at frontier grade and follows orders better than the model it replaced. It drifts in long unsupervised loops and it can't out-think a frontier model on judgment. So we never ask it to. Short packets, tight specs, and a frontier model holding the plan and the red pen. The gaps in that table aren't a problem. They're the org chart.
Caveats we're keeping: Alibaba re-evaluated all baselines except Opus's official SWE-bench Pro score in their own harness setup. Benchmark deltas of five to eight points routinely shrink in daily driving. Nothing in this manual requires the local engine to be better than Opus 4.6. It requires it to be good enough to pass gates, which is a lower and more useful bar.
The lease math kills local. The sunk math resurrects it.
Here's the part the local-first crowd skips and the API-first crowd doesn't know. Both sides are half right.
The case against local
A leased RTX PRO 6000 box runs roughly $1,000 to $1,500 a month. A Claude Max seat runs $100 to $200. Same monthly spend buys you five to ten Max seats driving Claude Code with a current frontier model, million-token contexts, zero ops burden, no CUDA roulette, no thermal throttling. If you're reaching for your wallet to build this stack, stop. Buy the seats. That's not a concession, it's arithmetic.
The case for local
The math inverts on exactly one condition: you already own the iron. A gaming PC with a 5090 that's already paid for has a marginal token cost of approximately zero. Electricity in Bangkok, aircon included, rounds to pennies per hour. At that point every token you route locally is a token you didn't burn against a rate limit or a meter.
Four lanes where the owned box earns its keep:
- Bulk grunt work. Test generation, lint sweeps, doc passes, commit summaries, classification. High volume, low judgment. Burning Max quota on this is lighting money on fire.
- Rate-limit buffer. When your frontier sessions cap out mid-build, the local engine keeps the line moving instead of idling the whole factory.
- Privacy-bound work. Code and data that don't leave the building, full stop.
- Parallel fabrication. Three or four concurrent agents hammering scoped packets while your frontier seat does exactly two jobs: planning and judging.
Nobody should lease GPUs to compete with their own Claude subscription. Everybody with a paid-off 5090 should stop letting it idle.
The target economics of the full stack: frontier handles the brief, the plan, and the audits. That's input-heavy, output-light, and token-cheap. The local engine burns the other 90-plus percent of tokens at electricity prices. Your API bill becomes a judgment bill, and judgment is cheap when it's not also doing the typing.
One box. No rack. No excuses.
The reference build is a clean high-end gaming PC, retired from gaming duty and promoted to build box. Nothing exotic. If you've bought a serious rig in the last two years, you likely have most of this. On a Mac instead? Appendix A has your lane, and Section 04 explains why it might be the better one.
| Component | Spec | Job in the factory |
|---|---|---|
| GPU | RTX 5090, 32GB | The engine room. Weights live here, always fully resident. Never split a dense model to CPU, offload murders throughput. |
| RAM | 128GB DDR5 | Not for model offload. Warm-swap cache for a second engine, tmpfs for worktree builds so four test suites don't fight the disk, headroom for the harness. |
| Storage | 32TB | Model zoo, one bare repo plus worktrees per strike, and the evidence archive. Evidence only counts if you keep it. |
| Network | Tailscale | The factory becomes a private inference service. Reachable from the laptop, the phone, or a frontier agent session anywhere. No open ports, no VPS in the middle. |
The serving stack
SGLang with the NVFP4 quant and DSpark speculative decoding. This is the day-zero config behind the 206.1 tok/s single-stream number on this exact GPU class. vLLM with the same quant is the fallback. OS: Linux bare-metal is the right call for a dedicated box. WSL2 works if you must stay on Windows and costs you roughly five to ten percent throughput. Dual-boot splits the difference. Full setup, including the non-Blackwell and Apple paths, lives in Appendix A.
The KV budget, which is the real spec sheet
32GB of VRAM minus roughly 16GB of NVFP4 weights leaves about 14GB for KV cache after overhead. With fp8 KV and RadixAttention prefix caching, that budget buys you a choice: a working swarm of three to four concurrent agents at 32K to 48K context each, or one serial agent at 128K-plus. Same card, opposite factories. Section 04 is the fork in that road. Single-stream headline is 206 tok/s; under a full swarm, spec-decode fades and you land around 350 to 500 aggregate. All of it goes in your ledger.
