{
  "rows": [
    {
      "id": "smollm2-fused-kernel",
      "concept": "In-kernel model (oracle-exact forward pass + kernel-owned KV)",
      "category": "model",
      "surface": "subsystem",
      "what_you_get": "A pure-Go model whose KV cache is a kernel-owned Go structure, every rung proven bit-for-bit against a HuggingFace oracle — so the kernel can evict a poisoned span at the KV level.",
      "audience": "researcher",
      "maturity": "shipped",
      "claims_section": "In-kernel model",
      "claims_tag": "SHIPPED",
      "first_command": "",
      "first_command_verb": "",
      "needs_gpu": false,
      "needs_key": false,
      "witness_path": "internal/model",
      "witness": "go test ./internal/model (oracle argmax-exact, per-layer cos=1.0, final-logits max|d|~4.4e-5)",
      "entry_doc": "docs/benchmarks/IN-KERNEL-MODEL-RESULTS.md",
      "verdict": "real-not-easy",
      "gaps": [
        "Reference-grade correctness on a 135M model, not serving-grade throughput on a 7B+ model",
        "The fine-tuned syscall/adjudication model is unbuilt; the fused model is stock SmolLM2"
      ],
      "durability_note": "The HF oracle witnesses every layer numerically; bit-exactness is a non-regressing cost of correctness enforced by CI."
    },
    {
      "id": "kv-quarantine-bridge",
      "concept": "KV-quarantine bridge (quarantine evicts the K/V span)",
      "category": "model",
      "surface": "subsystem",
      "what_you_get": "When a tool result is quarantined, the kernel mechanically evicts that result's K/V span, leaving the attention cache bit-identical to never having seen the poison.",
      "audience": "developer",
      "maturity": "shipped",
      "claims_section": "In-kernel model",
      "claims_tag": "SHIPPED",
      "first_command": "",
      "first_command_verb": "",
      "needs_gpu": false,
      "needs_key": false,
      "witness_path": "internal/kvmmu",
      "witness": "go test ./internal/kvmmu (max|d|=0 vs never-saw, non-vacuous poison control max|d|~0.33)",
      "entry_doc": "docs/benchmarks/KV-QUARANTINE-BRIDGE-RESULTS.md",
      "verdict": "real-not-easy",
      "gaps": [
        "The eviction witness uses a synthetic model (HF numerics proven separately by the oracle)",
        "Not yet wired into the live agent HTTP loop"
      ],
      "durability_note": "Three-way witness: byte-gate verdict, bit-exact reposition invariant, and eviction confirmed against a non-vacuous control."
    },
    {
      "id": "parity-lane",
      "concept": "Parity lane (parallel matmul + batched prefill, bit-identical)",
      "category": "model",
      "surface": "subsystem",
      "what_you_get": "A parallelized matmul and batched-prefill GEMM whose every output is bit-identical to the serial reference, so the model gets faster with no proven-correctness rung disturbed.",
      "audience": "researcher",
      "maturity": "shipped",
      "claims_section": "In-kernel model",
      "claims_tag": "SHIPPED",
      "first_command": "",
      "first_command_verb": "",
      "needs_gpu": false,
      "needs_key": false,
      "witness_path": "internal/model",
      "witness": "TestParallelMatchesSerial, TestPrefillBatchedMatchesSerial (math.Float32bits equality)",
      "entry_doc": "docs/benchmarks/MODEL-BASELINE-RESULTS.md",
      "verdict": "real-not-easy",
      "gaps": [
        "Small-model parity only; 7B+ f32 throughput unproven",
        "GPU decode parity is a separate backend witness; the int8/Q8_0 SIMD lane is in-flight, not yet [SHIPPED]"
      ],
      "durability_note": "Bit-identical CPU witness (Float32bits equality) prevents silent drift; CI green on the parity tests."
