---
version: 0.4.0
date: 2026-06-17
headline: "Multi-provider agent boundary (OpenAI/Anthropic/Gemini/xAI) with a pre-send transcript quarantine, on top of in-kernel Q8 prefill reaching raw-compute parity with llama.cpp and a hardened vDSO integrity direction."
themes: ["agent-provider-boundary", "in-kernel-model", "security", "fleet-tooling", "governance", "docs"]
highlights:
  - "fak agent / serve drive native OpenAI, Anthropic, Gemini, and xAI wires via --provider."
  - "Pre-send quarantine redacts unsafe tool-result bytes before any provider serializes them."
  - "Q8 prefill reaches raw-compute parity with llama.cpp (ACT 5); multi-user batched decode lands."
  - "Cross-platform compute (HAL) seam + pure-Go CPU reference, bit-identical."
  - "vDSO integrity-direction hardening: revocation + tier-1 taint-laundering closed."
  - "Fleet tooling: benchmark-NODE runner, bottleneck detector, resilience playbook."
---

**TL;DR** — The agent boundary stops being OpenAI-only: a `TranscriptAdapter` seam lets `fak agent` and `fak serve` speak the four major provider wires natively, with the security boundary moved to the only place a closed API allows it — a pre-send quarantine before serialization. Underneath, the in-kernel Q8 inference lane reached raw-compute prefill parity with llama.cpp, multi-user batched decode landed, a cross-platform compute seam was added, and the vDSO integrity direction was hardened. Plus a wave of fleet tooling, governance (architest + DOS dogfood), and positioning/explainer docs.

## Multi-provider agent boundary

- **Provider transcript adapters** — `fak agent` and `fak serve` accept `--provider {openai,anthropic,gemini,xai}`; each adapter owns its endpoint, auth headers, request marshaling, and response parsing.
  - *Why:* the kernel's turn-tax and quarantine story should hold against any frontier wire, not just OpenAI-compatible endpoints.
  - *How:* `internal/agent/adapters.go` (`TranscriptAdapter`), `internal/agent/chat.go` (`NewProviderHTTPPlanner`), wired through `cmd/fak/main.go` and `internal/gateway/gateway.go`.
- **Pre-send transcript quarantine** — unsafe tool-result bytes are replaced with tiny stubs before any adapter serializes a request; a closed provider's KV cache cannot be un-attended after the fact.
  - *How:* `internal/agent/transcript.go` (`QuarantineOutboundMessages`) sharing the screen predicate lifted into `internal/ctxmmu.ScreenBytes`.
- **Adapter sweep harness** — `tools/run_transcript_adapter_sweep.ps1` records adapter microbenchmarks + a `fak agent` A/B across API, local-shim, and offline lanes (HTTP 402 billing-gated attempts recorded, not hidden).

## In-kernel model — Q8 parity, batched decode, compute seam

- **Q8_0 prefill → raw-compute parity with llama.cpp (ACT 5)** — fused prefill GEMM block accumulate (VFMADD231PS, +30% kernel), AVX-512 bit-identical activation quantizer (quant phase 25→5ms), allocation-free in-place RMSNorm, balanced allocation-free prefill attention, raw-K stashed in place.
- **Multi-user batched decode** — continuous batching over kernel-owned per-user KV, f32 bit-identical to serial Step.
- **Cross-platform compute (HAL) seam** — a new `internal/compute` leaf lifts dtype/ISA/exec/layout assumptions, with a pure-Go CPU reference that delegates verbatim for bit-identity.
- **Model-arch seam design** — the plan to adapt the in-kernel fusion past Llama-only to the top-10 most popular models.

## Security — vDSO integrity hardening

- **Integrity-direction hardening** — revocation support plus closing a tier-1 taint-laundering bypass in the vDSO fast-path.

## Fleet tooling & resilience

- **benchmark-NODE runner** + cross-hardware comparator.
- **fleet_bottleneck v1** — live bottleneck detection + a zero-dependency web dashboard.
- **fleet-resilience playbook** (skill) + resume-once ledger, toast notifications, status card.
- **turnbench** — cross-model local-vs-frontier parity benchmark; optional Tailscale / zero-dependency stand-in endpoints.
- **new_leaf golden path** — scaffold for adding a conforming leaf.

## Governance & layering (1000x base conditions)

- **architest gates** — registration-completeness gate, machine-checked layered-DAG import contract, the compute leaf declared at tier 1 to unblock CI.
- **DOS dogfood** — `dos.toml` puts fleet's own governance under the DOS kernel.
- **GROWTH.md** — the enforced base conditions for modular 1000x growth; STAR→layered-DAG correction.

## Docs, positioning & explainers

- **Positioning one-pager** + fleet-advantage activation chart; production-readiness plan.
- **KV-cache explainer** — how the KV cache changes as agentic context grows.
- **Related-art surveys** — agentic-first serving, addressable-context landscape, the 2026-06-17 SOTA sweep, NVIDIA Dynamo mapping.
- **Feature-space map** — fak's capabilities × deployment use cases, extended to 12 columns (incl. hybrid local+remote).
- **visuals(33)** — prefill ladder with the Act 5 raw-compute-parity bar.