Bind SGLang to the Tailscale interface only, never 0.0.0.0. The endpoint is then
reachable across your tailnet and invisible to everything else. Frontier in the cloud, muscle on
the tailnet.
The context ceiling is a feature. 24 to 32GB cards cannot hold 256K-context swarms, so full-repo feeds are off the table by physics. The hardware forces packet discipline, and packet discipline is what makes small models viable. The constraint is the methodology.
Same iron. Two factories.
The KV budget is a slider, not a setting. Push it one way and you get a swarm of parallel agents on tight packets. Push it the other and you get one deep agent with a fat context. Both are legitimate factories. Picking wrong for the work in hand is where builds go to die.
Swarm mode
Three or four agents, 32K to 48K each, isolated worktrees, serial merge queue. Maximum aggregate throughput, maximum gate discipline. This is the mode for partitionable work: features that split into clean packets, bulk grunt passes, anything where the plan gate can draw scope lines that don't cross. Spec-decode fades under batch, so you trade the 206 headline for 350 to 500 aggregate.
Serial mode
One agent, 128K-plus context, full speed. Batch-one is where DSpark pays best, so the single agent gets the whole 206 tok/s, not the faded per-stream rate. This is the mode for work that doesn't partition: cross-cutting refactors, migrations touching forty files with shared state, anything where packet boundaries would slice through a dependency. Forcing swarm onto un-partitionable work is how you get merge queue carnage.
Long single-agent loops are exactly where the local engine loses to Opus (the Terminal Bench row). So serial mode runs with the W2 cross-audit always-on, milestone audits at closer intervals, the file-churn and diff-reversal tripwires at half thresholds, and a generous wall clock. Serial trades partition overhead for gate overhead. Pick your tax, but pay one of them.
The deep lane: Apple Silicon
A Mac Studio with 128 to 512GB of unified memory changes the shape of serial mode entirely. The 27B's weights take their 16GB and leave hundreds of gigabytes for KV: full 256K context without blinking, something no consumer NVIDIA card can touch. The tradeoff is bandwidth. Expect 30 to 60 tok/s decode and noticeably slower prefill. So the Studio isn't the slow lane, it's the deep lane: overnight serial packets, whole-module context, big integration audits that run while you sleep. The 5090 sprints. The Studio goes deep. A builder with both has a complete factory.
| The brief looks like | Run it as |
|---|---|
| Splits into clean, scope-separate packets | Swarm on the 5090 |
| Cross-cutting, shared state, un-partitionable | Serial on the 5090, tight gates |
| Needs 100K-plus context, or can run overnight | Deep lane on the Studio |
Mode is declared per brief at the plan gate, logged per packet in the ledger. It's a routing decision, not a lifestyle.
Judgment. Muscle. Iron.
Every failure mode in agentic coding comes from letting one tier do another tier's job. The factory works because the boundaries are hard.
Your frontier model of choice. Fable 5, Opus 4.8, whichever is current when you read this. It does four things and only four things: writes the plan, partitions the work, audits milestones, and rescues stuck packets. Low token volume, highest stakes. This is the only tier that costs real money, and it should be single-digit percent of total tokens.
The 27B on your SGLang endpoint. It executes packets. That's the whole job description. It gets a tight spec, a scoped slice of the repo, and a token budget. It does not see the whole plan, it does not make architectural calls, and it does not decide when it's done. 200-plus tokens a second, in swarm or serial per the plan gate's call, at electricity prices.
Tests, linters, type checkers, the build. Free, instant, and immune to persuasion. Iron runs between every model touchpoint. No packet reaches a model reviewer until iron says green. This is the cheapest quality gate in the entire stack and the one most people skip.
Models argue. Iron doesn't. Route every dispute downhill to the tier that can't be sweet-talked.
The tier boundaries are also the cost boundaries. Every token that leaks upward from Muscle to Judgment is money. Every check that leaks upward from Iron to Muscle is wasted compute. The factory's entire economic engine is keeping work at the lowest tier that can verify it.
Five stages, four gates.
Baseline Freeze
Strike discipline. Tag the repo state, capture a green test baseline, record build evidence. Nothing promotes unless it beats or matches baseline. No baseline, no run.