    },
    {
      "id": "kvmmu-planned-eviction",
      "concept": "Planned-elision -> KV-eviction residency bridge",
      "category": "model",
      "surface": "subsystem",
      "what_you_get": "When the context planner elides a span, the kernel-owned KV residency shrinks to the planner's O(1) resident view byte-for-byte — an O(1) view becomes an O(1) KV footprint.",
      "audience": "researcher",
      "maturity": "shipped",
      "claims_section": "In-kernel model",
      "claims_tag": "SHIPPED",
      "first_command": "",
      "first_command_verb": "",
      "needs_gpu": false,
      "needs_key": false,
      "witness_path": "internal/kvmmu",
      "witness": "go test ./internal/kvmmu -run TestApplyPlan (post-plan next-token dist max|d|=0 vs resident-only reference)",
      "entry_doc": "docs/benchmarks/KV-QUARANTINE-BRIDGE-RESULTS.md",
      "verdict": "real-not-easy",
      "gaps": [
        "Synthetic model witness; not wired into the live agent HTTP loop",
        "Only SHRINKS residency to the view; paging a span back IN is the separate demand-fault path"
      ],
      "durability_note": "The eviction is the proven model.KVCache.Evict (re-RoPE+renumber); the plan's faithfulness witness guarantees every elided span carries a page-back-in handle."
    },
    {
      "id": "radixkv",
      "concept": "RadixAttention parity (prefix-tree KV reuse + policy eviction)",
      "category": "model",
      "surface": "subsystem",
      "what_you_get": "A radix-tree KV cache over the kernel-owned cache that reaches a 77-88% hit rate (inside SGLang's published band) with bit-identical reuse-through-an-edge-split and policy-driven eviction.",
      "audience": "researcher",
      "maturity": "shipped",
      "claims_section": "In-kernel model",
      "claims_tag": "SHIPPED",
      "first_command": "",
      "first_command_verb": "",
      "needs_gpu": false,
      "needs_key": false,
      "witness_path": "internal/radixkv",
      "witness": "TestReuseThroughSplitMatchesRecompute (max|d|=0); measured 77.2-88.2% hit rate vs SGLang's 50-99% band",
      "entry_doc": "ARCHITECTURE.md",
      "verdict": "real-not-easy",
      "gaps": [
        "Wired into the in-kernel serve path (fak serve --gguf, no --base-url) on by default since 68b67c6; stays an optional leaf for the proxy governed-gateway mainline, where fak fronts an upstream that owns the KV (no local model.KVCache to index) — the proxy prefix lever is the byte-faithful cache_control passthrough (shipped)",
        "Device-backend decode (backend != nil) bypasses the prefix tree; reuse is CPU-session-only today",
        "Measured on synthetic few-shot / multi-turn / tree-of-thought shapes; live production telemetry deferred"
      ],
      "durability_note": "SGLang numbers confirmed verbatim vs the NeurIPS 2024 proceedings; the eviction path is deterministic (no stochastic learner)."
    },
    {
      "id": "cross-engine-kv",
      "concept": "Cross-engine zero-copy KV co-residence seam",
      "category": "model",
      "surface": "seam",
      "what_you_get": "A frozen ABI seam that lets the kernel Evict/Clone an EXTERNAL engine's KV (vLLM/SGLang) zero-copy, so the per-agent quarantine holds against an engine fak does not itself run.",
      "audience": "platform",
      "maturity": "shipped",
      "claims_section": "In-kernel model",
      "claims_tag": "SHIPPED",
      "first_command": "",
      "first_command_verb": "",
      "needs_gpu": false,
      "needs_key": false,
      "witness_path": "internal/xenginekv",
      "witness": "TestResolveIsZeroCopyView, TestEvictQuarantine, TestCloneIndependent, TestPageOutZeroMovement",
      "entry_doc": "ARCHITECTURE.md",
      "verdict": "real-not-easy",
      "gaps": [
        "The arena is an in-process Go []byte STAND-IN; the engine-specific CUDA-IPC / shared-memory transport is the remaining STUB",
        "Requires per-engine integration work behind the frozen ABI before it is usable"
      ],
      "durability_note": "The SEAM (ABI boundary, zero-copy Resolve, Evict/Clone primitives, opt-in backend swap) is shipped and tested; what remains plugs in with no further ABI change."