Brief and Plan (Judgment)
Frontier ingests the brief, writes the plan, partitions it into strike packets, and declares the mode: swarm, serial, or deep lane. Each packet is self-contained: goal, files in scope, constraints, acceptance criteria, required evidence, hard token budget. The packet spec is the only context Muscle ever gets beyond retrieved files. This is where frontier's million-token context earns its fee: it sees the whole repo so the local engine never has to.
Packets checked for dependency order and scope collision. Two packets touching the same file get serialized or merged. A brief that won't partition gets routed to serial mode here, not forced into packets. Human eyeball optional, cheap, and worth it.
Fabrication (Muscle)
Packets fan out to isolated worktrees, one local agent per packet, batched on the SGLang endpoint. The loop per packet: implement, run iron, self-fix, repeat until green or a tripwire fires.
Deterministic only. Tests green, lint clean, types clean, build passes, diff confined to declared scope. No model opinion involved. Packets that fail here never reach frontier. This gate is what keeps the API bill near zero.
Waves (Escalation)
The stuck ladder, covered in full in Section 08. Local retry, local cross-audit, then and only then frontier rescue.
Merge Queue (Serial)
Packets integrate one at a time, full iron re-run after each merge. Parallel build, serial integration. A packet that was green in isolation and breaks the queue goes back to S3 carrying the integration failure as its case file.
Frontier reviews the integrated diff against the original brief: architecture drift, security, spec coverage, everything iron can't see. Input-heavy, output-light, cheap. Findings route back as fix packets.
Final frontier QA plus the full evidence bundle: baseline diff, test evidence, audit findings and resolutions, cost ledger. Promote only evidence-backed states. Ship.
The model never gets to say "I'm stuck."
Because it won't. A local model doesn't know it's stuck. It is confidently wrong at 206 tokens a second, and it will polish garbage all night if you let it. Escalation is triggered by the harness, mechanically, never by the model's self-assessment.
The five tripwires
- Three consecutive reds. Same test failure survives three fix attempts. The agent doesn't understand the failure. Stop feeding it.
- File churn. Same file edited three-plus times with no gate progress. It's rearranging deck chairs.
- Token budget breach. Every packet ships with a hard budget from the plan. Blowing it is a signal, not an inconvenience.
- Diff reversal. The agent reverts its own earlier edit. It's going in circles and doesn't know it.
- Wall clock cap. The dumbest tripwire and the one that saves you the most. Nothing runs unattended past its time box.
Every one of these is a grep against the harness log, not a judgment call. The moment you let a model decide whether it's stuck, you've handed the arsonist the smoke detector. The tripwires are dumb on purpose. Dumb is auditable.
What fires when a tripwire trips
The packet halts, the harness snapshots the state (diff, failing output, token spend, attempt log), and the packet enters the wave ladder with that snapshot as its case file. The local agent never gets to argue. The worktree is preserved exactly as it died, because the autopsy is worth more than the corpse.
Calibration: start generous (three reds, three edits, 150 percent of estimated tokens, 20-minute wall clock) and tighten from your ledger. Serial-mode packets run churn and reversal at half thresholds with a longer clock, per Section 04. Tripwires that never fire are set too loose. Tripwires that fire on half your packets mean your specs are bad, not your model.
The escalation ladder, and the two-strike rule.
A tripped packet climbs the ladder one rung at a time. Each rung is more expensive than the last, so the ladder's job is to resolve as low as possible.
Local retry, armed with the autopsy
Same engine, fresh context, and this time the failure evidence is in the prompt: the exact failing output, the diff that didn't work, the attempt history. Cheap, fast, and it clears most trips. A surprising amount of "stuck" is just a poisoned context.
Local adversarial cross-audit
A second local agent, cold context, reviews the diff against the packet spec. IJFW discipline: findings tagged consensus or contested. A different context window catches what the first one normalized. Still free.
Frontier rescue
Frontier gets the packet spec, the diff, and the full failure case file. It fixes the specific blocker and hands the packet back to Muscle. It does not rewrite the packet, it unblocks it. First real money spent on this packet.
If the same packet reaches W3 twice, frontier owns it to completion. No third handback. Ping-pong between tiers is worse than either tier working alone, and the second strike is your signal that the packet was mis-scoped at planning time. Log that too. It's a planning defect, not an execution defect.
When W2 runs even without a trip
Two modes, set per packet at planning time. Milestone-critical packets get always-on W2: the cross-audit runs before the merge queue even when iron is green, because tests can pass while the spec quietly drifts. Everything else runs W2 on-failure only, trusting iron. Serial-mode packets are milestone-critical by definition, so W2 is always-on there, no exceptions: one deep agent with a long leash needs the second opinion most. Blanket always-on doubles your local compute for single-digit catch rates; blanket on-failure lets spec drift ride green tests into the queue. Split it deliberately.
Target from the ledger: under 20 percent of packets ever reaching W3. Above that, the problem is upstream in your packet specs, and no amount of model swapping fixes a planning problem.
If it isn't logged, it didn't happen.
The factory's entire claim to legitimacy is measurable. The harness logs every packet: tokens by tier, wall clock, gate failures, wave reached, mode, and outcome. From that raw log, four metrics decide whether this whole architecture earns its keep on your hardware.
| Metric | What it tells you | Target |
|---|---|---|
| Escalation rate | Percent of packets reaching W3. The single best measure of whether local muscle plus tight specs actually works. | Under 20% |
| Frontier token share | Frontier tokens as a percent of all tokens. The cost story lives or dies here. | Single digits |
| First-pass iron rate | Packets clearing Gate 2 on the first attempt. Measures spec quality as much as model quality. | 60%+ |
| Cost per merged packet | Total spend divided by packets that survived the queue. The number you post. | Pennies |
The control group, or it's just vibes
Run the same 10 to 20 packets two ways: full frontier end to end, and the factory pipeline. Same specs, same gates, same repo. Log cost, wall clock, first-pass rates, and escalations for both. If the factory clears 80-plus percent of packets without frontier rescue, the cost per task collapse is real and you have the evidence. If it clears 40 percent, the honest report says the engine isn't ready and the harness is, which is still worth knowing, because the engine is a config change.
single-stream decode: ___ tok/s / serial at 128K: ___ tok/s / swarm aggregate,
4 agents: ___ tok/s / prefill, 30K: ___ s
escalation rate: ___% / frontier token share: ___% / first-pass iron: ___% /
cost per merged packet: $___
These slots are deliberate. This manual ships with the architecture proven and the local numbers unproven, because your numbers on your iron are the only ones that matter. Fill them in during your first burn-in week, then post the ledger in The Forge. That's how No.10's gatebench got hardened, and it's how this gets hardened.
The failure modes, before the comments find them.
- The endurance gap is real. The local engine loses Terminal Bench by five points, and that gap is exactly what it looks like: drift in long unsupervised tool loops. Swarm mode survives this by never running long loops. Serial mode lives closest to the edge, which is why it runs W2 always-on with tightened tripwires. If your packets sprawl and your gates loosen, the architecture degrades to the benchmark gap. Packet size is a load-bearing decision.
- The 206 evaporates under load. Speculative decoding pays best at batch one. Under a four-agent swarm the per-stream number drops hard even as the aggregate climbs. Quote your aggregate, not the launch-day headline, or someone in the comments will do it for you.
- Prefill is the hidden tax. Agentic coding re-reads files every turn, and decode speed says nothing about prefill. RadixAttention prefix caching claws a lot back since packets share a system prompt and spec preamble, but budget for it and log it. The deep lane pays this tax heaviest: Apple Silicon prefill on 100K-plus contexts is measured in minutes, which is fine overnight and miserable interactively.
- Judgment does not localize. The HLE gap (30.8 vs 40.0) is why planning and audit stay on frontier, permanently. Every few months someone will tell you the new local model can plan. Check the reasoning rows before you believe them, then check your escalation rate after.
- Windows costs you. WSL2 runs the stack at a five to ten percent throughput tax and occasional CUDA passthrough weirdness. A dedicated build box deserves bare-metal Linux. If the box still games on weekends, dual-boot and stop feeling bad about it.
- The engine is a socket, not a marriage. Qwen3.8-27B is this quarter's engine. Something replaces it within 90 days, guaranteed. The harness talks to an OpenAI-compatible endpoint and nothing else, so swapping weights is a config line. The gates, tripwires, and ledger are the permanent asset. Engines depreciate. Discipline compounds.
The honest version of the pitch: this stack doesn't make a small model smart. It makes a small model's dumbness cheap to catch.