    },
    {
      "id": "context-planner",
      "concept": "Persistent per-session context planner (O(1) resident view)",
      "category": "model",
      "surface": "benchmark",
      "what_you_get": "Replay the heaviest real sessions through the planner and watch resident tokens stay ~13x below linear with every back-reference served as a recoverable page fault — measured, not modeled.",
      "audience": "researcher",
      "maturity": "shipped",
      "claims_section": "In-kernel model",
      "claims_tag": "SHIPPED",
      "first_command": "go run ./cmd/ctxplanbench -selfcheck",
      "first_command_verb": "ctxplanbench",
      "needs_gpu": false,
      "needs_key": false,
      "witness_path": "internal/ctxplan",
      "witness": "go test ./internal/ctxplan ./cmd/ctxplanbench; -heaviest 5 replays real transcripts (715 turns, 100% of misses served)",
      "entry_doc": "docs/cli-reference.md",
      "verdict": "usable-today",
      "gaps": [
        "Off the live agent loop (a bench cmd); the agent seam keeps its own heuristic forecast",
        "The forecast is a cheap recency/recurrence heuristic, not a model; a miss costs one page fault, never a lost fact"
      ],
      "durability_note": "Resident units are a bytes/4 proxy; exact counts reproduce cross-platform; planned recall kept exact on 715/715 turns where compaction destroyed facts on 695/715."
    },
    {
      "id": "gpu-backends",
      "concept": "GPU backends (AMD Vulkan / NVIDIA CUDA / Apple Metal)",
      "category": "model",
      "surface": "subsystem",
      "what_you_get": "The in-kernel forward pass runs on real GPUs argmax-exact (cosine 1.0 vs cpu-ref); the NVIDIA CUDA-graph path even hits decode-speed parity with llama.cpp Q8_0 on a model that fits.",
      "audience": "researcher",
      "maturity": "shipped",
      "claims_section": "Engine",
      "claims_tag": "SHIPPED",
      "first_command": "",
      "first_command_verb": "",
      "needs_gpu": true,
      "needs_key": false,
      "witness_path": "internal/compute",
      "witness": "go test -tags vulkan/cuda/metal ./internal/compute ./internal/model (TestVulkan*, TestCUDAForwardMatchesRef, TestMetalForwardMatchesRef)",
      "entry_doc": "GPU.md",
      "verdict": "real-not-easy",
      "gaps": [
        "Needs a GPU + a build tag; off by default (the shipped pure-Go binary has zero GPU dependency)",
        "AMD Vulkan f32 is correct but ~58x slower than llama.cpp CPU; token-per-watt stays SIMULATED (no power meter on the box)"
      ],
      "durability_note": "Numerical parity is witnessed per backend (argmax-exact, cosine 1.0); throughput is claimed only where measured (the NVIDIA decode parity)."
    },
    {
      "id": "model-routing",
      "concept": "Model routing (per-aspect + ensemble — fak route)",
      "category": "model",
      "surface": "product",
      "what_you_get": "Author a version-tagged JSON routing manifest and run `fak route` as the oracle: it selects a per-aspect Plan (whole request, one tool call, a sub-query, a reasoning step) or a first-class ensemble, and `--simulate` folds stand-in member outputs through the reduction so the ensemble runs end-to-end with no model in the loop.",
      "audience": "developer",
      "maturity": "shipped",
      "claims_section": "Model routing (per-aspect + ensemble — `fak route`)",
      "claims_tag": "SHIPPED",
      "first_command": "go run ./cmd/fak route --manifest examples/model-routing.example.json --aspect tool",
      "first_command_verb": "route",
      "needs_gpu": false,
      "needs_key": false,
      "witness_path": "internal/modelroute",
      "witness": "go test ./internal/modelroute (per-aspect routing, first-match, fail-closed default, manifest round-trip, TestCombine*); go test ./cmd/fak -run TestRoute*",
      "entry_doc": "examples/model-routing.example.json",
      "verdict": "durable-product",
      "gaps": [
        "The oracle decides and reduces stand-in outputs; binding a Plan to live model calls is the caller's integration",
        "all_reduce is a weighted numeric mean over scalar outputs, not a tensor all-reduce"
      ],
      "durability_note": "Pure, stdlib-only (architest tier 1); the manifest loads with DisallowUnknownFields and round-trips --dump<->--check, mirroring the capability-floor policy idiom, with a fail-closed Default."
    }
  ]
}