Every claim, sourced.
| Claim | Source and caveat |
|---|---|
| Qwen3.8-27B vs Opus 4.6 Max benchmark table | Alibaba Qwen3.8 launch chart, August 2026. Run in the Claude Code harness, temp 1.0, top_p 0.95, 256K context. All baselines re-evaluated by Alibaba except Opus's SWE-bench Pro score, which is the officially reported number. QwenSWEBench and CoWorkBench are Alibaba in-house and excluded from our table. |
| 206.1 tok/s on a single RTX 5090 | SGLang team day-zero announcement, August 14, 2026. NVFP4 quant plus DSpark speculative decoding, single-stream decode. Best-case launch number; spec-decode acceptance drops on dense code and under batch. Same config quoted for the RTX PRO 6000 class. DGX Spark posted 38.28 on the same test, which is the unified-memory bandwidth wall in one stat. |
| "4x Opus speed" | Opus 4.6 measured at 37.8 tok/s output on the Anthropic API (Artificial Analysis), with 40 to 60 typical under load. 206 against that range is 3.4x to 5.4x. The cover says 4x because we round toward the conservative end of our own claim. Fight us. |
| Opus 4.6 timeline | Released February 5, 2026 (Anthropic announcement). Succeeded by Opus 4.7 on April 16, 2026, then 4.8, then the Fable 5 generation. "Frontier in February" is literal. |
| "99.6% cheaper tokens" | Per-token electricity math: 206 tok/s at roughly 600W wall draw is about 0.8 kWh per million tokens, roughly $0.10 at Bangkok rates. Opus-class output tokens run $25 per million. That's 99.6 percent cheaper per token, stated to the decimal because we did the arithmetic. Double the wattage assumption to 1,200W and it's still 99.2. Per token, not per project: your project cost includes the frontier planning and audit share, which the ledger in Section 09 measures. |
| Swarm, serial, and deep lane numbers | Derived from the KV arithmetic and published bandwidth, not measured: batch-one spec-decode keeps the 206 headline, swarm aggregate of 350 to 500 comes from weight-read reuse minus spec-decode fade, Apple Studio decode of 30 to 60 tok/s follows from unified-memory bandwidth with slow prefill. Estimates until the burn-in slots say otherwise. That's what the slots are for. |
| Lease vs seats math | RTX PRO 6000 class hosted boxes at roughly $1,000 to $1,500 a month against Claude Max at $100 to $200 a seat. Prices move; the ratio hasn't. |
| KV budget and swarm sizing | Derived: 32GB VRAM, ~16GB NVFP4 weights for a dense 27B, ~14GB usable KV with fp8 cache. Three to four agents at 32K to 48K each, or one serial agent at 128K-plus. Verify against your own SGLang startup logs; the slot in Section 09 is waiting. |
| Gate and strike discipline | Ferrox Labs, prior art: IJFW (cross-audit workflow), Field Manual No.09 (Strike: worktrees, serial merge queue, evidence-backed promotion), No.10 (gates and gatebench). This manual is the gate layer No.10 promised, welded to owned hardware. |
Standing rule, unchanged since No.10: every claim traceable to a primary source, every caveat the source publishes appears here, and sourcing without caveats is marketing. If you catch a number that doesn't hold, post it in the group. Public corrections are cheaper than quiet errors.
Flags don't rot. Version pins do.
Launch-week install commands are stale by September, so this appendix refuses to pretend otherwise. Below are the load-bearing flags, the ones that define the factory regardless of which point release you install. Get the current version pins from the living recipes (the Unsloth Qwen3.8 guide and the SGLang docs are the two that stay current), then make sure these survive the paste:
serve --model <qwen3.8-27b, NVFP4 on Blackwell / int4-AWQ elsewhere>
--kv-cache-dtype fp8 # doubles your agent count
--context-length 49152 # swarm; 131072+ for serial
--host <your-tailscale-ip> # NEVER 0.0.0.0
--enable-prefix-caching # packets share preamble, cash it in
--speculative <DSpark per current recipe; skip on pre-Blackwell>Pick your iron
| Iron | Path | Single-stream | Swarm | The honest note |
|---|---|---|---|---|
| RTX 5090 (32GB) | SGLang, NVFP4 + DSpark | ~206 tok/s | 3-4 agents, 350-500 agg | The reference build. Full headline path. |
| RTX PRO 6000 (96GB) | Same path | ~206 tok/s | 8-12 agents | The real swarm host, if you own one. |
| RTX 4090 / 3090 | int4 AWQ/GPTQ Marlin, vLLM or SGLang | 60-90 tok/s | 2-3 agents | No NVFP4 or DSpark pre-Blackwell. Still a factory. |
| Mac Studio (128GB+) | MLX or llama.cpp GGUF Q6 | 30-60 tok/s | Serial only | The deep lane: 256K context, slow prefill. See Section 04. |
| Tonight-simple | Ollama / LM Studio, Q4 | 40-60 tok/s | 1 agent | Zero ceremony. Every gate and tripwire still applies. |
Run the agent user non-privileged or in containers, worktrees on a scratch path, no secrets in the agent's environment, and the endpoint bound to the tailnet only. Your build box holds SSH keys and browser sessions. The agents never need to know that.
Thermals: a gaming case sustaining multi-agent decode in a Thai August is not a gaming session. Set a real fan curve, clean the dust filters, and watch clocks for the first hour. A throttling engine quietly wrecks your wall-clock tripwires. Bench before you believe: run the single-stream and swarm benches from the burn-in plan before trusting any number in this table on your box.
Six jobs. Any harness that does them qualifies.
The factory is a discipline, not a product. Whatever orchestrates it must do these six things, mechanically:
- Serve packets. Hand each agent its spec and its scoped files, nothing more. No agent ever sees the whole plan.
- Run iron between every model touch. Tests, lint, types, build. No packet reaches any model reviewer before iron says green.
- Watch the five tripwires. Greps against the log, never model self-assessment. Halt, snapshot, preserve the worktree.
- Climb the waves. W1 retry with the failure evidence, W2 cross-audit, W3 frontier rescue, two-strike ownership transfer. No skipping rungs downward.
- Serialize the merge queue. One integration at a time, full iron re-run per merge, failures back to the ladder with the integration case file.
- Append everything to the ledger. Tokens by tier, wall clock, gates, waves, mode, outcome. Append-only. If it isn't logged, it didn't happen.
The packet spec, the atom of the whole system
PACKET strike-2608-004
GOAL Add fp8 KV flag to server bootstrap; expose in config
SCOPE src/server/boot.py, config/serve.yaml (ONLY these)
CONSTRAINTS No new dependencies. Public API stays stable.
ACCEPT pytest tests/server -q green / mypy clean / diff <= 120 lines
EVIDENCE test output, mypy output, diff stat
BUDGET 40K tokens / 15 min wall / mode: swarm / W2: on-failureEvery line is load-bearing. SCOPE powers the diff-confinement check at the iron gate. ACCEPT is what W2 audits against. BUDGET arms two tripwires. A packet missing any of these lines is a plan-gate failure, not an agent problem.
IJFW carries the gate workflow and the multi-AI cross-audit discipline out of the box. The tripwire watcher and the merge queue are Claude Code hooks plus about a hundred lines of glue against the SGLang endpoint. More of this line is getting productized at Ferrox Labs; watch the group.
Frontier's seat at the table: Tier 1 runs wherever you already run it, a Claude Code session on a Max seat or straight API. It reads the brief and the repo, emits packet specs in the format above, and gets called back only at Gate 3, Gate 4, and W3. The harness treats it as exactly one more endpoint with a much bigger invoice.
Your weekend, in order.
Stand up the engine
Pick your iron from Appendix A, pull current pins from the living recipes, keep the load-bearing flags. Bind to the tailnet interface. Run the single-stream bench, the serial 128K bench, and the swarm bench. Write the numbers down. Those are your first entries in the ledger.
Wire the harness
Stand up the six jobs from Appendix B against the local endpoint. Set the five tripwires generous. Pick a real repo with a green test suite, freeze the baseline, and have frontier cut ten small packets from a real brief, mode declared per packet.
Run the line and read the ledger
Fan out, let the gates work, let the tripwires fire. Then read the four numbers: escalation rate, frontier share, first-pass iron, cost per merged packet. Now you know whether this architecture pays on your iron. Not vibes. A ledger.
Six months ago the muscle in this factory was the best coding model money could buy. Today it's a free download and a warm GPU. That gap between frontier and free is now measured in weeks, and every time it closes, this same factory gets a better engine for a config line. Build the factory once. Upgrade the engine forever.
Post your burn-in ledger in The Forge. The targets in this manual get replaced by community medians as the numbers come in, same as gatebench. Come tell us what broke. That's how this gets good.